Forgot your password?
typodupeerror

Skype Protocol Has Been Cracked 279

Posted by Zonk
from the rising-in-the-east dept.
nsrCZ writes "The Skype core protocol has been reverse-engineered by a Chinese company. The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it. If it's true, then it could affect the whole eBay/Skype business in many ways, including that they might not get their piece of the emerging Chinese cake." From the article: "By cracking the Skype protocol, the company claims it can also block Skype voice traffic, Paglee said. 'They could literally turn the lights off on Skype in China very, very quickly,' said Paglee, who is also a lawyer and engineer, speaking from California on Friday. The company could transfer the technology to the Chinese government, which has continually sought ways to tighten its filtering and control over the Internet. So far, the company doesn't have any plans to market its blocking capabilities, Paglee said."
This discussion has been archived. No new comments can be posted.

Skype Protocol Has Been Cracked

Comments Filter:
  • Re:Tapping (Score:5, Informative)

    by Barsema (106323) on Friday July 14, 2006 @11:51AM (#15719362) Homepage
    From TFA :

    The company, however, has not been able to decrypt the phone calls passing through those computers and listen in because of the complicated encryption keys used during calls, Paglee said.

    So I guess not.
  • Reverse Engineering (Score:5, Informative)

    by ultrasound (472511) on Friday July 14, 2006 @11:53AM (#15719378)
    it is not patented and thus it is not against the law to crack it....

    Patenting something does not prevent anyone from reverse engineering it, and in fact they wouldnt need to because the mechanism would be documented in the patent.

    Reverse engineering is not 'against the law' in most parts of the world, only the US thanks to the DMCA (C is for copyright, not patent), so therefore they probably have not broken the law if they did this outside the US. At present it is legal in the EU to reverse engineer a competitors product for the purpose of producing a compatible interface, sadly however that may not be the case if the proposed "directive on criminal measures aimed at ensuring the enforcement of intellectual property rights" is ratified.

  • by Aim Here (765712) on Friday July 14, 2006 @11:56AM (#15719405)
    The article submitter seems to be a lot confused regarding the law. There's nothing unlawful about cracking a patented algorithm. It might be unlawful to market a device using the same encryption, in those parts of the unfree (softwarewise) world where software patents are implemented, but that's a different thing.

    Cracking encryption algorithms is generally only unlawful where the encryption is a method of encrypting copyrighted material, AND the country involved has implemented some variant of the DMCA or EUCD. That's the legal machinery that DVD Jon had problems with. The Skype Protocol won't be covered by DMCA-like provisions.

  • Paglee means . . . (Score:2, Informative)

    by narsiman (67024) on Friday July 14, 2006 @12:03PM (#15719466)
    Paglee - a mad girl in Hindi. (mockingliy)

    Welcome to global communications.
  • by throwaway18 (521472) on Friday July 14, 2006 @12:07PM (#15719502) Journal
    To be able to reverse-engineer the Skype protocol, these guys had at one point or another to decrypt the data, and encrypt it as well.


    What this means is that they could configure their application as a SuperNode and intercept conversations, files, text in between.


    This is not a valid conclusion. To send out and receive audio when participating in a call it is necessary for a client to have the crypto keys. When the client is running on a general purpose computer the keys are inevitably accessable by the end user. The only solution to that is tamper resistant hardware and we, the slashdot masses, hate that.

    To function as a relay for other people skype conversations you don't need to be able to encrypt and decrpt the streams, you just pass them on.

    There is a big problem with skype which is that the way is implemented means thats the people who run skype could evesdrop on calls and could be served with warrants to do so. Using end to end public key encryption to prevent that would not prevent anyone reverse engineering it and creating a compatable client.

  • Re:DMCA? (Score:5, Informative)

    by drinkypoo (153816) <martin.espinoza@gmail.com> on Friday July 14, 2006 @12:13PM (#15719555) Homepage Journal
    I realize that the DMCA doesn't extend outside of the USA, but could Skype use it to block this software/information in the US?

    This is why mod points should be more carefully controlled.

    The DMCA explicitly protects your right to reverse-engineer for the purposes of interoperability.

  • Re:Blocking (Score:5, Informative)

    by Anonymous Coward on Friday July 14, 2006 @12:19PM (#15719608)
    Excerpt from http://lists.grok.org.uk/pipermail/full-disclosure /2005-November/038646.html [grok.org.uk] :

    *********

    1) Skype will initially attempt to contact supernodes, the IPs of which
    are in a file stored along with the other files that Skype installs. The
    first method of contact is direct. The source ports that Skype attempts
    to connect from are non-default ports. From my observations I could see
    that the UDP source port 1247 is the initial control channel. Once the
    connection is established, the rest of the communications is done in TCP
    over non-default source ports with ranges sweeping from 2940-3000.
    In general, any company that is serious about its security policy would
    have strict egress filtering rules, which makes identifying the
    non-default source/destination ports that Skype uses irrelevant since
    they would be blocked anyway.

    2) If the above fails, Skype will use the proxy server specified in Internet
    Explorer, and attempt to tunnel the traffic over port 443 using the SSL
    protocol. The destination IPs are of course random as above, which makes
    destination blocking out of the question. The only option left is to
    block SSL,
    which is not really a solution, unless you want to end up excluding all
    legal SSL destinations.
    Deleting the user's proxy settings would also disallow Skype from
    connecting. That would however leave the user without internet access.
    Even if the user had no proxy settings, and the proxying was done
    transparently (which would definitely include proxying http and https
    traffic), the Skype traffic (SSL) would again be transparently proxied,
    which puts us back at square one.

    ********

    The aforementioned link however speaks of a somewhat twisted method of blocking out skype by restricting outbound HTTPS to only the requests adressed by FQDN.

    Perhaps Skype will eventually just use SSL over 443 for the whole of the communication in order to establish connections, which is quite an effective method of bypassing any kind of firewall or filter put in place by a corporation. And the same technique holds true for any other "undesirable" protocol. With VPNs now starting to use SSL over 443 to evade restrictive outbound ACLs, it's getting more difficult to restrict what leaves your network.

  • by mpapet (761907) on Friday July 14, 2006 @12:29PM (#15719695) Homepage
    This isn't really an insightful comment. It's currently modded as such.

    Asterisk does not currently provide the nuts and bolts of connecting SIP callers. It's SIP integration is not built out so great either. (ex. can't easily connect to a STUN or RTP proxy)

    The normal procedure is to use an SIP server with asterisk as a voicemail backend.

    The SER and OpenSER SIP server projects both connect to asterisk.

    There is no reason to use skype's proprietary protocol. Good for the Chinese for putting a dent in their proprietary methods. Let SIP providers compete on a service basis, not protocol competition.

  • by Blue Trapezoid (978067) <heylukee@@@gmail...com> on Friday July 14, 2006 @12:35PM (#15719743) Homepage
    It's British English [wikipedia.org]. Get over it.
  • by pavon (30274) on Friday July 14, 2006 @01:15PM (#15720110)
    Patenting something does not prevent anyone from reverse engineering it, and in fact they wouldnt need to because the mechanism would be documented in the patent.
    Well no, because you can't patent a protocol. Instead they could patent a core method upon which the protocol is based, and that method would be made public - in non-specific legalese, that would in itself be practically useless for the purpose of implementing the protocol. The details of the protocol itself would still need to be reverse engineered.

    You are absolutely right about reverse engineering not being illegal. In fact even with the DMCA reverse engineering is still entirely legal. The catch with both the DCMA and patents is what you can do with the protocol once it has been reverse-engineered. In the case of patents, the basic priciples have been disclosed, and you are allowed to distribute any additional information that you learn about the implementation, but you are not allowed to implement the protocol without a patent license.

    In the case of the DCMA, you may be* prohibited from disiminating information that you have reverse-engineered, if can be used to circumvent a copyright protection device. I don't think that would apply in this case - what copyrighted work is being protected? The only possibility are the conversations themselves, but this does not allow you to listen in on anothers conversation, it simply allows you to initiate new coversations. Assuming that you are using secure cryptography, revealing the mechanism of the encryption does not weaken the security of the system, only revealing the keys, which in this case are generated per connection, like SSL.

    So unless Skype's security is crap, which I don't believe to be true, the DMCA would not restrict you from publishing the details of the protocol, or third party implementations of it. On the other hand patents could. Therefore, the submitter was correct in bringing them up as a potential barrier, even if his wording was not.

    * The law contradicts itself, and while there have been some precident setting cases, the interpretation is still very much up in the air.
  • by Anonymous Coward on Friday July 14, 2006 @01:15PM (#15720120)
    That's correct. Send them a message and a few seconds with tcpdump is all you need. No hacking required.
  • Re:Innovation (Score:0, Informative)

    by Monkeman (827301) <Monkeman AT gmail DOT com> on Friday July 14, 2006 @01:20PM (#15720149)
    China's not exactly the flagship of ethical behavior.
  • Re:It could indeed. (Score:2, Informative)

    by orzetto (545509) on Friday July 14, 2006 @02:10PM (#15720530)
    But then again, if the Chinese government wants to arrest a citizen in China they just do it and can find (or make up) a reason for the arrest afterwards.

    ...See the straw in the Chinese's eye and not the beam in your ass... In America they don't even have to make up something later to deport you to Guantanamo, and in Europe you can be abducted [cnn.com], tortured at a military base, and dumped in some sort of Konzentrationlager in some country not too fussy about human rights.

    Start worrying about civil rights in your backyard before you go nitpick on the Chinese. That's the Chinese's problem and it's up to them to solve'em. You solve yours.

    Speaking of illegal encryption, guess why Skype is based in Luxembourg and not in the US.

  • by lazzaro (29860) on Friday July 14, 2006 @02:32PM (#15720665) Homepage
    This paper [columbia.edu] was published in 2004, by the VoIP group at Columbia. It reverse-engineers the Skype network with sufficient detail to let one make a serious attempt at firewalling Skype traffic.
  • by BTWoo (805160) on Friday July 14, 2006 @02:38PM (#15720704)
    I guess Coobol [coobol.com] did it.
  • by Anonymous Coward on Friday July 14, 2006 @02:50PM (#15720785)
    According to an article [skype.com] from the New York Times back in May 21, German authorities claim to have the ability to intercept and decrypt Skype calls.
  • Re:Innovation (Score:2, Informative)

    by SharkJumper (651652) <sharkjumper@PARISgmail.com minus city> on Friday July 14, 2006 @03:24PM (#15721015)
    From Paglee's blog post about this: [voipwiki.com]

    The advent of the release of this software raises many interesting issues. According to their CEO, their software will not support Skype's Super Node technology. [theregister.co.uk] Right now every computer with Skype installed on it can be used as a relay to carry data between two other computers when both of those computers are only allowed to make outgoing TCP calls. This means that very soon Skype users will have an alternative client which will not hijack their computer. This could eventually have a very negative effect on the Skype network if too many people choose not to act as Skype Super Nodes and the network starts to deteriorate.
  • Re:Innovation (Score:4, Informative)

    by Schraegstrichpunkt (931443) on Friday July 14, 2006 @04:39PM (#15721517) Homepage
    So exactly where has China innovated?

    Apparently you never heard of the MD5 and SHA-1 breaks.

To err is human -- to blame it on a computer is even more so.

Working...