Forgot your password?
typodupeerror

Skype Protocol Has Been Cracked 279

Posted by Zonk
from the rising-in-the-east dept.
nsrCZ writes "The Skype core protocol has been reverse-engineered by a Chinese company. The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it. If it's true, then it could affect the whole eBay/Skype business in many ways, including that they might not get their piece of the emerging Chinese cake." From the article: "By cracking the Skype protocol, the company claims it can also block Skype voice traffic, Paglee said. 'They could literally turn the lights off on Skype in China very, very quickly,' said Paglee, who is also a lawyer and engineer, speaking from California on Friday. The company could transfer the technology to the Chinese government, which has continually sought ways to tighten its filtering and control over the Internet. So far, the company doesn't have any plans to market its blocking capabilities, Paglee said."
This discussion has been archived. No new comments can be posted.

Skype Protocol Has Been Cracked

Comments Filter:
  • Innovation (Score:3, Insightful)

    by SleeknStealthy (746853) on Friday July 14, 2006 @11:46AM (#15719290)
    I love how the Chinese innovate. Corporate espionage, reverse engineering and overall IP infringement...Skype should have patented its technology, but it's not like the Chinese respect IP anyway.
    • Re:Innovation (Score:4, Insightful)

      by Anonymous Coward on Friday July 14, 2006 @11:54AM (#15719388)
      I love how the Chinese innovate. Corporate espionage, reverse engineering and overall IP infringement...

      Yes, the US have been a good master.
    • Exactly. Reverse engineering is theft! And Skype should have patented not only their protocol but also talking itself!
    • Re:Innovation (Score:4, Insightful)

      by spyrochaete (707033) <spyrochaete@NOspAm.hyppy.zapto.org> on Friday July 14, 2006 @12:15PM (#15719568) Homepage Journal
      Thanks for sharing your generalizations about the most populous country in the world. Obviously every aspect of China meets your concise description.
      • Re:Innovation (Score:4, Insightful)

        by IAmTheDave (746256) <basenamedave-sd@@@yahoo...com> on Friday July 14, 2006 @12:39PM (#15719780) Homepage Journal
        Thank you - not to mention that every true innovation stands on the shoulders of giants who came before. Want to know why patents/copyrights are killing innovation? Because there are now police lines around those proverbial shoulders.

        True, groundbreaking innovation is rarely anything more than a modification of an existing process or practice or idea or thought. An ingenious one, yes - but without the work that came before, there would be nothing. Stopping the work that can come after is nothing short of criminal.
      • Re:Innovation (Score:3, Insightful)

        by c_forq (924234)
        Come on now, he didn't comment on every aspect of China, just the corporate one. And to be fair in the corporate arena you pretty much have to do what the competition is doing to stay in business, wither it be espionage, bribes, maximizing efficiency, price cutting, or advertising.
      • Re:Innovation (Score:3, Interesting)

        by saleenS281 (859657)
        So exactly where has China innovated?

        Automobiles they have "chery" whose entire line-up are shoddy copies [paultan.org] of cars already produced by other manufacturers.

        We have Huawei, who has literally stolen Cisco's router code [microscope.co.uk] to make a "competing product".

        And then we have their military who happened to... yes steal [theepochtimes.com] their designs as well (at least the stuff they didn't just purchase from Russia and reverse engineer).

        So exactly what are these innovations taking place in China you wanted to defend?

        BTW, the
    • Re:Innovation (Score:3, Insightful)

      by JPribe (946570)
      And patenting their protocol here in the States would have what effect in China? Please share, as I seem to have forgetten and am in need of a reminder.
      • That is if you can patent a protocol.

        Protocol in itself is not an invention.

        You can have a protocol as a part of an invention or rely on an invention to work, but in itself...

        The chances of patenting it even in the US are pretty slim.
    • Re:Innovation (Score:5, Insightful)

      by sholden (12227) on Friday July 14, 2006 @12:29PM (#15719699) Homepage
      Because the US respected all the British IP in its early days.
      • Re:Innovation (Score:3, Insightful)

        by castoridae (453809)
        Even if our ancestors were also "wrong", it's still "wrong" for China (defined as the collective group of infringing companies, government agencies and individuals which happen to reside and work in China) to do it.

        * Quotes intentionally added to "wrong" to allay any possible tangent subthreads about how IP/patents/copyrights are in principal wrong/imorral/broken. Gotta know your audience. :-)
        • Why exactly is it wrong? If the Chinese government gives the go ahead, can't Chinese entities do what the fuck they like with Skype? Or any other piece of software, for that matter?
          • You missed my point (specifically, you missed my "footnote"). I'm saying that you have to apply your principals consistently. If it was wrong for the US in colonial days, it's wrong for China now. If it isn't wrong for China now, then it wasn't wrong for the US then.
        • Re:Innovation (Score:3, Insightful)

          by 1u3hr (530656)
          it's still "wrong" for China (defined as the collective group of infringing companies, government agencies and individuals which happen to reside and work in China) to do it.

          What "infringement"? As TFA says, THERE IS NO PATENT. They reverse-engineered a protocol. A week ago, some Americans did the same to the Galileo GPS signal [slashdot.org]. And that will lead to a direct monetary loss to Galileo. Was that "wrong"?

          copyrights are in principal wrong

          The word is "principle".

        • Re:Innovation (Score:5, Insightful)

          by kfg (145172) * on Friday July 14, 2006 @01:51PM (#15720365)
          Even if our ancestors were also "wrong". . .

          IF our ancestors were also wrong. . .

          It remains to show they were wrong, and in doing so you necessarily question the legitimacy of the USA's sovereignity. We were signatory to no treaties to "respect" British IP and our ip laws still differ. It took a special act of Congress to partially respect the British copyright of Peter Pan (which is, in effect, in perpetuity, forbidden by the US Constitution).

          If and when China does not respect American ip they are wrong because we are both signatory to the Berne Convention treaty, even if we were both wrong to do so.

          And bearing in mind that the current administration has declared that treaties it has willfully signed are not binding upon it, as that violates American legal sovereignity. Yes, the Supremes have recently bitch slapped them over that, but the current adminstration seems to be gearing itself up to treat that as a legal opinion not actually binding upon it.

          And herein lies the real damage that has been done to America's international standing in the past few years. If we declare null and void international law to which we are signatory on war, torture and due process why the fuck should anyone respectfully decline to copy Pauly Shore movies, no matter how cruel that is?

          KFG
      • by Anonymous Coward
        Because the US respected all the British IP in its early days.

        Jeez, when will you guys get it?

        Like information, MUTTON CHOPS WANT TO BE FREE
    • Re:Innovation (Score:5, Interesting)

      by Jeremy Erwin (2054) on Friday July 14, 2006 @12:38PM (#15719765) Journal
      Perhaps I'm being unrealistically naive, but the original concept of the patent system was "full disclosure for protection". During the patent term, manufacturers would have to obtain a license to duplicate the patented object, but after those 17 years were up, no assistance (engineering or otherwise_ from the original inventor would have been necessary-- because the invention had been fully disclosed.

      If skype had patented its system, it would have had to disclose elements of its protocols which would make it quite easy for any espionage shop to infiltrate, route around or otherwise frustrate.

      Consider, for instance, a lock manufacturer. Their cylinders are described in exquisite detail in their patents. A person skilled in the art of lock-picking might find their patents to be of particular interest. But if the lock incorporates security mechanisms which defeat all potential attacks, it doesn't matter if they are disclosed.

      However, if the companies key manufacturing division and distribution network are infiltrated, then a duplicate key can probably be manufactured with a modicum of difficulty. That's why such practices are not disclosed in the patent, and are usually subject to "trade secret" regulations.

      P.S. I'm not so sure that the NSA and CIA let IP laws get in the way of espionage.
    • Re:Innovation (Score:4, Insightful)

      by tomstdenis (446163) <tomstdenis@SLACK ... com minus distro> on Friday July 14, 2006 @12:45PM (#15719851) Homepage
      Um hello, IBM PC clones anyone?

      Oh that's right you were born in the 90s and don't remember the 80s.

      Kids these days...
    • Re:Innovation (Score:5, Interesting)

      by babbling (952366) on Friday July 14, 2006 @01:02PM (#15720015)
      Why should Skype have patented this, and how does this negatively affect Skype?

      Skype don't get their money from people installing their client, they get their money from people paying for the extra services like SkypeOut, SkypeIn, and so on. They should regard maintaining the Skype clients as an unwanted hassle. What they really want is as many people as possible connecting to their servers and using the extra services. This is separate from the protocol.

      If I was an executive at Skype, I would view this as a good thing for the company. It's only going to result in more users. It's strange that Skype didn't voluntarily open up their protocol earlier!
      • I think you're missing the point... this company won't just make another Skype client, they'll make their own "skype" network. Skype won't get anything because this will be a completely different service. The reason this is of concern is because it is well known in the Chinese market, if there's a Chinese alternative, the people will use it (notice Google losing out to the Chinese duplicate).
    • Re:Innovation (Score:5, Insightful)

      by Em Ellel (523581) on Friday July 14, 2006 @01:19PM (#15720143)
      Skype should have patented its technology, but it's not like the Chinese respect IP anyway.

      Erm, ok, if they patent it, don't they have to disclose details of it? Kinda defeats the purpose of having a secret closed protocol that Skype wanted. I think there might be a better way to protect IP, via "trade secret" or something like it, but I am no specialist in the area :-)

      -Em
    • He seems to be the world's best reverse engineer!
  • Tapping (Score:2, Insightful)

    by slindseyusa (942823)
    Isn't the more important aspect of this the concern that anyone could use this to tap into a conversation over Skype?
    • Re:Tapping (Score:5, Informative)

      by Barsema (106323) on Friday July 14, 2006 @11:51AM (#15719362) Homepage
      From TFA :

      The company, however, has not been able to decrypt the phone calls passing through those computers and listen in because of the complicated encryption keys used during calls, Paglee said.

      So I guess not.
    • by Penguin Programmer (241752) on Friday July 14, 2006 @11:58AM (#15719427) Homepage
      Closed protocols are not a substitute for security. Any traffic that goes over the internet can be intercepted. Once you have the packets, it's just a matter of figuring out what they mean. This certainly does raise concerns that tapping into Skype conversations may become easy, but this was bound to happen eventually and should be no surprise to anyone.

      Besides, who really cares? Phone conversations can be tapped into. Cell phones, too. Everyone knows not to transmit confidential information over the phone.
  • Paglee details in his blog a call he received from the engineers using a rudimentary client. Part of the proof that the protocol had been cracked came when the engineers sent Paglee the IP address of his computer, information that normally would be encrypted during a Skype session.

    Little did he know they were in his apartment earlier in the day.
  • by Rosco P. Coltrane (209368) on Friday July 14, 2006 @11:48AM (#15719317)
    Closed Skype protocol gets cracked in X months == Skype releases a new version with a new closed protocol that'll take X more months to crack. Big deal...

    Anyway, Skype is a big no-no for me. I don't like software that connects to who-knows-what and uses bandwidth all the time without any way to know what the heck it's doing.
  • by Rob T Firefly (844560) on Friday July 14, 2006 @11:49AM (#15719327) Homepage Journal
    The company could transfer the technology to the Chinese government
    In other news, my front door could be unlocked with my house key, I could inhale the next time I need oxygen, and water could cause things it touches to become wet.
    • Re:It could indeed. (Score:4, Interesting)

      by regen (124808) on Friday July 14, 2006 @12:40PM (#15719796) Homepage Journal
      The interesting thing is since skype uses encryption and encryption use by private citizens is illegal in China, just using skype could get you arrested. But then again, if the Chinese government wants to arrest a citizen in China they just do it and can find (or make up) a reason for the arrest afterwards.
      • Re:It could indeed. (Score:2, Informative)

        by orzetto (545509)

        But then again, if the Chinese government wants to arrest a citizen in China they just do it and can find (or make up) a reason for the arrest afterwards.

        ...See the straw in the Chinese's eye and not the beam in your ass... In America they don't even have to make up something later to deport you to Guantanamo, and in Europe you can be abducted [cnn.com], tortured at a military base, and dumped in some sort of Konzentrationlager in some country not too fussy about human rights.

        Start worrying about civil rights in yo

  • Net Neutrality (Score:2, Interesting)

    by hansamurai (907719)
    They could sell it to US Telco companies and make a little profit too.
  • by Timex (11710) * <smithadmin.gmail@com> on Friday July 14, 2006 @11:49AM (#15719330) Journal
    The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it.

    I'm sure Skype's lawyers might see this differently.

    If this happened in the US, lawyers would be crying "foul!" on the basis of the protocol being a Trade Secret, and they would have something to say about the agreement that one sees when installing the software. I believe I remember seeing a "no reverse-engineering" clause in there.

    This being a Chinese source, though, means that US rules don't necessarily apply.
  • I mean in this day and age, depending on the secrecy of a closed protocol running on top of an open network for a business model seems pretty... dumb... Though obviously they are also trying to do services (like SkypeOut) which make much more sense, what is the value in having a proprietary protocol, when something like SIP (maybe an updated version that supports P2P negotiation) is out there? I mean it's not like the OSS world is playing catch-up this time (like, say, Jabber is compared to AIM's install
  • Isn't that sweet? (Score:3, Interesting)

    by botzi (673768) on Friday July 14, 2006 @11:49AM (#15719335)
    "Even if it was possible to do this, the software code would lack the feature set and reliability of Skype,"

    Don't you just love when people speak with certainties about yet unreleased things? Sure, it may well lack it for about 24 days. Then what happens? I'm not convinced that people would base stand alone software on that protocole anyway. More likely soe SIP clients would implement the protocole as an add on.
  • If it were patented (Score:3, Interesting)

    by mocm (141920) on Friday July 14, 2006 @11:50AM (#15719344) Homepage
    they couldn't make it closed. That is the purpose of patents.
  • Blocking (Score:4, Interesting)

    by slashkitty (21637) on Friday July 14, 2006 @11:50AM (#15719347) Homepage
    Do you really have to "crack" the protocol to block the traffic? Were their packets that well disguised?
    • Unless it looks like other well-known traffic, wouldn't it be a lot easier to block using a "I can't tell what this is, so just discard the packets"-type filter? The device filtering the traffic will see the session from start to finish, so it's not like it has to figure it out mid-session.
    • Re:Blocking (Score:5, Informative)

      by Anonymous Coward on Friday July 14, 2006 @12:19PM (#15719608)
      Excerpt from http://lists.grok.org.uk/pipermail/full-disclosure /2005-November/038646.html [grok.org.uk] :

      *********

      1) Skype will initially attempt to contact supernodes, the IPs of which
      are in a file stored along with the other files that Skype installs. The
      first method of contact is direct. The source ports that Skype attempts
      to connect from are non-default ports. From my observations I could see
      that the UDP source port 1247 is the initial control channel. Once the
      connection is established, the rest of the communications is done in TCP
      over non-default source ports with ranges sweeping from 2940-3000.
      In general, any company that is serious about its security policy would
      have strict egress filtering rules, which makes identifying the
      non-default source/destination ports that Skype uses irrelevant since
      they would be blocked anyway.

      2) If the above fails, Skype will use the proxy server specified in Internet
      Explorer, and attempt to tunnel the traffic over port 443 using the SSL
      protocol. The destination IPs are of course random as above, which makes
      destination blocking out of the question. The only option left is to
      block SSL,
      which is not really a solution, unless you want to end up excluding all
      legal SSL destinations.
      Deleting the user's proxy settings would also disallow Skype from
      connecting. That would however leave the user without internet access.
      Even if the user had no proxy settings, and the proxying was done
      transparently (which would definitely include proxying http and https
      traffic), the Skype traffic (SSL) would again be transparently proxied,
      which puts us back at square one.

      ********

      The aforementioned link however speaks of a somewhat twisted method of blocking out skype by restricting outbound HTTPS to only the requests adressed by FQDN.

      Perhaps Skype will eventually just use SSL over 443 for the whole of the communication in order to establish connections, which is quite an effective method of bypassing any kind of firewall or filter put in place by a corporation. And the same technique holds true for any other "undesirable" protocol. With VPNs now starting to use SSL over 443 to evade restrictive outbound ACLs, it's getting more difficult to restrict what leaves your network.

      • Re:Blocking (Score:3, Insightful)

        by jroysdon (201893)
        Using "SSL" over 443 has long worked for bypassing firewalls and even proxies [roysdon.net]. I wrote about this back in 2003 and have been using ever since. It works even through a proxy server, as the proxy server just has to blindly forward all "SSL" traffic over port 443. By the very nature of SSL traffic, there is nothing you can do about it. All I do is wrap my SSH (or whatever) traffic inside an "SSL" stream and you can't touch it without breaking every other https site.

        The only way to block this would be to cr
    • Probably not, but I think it's much more interesting for authorities to not block traffic, but simply wiretap it.

      Since China controls the Chinese routers, it's easy to be the listening man in the middle.
    • Yes. Skype is one of the most sneaky and well disgused protocols ever.

      Mainly becasue they "borrow" (no such thing as stealing on /.) massive amounts of bandwitdth from the people unfortunate enough to meet the *.edu criteria to be a supernode.

      Botnet designers have nothing on Skype, except alot to learn.
  • by Anonymous Coward on Friday July 14, 2006 @11:50AM (#15719349)
    It's now call Scrype terraphone and it love you long time
  • Reverse Engineering (Score:5, Informative)

    by ultrasound (472511) on Friday July 14, 2006 @11:53AM (#15719378)
    it is not patented and thus it is not against the law to crack it....

    Patenting something does not prevent anyone from reverse engineering it, and in fact they wouldnt need to because the mechanism would be documented in the patent.

    Reverse engineering is not 'against the law' in most parts of the world, only the US thanks to the DMCA (C is for copyright, not patent), so therefore they probably have not broken the law if they did this outside the US. At present it is legal in the EU to reverse engineer a competitors product for the purpose of producing a compatible interface, sadly however that may not be the case if the proposed "directive on criminal measures aimed at ensuring the enforcement of intellectual property rights" is ratified.

    • The parent is only "informative" in the weakest sense. Yes, a patent application must contain detail sufficient for a third party to replicate your invention. However, that detail is utterly useless until either the patent expires or an infringement case comes before a court. In particular, if I hold a patent on process X, then I hold a grant patent to bar any comer from constructing any mechanism which implements the patented process. (Bear in mind that the current European controversy has nothing to d
    • by pavon (30274) on Friday July 14, 2006 @01:15PM (#15720110)
      Patenting something does not prevent anyone from reverse engineering it, and in fact they wouldnt need to because the mechanism would be documented in the patent.
      Well no, because you can't patent a protocol. Instead they could patent a core method upon which the protocol is based, and that method would be made public - in non-specific legalese, that would in itself be practically useless for the purpose of implementing the protocol. The details of the protocol itself would still need to be reverse engineered.

      You are absolutely right about reverse engineering not being illegal. In fact even with the DMCA reverse engineering is still entirely legal. The catch with both the DCMA and patents is what you can do with the protocol once it has been reverse-engineered. In the case of patents, the basic priciples have been disclosed, and you are allowed to distribute any additional information that you learn about the implementation, but you are not allowed to implement the protocol without a patent license.

      In the case of the DCMA, you may be* prohibited from disiminating information that you have reverse-engineered, if can be used to circumvent a copyright protection device. I don't think that would apply in this case - what copyrighted work is being protected? The only possibility are the conversations themselves, but this does not allow you to listen in on anothers conversation, it simply allows you to initiate new coversations. Assuming that you are using secure cryptography, revealing the mechanism of the encryption does not weaken the security of the system, only revealing the keys, which in this case are generated per connection, like SSL.

      So unless Skype's security is crap, which I don't believe to be true, the DMCA would not restrict you from publishing the details of the protocol, or third party implementations of it. On the other hand patents could. Therefore, the submitter was correct in bringing them up as a potential barrier, even if his wording was not.

      * The law contradicts itself, and while there have been some precident setting cases, the interpretation is still very much up in the air.
  • by Aim Here (765712) on Friday July 14, 2006 @11:56AM (#15719405)
    The article submitter seems to be a lot confused regarding the law. There's nothing unlawful about cracking a patented algorithm. It might be unlawful to market a device using the same encryption, in those parts of the unfree (softwarewise) world where software patents are implemented, but that's a different thing.

    Cracking encryption algorithms is generally only unlawful where the encryption is a method of encrypting copyrighted material, AND the country involved has implemented some variant of the DMCA or EUCD. That's the legal machinery that DVD Jon had problems with. The Skype Protocol won't be covered by DMCA-like provisions.

  • by throwaway18 (521472) on Friday July 14, 2006 @11:59AM (#15719431) Journal
    Lots of info on how skype works, including that the people who run skype could evesdrop on conversations, the possibility of using skype to relay non skype traffic and an overflow security hole (hopfully now fixed) were revealed four months ago.

    Silver needle in the Skype at Blackhat Europe [secdev.org]

  • by Bromskloss (750445) <auxiliary@address@for@privacy.gmail@com> on Friday July 14, 2006 @12:00PM (#15719439)
    Good point in the FAQ of standards based (H.323, SIP) communications program (text, audio, video) Ekiga:
    Ekiga is not compatible with Skype and will never be as long as their protocol will stay proprietary. We do not think using closed protocols for communications is a good thing.
  • Check out:

    Skype Journal [skypejournal.com]

    Looks like there are a lot of opportunity for deeper business integration. Wonder if this opens up any vulnerabilities for standard client users?
  • Paglee means . . . (Score:2, Informative)

    by narsiman (67024)
    Paglee - a mad girl in Hindi. (mockingliy)

    Welcome to global communications.
  • by Doc Ruby (173196) on Friday July 14, 2006 @12:23PM (#15719638) Homepage Journal
    A real patent of Skype's protocol (if a protocol patent could be considered "real") would have published all the details, precisely to protect by law what Skype instead protects by secrecy.

    Of course China's mafia government would have found ways to to protect their local "infringers" if it gave them control over Skype's important telecom traffic.

    An open protocol using open software from more than a single (point of failure) source is a lot more reliable in the face of large scale attackers, like a government. SIP and IAX are safer.
  • Now that it's (reportedly) proven crackable, it should be a matter only of time before someone gets a cracked Skype protocol into an open Asterisk module.
  • Reverse engineering (Score:3, Interesting)

    by wiredlogic (135348) on Friday July 14, 2006 @12:39PM (#15719783)
    Reverse engineering is always legal. The only question is whether you have the right to do anything with the results of such activity. You can only infringe a patent directly if you engage in the commercial sale of products using patented technology.

    You can be found guilty of contributory infringement if you publish detailed information about how to go about infringing a patent. This is a shady area though, since the patent itself already describes the technology in question so it boils down to an evaluation of the individual's intent.
  • by kanweg (771128) on Friday July 14, 2006 @12:41PM (#15719806)
    on being second.

    Bert
  • Literally (Score:5, Funny)

    by RPoet (20693) on Friday July 14, 2006 @12:46PM (#15719870) Journal
    They could literally turn the lights off on Skype in China very, very quickly

    No, they could metaphorically turn the lights off on Skype in China very, very quickly.
  • by Anonymous Coward
    As most people here seem to be somewhat lacking in knowledge over the legal aspect, just because something does not have a patent does not mean it is legal to crack it. Reverse engineering may or may not be legal depending on the country the reversing was done in. US law is *NOT* global law, as so many large US companies and the US government itself is learning. Patents, ignoring their frequent misuse by US companies, are designed to protect innovative ideas long enough for a person or entity to make profit
  • by lazzaro (29860) on Friday July 14, 2006 @02:32PM (#15720665) Homepage
    This paper [columbia.edu] was published in 2004, by the VoIP group at Columbia. It reverse-engineers the Skype network with sufficient detail to let one make a serious attempt at firewalling Skype traffic.

With your bare hands?!?

Working...