Slashdot Mirror

Part of the work have already been done here if you are intrested:
http://www.secdev.org/conf/skype_BHEU06.handout.pdf

Open the SDK, Apple. Allow the legal unlocking,

Opening the SDK doesn't necessarily imply legal unlocking, given that "unlocking", when talking about a mobile phone, refers to allowing it to work on arbitrary networks, not to allowing third-party apps on it.

and make it easy for people to write apps

...and hard for Apple to change UIKit, for example, if they decide that the version of UIKit in the current release of Handheld OS X needs cleaning up in ways that break binary compatibility with that version.

and then sell them for them on iTunes.

At least one application I would have liked to have had on my iPhone yesterday, to try to figure out why its connection to the Wi-Fi network at the restaurant I was at wasn't working, isn't "sold" (and, yes, there have been earlier versions of it that ran on handhelds, and, yes, somebody did ls -l /dev on a jailbroken 1.0.2 iPhone and the usual four initial instances of my favorite device were there).

Obfuscation of binaries is, regrettably, an increasingly refined art. I would take a look at this, a presentation about how Skype does a lot of it's obfuscation, to see the state of the art today. Admittedly, this is Skype, with resources, know-how and a lot of people, but it's quite possible to make reverse engineering difficult. It's just usually not worth it.

The CanSecWest presentation that started all this is available here.

Let's look at this list. (Disclaimer: I have never used Windows Vista.)

Lots of info on how skype works, including that the people who run skype could evesdrop on conversations, the possibility of using skype to relay non skype traffic and an overflow security hole (hopfully now fixed) were revealed four months ago.

Silver needle in the Skype at Blackhat Europe

Skype is a security risk: see this talk (handout notes) for an analysis of how and why Skype is insecure and a potential vehicle for the most extensive botnet ever.

Skype is a security risk: see this talk (handout notes) for an analysis of how and why Skype is insecure and a potential vehicle for the most extensive botnet ever.

That's not even close to being true. This presentation from Black Hat Europe 2006 gives a decent description of how to recognize and block it (and even a high level description of how to hack it if you were so inclined): http://www.secdev.org/conf/skype_BHEU06.handout.pd f

But you could use alternative open source software like ekiga. Also after reading how skype works http://www.secdev.org/conf/skype_BHEU06.pdf , you maybe frightened by all the obscurity behind it.

That's a very uninformed statement. Skype is far from desperate. Did you see how much money eBay bought them for? Skype-to-Skype calls are free, and the more people that use Skype, the cheaper it gets. Call quality is very good, there are no restrictions on call length, it includes conference calls and video, instant chat, file sharing, etc.

The largest problems with Skype are security-related. Hackers can use Skype to relay TCP communications, effectively hacking networks from inside the firewall. And since the communication to the Skype client is encrypted and obfuscated (and it is very difficult to determine which traffic is actually Skype traffic), you can make it impossible to trace the traffic back to the hacker. Here's a link to a Black Hat Europe presentation on the subject:

... is what some smart people demonstrated at BlackHat Europe: Silver Needle in the Skype