Slashdot Mirror
Skype Addresses Visibility Concerns
An anonymous reader writes "TechWorld is reporting that VoIP pioneer Skype has finally decided to buckle down from their startup mentality and address some of the concerns about the 'visibility' of Skype by network admins. From the article: 'Problems started around the time that the version 2.0 beta appeared last year, the moment when a handful of software engineers started to assess a troubling issue thrown up by the program's new and evasive design: it was incredibly hard to detect using perimeter security systems. Skype's unofficial explanation for its extreme stealthiness has always been that this was necessary to avoid telcos threatened by its business model from blocking it. While this presents no issues for a home user, using "invisible" software capable of making and receiving voice calls, opening instant messaging sessions and exchanging files on a corporate networks, caused some to ponder whether the ever-more-popular Skype hadn't just turned itself into a huge security risk.'"
After all the teleco's have a vested interest to mod all VOIP calls to force you to get cell phones. Unless you pay them an extra fee of course.
Not to sound trollish but I would have sold stock immediately after the bill became law in the senate.
http://saveie6.com/
The gist of this article seems to be that unless you're doing complete content analysis on incoming packets, you aren't going to be able to detect Skype: it uses (on my system at any rate) port 443 (SSL?) and port 80 (HTTP) as its default ports. Any sysadmin that blocks those ports is going to get some very annoyed phone calls from pissed off users.
That skype is being devious and sneaky is not the issue here. I think the real issue here is that sysadmins don't have control over the machines they're supposed to be looking after. There are plenty of ways to make sure that Skype doesn't make it onto the corporate network-- don't give unauthorized users permission to install software, blacklist it on the company approved software image, packet analysis... the list goes on. I figure if the sysadmin is not paranoid enough to do these things to begin with, the use of Skype on his/her network probably isn't a major threat. Or the sysadmin is inept. Your call.
... caused some to ponder whether the ever-more-popular Skype hadn't just turned itself into a huge security risk.
The fact that Skype is designed to be unfirewallable is not a security risk: Any site which wants to block Skype should have a policy prohibiting its use.
The security risk is users who ignore such policies, and system configurations which allow said users to install and use Skype.
Tarsnap: Online backups for the truly paranoid
... software written to secure my communication is now being called a security risk as though the software is bad rather than the users of it. I rather enjoy secure communication.
Skype isn't creating a security hole. Skype is demonstrating that current firewalling practices are inadequate for blocking a determined entity from making an outgoing connection.
Perhaps they ought not to do that; I remember similar concerns about SOAP when it was first being proposed (and no doubt many on here still refuse to use it) and it showed that fewer were willing to blame the inadequacy of the protection than they were the people "bypassing" it. Rather, we should take away the lesson that firewalls in and of themselves are not an absolute solution and instead incorporate other methods and practices in developing secure environments.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
It's extra security for everyone when everyone uses encryption, someone sniffing the network wouldn't be able to tell a critical e-mail from a snippet of voice... Not being able to identify the data is the real reason 'Net Neutrality' is assured.
Since it's a good thing that the data can't be identified (in some ways) how about having your users, in a business setting, not run as Administrator on the desktop machines? Just disallow the installation of IP telephony applications, not as a policy, but as an account restriction.
Better yet, do it before the next worm ravages your network.
I'm worried about allowing software on to the network that I can't monitor and disable at will.
And thats exactly why I dont want skype to change. I dont want the ability for my ISP, or any other provider down the line, to be able to block skype. It is my personal long-distance telephone, and I dont doubt that there are plenty of providers out there that would jump at the opportunity to block it.
Imagine that you have just spent the last two years actively using an internet service for your telephone - at free or near-free pricing. You wake up one day, and it doesnt work anymore. You call up your internet provider, who also happens to be a telco, and say "my internet-based-replacement for long distance isnt working anymore".
You can bet what their responce would be.
.
You don't have to worry about NAT full-cone, restricted-cone, port-restricted cone, STUN, or any other crap in a badly designed protocol.
Have you ever stopped and think that maybe NAT, not the protocol that is the problem? The sooner we get rid of the cludge that NAT is and always was, the better it will be for all net users (hint: IPv6 + stateful firewall => better than NAT cludge)
You can proxy the SSL handshake, and check that it is in fact a valid handshake. Unless you do something really sneaky (install custom CA on corporate machines, generate certificate for each website visited by user which is signed by your custom key), you can't intercept any of the data communication of SSL. My proposal was that a layer7 filter can look for SSL handshakes at the beginning of every port 443 connection. If it doesn't see one after X packets, kill the connection.
Why not rate-limit outgoing TCP port 443? If Skype needs 100 kbps over a connection to maintain unbroken voice output, limit each connection to 50 kbps. You could also limit it to bursts of traffic - full speed for 0.5 second at a time, then 4.5 seconds at 50 kbps. Real HTTPS (small outgoing requests and large incoming responses) would still be responsive under these conditions.
Hands in my pocket
One important reason that Skype should be sneaky is so people using the software under corrupt/abusive regimes can continue to do so without easy interference on the part of the government. In comparison to your intranet's security, the security of dissidents wins.
This is the natural response to to the unnecessary port-blocking that seems to be used everywhere now. Many places block every port except for the few you need for web surfing, so everything runs on port 80. It's sad because it negates the point of ports in the first place.
In the end, I think sysadmins need to learn that users aren't satisfied with only web surfing.
...is another's ticket to freedom.
If Corporate firewalls can't block Skype, neither can China's.
Have you ever stopped and think that maybe NAT, not the protocol that is the problem? The sooner we get rid of the cludge that NAT is and always was, the better it will be for all net users (hint: IPv6 + stateful firewall => better than NAT cludge)
Great, but until then, software needs to work in the real world. What do you suggest, Skype just hold off on offering a product until the whole world adopts IPv6 and they can do it nicely? Yes, NAT is a hack, but it's so widespread it has to be dealt with when developing a product. You can't just code to standards and ship it when the real world isn't obeying the standards.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
Let me be the first to state the obvious:
Corporate Security should not rely on well-behaving of fourth-party applications/protocols.
Sure, go ahead and demand that Skype's protocol be crippled to improve visibility, but the fact remains that if a random O.S.S. proggie can accidentally breach your perimeter, then your P.O.S. security will not stand up to a script-kiddie, let alone a corporate spy.
Obama likes poor people so much, he wants to make more of them.
NAT is a wonderful technology. First of all it really solves the issue with IP-addresses running low beautifully (and saying "well, IPv6 would work even better!" are lousy arguments, it will take an enourmous amount of time before IPv6 is fully implemented, probably atleast a decade). Actually since the widespread adoption of NAT routers, it isn't even really a problem anymore!
Secondly, it's the most important thing ever to happen to internet security. Bar none. Due to how the NAT protocol works (by mapping ports based on outgoing requests), it works as a cheap very good hardware firewall. All the stupid windows exploits that works by looking for unsecure services with open ports is not a problem anymore. A person behind a NAT-router is completly stealthed and invisible to the outside world. The only remaining way to get into someones computer is if someone actually downloads the software themself or if they're using IE. Either way, they're probably to stupid to run a software firewall (which would protect them) (and yes, I love to use singular they, in case you were wondering ;)
Third, it's also great if you share your internet connection with several other computers (either at home or in a corporate environment). Old style hubs would simply broadcast incoming data to all computers in the local network. NAT doesn't do that, it maps local IPs to ports and only transmits to them. Which means that if you don't want every single person on your local network being able to read your email or know that you browsed to men-seeking-men.com, NAT works perfectly.
I'm guessing you are critizingNAT because at one point you wanted to run some software that required you act as a server and you were to dumb to figure out how to open a port? That must be it since it's really the only downside to NAT. Well, that's being solved too. More and more people are learning how to open ports easily (maybe you'll learn someday too!), and even better, software is learning how to do it automatically using either UPnP or getting help from third party servers to do it (that is, the two computers who wishes to talk to eachother connects to a third party server who informs them of the others IP and currently open port, that way the port is already mapped to the correct local IP so the two computers can connect. This is the trick that Skype, amongs others, are using).
Long story short, NAT is an amazing technology. Very soon the mapping ports issue won't even be a problem when all routers support UPnP and software takes advantage of it. Long story even shorter: you're dead wrong.
If companies want to keep data safe, they need to worry more about their employees and less about obscure ways that said employees might be able to smuggle data out of the network. In my job I have access to files that should not leave the office. I know this, therefore I do not remove them from the office. However, I still have full access to everything on a specific database. If I really wanted to, just like any other employee, I could find a way to get the records out without using Skype. There are cases of credit company employees stealing personal info, and they did not need Skype to do it!
Information wants a fueled airplane waiting at the hangar and no one gets hurt.
Excuse me, but I really can't see the problem. In every corporate setup I've ever seen all employees have a phone sitting on their desk. Almost all these phones are fully connected to the outside world, i.e. lines out are not restricted. It really doesn't matter which phone or communication device that are used - secrets will get out regardless if someone is bent on doing so, and Skype isn't anything special in that regard.
Sure monitoring is easier on wired phones but the main concern must be to contain secrets, i.e. prevent the leak. Finding out that it happened and who did it is also interesting but that would help only in damage control and punishment, not in prevention. In these days where cell phones and other wireless devices are everywhere, focus must be on preventing access to the secrets, not preventing communication of the secrets to the outside world - because this last option borders on the almost impossible.
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --