Slashdot Mirror
Skype Protocol Has Been Cracked
nsrCZ writes "The Skype core protocol has been reverse-engineered by a Chinese company. The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it. If it's true, then it could affect the whole eBay/Skype business in many ways, including that they might not get their piece of the emerging Chinese cake." From the article: "By cracking the Skype protocol, the company claims it can also block Skype voice traffic, Paglee said. 'They could literally turn the lights off on Skype in China very, very quickly,' said Paglee, who is also a lawyer and engineer, speaking from California on Friday. The company could transfer the technology to the Chinese government, which has continually sought ways to tighten its filtering and control over the Internet. So far, the company doesn't have any plans to market its blocking capabilities, Paglee said."
I love how the Chinese innovate. Corporate espionage, reverse engineering and overall IP infringement...Skype should have patented its technology, but it's not like the Chinese respect IP anyway.
Math
China are blocking something to prevent people talking about things they shouldn't?
Say it ain't so!
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
Open source it and put it in a decent project like say, Asterisk... I hate Skype just because their protocol is closed. I can't do anything useful with it except when I use their crap.
Custom electronics and digital signage for your business: www.evcircuits.com
Isn't the more important aspect of this the concern that anyone could use this to tap into a conversation over Skype?
... in the NSA.
I realize that the DMCA doesn't extend outside of the USA, but could Skype use it to block this software/information in the US?
Think about it - your conversation could arguably considered copyrighted information (as it's being recorded) - and the Skype protocol "effectively" protects it from being played back.
Could the DMCA be a large hammer that Skype could use to prevent competing products from entering the US market?
Paglee details in his blog a call he received from the engineers using a rudimentary client. Part of the proof that the protocol had been cracked came when the engineers sent Paglee the IP address of his computer, information that normally would be encrypted during a Skype session.
Little did he know they were in his apartment earlier in the day.
Closed Skype protocol gets cracked in X months == Skype releases a new version with a new closed protocol that'll take X more months to crack. Big deal...
Anyway, Skype is a big no-no for me. I don't like software that connects to who-knows-what and uses bandwidth all the time without any way to know what the heck it's doing.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Slashdot Burying Stories About Slashdot Media Owned
They could sell it to US Telco companies and make a little profit too.
Reviewing just the first hour of video games.
I'm sure Skype's lawyers might see this differently.
If this happened in the US, lawyers would be crying "foul!" on the basis of the protocol being a Trade Secret, and they would have something to say about the agreement that one sees when installing the software. I believe I remember seeing a "no reverse-engineering" clause in there.
This being a Chinese source, though, means that US rules don't necessarily apply.
When politicians are involved, everyone loses.
I mean in this day and age, depending on the secrecy of a closed protocol running on top of an open network for a business model seems pretty... dumb... Though obviously they are also trying to do services (like SkypeOut) which make much more sense, what is the value in having a proprietary protocol, when something like SIP (maybe an updated version that supports P2P negotiation) is out there? I mean it's not like the OSS world is playing catch-up this time (like, say, Jabber is compared to AIM's installed and active user base)..
Just curious...
...of things to come? China Rising...
"Even if it was possible to do this, the software code would lack the feature set and reliability of Skype,"
Don't you just love when people speak with certainties about yet unreleased things? Sure, it may well lack it for about 24 days. Then what happens? I'm not convinced that people would base stand alone software on that protocole anyway. More likely soe SIP clients would implement the protocole as an add on.
1. No sig. 2. ???? 3. Profit!!!
they couldn't make it closed. That is the purpose of patents.
***Quis custodiet ipsos custodes***
Do you really have to "crack" the protocol to block the traffic? Were their packets that well disguised?
-- these are only opinions and they might not be mine.
It's now call Scrype terraphone and it love you long time
"Moreover, no amount of reverse engineering would threaten Skype's cryptographic security or integrity."
/.
This is
I'm sure we could figure out something.
Patenting something does not prevent anyone from reverse engineering it, and in fact they wouldnt need to because the mechanism would be documented in the patent.
Reverse engineering is not 'against the law' in most parts of the world, only the US thanks to the DMCA (C is for copyright, not patent), so therefore they probably have not broken the law if they did this outside the US. At present it is legal in the EU to reverse engineer a competitors product for the purpose of producing a compatible interface, sadly however that may not be the case if the proposed "directive on criminal measures aimed at ensuring the enforcement of intellectual property rights" is ratified.
The article submitter seems to be a lot confused regarding the law. There's nothing unlawful about cracking a patented algorithm. It might be unlawful to market a device using the same encryption, in those parts of the unfree (softwarewise) world where software patents are implemented, but that's a different thing.
Cracking encryption algorithms is generally only unlawful where the encryption is a method of encrypting copyrighted material, AND the country involved has implemented some variant of the DMCA or EUCD. That's the legal machinery that DVD Jon had problems with. The Skype Protocol won't be covered by DMCA-like provisions.
...security
To be able to reverse-engineer the Skype protocol, these guys had at one point or another to decrypt the data, and encrypt it as well.
What this means is that they could configure their application as a SuperNode and intercept conversations, files, text in between.
Guess the AES 256bit encryption wasn't implemented properly.
Thanks Skype.
Artificial intelligence is no match for natural stupidity
Closed protocols are not a substitute for security. Any traffic that goes over the internet can be intercepted. Once you have the packets, it's just a matter of figuring out what they mean. This certainly does raise concerns that tapping into Skype conversations may become easy, but this was bound to happen eventually and should be no surprise to anyone.
Besides, who really cares? Phone conversations can be tapped into. Cell phones, too. Everyone knows not to transmit confidential information over the phone.
Lots of info on how skype works, including that the people who run skype could evesdrop on conversations, the possibility of using skype to relay non skype traffic and an overflow security hole (hopfully now fixed) were revealed four months ago.
Silver needle in the Skype at Blackhat Europe
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
Check out:
Skype Journal
Looks like there are a lot of opportunity for deeper business integration. Wonder if this opens up any vulnerabilities for standard client users?
We Apprentice Developers and Designers
Paglee - a mad girl in Hindi. (mockingliy)
Welcome to global communications.
"Moreover, no amount of reverse engineering would threaten Skype's cryptographic security or integrity."
what the fuck? admins, ban this twat
The possibility that this may lead to blocking, isn't what it interesting. I like that this may lead to interoperability. Skype, much like DVDs prior to CSS getting cracked, wasn't useful. Now it may finally become so.
"The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it."
UM.......... Say Who?????
A real patent of Skype's protocol (if a protocol patent could be considered "real") would have published all the details, precisely to protect by law what Skype instead protects by secrecy.
Of course China's mafia government would have found ways to to protect their local "infringers" if it gave them control over Skype's important telecom traffic.
An open protocol using open software from more than a single (point of failure) source is a lot more reliable in the face of large scale attackers, like a government. SIP and IAX are safer.
--
make install -not war
If I had mod points, I'd mod you insightful. What an intelligent comment my friend :)
It's not really cracked until the "crack" is public.
You cannot keep a protocol secret if you patent it because in the patent you have to document everything. This concept does not seem to be clear to the writer of the article.
This isn't really an insightful comment. It's currently modded as such.
Asterisk does not currently provide the nuts and bolts of connecting SIP callers. It's SIP integration is not built out so great either. (ex. can't easily connect to a STUN or RTP proxy)
The normal procedure is to use an SIP server with asterisk as a voicemail backend.
The SER and OpenSER SIP server projects both connect to asterisk.
There is no reason to use skype's proprietary protocol. Good for the Chinese for putting a dent in their proprietary methods. Let SIP providers compete on a service basis, not protocol competition.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Incorrect. "China" is being used as shorthand for "the members of the government of China" (or similar) therefore "are" is a perfectly valid word to use.
Talking into a teapot or a teacup would probably block most of the sound provided you weren't talking very loud.
Now that it's (reportedly) proven crackable, it should be a matter only of time before someone gets a cracked Skype protocol into an open Asterisk module.
--
make install -not war
It's British English. Get over it.
Reverse engineering is always legal. The only question is whether you have the right to do anything with the results of such activity. You can only infringe a patent directly if you engage in the commercial sale of products using patented technology.
You can be found guilty of contributory infringement if you publish detailed information about how to go about infringing a patent. This is a shady area though, since the patent itself already describes the technology in question so it boils down to an evaluation of the individual's intent.
I am becoming gerund, destroyer of verbs.
on being second.
Bert
You haven't posted in a year, and that you couldn't resist?
No, they could metaphorically turn the lights off on Skype in China very, very quickly.
"Oppression and harassment is a small price to pay to live in the land of the free." -- Montgomery Burns.
Actually, it is never against the law to rightfully reverse engineer anything, because you are doing legitimate work to build a new system.
As most people here seem to be somewhat lacking in knowledge over the legal aspect, just because something does not have a patent does not mean it is legal to crack it. Reverse engineering may or may not be legal depending on the country the reversing was done in. US law is *NOT* global law, as so many large US companies and the US government itself is learning. Patents, ignoring their frequent misuse by US companies, are designed to protect innovative ideas long enough for a person or entity to make profitable use of the innovation. It also prevents other companies from copying the idea without some form of licensing - free or otherwise.
However, a patent does *NOT* protect an idea only the implementation of an idea; that's a very important distinction. Further, not having a patent on an innovation does not mean you cannot sue if someone uses your innovation without your permission - in fact the only real value to a patent is a kind of 'date-stamp' to *help* decide (but not confirm) who got there first.
But as to the question of a patent making it illegal to reverse engineer an innovation - No, patent law does not cover this aspect of the law. Anti-reversing laws are a totally separate beast and country dependant.
You forgot "yellow".
piece of the emerging Chinese cake
Mmmmm. Emerging Chinese cake. Rrrrgh.
You are absolutely right about reverse engineering not being illegal. In fact even with the DMCA reverse engineering is still entirely legal. The catch with both the DCMA and patents is what you can do with the protocol once it has been reverse-engineered. In the case of patents, the basic priciples have been disclosed, and you are allowed to distribute any additional information that you learn about the implementation, but you are not allowed to implement the protocol without a patent license.
In the case of the DCMA, you may be* prohibited from disiminating information that you have reverse-engineered, if can be used to circumvent a copyright protection device. I don't think that would apply in this case - what copyrighted work is being protected? The only possibility are the conversations themselves, but this does not allow you to listen in on anothers conversation, it simply allows you to initiate new coversations. Assuming that you are using secure cryptography, revealing the mechanism of the encryption does not weaken the security of the system, only revealing the keys, which in this case are generated per connection, like SSL.
So unless Skype's security is crap, which I don't believe to be true, the DMCA would not restrict you from publishing the details of the protocol, or third party implementations of it. On the other hand patents could. Therefore, the submitter was correct in bringing them up as a potential barrier, even if his wording was not.
* The law contradicts itself, and while there have been some precident setting cases, the interpretation is still very much up in the air.
He seems to be the world's best reverse engineer!
Religion is the main cause of atheism.
The Skype protocol has been cracked for a while, and by at least three organizations I know of, each using different techniques. Some of those techniques have been published, and it's only a matter of time before hackers start exploiting Skype. The only news here is that one of the companies who cracked it is releasing their own Skype library.
I guess we can reformulate the theorem to:
Two billion chinese hitting keys at random on their computers for a month or so, eventually one of them will almost surely break your code!
What is best in life? To crush your enemies, to see them driven before you and to hear the lamentations of their women.
With SkypeOut being free for the rest of the year, it would be nice to see Asterisk use this protocol to make outgoing phone calls. Over and above that simple integration with the Skype userbase would be awesome!!
Ultimately it comes to down to open systems vs closed systems. Traditional telco vendors (carrier and enterprise) all had "closed" systems - propreitery hardware and operating systems and usually propreitery protocols. *ALL* of them are moving (or have moved) towards open systems (read Linux) - supporting standard protocols that other vendors/end users can (in theory) work with. If you look at any product or system - it ultimately has to move to towards an "open" system.
Would Skype be as successful if it had been based on SIP? Skype was a disruptive product and most disruptive products *have* been "closed" systems to begin with. This has to happen sooner or later - and Skype cannot shy away from that. Take a look at http://skypejournal.com/ this has an interesting comment on this.
I don't think this is evil and has anything to do with breaking or cracking something. (Is DVD John bad?) I think this is a good thing - systems have to be eventually open and good systems win on the merit of the quality, user experience and, of course, cost...
---
Sig fault and hence dumped
What's to stop them from changing the protocol now?
The several million people whose copies only support the current one.
In fact, that's how PGPphone used to work, if you can still lay your hands on a copy of it.
Oh, I'm sure you can find it floating around somewhere.
Anybody know the best way to find women who want skype video sex? Finding guys is easy. Just make a woman's profile and put it up in 'skype me' mode. In seconds, you'll have more middle-eastern pecker than you could possibly need for a shishkabob. But finding women is a lot harder. Any tips?
Fascism trolls keeping me up every night. When I starts a preachin', he HITS ME WITH HIS REICH!
Thank you!
Saved me the bother.
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
This paper was published in 2004, by the VoIP group at Columbia. It reverse-engineers the Skype network with sufficient detail to let one make a serious attempt at firewalling Skype traffic.
I guess Coobol did it.
According to an article from the New York Times back in May 21, German authorities claim to have the ability to intercept and decrypt Skype calls.
> Asterisk does not currently provide the nuts and bolts of connecting SIP callers. It's SIP integration is not built out so great either.
> (ex. can't easily connect to a STUN or RTP proxy)
Methinks thou have been modded 'informative' by others as lacking as clue as thee. Granted I'm still learning about VoIP and Asterisk but I took a WiFi VoIP phone (zyxel) home and it used the Asterisk server at work from behind my Linky's NAT just fine. Perhaps previous versions of * didn't have as complete support for SIP as 1.2 but I think you need to try a current version and update your knowledge.
As for Skype, it is great it has been reversed. Now we need a reversed copy of the protocol out in public so other products can interoperate with it. Until then it is just another closed product of zero interest because it has zero longterm future.
Democrat delenda est
This is terrible. Clearly, Skype must be banned.
nt
What you said might be true, but it's exactly what some people say about open source.
it will be cracked.
now whether it takes a 5 year old laptop to do it or the latest supercomputer, it will be cracked.
Truth hurts, eh American moderators?
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
I took a WiFi VoIP phone (zyxel) home and it used the Asterisk server at work from behind my Linky's NAT just fine
o xy explains the difference between it and a proxy. Please read it and consider carefully.
1. Because it works in your situation, it's not a good idea to generalize.
2. Conveniently, you fail to mention how you are connecting to the office network.
3. http://www.voip-info.org/wiki-Asterisk+SIP+not-pr
The task of proxying over heterogeneous security appliances and public/private networks is not as easy as you claim.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Today I received a call through Skype from a friend at a company in China, except he told me he was not using Skype to call me. His company has successfully reverse engineered the Skype protocol and he wanted to call me in the United States to see how it worked between physically distant IP addresses.
If you look at the photo posted at the blog you will notice the two skype users involved:
ct,004 (the hacker) and hanzen.cn (Charlie Paglee - blog owner)
I wonder how long ct,004 will be around for....
NSA and CIA are not out there reverse-engineering products and SELLING them for incredibly cheap prices, putting the original innovators out of business. The CIA and NSA might "steal" plans for products, but they aren't out to destroy the free market economy.
China has no scruples. They will do whatever they can to beg, borrow, or steal, and then they will profit from it. And it's NOTHING like what the US did to Britain 200 years ago. It's more like what pirates did in the Caribbean 300 years ago. Rob and steal from everyone.
Someone needs to put their foot down. But it's OK to send the WTO against the US for steel embargoes against Asian steel manufacturers (who are dumping steel). It's OK to bitch and moan about the US not toeing the line on the Kyoto accord. (Look at China... the #1 polluter on the planet. The US isn't even in the top 20, and we're the 3 largest country in the world.)
Face it... the US gets F*cked every time they do anything... while everyone else gets to skate on without any worries.
Hypocrites can't stand the critique
So how long 'til I can use Skype from Gaim? If voip is going in anyway (gtalk), why not add Skype to the (lengthy) list of supported protocols?
I remember slashdot story about some american being sued (or something as bad) for reverse engineering something. Then everyone was instantly saying how is it ok to reverse engineer a product to find out how it works. So why it suddenly isn't ok? Because it's China?
We need at least one other implementation, and then we can publish the spec as an RFC.
Perhaps somebody wants to hack Asterisk PBX to handle this?
Once there is a second implementation, we can publish an RFC.
It would be a riot. Imagine reading an RFC that tells you to obfuscate your packets. Imagine if it told you to use a specific set of RSA keys and a specific set of IP addresses.
Screenshots or it didn't happen.
Arguing about vi versus Emacs is like arguing whether it's better to make fire by rubbing sticks or banging rocks.
no, they'll just push an upgrade.
The Kruger Dunning explains most post on
Skype for Linux works very badly, there are even problems with using it two times without restarting - you will notice "sound device error" message. Interface is very unfriendly and I am sure it would be much better to use Open Source client. But there is no any!
I believe that making this protocol public would help community a lot.
Perfect forward secrecy (provided when DH is used for session key generation but even when the RSA algo is used for this... you won't be able to decipher my traffic for a very long time): google it.
What should Skype have patented? The company didn't invent anything, they just took existing technology and built a successful business around it. It took billions of dollars to develop the technologies that have made Skype successful, and Skype didn't pay a dime for those technologies.
If there is anything to complain about at all, it's the fact that Skype's protocols aren't open to begin with and that Skype fails to follow open Internet telephony standards. Skypte is the problem here, not the Chinese.