Slashdot Mirror
Skype Protocol Has Been Cracked
nsrCZ writes "The Skype core protocol has been reverse-engineered by a Chinese company. The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it. If it's true, then it could affect the whole eBay/Skype business in many ways, including that they might not get their piece of the emerging Chinese cake." From the article: "By cracking the Skype protocol, the company claims it can also block Skype voice traffic, Paglee said. 'They could literally turn the lights off on Skype in China very, very quickly,' said Paglee, who is also a lawyer and engineer, speaking from California on Friday. The company could transfer the technology to the Chinese government, which has continually sought ways to tighten its filtering and control over the Internet. So far, the company doesn't have any plans to market its blocking capabilities, Paglee said."
I love how the Chinese innovate. Corporate espionage, reverse engineering and overall IP infringement...Skype should have patented its technology, but it's not like the Chinese respect IP anyway.
Math
Open source it and put it in a decent project like say, Asterisk... I hate Skype just because their protocol is closed. I can't do anything useful with it except when I use their crap.
Custom electronics and digital signage for your business: www.evcircuits.com
Isn't the more important aspect of this the concern that anyone could use this to tap into a conversation over Skype?
Closed Skype protocol gets cracked in X months == Skype releases a new version with a new closed protocol that'll take X more months to crack. Big deal...
Anyway, Skype is a big no-no for me. I don't like software that connects to who-knows-what and uses bandwidth all the time without any way to know what the heck it's doing.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
I'm sure Skype's lawyers might see this differently.
If this happened in the US, lawyers would be crying "foul!" on the basis of the protocol being a Trade Secret, and they would have something to say about the agreement that one sees when installing the software. I believe I remember seeing a "no reverse-engineering" clause in there.
This being a Chinese source, though, means that US rules don't necessarily apply.
When politicians are involved, everyone loses.
Closed protocols are not a substitute for security. Any traffic that goes over the internet can be intercepted. Once you have the packets, it's just a matter of figuring out what they mean. This certainly does raise concerns that tapping into Skype conversations may become easy, but this was bound to happen eventually and should be no surprise to anyone.
Besides, who really cares? Phone conversations can be tapped into. Cell phones, too. Everyone knows not to transmit confidential information over the phone.
It's not really cracked until the "crack" is public.
Talking into a teapot or a teacup would probably block most of the sound provided you weren't talking very loud.
As most people here seem to be somewhat lacking in knowledge over the legal aspect, just because something does not have a patent does not mean it is legal to crack it. Reverse engineering may or may not be legal depending on the country the reversing was done in. US law is *NOT* global law, as so many large US companies and the US government itself is learning. Patents, ignoring their frequent misuse by US companies, are designed to protect innovative ideas long enough for a person or entity to make profitable use of the innovation. It also prevents other companies from copying the idea without some form of licensing - free or otherwise.
However, a patent does *NOT* protect an idea only the implementation of an idea; that's a very important distinction. Further, not having a patent on an innovation does not mean you cannot sue if someone uses your innovation without your permission - in fact the only real value to a patent is a kind of 'date-stamp' to *help* decide (but not confirm) who got there first.
But as to the question of a patent making it illegal to reverse engineer an innovation - No, patent law does not cover this aspect of the law. Anti-reversing laws are a totally separate beast and country dependant.
The DMCA also prohibits the construction, possession, and/or use of a device to defeat copyright infringement. In a case where the law contradicts itself, the people with the most money win.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
What's to stop them from changing the protocol now?
The several million people whose copies only support the current one.
Just because it abuses a stereotype doesn't mean it can't also be very funny. And it doesn't make me any more of a racist to laugh at it, even though I dislike racism, and wouldn't use humor that way myself. Try as I might, I can't find it unfunny. Guys getting kicked in the nuts is also pretty funny to watch, but that doesn't mean I advocate testicular violence. So get over your enlightened condescension and enjoy the ride.
Using "SSL" over 443 has long worked for bypassing firewalls and even proxies. I wrote about this back in 2003 and have been using ever since. It works even through a proxy server, as the proxy server just has to blindly forward all "SSL" traffic over port 443. By the very nature of SSL traffic, there is nothing you can do about it. All I do is wrap my SSH (or whatever) traffic inside an "SSL" stream and you can't touch it without breaking every other https site.
The only way to block this would be to create a whitelist of SSL/https sites and allow only those access. Since every business relationship is driven online these days and everyone wants it encrypted, unless you sell tires to folks that walk in and just have a cash register, you'll still going to have to allow SSL.