Slashdot Mirror
Skype Protocol Has Been Cracked
nsrCZ writes "The Skype core protocol has been reverse-engineered by a Chinese company. The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it. If it's true, then it could affect the whole eBay/Skype business in many ways, including that they might not get their piece of the emerging Chinese cake." From the article: "By cracking the Skype protocol, the company claims it can also block Skype voice traffic, Paglee said. 'They could literally turn the lights off on Skype in China very, very quickly,' said Paglee, who is also a lawyer and engineer, speaking from California on Friday. The company could transfer the technology to the Chinese government, which has continually sought ways to tighten its filtering and control over the Internet. So far, the company doesn't have any plans to market its blocking capabilities, Paglee said."
Do you really have to "crack" the protocol to block the traffic? Were their packets that well disguised?
-- these are only opinions and they might not be mine.
Lots of info on how skype works, including that the people who run skype could evesdrop on conversations, the possibility of using skype to relay non skype traffic and an overflow security hole (hopfully now fixed) were revealed four months ago.
Silver needle in the Skype at Blackhat Europe
Perhaps I'm being unrealistically naive, but the original concept of the patent system was "full disclosure for protection". During the patent term, manufacturers would have to obtain a license to duplicate the patented object, but after those 17 years were up, no assistance (engineering or otherwise_ from the original inventor would have been necessary-- because the invention had been fully disclosed.
If skype had patented its system, it would have had to disclose elements of its protocols which would make it quite easy for any espionage shop to infiltrate, route around or otherwise frustrate.
Consider, for instance, a lock manufacturer. Their cylinders are described in exquisite detail in their patents. A person skilled in the art of lock-picking might find their patents to be of particular interest. But if the lock incorporates security mechanisms which defeat all potential attacks, it doesn't matter if they are disclosed.
However, if the companies key manufacturing division and distribution network are infiltrated, then a duplicate key can probably be manufactured with a modicum of difficulty. That's why such practices are not disclosed in the patent, and are usually subject to "trade secret" regulations.
P.S. I'm not so sure that the NSA and CIA let IP laws get in the way of espionage.
The interesting thing is since skype uses encryption and encryption use by private citizens is illegal in China, just using skype could get you arrested. But then again, if the Chinese government wants to arrest a citizen in China they just do it and can find (or make up) a reason for the arrest afterwards.
The Economics of Website Security
I agree with you. Skype, due to its central corporate authentication of the RSA keys for customers, is ripe for law-enforcement mandated man-in-the-middle attacks. Without publising their protocol and any safeguards they've embedded in it, such as a public RSA key repository similar to those used by many GPG users, it's technologically easy for them to authenticate a centralized key upon request for NSA, CIA, FBI, or my aunt-Matilda-if-she-asks-them-nicely tap in the center of any conversation connection.
For all such transactions, whether they are SSL, SSH, or some proprietary technology like Skype, you have to trust the site that holds the server keys or the people that write the software not to embed backdoors or fake keys to allow tapping. There are even technical reasons to permit such forgery: web-proxies for high-availability banking transactions, for example, may want to have their SSL keys multi-hosted. I've sat in on discussions about exactly that sort of approach and its security consequences.
Anyone who assumes that Skype conversations is immune from a legal wiretap order or even an unconstitutional Patriot Act order that Skype dare not publish due to the Patriot Act's nature is engaging in wishful thinking. If you want real end-to-end encryption, you have to have personal control of the key exchange. In fact, that's how PGPphone used to work, if you can still lay your hands on a copy of it. It just never got broadly enough deployed, or provided the convenience and computer->cheap telephone call services that Skype provides.
Why should Skype have patented this, and how does this negatively affect Skype?
Skype don't get their money from people installing their client, they get their money from people paying for the extra services like SkypeOut, SkypeIn, and so on. They should regard maintaining the Skype clients as an unwanted hassle. What they really want is as many people as possible connecting to their servers and using the extra services. This is separate from the protocol.
If I was an executive at Skype, I would view this as a good thing for the company. It's only going to result in more users. It's strange that Skype didn't voluntarily open up their protocol earlier!
Skype's lawyers can see it however they want - but in this instance, they have no legal leg to stand on. It's not illegal to replicate something protected as a trade secret. (It *is* illegal to steal or 'borrow' it, or to hire employees from a rival to 'work on your own _x_'.)
So exactly where has China innovated?
Automobiles they have "chery" whose entire line-up are shoddy copies of cars already produced by other manufacturers.
We have Huawei, who has literally stolen Cisco's router code to make a "competing product".
And then we have their military who happened to... yes steal their designs as well (at least the stuff they didn't just purchase from Russia and reverse engineer).
So exactly what are these innovations taking place in China you wanted to defend?
BTW, there's PLENTY more examples to prove how they don't innovate at all, just steal/reverse engineer/copy others if you need them.
Yeah, well you have to look at the audience... You got mostly white males in the ages of 16-24. They think they know everything about anything and therefore can easily feel comfortable shooting off about entire peoples they have never met. The fact that they're american doesn't help either :-)
On the flipside some of the stereotypes and comments are well deserved. I mean, read comp.lang.c for a week. You'll get a lot of "I have to write this program and I don't have the first damn clue" types of posts, amazingly enough mostly from India. Look at phishing stats, they're mostly organized by people in Eastern block countries. That's not conjecture or hyperbole that's the truth. China does have a track record for more than just reverse engineering. Classic IP violations are more common than in other nations [although I wouldn't say it's epidemic like some people suggest].
So like all nonsense there is some element of truth to it.
Tom
Someday, I'll have a real sig.