Slashdot Mirror
Skype Protocol Has Been Cracked
nsrCZ writes "The Skype core protocol has been reverse-engineered by a Chinese company. The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it. If it's true, then it could affect the whole eBay/Skype business in many ways, including that they might not get their piece of the emerging Chinese cake." From the article: "By cracking the Skype protocol, the company claims it can also block Skype voice traffic, Paglee said. 'They could literally turn the lights off on Skype in China very, very quickly,' said Paglee, who is also a lawyer and engineer, speaking from California on Friday. The company could transfer the technology to the Chinese government, which has continually sought ways to tighten its filtering and control over the Internet. So far, the company doesn't have any plans to market its blocking capabilities, Paglee said."
I love how the Chinese innovate. Corporate espionage, reverse engineering and overall IP infringement...Skype should have patented its technology, but it's not like the Chinese respect IP anyway.
Math
Open source it and put it in a decent project like say, Asterisk... I hate Skype just because their protocol is closed. I can't do anything useful with it except when I use their crap.
Custom electronics and digital signage for your business: www.evcircuits.com
Isn't the more important aspect of this the concern that anyone could use this to tap into a conversation over Skype?
Paglee details in his blog a call he received from the engineers using a rudimentary client. Part of the proof that the protocol had been cracked came when the engineers sent Paglee the IP address of his computer, information that normally would be encrypted during a Skype session.
Little did he know they were in his apartment earlier in the day.
Closed Skype protocol gets cracked in X months == Skype releases a new version with a new closed protocol that'll take X more months to crack. Big deal...
Anyway, Skype is a big no-no for me. I don't like software that connects to who-knows-what and uses bandwidth all the time without any way to know what the heck it's doing.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Slashdot Burying Stories About Slashdot Media Owned
They could sell it to US Telco companies and make a little profit too.
Reviewing just the first hour of video games.
I'm sure Skype's lawyers might see this differently.
If this happened in the US, lawyers would be crying "foul!" on the basis of the protocol being a Trade Secret, and they would have something to say about the agreement that one sees when installing the software. I believe I remember seeing a "no reverse-engineering" clause in there.
This being a Chinese source, though, means that US rules don't necessarily apply.
When politicians are involved, everyone loses.
I mean in this day and age, depending on the secrecy of a closed protocol running on top of an open network for a business model seems pretty... dumb... Though obviously they are also trying to do services (like SkypeOut) which make much more sense, what is the value in having a proprietary protocol, when something like SIP (maybe an updated version that supports P2P negotiation) is out there? I mean it's not like the OSS world is playing catch-up this time (like, say, Jabber is compared to AIM's installed and active user base)..
Just curious...
...of things to come? China Rising...
"Even if it was possible to do this, the software code would lack the feature set and reliability of Skype,"
Don't you just love when people speak with certainties about yet unreleased things? Sure, it may well lack it for about 24 days. Then what happens? I'm not convinced that people would base stand alone software on that protocole anyway. More likely soe SIP clients would implement the protocole as an add on.
1. No sig. 2. ???? 3. Profit!!!
they couldn't make it closed. That is the purpose of patents.
***Quis custodiet ipsos custodes***
Do you really have to "crack" the protocol to block the traffic? Were their packets that well disguised?
-- these are only opinions and they might not be mine.
It's now call Scrype terraphone and it love you long time
Patenting something does not prevent anyone from reverse engineering it, and in fact they wouldnt need to because the mechanism would be documented in the patent.
Reverse engineering is not 'against the law' in most parts of the world, only the US thanks to the DMCA (C is for copyright, not patent), so therefore they probably have not broken the law if they did this outside the US. At present it is legal in the EU to reverse engineer a competitors product for the purpose of producing a compatible interface, sadly however that may not be the case if the proposed "directive on criminal measures aimed at ensuring the enforcement of intellectual property rights" is ratified.
The article submitter seems to be a lot confused regarding the law. There's nothing unlawful about cracking a patented algorithm. It might be unlawful to market a device using the same encryption, in those parts of the unfree (softwarewise) world where software patents are implemented, but that's a different thing.
Cracking encryption algorithms is generally only unlawful where the encryption is a method of encrypting copyrighted material, AND the country involved has implemented some variant of the DMCA or EUCD. That's the legal machinery that DVD Jon had problems with. The Skype Protocol won't be covered by DMCA-like provisions.
Closed protocols are not a substitute for security. Any traffic that goes over the internet can be intercepted. Once you have the packets, it's just a matter of figuring out what they mean. This certainly does raise concerns that tapping into Skype conversations may become easy, but this was bound to happen eventually and should be no surprise to anyone.
Besides, who really cares? Phone conversations can be tapped into. Cell phones, too. Everyone knows not to transmit confidential information over the phone.
Uh, no. See Lexmark vs. SCC.
Lots of info on how skype works, including that the people who run skype could evesdrop on conversations, the possibility of using skype to relay non skype traffic and an overflow security hole (hopfully now fixed) were revealed four months ago.
Silver needle in the Skype at Blackhat Europe
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
Check out:
Skype Journal
Looks like there are a lot of opportunity for deeper business integration. Wonder if this opens up any vulnerabilities for standard client users?
We Apprentice Developers and Designers
Paglee - a mad girl in Hindi. (mockingliy)
Welcome to global communications.
What this means is that they could configure their application as a SuperNode and intercept conversations, files, text in between.
This is not a valid conclusion. To send out and receive audio when participating in a call it is necessary for a client to have the crypto keys. When the client is running on a general purpose computer the keys are inevitably accessable by the end user. The only solution to that is tamper resistant hardware and we, the slashdot masses, hate that.
To function as a relay for other people skype conversations you don't need to be able to encrypt and decrpt the streams, you just pass them on.
There is a big problem with skype which is that the way is implemented means thats the people who run skype could evesdrop on calls and could be served with warrants to do so. Using end to end public key encryption to prevent that would not prevent anyone reverse engineering it and creating a compatable client.
More to the point, Skype did not copyright the technology.
Not that the DMCA is relevant to me, yet (being outside the US), but I like this (currently) hypothetical topic...
Don't the anti-curcumvention provisions in the DMCA only protect the copyright holder? As the person doing the talking over Skype, presumably you are the copyright holder, and thus you are therefore allowed to decrypt your own copyrighted 'content'.
Or am I missing something? Does the Skype EULA transfer copyright of your conversation to Skype themselves? *scary*
Sparks:Gadget:Beer Maker
This is why mod points should be more carefully controlled.
The DMCA explicitly protects your right to reverse-engineer for the purposes of interoperability.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
A real patent of Skype's protocol (if a protocol patent could be considered "real") would have published all the details, precisely to protect by law what Skype instead protects by secrecy.
Of course China's mafia government would have found ways to to protect their local "infringers" if it gave them control over Skype's important telecom traffic.
An open protocol using open software from more than a single (point of failure) source is a lot more reliable in the face of large scale attackers, like a government. SIP and IAX are safer.
--
make install -not war
It's not really cracked until the "crack" is public.
You cannot keep a protocol secret if you patent it because in the patent you have to document everything. This concept does not seem to be clear to the writer of the article.
This isn't really an insightful comment. It's currently modded as such.
Asterisk does not currently provide the nuts and bolts of connecting SIP callers. It's SIP integration is not built out so great either. (ex. can't easily connect to a STUN or RTP proxy)
The normal procedure is to use an SIP server with asterisk as a voicemail backend.
The SER and OpenSER SIP server projects both connect to asterisk.
There is no reason to use skype's proprietary protocol. Good for the Chinese for putting a dent in their proprietary methods. Let SIP providers compete on a service basis, not protocol competition.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Talking into a teapot or a teacup would probably block most of the sound provided you weren't talking very loud.
Now that it's (reportedly) proven crackable, it should be a matter only of time before someone gets a cracked Skype protocol into an open Asterisk module.
--
make install -not war
yes they are already blocking http://anonet.org/ and all of its subdomains but intermitantly, its a great tool, i just hope the chinese doesn't block VPN's next! for those in china, use tor to access the site, same goes for those in the _peoples republic of amerika, franKe, germEny oh and soon engFand.
It's British English. Get over it.
Is it being recorded though, or just transmitted? Something is only copyrighted once it gets fixed into a medium. So if you are recording to disk and then transmitting, that would be protected by copyright. But the user would hold the copyright, not Skype, so Skype couldn't use the DMCA against anybody.
I thought that maybe Skype could include a copyrighted logo or something at the beginning of each transmission, but Nintendo tried to do exactly this, and the court ruled that the copying for protocol purposes wasn't infringement. But the law has gotten far more protective over copyright lately, so who knows? Skype might be able to ward off competitors with just the possibility of a successful lawsuit.
Bogtha Bogtha Bogtha
Reverse engineering is always legal. The only question is whether you have the right to do anything with the results of such activity. You can only infringe a patent directly if you engage in the commercial sale of products using patented technology.
You can be found guilty of contributory infringement if you publish detailed information about how to go about infringing a patent. This is a shady area though, since the patent itself already describes the technology in question so it boils down to an evaluation of the individual's intent.
I am becoming gerund, destroyer of verbs.
on being second.
Bert
No, they could metaphorically turn the lights off on Skype in China very, very quickly.
"Oppression and harassment is a small price to pay to live in the land of the free." -- Montgomery Burns.
If mod points were more carefully controlled, your post wouldn't have a score of 5 either.
Hear that, everyone?
If you're one of the millions who found a ton of value in Skype before it was cracked, you were very, very wrong, because this anonymous Internet jackass has said so. No matter how valuable you think Skype was before, it really wasn't.
You know all the money you saved on long distance calling since Skype dropped the fees behind North American calls? That didn't happen either.
But, as you'll guess, now Skype will become useful, as it will become interoperable with some piece of garbage OSS code that will be orphaned within five seconds of its Alpha version being released. Now that's value.
-
Inventor of the term 'pardon my French'.
The DMCA explicitly protects your right to reverse-engineer for the purposes of interoperability.
Except when it might interfere with the profits of the MPAA*.
*See DVD Jon
Tubal-Cain smokes the white owl.
As most people here seem to be somewhat lacking in knowledge over the legal aspect, just because something does not have a patent does not mean it is legal to crack it. Reverse engineering may or may not be legal depending on the country the reversing was done in. US law is *NOT* global law, as so many large US companies and the US government itself is learning. Patents, ignoring their frequent misuse by US companies, are designed to protect innovative ideas long enough for a person or entity to make profitable use of the innovation. It also prevents other companies from copying the idea without some form of licensing - free or otherwise.
However, a patent does *NOT* protect an idea only the implementation of an idea; that's a very important distinction. Further, not having a patent on an innovation does not mean you cannot sue if someone uses your innovation without your permission - in fact the only real value to a patent is a kind of 'date-stamp' to *help* decide (but not confirm) who got there first.
But as to the question of a patent making it illegal to reverse engineer an innovation - No, patent law does not cover this aspect of the law. Anti-reversing laws are a totally separate beast and country dependant.
The DMCA explicitly protects your right to reverse-engineer for the purposes of interoperability.
The reverse-engineering clause has many exceptions - not the least of which is "non-infringing uses"
And as a previous poster pointed out, it interoperability didn't stop the MPAA suits against DeCSS.
You are absolutely right about reverse engineering not being illegal. In fact even with the DMCA reverse engineering is still entirely legal. The catch with both the DCMA and patents is what you can do with the protocol once it has been reverse-engineered. In the case of patents, the basic priciples have been disclosed, and you are allowed to distribute any additional information that you learn about the implementation, but you are not allowed to implement the protocol without a patent license.
In the case of the DCMA, you may be* prohibited from disiminating information that you have reverse-engineered, if can be used to circumvent a copyright protection device. I don't think that would apply in this case - what copyrighted work is being protected? The only possibility are the conversations themselves, but this does not allow you to listen in on anothers conversation, it simply allows you to initiate new coversations. Assuming that you are using secure cryptography, revealing the mechanism of the encryption does not weaken the security of the system, only revealing the keys, which in this case are generated per connection, like SSL.
So unless Skype's security is crap, which I don't believe to be true, the DMCA would not restrict you from publishing the details of the protocol, or third party implementations of it. On the other hand patents could. Therefore, the submitter was correct in bringing them up as a potential barrier, even if his wording was not.
* The law contradicts itself, and while there have been some precident setting cases, the interpretation is still very much up in the air.
copyright is inherent in creation, not an act that needs to be taken (a la trademark registration or patent filing)
RAM is my medium, and I record to it all the time.
-- No sig for you!
> And as a previous poster pointed out, it interoperability didn't stop the MPAA suits against DeCSS.
Were any of those lawsuits in the US?
He seems to be the world's best reverse engineer!
Religion is the main cause of atheism.
The DMCA also prohibits the construction, possession, and/or use of a device to defeat copyright infringement. In a case where the law contradicts itself, the people with the most money win.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The Skype protocol has been cracked for a while, and by at least three organizations I know of, each using different techniques. Some of those techniques have been published, and it's only a matter of time before hackers start exploiting Skype. The only news here is that one of the companies who cracked it is releasing their own Skype library.
I guess we can reformulate the theorem to:
Two billion chinese hitting keys at random on their computers for a month or so, eventually one of them will almost surely break your code!
What is best in life? To crush your enemies, to see them driven before you and to hear the lamentations of their women.
Ultimately it comes to down to open systems vs closed systems. Traditional telco vendors (carrier and enterprise) all had "closed" systems - propreitery hardware and operating systems and usually propreitery protocols. *ALL* of them are moving (or have moved) towards open systems (read Linux) - supporting standard protocols that other vendors/end users can (in theory) work with. If you look at any product or system - it ultimately has to move to towards an "open" system.
Would Skype be as successful if it had been based on SIP? Skype was a disruptive product and most disruptive products *have* been "closed" systems to begin with. This has to happen sooner or later - and Skype cannot shy away from that. Take a look at http://skypejournal.com/ this has an interesting comment on this.
I don't think this is evil and has anything to do with breaking or cracking something. (Is DVD John bad?) I think this is a good thing - systems have to be eventually open and good systems win on the merit of the quality, user experience and, of course, cost...
---
Sig fault and hence dumped
What's to stop them from changing the protocol now?
The several million people whose copies only support the current one.
In fact, that's how PGPphone used to work, if you can still lay your hands on a copy of it.
Oh, I'm sure you can find it floating around somewhere.
True, but it is much easier to establish who did something first if you register for a copyright. Otherwise you may need to prove that you were using it first, which can be difficult sometimes.
"But this one goes to 11!"
"In a case where the law contradicts itself, the people with the most money win."
Isn't that the case pretty much regardless of contradictory law??
"But this one goes to 11!"
Thank you!
Saved me the bother.
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
This paper was published in 2004, by the VoIP group at Columbia. It reverse-engineers the Skype network with sufficient detail to let one make a serious attempt at firewalling Skype traffic.
I guess Coobol did it.
According to an article from the New York Times back in May 21, German authorities claim to have the ability to intercept and decrypt Skype calls.
> Asterisk does not currently provide the nuts and bolts of connecting SIP callers. It's SIP integration is not built out so great either.
> (ex. can't easily connect to a STUN or RTP proxy)
Methinks thou have been modded 'informative' by others as lacking as clue as thee. Granted I'm still learning about VoIP and Asterisk but I took a WiFi VoIP phone (zyxel) home and it used the Asterisk server at work from behind my Linky's NAT just fine. Perhaps previous versions of * didn't have as complete support for SIP as 1.2 but I think you need to try a current version and update your knowledge.
As for Skype, it is great it has been reversed. Now we need a reversed copy of the protocol out in public so other products can interoperate with it. Until then it is just another closed product of zero interest because it has zero longterm future.
Democrat delenda est
I think you meant "enable copyright infringement". Otherwise DRM would be illegal. :)
What you said might be true, but it's exactly what some people say about open source.
Interoperability is what the AC should have stuck with and yes it does have interesting possibilitys.
maybe soon we will see that vonage and skype customers can talk to each other without having to subscribe to both
(add any number of other service providers to this too) maybe your own ISP might do a voip deal thats cheaper than skype. who knows. (vonage just used as an example)
millions of people currently use skype now billions don't. If the protocol is open then its no longer a choice of who has the most users but who has the best rates.
course the lawyers now will have a feeding frenzy and hopefully the winners will be the consumers -actually win or lose skype will lose. Customers are free to go elsewhere at anytime if their interests, lower prices and greater interoperability are not met, many will desert skype.
Mergers will be made Deals will be struck between other telecommunications companys sharing a common protocol.
skype may or may not be included.
Blarney Quality Restaurant, Plants
it will be cracked.
now whether it takes a 5 year old laptop to do it or the latest supercomputer, it will be cracked.
Truth hurts, eh American moderators?
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
I took a WiFi VoIP phone (zyxel) home and it used the Asterisk server at work from behind my Linky's NAT just fine
o xy explains the difference between it and a proxy. Please read it and consider carefully.
1. Because it works in your situation, it's not a good idea to generalize.
2. Conveniently, you fail to mention how you are connecting to the office network.
3. http://www.voip-info.org/wiki-Asterisk+SIP+not-pr
The task of proxying over heterogeneous security appliances and public/private networks is not as easy as you claim.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
So how long 'til I can use Skype from Gaim? If voip is going in anyway (gtalk), why not add Skype to the (lengthy) list of supported protocols?
I remember slashdot story about some american being sued (or something as bad) for reverse engineering something. Then everyone was instantly saying how is it ok to reverse engineer a product to find out how it works. So why it suddenly isn't ok? Because it's China?
We need at least one other implementation, and then we can publish the spec as an RFC.
Perhaps somebody wants to hack Asterisk PBX to handle this?
Once there is a second implementation, we can publish an RFC.
It would be a riot. Imagine reading an RFC that tells you to obfuscate your packets. Imagine if it told you to use a specific set of RSA keys and a specific set of IP addresses.
Screenshots or it didn't happen.
Arguing about vi versus Emacs is like arguing whether it's better to make fire by rubbing sticks or banging rocks.
no, they'll just push an upgrade.
The Kruger Dunning explains most post on
>The DMCA explicitly protects your right to reverse-engineer for the purposes of interoperability.
Whatever the statute actually says, that's not the way it's working in practice.
On February 27, 2003, judge Karl Forester ordered Static Control Components to stop selling inkjet cartridges that interoperated with Lexmark printers. He issued the injunction under the DMCA.
Skype for Linux works very badly, there are even problems with using it two times without restarting - you will notice "sound device error" message. Interface is very unfriendly and I am sure it would be much better to use Open Source client. But there is no any!
I believe that making this protocol public would help community a lot.
What should Skype have patented? The company didn't invent anything, they just took existing technology and built a successful business around it. It took billions of dollars to develop the technologies that have made Skype successful, and Skype didn't pay a dime for those technologies.
If there is anything to complain about at all, it's the fact that Skype's protocols aren't open to begin with and that Skype fails to follow open Internet telephony standards. Skypte is the problem here, not the Chinese.
But seriously, if you gave me 100 years and unlimited computing power, I'd live the rest of my life in virtual universe where I am omnipotent.
OT: Actually, that's a really interesting question, what would YOU do with 100 years and unlimited computing power?
With unlimited computing power I could break your SSL session in minutes, seconds even. No cipher short of a random one time pad is perfectly secure.
However, the principle behind encryption is not to make messages perfectly secure, but secure enough so that by the time they have been decrypted the information being protected is useless. For instance, let's pretend I can decrypt your SSL session on my laptop in 100 years. That's entirely possible if the cipher used is a bit weak, but what good does it do me to know your current credit card details in 100 years time?
With modern computers, it's quite easy to make ciphers almost arbitrarily secure but in olden days, when secure ciphers were extremely expensive, the trade off between how long lived the information was and the security of the cipher was often critical and when misjudged could lead to disastrous results.
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
destroy it before it took over the universe...
unlimited power would require some form of mechanism to gather (potentialy) unlimited energy from the universe.
XML - A clever joke would be here if