Slashdot Mirror
Skype Protocol Has Been Cracked
nsrCZ writes "The Skype core protocol has been reverse-engineered by a Chinese company. The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it. If it's true, then it could affect the whole eBay/Skype business in many ways, including that they might not get their piece of the emerging Chinese cake." From the article: "By cracking the Skype protocol, the company claims it can also block Skype voice traffic, Paglee said. 'They could literally turn the lights off on Skype in China very, very quickly,' said Paglee, who is also a lawyer and engineer, speaking from California on Friday. The company could transfer the technology to the Chinese government, which has continually sought ways to tighten its filtering and control over the Internet. So far, the company doesn't have any plans to market its blocking capabilities, Paglee said."
I love how the Chinese innovate. Corporate espionage, reverse engineering and overall IP infringement...Skype should have patented its technology, but it's not like the Chinese respect IP anyway.
Math
Closed Skype protocol gets cracked in X months == Skype releases a new version with a new closed protocol that'll take X more months to crack. Big deal...
Anyway, Skype is a big no-no for me. I don't like software that connects to who-knows-what and uses bandwidth all the time without any way to know what the heck it's doing.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Slashdot Burying Stories About Slashdot Media Owned
I'm sure Skype's lawyers might see this differently.
If this happened in the US, lawyers would be crying "foul!" on the basis of the protocol being a Trade Secret, and they would have something to say about the agreement that one sees when installing the software. I believe I remember seeing a "no reverse-engineering" clause in there.
This being a Chinese source, though, means that US rules don't necessarily apply.
When politicians are involved, everyone loses.
Do you really have to "crack" the protocol to block the traffic? Were their packets that well disguised?
-- these are only opinions and they might not be mine.
It's now call Scrype terraphone and it love you long time
From TFA :
The company, however, has not been able to decrypt the phone calls passing through those computers and listen in because of the complicated encryption keys used during calls, Paglee said.
So I guess not.
So your solution to China cracking the protocol is to make it open-source.
You are a genius.
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
Patenting something does not prevent anyone from reverse engineering it, and in fact they wouldnt need to because the mechanism would be documented in the patent.
Reverse engineering is not 'against the law' in most parts of the world, only the US thanks to the DMCA (C is for copyright, not patent), so therefore they probably have not broken the law if they did this outside the US. At present it is legal in the EU to reverse engineer a competitors product for the purpose of producing a compatible interface, sadly however that may not be the case if the proposed "directive on criminal measures aimed at ensuring the enforcement of intellectual property rights" is ratified.
The article submitter seems to be a lot confused regarding the law. There's nothing unlawful about cracking a patented algorithm. It might be unlawful to market a device using the same encryption, in those parts of the unfree (softwarewise) world where software patents are implemented, but that's a different thing.
Cracking encryption algorithms is generally only unlawful where the encryption is a method of encrypting copyrighted material, AND the country involved has implemented some variant of the DMCA or EUCD. That's the legal machinery that DVD Jon had problems with. The Skype Protocol won't be covered by DMCA-like provisions.
Closed protocols are not a substitute for security. Any traffic that goes over the internet can be intercepted. Once you have the packets, it's just a matter of figuring out what they mean. This certainly does raise concerns that tapping into Skype conversations may become easy, but this was bound to happen eventually and should be no surprise to anyone.
Besides, who really cares? Phone conversations can be tapped into. Cell phones, too. Everyone knows not to transmit confidential information over the phone.
Lots of info on how skype works, including that the people who run skype could evesdrop on conversations, the possibility of using skype to relay non skype traffic and an overflow security hole (hopfully now fixed) were revealed four months ago.
Silver needle in the Skype at Blackhat Europe
What the hell is that supposed to mean? First of all, let's address this statement:
Perhaps you wrote this incorrectly, but, by definition, nothing is useful unless you use it. Would you care to elaborate why you think their service is useless crap? Oh yes, this nugget of gold:
What you're saying, implicitly, is that you have no real qualms against Skype aside from their lack of openess with respect to their protocol. That's absurd! I could understand if you disliked this about their service, but to actually hate their service because of this one fact is borderline stupid.
This is why mod points should be more carefully controlled.
The DMCA explicitly protects your right to reverse-engineer for the purposes of interoperability.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
This isn't really an insightful comment. It's currently modded as such.
Asterisk does not currently provide the nuts and bolts of connecting SIP callers. It's SIP integration is not built out so great either. (ex. can't easily connect to a STUN or RTP proxy)
The normal procedure is to use an SIP server with asterisk as a voicemail backend.
The SER and OpenSER SIP server projects both connect to asterisk.
There is no reason to use skype's proprietary protocol. Good for the Chinese for putting a dent in their proprietary methods. Let SIP providers compete on a service basis, not protocol competition.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
on being second.
Bert
No, they could metaphorically turn the lights off on Skype in China very, very quickly.
"Oppression and harassment is a small price to pay to live in the land of the free." -- Montgomery Burns.
I agree with you. Skype, due to its central corporate authentication of the RSA keys for customers, is ripe for law-enforcement mandated man-in-the-middle attacks. Without publising their protocol and any safeguards they've embedded in it, such as a public RSA key repository similar to those used by many GPG users, it's technologically easy for them to authenticate a centralized key upon request for NSA, CIA, FBI, or my aunt-Matilda-if-she-asks-them-nicely tap in the center of any conversation connection.
For all such transactions, whether they are SSL, SSH, or some proprietary technology like Skype, you have to trust the site that holds the server keys or the people that write the software not to embed backdoors or fake keys to allow tapping. There are even technical reasons to permit such forgery: web-proxies for high-availability banking transactions, for example, may want to have their SSL keys multi-hosted. I've sat in on discussions about exactly that sort of approach and its security consequences.
Anyone who assumes that Skype conversations is immune from a legal wiretap order or even an unconstitutional Patriot Act order that Skype dare not publish due to the Patriot Act's nature is engaging in wishful thinking. If you want real end-to-end encryption, you have to have personal control of the key exchange. In fact, that's how PGPphone used to work, if you can still lay your hands on a copy of it. It just never got broadly enough deployed, or provided the convenience and computer->cheap telephone call services that Skype provides.
You are absolutely right about reverse engineering not being illegal. In fact even with the DMCA reverse engineering is still entirely legal. The catch with both the DCMA and patents is what you can do with the protocol once it has been reverse-engineered. In the case of patents, the basic priciples have been disclosed, and you are allowed to distribute any additional information that you learn about the implementation, but you are not allowed to implement the protocol without a patent license.
In the case of the DCMA, you may be* prohibited from disiminating information that you have reverse-engineered, if can be used to circumvent a copyright protection device. I don't think that would apply in this case - what copyrighted work is being protected? The only possibility are the conversations themselves, but this does not allow you to listen in on anothers conversation, it simply allows you to initiate new coversations. Assuming that you are using secure cryptography, revealing the mechanism of the encryption does not weaken the security of the system, only revealing the keys, which in this case are generated per connection, like SSL.
So unless Skype's security is crap, which I don't believe to be true, the DMCA would not restrict you from publishing the details of the protocol, or third party implementations of it. On the other hand patents could. Therefore, the submitter was correct in bringing them up as a potential barrier, even if his wording was not.
* The law contradicts itself, and while there have been some precident setting cases, the interpretation is still very much up in the air.
The DMCA also prohibits the construction, possession, and/or use of a device to defeat copyright infringement. In a case where the law contradicts itself, the people with the most money win.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
What's to stop them from changing the protocol now?
The several million people whose copies only support the current one.
This paper was published in 2004, by the VoIP group at Columbia. It reverse-engineers the Skype network with sufficient detail to let one make a serious attempt at firewalling Skype traffic.