Slashdot Mirror
More Skype Back Door Speculation
An anonymous reader writes "According to reports, there may be a back door built into Skype, which allows connections to be bugged. The company has declined to expressly deny the allegations. At a meeting with representatives of ISPs and the Austrian regulator on lawful interception of IP based services held on 25th June, high-ranking officials at the Austrian interior ministry revealed that it is not a problem for them to listen in on Skype conversations."
I don't use Skype (or VoIP for that matter) but I would be curious if anyone knows of any alternatives that is completely open.
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
Has anyone made attempts at decoding the SKYPE protocol. This would take some clever reverse engineering of the code and some clever wire sniffing.
I wonder if it would be possible to inject an encryption layer underneath what their service provides.
On a legal note, in the US, could consumers who purchased SKYPE products sue SKYPE.
Chances are pretty good that if this backdoor exists, it has for a long time.
Unless you think it's a good thing that some people can snoop on others conversations, this should be a really good reason to embrace free software.
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
So you mean the times we spent talking about CP and Terrorism were bugged?
Ah, shit.
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
There are quite a number of alternatives based on the open SIP protocol. Have a look at the list: http://www.voip-info.org/wiki-Open+Source+VOIP+Software
I know it's tedious work, but some people actually seem to like it. Isn't it time that people disassemble these suspected binaries in order to issue a report on the matter? Not only on Skype, but on many other suspected programs, libraries and operating systems?
Lets find out...
/. audience that wants to bed Skype and see if it's a back door kind of program?
Do I have a volunteer from the
With closed source and closed protocol specifications there is no way to disprove the claim of an existing backdoor. Regardless of wether there really exist a backdoor or not. Simple but true and it is the drawback of wanting to provide security in a closed source environment.
All you have to know to monitor someone's Skype is their password. Login with Skype on another machine, set status to invisible. Anything they type or receive in chat you receive.
1. For IM: Jabber (non-US server) + OTR Plugin + Tor. ... and we don't do waterboarding here) (I hope)
2. For everything else (email/vpn/storage) services as provided by www.xerobank.com will do you good.
3. TrueCrypt Full Drive Encryption. (Check your local laws - under Dutch law they cannot force me to give up the passwords
You can be sure that these people are also trying to:
You can be equally certain that they are not doing it right and that the backdoors they are trying to put in make your system less secure.
Running open source software is your best bet, but even there, you aren't completely protected.
Assume all communication that uses any kind of monitorable infrastructure is bugged. The capacity is there, and the desire is there.
It is the way of things.
-- http://frobnosticate.com
This is going to be a problem with any so called "secure" communication system that relies on source secret clients and unpublished protocols.
There are many ways to build such clients to "assist" external intercept, since they often have to first communicate with some central server to locate users. They could for example have a command that forces the client to always route back through the server (like they do for NAT), and use a simple data transformation rather than full encryption so casual packing snooping makes it "appear" encrypted when it is actually not.
They might also have flaws in their implimentation, particularly with key exchange, that allows an invisible man in the middle. The ZRTP stuff developed by Phil Zimmerman that we use in GNU Telephony secure calling uses extra steps to compute a sas to validate there are not fake public session keys given out by a man in the middle, for one example of how such flaws can effect otherwise "secure in appearence" systems.
Of course, even secure peer-reviewed protocols and foss clients do not gaurantee security. For example, one can tether a bunch of ZRTP softphones to an Asterisk server using PBX enrollment, but this enables and requires said server to decrypt all traffic as it passes through, as it acts as a "trusted" man-in-the-middle.
In the end, the best solution, even with ZRTP, remains using pure peer-to-peer (end-to-end) media connections, and when needed transparent proxy media exchange; the latter for dealing with NAT. In ZRTP, sas negotiation assures any such proxy used for NAT "remains" transparent.
In the case of Skype, source secret clients that can report false call information and source secret protocols are a clear recipe for disaster.
"i always hate the people who mix up the austrian kangaroo with the australian schnitzel"
Speaking as an Aussie there are lots of locals who still manage to confuse "The sound of music" with Guy Sebastian.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
Asterisk+SIP+Ekiga is not a good replacement for Skype:
Add to this that Skype has existed for a large number of years (5 years is "long" in "internet time") and it's not exactly known as a big medium for spreading viruses, hack attacks, etc. and you'll realize that security through obscurity actually can work. Of course, past trends are not indication of future behaviour, but you can't argue with results.
-- Sig down
If you go to the options of the Skype client under the 'Chat Appearance' settings, do have a look at the sample chat displayed. I quote:
-Does Big Brother exist?
-of course he exists. The Party exists. Big Brother is the embodiment of the party
-Does he exist in the same way as I exist?
-You do not exist
-I think I exist. I am conscious of my own identity. I was born and I shall die. I have arms and legs. I occupy a particular point in space. No other solid object can occupy the same point simultaneously. In that sense, does Big Brother exist?
-It is of no importance. He exists.
To me this is quite conclusive.
I think what people are worrying about is not the risk of being individually targeted for lawful interception, but the risk of blanket mass interception of all calls worldwide, using automated keyword matching implemented extremely efficiently on extraordinarily vast numbers (100s millions, money no object, power 20MW+) of dedicated chips, not general purpose CPUs, that fill no more than 4.5 acres of warehousing underground consuming c.5MW surprisingly.
What keeps me with Skype is that I can have US telephone number. So no matter where I am my friends and family can call me.
If there was another service which allowed me to have a US telephone number for incoming calls and let me call any other POTS number I'd use it.
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
Therefore, if the Chinese have no problem with Skype, Skype must have a back door.
Try OpenWengo. It works as well as Skype. It is encrypted with the "NG release", available now. The download page says "secure PC-to-PC calls". See this discussion about encryption. It's Open Source. Linux, Mac, and Windows.