Slashdot Mirror

← Back to Stories (view on slashdot.org)

Eavesdropping On Google Voice and Skype

Posted by Soulskill on from the can-i-hear-you-now dept.

Simmons writes with news of research that demonstrated vulnerabilities in Skype and Google Voice that would have allowed attackers to eavesdrop on calls or place unauthorized calls of their own. "The attacks on Google Voice and Skype use different techniques, but essentially they both work because neither service requires a password to access its voicemail system. For the Skype attack to work, the victim would have to be tricked into visiting a malicious Web site within 30 minutes of being logged into Skype. In the Google Voice attack (PDF), the hacker would first need to know the victim's phone number, but Secure Science has devised a way to figure this out using Google Voice's Short Message Service (SMS). Google patched the bugs that enabled Secure Science's attack last week and has now added a password requirement to its voicemail system, the company said in a statement. ... The Skype flaws have not yet been patched, according to James." Reader EricTheGreen contributes related news that eBay may sell Skype back to its original founders.

62 comments

  1. Not nearly as interesting as you'd expect by BadAnalogyGuy · · Score: 4, Interesting

    Unlike security vulnerabilities that gain access to your files and keyboard, this only gets access to your phone calls. This means that the hackers would need a very powerful machine to both monitor and save important calls and a means of automating the scanning of calls.

    It's simply not cost effective to listen in on every call. It's much better to gain file or keyboard access and let Perl scan the logs for interesting data.

    1. Re:Not nearly as interesting as you'd expect by Anonymous Coward · · Score: 5, Funny

      Surely it would be trivial to pipe the calls through some voice recognition software? Then do a text search for 'credit card', 'creedal car', and maybe 'cricket Karl'.

    2. Re:Not nearly as interesting as you'd expect by Jurily · · Score: 2, Insightful

      It's simply not cost effective to listen in on every call.

      It's most likely not every call. Just by those on the List.

    3. Re:Not nearly as interesting as you'd expect by RulerOf · · Score: 3, Interesting

      It's most likely not every call. Just by those on the List.

      Now that you mention it, I actually pay $5 a month for an identical service from a company called Callwave, and their voicemail transcription services aren't 100% unlimited unless you pay for a pretty high tier of service. Ironically, the voicemails that I choose to have the service transcribe for me are actually the ones a thief would want most.

      This kind of attack into a voice portal is nothing new. I sat down with a fellow who owns a business VoIP telephony service and he showed me how he could alter his outgoing caller ID info to get into my voicemail directly from his telephone keypad... which makes it very easy to get into password-less voice portals/mail systems. Their voice portal requires a password, now that I think of it.

      --
      Boot Windows, Linux, and ESX over the network for free.
    4. Re:Not nearly as interesting as you'd expect by Anonymous Coward · · Score: 1, Interesting

      Seriously, though even if your voice recognition software just looked for digits and then passed off segments of conversation that included a long string of digits to a human for further analysis. You'd get a lot of false positives (phone numbers, etc) but you'd at least exclude most casual conversations. If you want to data mine more accurately, just look for exactly 16 digits given over N seconds and make sure they form a valid CC with check digit, etc.

    5. Re:Not nearly as interesting as you'd expect by mattwarden · · Score: 1

      Hello,

      I work for the NSA and we are recruiting for a currently classified project. Could we give you a call?

    6. Re:Not nearly as interesting as you'd expect by s_p_oneil · · Score: 1

      Actually, it's pretty easy for an organization like the NSA to detect which Skype users are logged into which IP without a powerful machine, which lets them listen in on just the Skype users they're interested in. Or they can just scan calls going to/from IP ranges they're interested in (i.e. from the US to North Korea). The hard part is getting all the Skype users to visit the malicious web site.

    7. Re:Not nearly as interesting as you'd expect by bhiestand · · Score: 1

      Seriously, though even if your voice recognition software just looked for digits and then passed off segments of conversation that included a long string of digits to a human for further analysis. You'd get a lot of false positives (phone numbers, etc) but you'd at least exclude most casual conversations. If you want to data mine more accurately, just look for exactly 16 digits given over N seconds and make sure they form a valid CC with check digit, etc.

      And the point of all of this is to get a bunch of silly credit card numbers? You REALLY think this would be a profitable attack? It's not exactly "trivial" to run a huge mass of voice through voice recognition with a high enough accuracy to make this useful. Then after that, you end up with a bunch of credit card numbers, and not necessarily a name or expiration date... when there are already a ton of credit card numbers out there that are never used for fraud.

      No, attacks like this are far more useful for targeted attacks. If you know Senator Kennedy uses Skype, and you know a way to get him to click on a malicious site (perhaps a specific attack on his system and editing the hosts file to force google.com to redirect to your server that mirrors google.com and adds an attack in), then you may have a chance of eventually intercepting some sort of highly valuable information... like a senator making appointments with fetish sex providers, secret gay lovers, etc. Now a digital copy of that kind of conversation could be worth millions... in blackmail or in sales to fox news/hustler/playboy/media outlets.

      --
      SWM seeks new sig for a brief fling
    8. Re:Not nearly as interesting as you'd expect by hesaigo999ca · · Score: 1

      i could still plug any keystroke logger with uneventful data, and still log myself into the bank account I got or plug my cc data online...it all depends on if you force yourself to accept someone is always watching or someone is always logging.

    9. Re:Not nearly as interesting as you'd expect by Anonymous Coward · · Score: 0

      I'd like to add that there is no reason the data needs to be processed immediately. You could just save all the data to a server and process it later at your leisure.

  2. Believe it or not by Landak · · Score: 5, Insightful

    Believe it or not, Skype carries the second largest number of international calls in the world, second only to AT&T. With a volume like that, you'd imagine that any potential vulnerability may well find someone interested in applying it, very quickly. Like, for instance, the NSA...

    --
    My UID is prime. Is yours?
    1. Re:Believe it or not by CRCulver · · Score: 5, Interesting

      Skype has already been accused of having a half-assed approach to security in order to appease government agencies. It's a pity that there's no widely available encrypted voice applications. A decade ago when the nerd community was toying with PGPfone, it seemed like widespread encrypted telephony was right around the corner. Ekiga announced encryption for the 3.0 release, but then quietly buried those plans, and as nice as it is to have easy encryption in Pidgin, the app remains limited to text chat.

    2. Re:Believe it or not by Wowsers · · Score: 4, Insightful

      Luckily* for Linux and Skype users, Skype hasn't been updated in about 2 years, and definitely no 64 bit version. So the vulnerability will be there for who knows how long until Skype (or is it eBay) gets their finger out of their backside and gives Linux/Skype users a better deal.

      * Being sarcastic

      --
      Take Nobody's Word For It.
    3. Re:Believe it or not by jbn-o · · Score: 1

      Ekiga announced encryption for the 3.0 release, but then quietly buried those plans

      On the Ekiga wiki under the heading "Implementation started" one finds "ZRTP (encrypted communication)" suggesting that encryption is being worked on. What exactly were you referring to?

      --
      Digital Citizen
    4. Re:Believe it or not by CRCulver · · Score: 1

      That was intended for 3.0, which was already released months ago.

    5. Re:Believe it or not by Anonymous Coward · · Score: 0

      Skype has already been accused of having a half-assed approach to security in order to appease government agencies. It's a pity that there's no widely available encrypted voice applications. A decade ago when the nerd community was toying with PGPfone, it seemed like widespread encrypted telephony was right around the corner. Ekiga announced encryption for the 3.0 release, but then quietly buried those plans, and as nice as it is to have easy encryption in Pidgin, the app remains limited to text chat.

      zfoneproject.com (PGPFone replacement)

    6. Re:Believe it or not by bit01 · · Score: 1

      Like, for instance, the NSA...

      The NSA doesn't need an opportunistic vulnerability. They just secretly order one put in.

      ---

      Windows and closed source software. The US intelligence agencies back door to every network connected country and business on earth.

    7. Re:Believe it or not by dotancohen · · Score: 1

      Luckily* for Linux and Skype users, Skype hasn't been updated in about 2 years, and definitely no 64 bit version. So the vulnerability will be there for who knows how long until Skype (or is it eBay) gets their finger out of their backside and gives Linux/Skype users a better deal.

      * Being sarcastic

      So Skype could solve this most easily by patching the Windows client and dropping support for the Linux client, no? Be careful what you wish for.

      --
      It is dangerous to be right when the government is wrong.
    8. Re:Believe it or not by Anonymous Coward · · Score: 1, Interesting

      It is possible, though, that the NSA, fearing that Ekiga will become popular for security-conscious VOIP users, is forcing the Ekiga team to not include it at all, but simply keep delaying it, under threats of death or imprisonment.

    9. Re:Believe it or not by xded · · Score: 1

      Parent sounds paranoid?

      1. Read this.
      2. Wonder on Skype diffusion and on lack of encrypted alternatives.
      3. Judge by youself.

      Do you still want to point out that a mircryption chat session is way easier to set up than an encrypted VOIP call? Well, remember that cold war was just yesterday, at least in some politician's heads.

  3. Skype back to the founders? by linhares · · Score: 1, Interesting
    Well, if Skype is going back to the founders, I guess that's good. eBay never did anything really interesting with it anyways. I don't understand why skype let other social networking sites (yes, that's what skype is, and it fosters an even closer-knit community than facebook or others ever will, as people actually _talk_ to others, as opposed to poking them.

    What I would like to see would be a tight integration of skype, facebook, and google contacts. In android phones or in the iPhone our contacts info is all here and there, scattered all around. I'd love to see a contact, then immediately know through facebook what they're up to, then either call, email, or skype, if human contact is desirable or unavoidable. In any case, skype has been held back for years and years, and I hope that it will eventually bring down the phone companies to being what they truly are: dumb pipes providing internet access.

    1. Re:Skype back to the founders? by Bert64 · · Score: 2, Interesting

      Skype would be worse than the phone companies, because it is controlled centrally by a single organization... At least there are multiple phone companies, they follow standards and you can interoperate between them.

      A phone company's monopoly in a particular area is often unavoidable due to the cost of laying physical cables, a monopoly of skype is just completely ridiculous and inexcusable.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    2. Re:Skype back to the founders? by linhares · · Score: 1

      Skype would be worse than the phone companies, because it is controlled centrally by a single organization...

      OMG Skype==evil!!!

      As if any one of their competitors couldn't gain ground whenever they screw up royally.

      Google talk is much more dangerous to your monopoly paranoias than Skype.

    3. Re:Skype back to the founders? by BrokenHalo · · Score: 1

      ...other social networking sites (yes, that's what skype is, and it fosters an even closer-knit community than facebook or others ever will, as people actually _talk_ to others, as opposed to poking them...

      Why the hell did you post that as AC? What you say is entirely true.

      I don't have a Facebook account, but my wife does. The amount of time she spends on it is scary, though she is definitely intelligent enough to know that it is only a substitute for real interaction. Skype, however, is a genuinely useful service (regardless of its shortcomings) because the "social networking" requires a certain amount of cerebral input, rather than a generic off-the-peg poke to say "I still exist, and your name just farted across my synapses for 0.3 nanoseconds".

    4. Re:Skype back to the founders? by MrMarket · · Score: 1

      How does skype have a monopoly? They are not the only company offering voice and video chat.

    5. Re:Skype back to the founders? by RobertM1968 · · Score: 3, Interesting

      In the US, I was not aware there were multiple phone companies. Wow, you learn something new every day. Last I heard, there was "The Bell Companies" (under a plethora of names - yet still really one massive interrelated entity).

      ATT/Bell/Verizon

      Then... there are a bunch of phone service resellers; who sell either access onto Bell's phone network (they dont own their own after all) via their POC routers, or Bell's; followed by VOIP providers who still largely have to have their calls transferred onto the Bell phone network for delivery to the non VOIP caller (ie: VOIP->landline call or landline->VOIP call).

      And even long distance calls via a carrier that has their own lines, still gets transferred to the local lines, computers and telco switches for delivery to the home(s).

      So, as far as I can see, it's VOIP->VOIP that's the only other option to not going through the one telco monopoly in this country.

      --
      StarTrekPhase2 - The Five Year Mission Continues!
    6. Re:Skype back to the founders? by Bert64 · · Score: 3, Insightful

      Google talk interoperates with other services using XMPP - a published standard... I can talk to google users without having to use their service. People can *choose* to use google's servers and accept the inherent risks, or they can choose not to and still communicate with the same people. I choose not to use their service, but i talk to a few google talk users.

      Skype doesn't interoperate with anything, you have to use their service and their client. Once you have sufficient users locked in to the service, using a competitor becomes pointless because everyone you want to talk to is only contactable using skype, at which point they can screw up however they want.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    7. Re:Skype back to the founders? by Bert64 · · Score: 1

      I have heard of those IM clients, and most of them operate on closed proprietary networks, and most of them have strangleholds in various markets tho none has globally... Because none of them interoperate, it becomes necessary to have accounts on all the different services which is just stupid.

      Skype have terrible prices when you compare to some of the SIP providers out there...

      Apple shit only works with apple shit, but so what? You can completely ignore apple (as many people do) and suffer no ill effects... You can buy a non apple phone, download music to it from a non apple music store using a non apple computer and non apple software. You don't even to know that apple exists. Apple are only well known in the US and parts of Europe, in other countries people haven't even heard of them and yet they don't care.
      MS is different, you cannot completely ignore them because sooner or later you will be sent a file in a proprietary ms-only format.

      Apple do not make deals with hardware manufacturers, they make their own hardware and they don't stop you running anything on it. MS actually do worse by preventing you loading linux on the xbox 360 (compare that to sony and the ps3).
      MS have worked to prevent hardware manufacturers selling alternatives, they did it to beos, they did it to netscape, there is documentation about it all over the internet and they were found guilty in court.

      MS do intentionally hurt consumers in many ways not least of all by trying to get them locked in.. Apple may well do the same, but they are small enough that consumers can ignore them.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    8. Re:Skype back to the founders? by Bert64 · · Score: 2, Informative

      There is a world outside of the US...

      You are also thinking of fixed line phones, many people use cellphones for general voice calls these days too.

      Here, i have 5 mobile operators to choose from with their own networks (and multiple resellers) and 2 fixed line providers (as well as countless resellers)... Because fixed lines cost more to roll out (ie a monopoly is pretty much unavoidable), the incumbent suppliers are heavily regulated to avoid gouging consumers.

      If you want competitive voip, try finding a provider that supports SIP... You can call between sip providers for free as it's pure ip, calling non sip lines has a cost imposed by whatever telco they hand off to.

      If you want to call from skype to someone using a different voip service, you're likely to pay termination charges as the call gets routed out via a telco network and back, there is no interoperability with skype.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    9. Re:Skype back to the founders? by Anonymous Coward · · Score: 0

      Name an alternative for Linux Mac calls with video.
      There isn't any.

    10. Re:Skype back to the founders? by RobertM1968 · · Score: 1

      I didnt realize that cell phones talked directly to each other... ;-)

      But yes, I was talking fixed line phones - since the post I was responding to was - (and the general discussion was talking about VOIP calls - which are usually made from some sort of fixed line connection (Internet from someplace, going through a wire or cable)).

      And here, there are a few mobile carriers - they each talk about the wonderful network they use - but yet again, many share the same one(s).

      Regardless, they get routed from cell to tower to... ???... to cell/landline/VOIP phone.

      --
      StarTrekPhase2 - The Five Year Mission Continues!
    11. Re:Skype back to the founders? by RoFLKOPTr · · Score: 1

      (And now to the part that's gonna get me modded Troll....)

      Like clockwork.

    12. Re:Skype back to the founders? by linhares · · Score: 1

      Why the hell did you post that as AC? What you say is entirely true.

      I didn't.

    13. Re:Skype back to the founders? by linhares · · Score: 1

      Once you have sufficient users locked in to the service, using a competitor becomes pointless because everyone you want to talk to is only contactable using skype, at which point they can screw up however they want.

      Network effects are powerful, but ask these guys or even these guys if that's a sure guarantee of "screwing up however they want".

    14. Re:Skype back to the founders? by BrokenHalo · · Score: 1

      Oops. sorry... 8-|

    15. Re:Skype back to the founders? by fractoid · · Score: 1

      I didnt realize that cell phones talked directly to each other... ;-)

      They bloody well should and it's always irked me that they don't. Why talk to a cell tower that's 4km away when I'm phoning someone across the street? And why the hell should I *pay* for it?!

      --
      Rampant carbon sequestration destroyed the Dinosaurs' tropical paradise. I'm here to help repair the damage.
  4. Unsurprising by Alcoholist · · Score: 4, Insightful

    Anyone expecting privacy on these systems is a fool. It's not like either of these companies is regulated in any way, to say nothing of the fact they provide their services over the Internet which you only have read /. for a day to know is not secure.

    --
    Bibo Ergo Sum.
    1. Re:Unsurprising by Anonymous Coward · · Score: 2, Insightful

      Anyone expecting privacy on these systems is a fool.

      Maybe, but not for the reasons you give. You just have to look at AT&T to realize that regulation doesn't give you privacy. And providing a service over the Internet doesn't automatically makes it not secure. Security is a layer that you add if you want it, see SSL for an example.

    2. Re:Unsurprising by Samschnooks · · Score: 5, Funny

      Anyone expecting privacy on these systems is a fool. It's not like either of these companies is regulated in any way, to say nothing of the fact they provide their services over the Internet which you only have read /. for a day to know is not secure.

      Exactly. The same goes for traditional cell service. Why just the other day, I was in the grocery store and someone was yacking away about some big business deal in the bread isle. I sat there "shopping" while this guy was talking about financing, etc, etc, etc...

      Then, I moved over to the soda isle, this young chicky apparently was having boyfriend troubles and I offered to help but she got all indignant and looks at me like I was a perv or something.

      Then, over in the fish isle, this middle aged guy was trying to figure out if he should get the Salmon or the Trout and asking his wife, I think, which should he get. I told him the Trout. Great stuff. Again the funny looks! I don't get it?

      The bread isle, this person was pushing their cart talking away and I answered - god I hate those blue tooths! Same thing - weird looks!

      I won't tell you about the guy on the street talking really loudly but without and Bluetooth or Cell - he asked me for money.

      What was this again about privacy and phone calls? I forgot what we're talking about.

    3. Re:Unsurprising by tukang · · Score: 1
      It's not like either of these companies is regulated in any way

      Considering that the gov't does most of the spying, I don't think that using a regulated company's service will necessarily give you more privacy. In fact, I expect that the gov't has a harder time spying on skype/google conversations than they do regular phone lines.

    4. Re:Unsurprising by Anonymous Coward · · Score: 2, Insightful

      In a used book store, perhaps 8 years ago, I held a conversation with the gentleman next to me for 5 minutes. Then he walked away and kept talking on his phone.

      People who talk on cell phones while being checked out are rude. The cashier is a person and deserves the currtacy of your attention over anyone on a phone conversation.

      Using a cell phone in public is rude.

      Texting/emailing while anyone is talking to you is rude unless they are dictating the contents of the message.

      I'm guilty of talking and emailing when I should be carefully listening to another person.

    5. Re:Unsurprising by BrokenHalo · · Score: 2, Informative

      I'm guilty of talking and emailing when I should be carefully listening to another person.

      So am I from time to time, though I usually prefer to let the phone just ring out. The person to whom you're talking is left with a much more favourable impression, and voicemail does the rest.

    6. Re:Unsurprising by mattwarden · · Score: 3, Insightful

      > Anyone expecting privacy on these systems is a fool. It's not like either of
      > these companies is regulated in any way

      Amen. As we know, telephone companies that area regulated would never compromise their users' privacy.

      Oops!

    7. Re:Unsurprising by mattwarden · · Score: 1, Funny

      > Then, over in the fish isle

      People like you are why I never shop on the islands.

    8. Re:Unsurprising by Anonymous Coward · · Score: 0

      For the Skype attack to work, the victim would have to be tricked into visiting a malicious Web site within 30 minutes of being logged into Skype.

      This is the only compromising loss of privacy here, which is barely a vulnerability let alone an attack. The only difference between this one and hitting one of those sites while surfing, which even if you're trying to can still be fruitless, is that it has to be done within 30 minutes of logging into Skype for it to work.

      Settle down with the hyperbole.

  5. Re:Whoa! by linhares · · Score: 1

    Your karma must be improving, grasshopper.

  6. Nerdy solution by Wowsers · · Score: 4, Funny

    For a minute there I thought there was a problem, but nerds have no friends so nobody calls you on Skype anyway.

    --
    Take Nobody's Word For It.
    1. Re:Nerdy solution by Anonymous Coward · · Score: 1, Funny

      Man, it's a sad day when even your mom doesn't dare enter her own basement to tell you that lunch is ready.

  7. bots by Anonymous Coward · · Score: 0

    This means that the hackers would need a very powerful machine to both monitor and save important calls and a means of automating the scanning of calls.

    You mean like an army of bots?

  8. Cloud apps improve security by Alascom · · Score: 5, Insightful

    Once again, we see that cloud apps like Google's Grandcentral have a real benefit to security, despite the sensationalist scare mongering.

    When a bug in a cloud based application is identified, it can be patched quickly, in a single location, and the bug disappears. The same cannot be said of locally installed apps (exchange servers, etc) that take years for companies and administrators to eventually get the patches installed.

    1. Re:Cloud apps improve security by StreetStealth · · Score: 1

      And conversely, a locally-installed, open-source application can be patched on-site or by a collaboration between many users while cloud users are at the mercy of their provider.

      Not that there's anything that really fits this definition for secure VOIP, but just sayin'.

      --
      Your mind is clear / The things that you fear / Will fade with how much you / Believe what you hear
    2. Re:Cloud apps improve security by whoop · · Score: 1

      So, you're saying that Open Source apps have to wait for someone to fix it, meanwhile cloudies have to wait for someone to fix it? Ah, I see. Don't trust the man!

    3. Re:Cloud apps improve security by dotancohen · · Score: 1

      And Skype is the counterexample where if the company sits there and does nothing, the consumer is powerless to improve the situation. If the source code were out in the open, a large user base would devise a solution of it's own.

      --
      It is dangerous to be right when the government is wrong.
  9. Increasingly I look for p2p communications by CranberryKing · · Score: 1
    for everything. E-mail is insecure. Service-based VoIP is insecure. Video conferencing via google or skype is going to be insecure since it disappears somewhere in a google/skype cloud.

    Can't you do full video/voice conference, p2p with VideoLAN?

  10. Oh Okay by Anonymous Coward · · Score: 0

    For the Skype attack to work, the victim would have to be tricked into visiting a malicious Web site within 30 minutes of being logged into Skype. In the Google Voice attack (PDF), the hacker would first need to know the victim's phone number, but Secure Science has devised a way to figure this out using Google Voice's Short Message Service (SMS). Google patched the bugs that enabled Secure Science's attack last week and has now added a password requirement to its voicemail system

    I was half-interested for a second there.

  11. spoofable voicemail carriers by SirGeeksAlot · · Score: 1

    You think google voice or skype are bad, go find someone with a youmail or a phonetag account. Spoof the callerID and dial into their voicemail access number. No pin required.

  12. deja vu by ascari · · Score: 1

    Sounds like the cyberspace equivalent of a handset and a couple of alligator clips. Solution: Just don't talk about sensitive stuff over the phone.