Slashdot Mirror
Skype Protocol Has Been Reverse Engineered
An anonymous reader writes "One researcher has decided he wants to make Skype open source by reverse engineering the protocol the service uses. In fact, he claims to have already achieved that feat on a new skype-open-source blog. The source code has been posted for versions 1.x/3.x/4.x of Skype as well as details of the rc4 layer arithmetic encoding the service uses. While his intention may be to recreate Skype as an open source platform, it is doubtful he will get very far without facing an army of Microsoft lawyers. Skype is not an open platform, and Microsoft will want to keep it that way."
And yet we have several programs that can read/write to Office files. It seems the same could be done with MS Skype - call it OpenSkype or LibreSkype.
The only problem is the potential to be sued for theft-of-service (making calls w/o paying).
Information wants to be expensive AND wants to be free. So you have Value vs. Cheap distribution fighting each other.
Just because the protocol is reverse engineered doesn't make it open. I would rather see an open standard become supported or used by Skype/Microsoft.
Let's play video games with mailmanZERO
This is a perfect example of how little effort it takes to develop something like this and how easily a community could maintain it for the world to use but companies have to protect their billions
Facetime has much better video quality for low-bandwidth connections, and there is no Window's application for it. That would be a better target.
Microsoft did not threaten any Kinect hackers when they reversed that protocol...
This could be the Skype killer we have been wishing for. It doesn't have to work with Skype, it just has to be as good as Skype and to be open. Imagine people being able to set up their own private Skype-like servers for personal and business use... even for home-monitoring uses and more. Skype will undoubtedly kill support for Linux and probably restrict access in a variety of ways. While being able to access Skype servers and services would be desirable, I wouldn't expect that to be allowed to work and would end up as the arms race we saw previously in instant messaging. (One that I think was ultimately lost or abandoned by those trying to fight 3rd party clients.) But if a truly free and open Skype-like set of clients and servers were made available, a lot of useful things can occur.
It's protected. Lawyers may bark, and pound a table or two, but ultimately, they'll fail.
Sec. 103(f) of the DMCA (17 U.S.C. 1201 (f)) says that if you legally obtain a program that is protected, you are allowed to reverse-engineer and circumvent the protection to achieve the ability the interoperability of computer programs
The remaining question to ask is what’s the point of doing this reverse engineering? Skype is a free-to-use service for the most part. You do pay for non Skype-to-Skype calls, and have to use the official software, but is that really enough to make users desire an alternative?
Yes.
sysadmins and parents of newborns get the same amount of sleep.
Here's the torrent if it gets taken down. http://thepiratebay.org/torrent/6442887
No. You do realize most encryption algorithms are published for all to see, right? Unless Skype is doing something very stupid in the key exchange, it's just as secure as before.
Live today, because you never know what tomorrow brings
To me it seems MS will simply follow their standard procedure of "Embrace (purchase and/or adopt a standard), Extend (introduce incompatibilities), and thereby Extinguish." to thwart any sort of open source implementations.
Similar to their Zune device, which has embraced a standard USB interface and media protocol, but has been extended with a DRM challenge & response system to extinguish the possibility of any software but Microsoft's being used with the Zune.
IMHO, since Skype is actually a distributed Peer to Peer system (where some peers are used as relays or to coordinate NAT traversal for other peers), why not simply ditch Skype and create our own low cost system? Some type of PGP like system can be used to implement a distributed authentication/registration system, and perhaps Asterisk could be in our own homes (w/ landlines) to provide outgoing phone calls. Recent laws have made me wary of allowing others to out-dial from my node (to a select group of local area codes), but it is a type of solution that that we used in the BBS days...
Please stop calling every single person who is tinkering with code a 'researcher'...
Researcher: One who conducts research.
Did he conduct research? Yes.
Then he is a researcher.
The real question is does the "offender" has the financial resource to defend it. Large corporations have very deep pocket and army of lawyers. Does (s)he?
ELOI, ELOI, LAMA SABACHTHANI!?
Reverse engineering is an absolute necessity for compatibility, and compatibility is often an absolute necessity for success. Being the best product often isn't enough.
This is my signature. There are many like it, but this one is mine.
I would like to see a Pidgin plugin for Skype!
Emerson was the first one to popularize the myth that if one were to "Build a better mousetrap, and the world will beat a path to your door", and yes for the pedants out there I realize this is a misquotation of what Emerson really said, but the juice of it is a maxim that many individuals use to understand the process of innovation. Unfortunately, when observed through the lens of history, the maxim does not hold water.
The truth about innovation is that it occurs when the right mix of entities are brought together in a way that has never been done before to create a distinct advantage in the market. To illustrate this point, look at what Henry Ford did with the Model-T and how he altered the landscape of factories throughout the world. He didn't invent new technologies, he took technologies being utilized in other industries and adapted them for his needs. Thereby allowing for a streamlined factory where metal came in one end, and completed cars came out the other end. There are many entities involved in innovation and I've merely down a fly-over of what Henry Ford did, but I think it helps to illustrate the point that I was making at the beginning ... Being the best product is never enough.
History repeats itself
I'm positive, don't belive me look at my karma
Fine, don't like jitsi? No problem. The DIFFERENCE is that Alice can run Jitsi and Bob can use Asterisk (which can interface with a normal phone), Ekiga, Empathy, LinPhone, Twinkle, SipDroid (on an Android machine), or any other of about 1000 programs to talk to Alice, without her having to give a damn what version of what software Bob is using. Contrast that with Skype where Alice can run Skype and Bob can run, well, Skype...
You mean SIP? The idea of reverse-engineering Skype is so we can make software that works with multiple protocols. It used to be that if you had friends on ICQ, MSN, Yahoo, SIP and Jabber, you had to run 4 different programs. Now you can use pidgin, empathy, BitlBee, etc to connect to all of them seamlessly as one. If we can get Skype's protocol added to that list, we can dump yet another stupid "this app only talks on one protocol" application.
The third zipfile contains no less than 443,000 lines of code (not counting a number of duplicates under _old), including ports to Virtual C++, Borland C and Gcc under Unix, different versions of the protocol parser, and so on. The few bits I've looked at are written competently and with confidence, there's none of the "this byte is 42 in all messages, I don't know why" that you'd expect in reverse-engineered code.
It's either a leak of Skype's code, or a decompilation; it's certainly not a reimplementation. --jch
Every communication between you and a server is legally your property. You can peek, squeeze, record, play, read, study, understand it, etc. It's yours, comes and go from your machine and is open for being observed by any sniffer you want to use. It would be illegal if you crack the binaries, or hack into another one's communication. That's it.
For the rest, you can just read the reverse engineered specs... either this year's, or the details published in 2006.
you had me at #!
One thing that making this protocol public is doing is allowing government agencies to more easily wiretap skype videos. I've interviewed at companies working on that very type of tool. Of course, the real security should be the encryption itself. However, without the platform itself being open source, only Microsoft will be able to make improvements to this encryption, if it is lacking.
the entire point of them buying Skype was so that they could embed a Skype client into windows phone to use to make calls to windows desktop Skype users and vice-versa... to use the large user base to lock it in to windows only... the Mac and Linux Skype clients would be deliberately kept way behind in features in order to discourage use.
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
Emerson was the first one to popularize the myth that if one were to "Build a better mousetrap, and the world will beat a path to your door", and yes for the pedants out there I realize this is a misquotation of what Emerson really said, but the juice of it is a maxim that many individuals use to understand the process of innovation. Unfortunately, when observed through the lens of history, the maxim does not hold water.
Well, a better mousetrap (or, for that matter, a better myth) need not hold water as long as it can reliably hold mice.
If there's a distinction to be made, it is the part where mice do not suffer (or should I say benefit?) from network effects. If a better mousetrap does a better job of catching my mice, that's all I care about, and so the only friction for the transition to the new mousetrap is how much it costs me in money, time, and effort.
The Skype problem is not like that at all. It's a significantly more difficult problem than, say, making a better OSS browser, email client, or even an entire operating system, because all of those experience network effects to a lesser degree than audiovisual communication. In some cases this is just because of the nature of the product and its intended uses, and in other cases it is because of widely used standards like TCP/IP, POP, SMTP, IMAP.
What of SIP? The problem with SIP, of course, is that SIP, as a protocol around which operators have built a business model, does not do what Skype does. Interoperability between subscribers of rival SIP operators is not free; presence is not usually supported, and there is no method for peer discovery between separate SIP switches. Calling between such subscribers is usually conducted, not directly, but through the PSTN (or is treated, and billed, as if it is, even if the two operators terminate calls between themselves directly, so to the end user, it's all the same.)
Skype is like one big SIP operator that connects to the PSTN. It's walled off from any other IM providers, or from any populations not using the official Skype client, servers, and protocols, but that's the value in it-- nobody has been able yet to drive a wedge between the Skype app and the Skype service (as was long ago done with ICQ) or to allow for separate groups or individuals to establish their own, separate workalike system (as is done with Jabber/Jingle or SIP).
Skype has value because of how open it isn't, because being as open as these other systems ultimately reduced network effects and reduced the influence the owner of the application has over the operation of the network.
An unofficial, Skype-compatible client that can't be influenced by Microsoft or kept off the network will start the ICQ process in motion, and prevent Microsoft from monetizing Skype the way ICQ first did, by inserting advertising content in the way of free functionality by direct control over the client software.
An unofficial, Skype-compatible server that isn't administrated by Microsoft will start the Jabber/SIP process in motion, dividing the Skype population and making the whole worth less than the sum of its parts, rather like the situation now with SIP operators-- all of which act a lot more like traditional telcos than Skype does, for what that's worth.
The degree to which one or both of those things reduces the value that Microsoft can get from Skype is not directly proportional to the degree to whcih they can help build value for anyone else, either the makers of those alternatives, or the users of them. I'd say there's a nonzero chance of those things eliminating all value in Skype for all players unless standards-based interoperability, at least as good as what exists today on the PSTN (and hopefully a good deal better) becomes widespread. It's difficult to see how that evolves from the current situation without regulatory oversight; nearly all market forces are actively working against it.
When people dialed in on our conference call systems with Skype, they most of the times sounded too unclear to be properly understood, which slowed down the groups in the meetings. So we had to ban it.
I use for example voipbuster, about EUR 40 per year for free calls to almost any number in the world that I might want to ever call, and it comes with a phone number too. Sound quality is just as good as any land line.
I just needed to get this out of my system.
The point is to develop the ability for users of Jitsi, Asterisk, Ekiga, Empathy, etc., etc. to talk with Skype users, while still also being able to talk with all the users of SIP programs, much in the way that we have IM programs that can communicate with IM users over various different protocols. Then Alice doesn't need to run two different programs to talk with both Skype and SIP users.
Unfortunately it's not Oh-Kay considering the U.S. Patent Law. Of course, the question is if implementations will be made by people in the U.S. and if Microsoft hodls any patents at all related to the protocol.
Why hasn't Jeremy Allison been sued yet by Microsoft/IBM?
Sanity.html - Error 404 not found
I think this is the point where I suggest that you have a laughably small number of friends.
Seriously, if you have any significant number of friends of a non-techie pursuasion (or otherwise, but with more pressing preoccupations than obscure choices of VOIP clients), insisting that everybody uses stinkyfinger to contact you is an easy path to a lonely life.
I consider myself to be reasonably tech-savvy, having worked as a sysprog in the aerospace industry (among others) since the 1970s, and I am not ashamed to say that Skype, despite its drawbacks offers a good enough VOIP/IM client for most purposes. And I don't need to behave like an asswipe with my friends to pursuade them to use it.
They can yell at lawyers all the way they want, but they can't do much.
The inner workings of Skype can only be protected by software patents.
As long as the theoretical "libreSkype" is developed and hosted from within a country that doesn't recognise software patents, there are no problem.
(And given the comments on this blogs, seems like there are several Russians working on this. And currently Russia doesn't recognise software patents).
As long as no product based on libreSkype is sold in the US, and as long as distributions only offer Skype support as a end-user downloadable after-market plug-in (as currently with MP3, etc.), nobody is going to get sued.
Microsoft is hopeless in this situation.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Truth be told, your technical analysis is above my pay grade. I don't say that to dismiss your point, but just to say I won't comment on the specifics of the skype protocol and what it offers for the internet. With that said, I believe you've missed the forest for the trees in my comment. I was merely taking the position that innovation is driven by networks of people, not superior technology. The position that I illustrated was not born from any research I did, but the research done by a professor at the UC Davis Graduate School of Management. I saw him speak on this very topic and he had a very compelling argument for the conclusions he reached during this speech.
Andrew Hargadon
His Book
And I am soon to be a student at UC Davis, GSM. I don't bring this up to toot my own horn (and it's only a very good business school not an elite one), but rather to say that there's a possibility that I may have begun drinking the kool aid :)
Efim Bushmanov is full of priase for Skype in a long interview. http://www.eweekeurope.co.uk/interview/russian-reverse-engineer-praises-skype-30956 He says all good products will not be able to stay in the closet for long, and hopes to see a full open source implementation for Skype soon. Peter Judge eWEEK Europe
Apparently not a lot of people bothered, although many were quick to repost the story under headlines like “Skype protocol reverse-engineered, source code published”. tl;dr: An important step on a long way is made, but it's going to take years until an alternative Skype client becomes reality.
Bushmanov based his work on de-obfuscated binaries of old versions of Skype for Windows which some other hackers had produced before (the first archive). He used IDA Pro to analyze the code (the second archive contains IDA databases) and gain understanding of some aspects of the protocol, which has layers of encryption and obfuscation. He also patched the binaries to add some logging. Basing on his findings, we wrote a program that can connect to a given [super]node and send an instant message for a given user. The third published archive contains a bunch of MS Visual Studio projects representing his progressive advancement.
To actually connect and send a message, the program needs so-called credentials. It seems to be a sort of session key issued by Skype login servers for 30 days or every time the user enters the password. Sean O'Neil wrote a hack in July 2009 that could connect to a login server and register a new user or log in as an existing one, procuring credentials. Since 2009 this has stopped working, probably because of changes on the server side. So instead Bushmanov used a hack to obtain credentials from running Skype for Windows.
To summarize: Bushmanov built upon prior work in the field and made an important step. There are hundreds of steps like that to be made until an alternative Skype client is possible. Microsoft has plenty of time to react, whatever strategy they choose.
One more thing: when Skype says they're going to do their best to defeat reverse-engineering attempts because the results can be used by spammers, they're lying. It's already possible to use Skype for spamming by automating it. What they're going to fight for is their business model, which relies upon there not being any alternative clients.