Slashdot Mirror
Russian FSB Can Reportedly Tap Skype Calls
An anonymous reader writes "Previous reports of a Microsoft provided backdoor to Skype has been unconfirmed. However, there are now reports that Russian federal security service FSB is able to tap call and locate users. 'FSB and the Internal Affairs Ministry (MVD) have been capable to wiretap and locate Skype users for some years already, reported Vedomosti on Thursday [Google translation of Russian original]. The newspaper is citing experts on information security. "Special services have been capable for several years not only to wiretap but also to locate a Skype user. That's why, for instance, employees of our company are forbidden to discuss business-related topics on Skype," General Director of Group-IB, Ilya Sachkov, says to Vedomosti. "After Microsoft acquired Skype in May 2011, it updated the software with technology allowing legitimate wiretapping," says Maksim Emm, Director of Peak Systems.'"
The Skype P2P protocol has always been an issue to worry about. It's hard to break/understand, and I've seen research papers that just scratched the surface of the protocol.
I never doubted that really smart minds (like Russians) would eventually crack it and exploit it. This would never happen with an open-source protocol.
And therein we learn the lesson about closed source software and proprietary methods. If folk had adopted something based on SIP, XMPP, IAX or any other open and documented protocol, we'd be able to communicate using a tried and tested security mechanism.
For something like communications, if you're totally and absolutely reliant upon a third party then you also need to have total and absolute trust in that third party or you should consider all your communications using them to be public.
Closed source software with obscure network protocol, now owned by a corporation whose main concern isn't the users' best interest, turns out to be not so nice after all. News at 10...
The best way to do use Skype for anything more important than saying hello to your grandmother for free on the internet is not to use Skype. Everybody with half a brain has known that for many years.Duh...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
shouldn't be too hard to trace all packets coming out of an ISP's network in Russia and decode them? or at least decode enough packets for part of a call
and how many fiber connections go into russia from foreign countries? for all we know the FSB has tapped them all and is reading all the data
the NSA was doing something like this a decade ago with Narus appliances
Oh yeah, because Russia today is so much more desirable and has completely stopped all its spying activities.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Am I the only one who mentally interpreted the headline as: "Russian Front Side Bus Can Reportedly Tap Skype Calls"?
Soviet Union was disbanded in the 90's
And????
Russia still remains. The KGB is now the FSB. Russia is more open, but it's still not the USA.
And speaking of the USA, you do realize that Project Echelon and similar efforts have been busily tapping into communications in the Land of the Free for longer than there was a Skype?
Would save a lot of trouble.
Watch this Heartland Institute video
You speak of the US as if they wouldn't do exactly the same thing (and almost certainly are). This is why there should be an open implementation that supports proper security.
Why would someone with something to hide use Skype?
Seriously - if you've got something to hide, use something to which you have the source and can control the encryption used.
Special services have been capable for several years not only to wiretap but also to locate a Skype user.
Special services have been capable for several years not only to wiretap but also to locate cellular phone and landline users.
Everything I write is lies, read between the lines.
Jitsi provides ZRTP encrypted voice chat. It's free, open source, and cross platform. Why use Skype?
Give me Classic Slashdot or give me death!
http://en.wikipedia.org/wiki/Secure_Real-time_Transport_Protocol
Nothing confirms a story like an official denial.
“He’s not deformed, he’s just drunk!”
... and I'll throw this out there as well.
"The greatest trick the Devil ever pulled was convincing the world he didn't exist." -- Keyser Soze
Have gnu, will travel.
In Soviet Russia, American grammar... does not apply. Or something like that.
c++;
This is a report in a newspaper citing unspecified sources. Moreover, it is in FSB's interest to have people believe that they are more capable/powerful then they really are. A large grain of salt is definitely in order.
The denial is strong in this one.
People do use Skype for business reasons. Skype sells products for business reasons. I use Skype for business reasons (but my business is basically public knowledge anyway, so no need to steal it). Does the business version come without the back door? Didn't think so.
One of the major sticking points with ECHELON for many was not that it was used to spy on middle school gossip, but that it was used to pass corporate intelligence to favoured "partners of the state".
It's only a matter of time before the back door itself becomes one of those pieces of intelligence as well.
This is why the anti-trust watchdogs have backed off in the US -- MS agreed to build in backdoors for spying in its OS.
I had suspected it, but proof was hard to come by.
I predict antitrust problems for Google Chrome/Android products in a few years.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
As an American I'm less bothered about the FSB doing it that than the NSA. Seriously, for my personal stuff, what does the FSB care? I'm much more concerned about the NSA (and if it can be done, I'm sure they are). For similar reasons I use Kaspersky on my personal computers. The FSB doesn't care about my bank account or the web sites I visit. The NSA/CIA/FBI maybe another story. Not that I'm terribly interesting, but having once looked at a web site that was slightly to the left of the Democratic party, I'm probably on some automated terrorist watchlist somewhere.
How could we guarantee no spying or eavesdropping via Skype? I think some sort of scrambling/de-scrambling/encryption program that sits at both ends of the Skype connection would do the trick. I'm surprised nothing like this already exists.
640YB ought to be enough for anybody.
That the whole point of microsoft centralizing the skype servers after they bought it was to allow gov't taps.
Nobody can possibly be this ignorant. Are you a paid government troll by any chance?
Project echelon has been widely reported on by a number of mainstream news sources. Do you think CBS news qualifies as a bastion of "tinfoil hattery"?
http://www.cbsnews.com/8301-18560_162-164651.html
The Church committee hearings in the late 1970s revealed extensive details about the multi-decade long MK Ultra program, including a trove of 20,000 related documents. Do Congressional hearings not count as "official reports"? It was also revealed that thousands of other documents related to the program had been destroyed.
Are you so brainwashed on the government Kool Aid that you can't even exercise your critical thinking skills and make a cursory examination of widely available and mostly undisputed evidence?
If you're so naive as to believe the absurdities published in official government reports, go stick your nose up a bureaucrat's ass. I'm sure it will smell like a rose garden to you.
Even more reason not to use Skype. Use an open source app like Jitsi. It does the same thing as Skype but is open source.
"And speaking of the USA, you do realize that Project Echelon and similar efforts have been busily tapping into communications in the Land of the Free for longer than there was a Skype?"
I browse on +1 so AC's need not respond, I won't see it.
Is this supposed to be a big surprise or big deal? It's not to anyone who knows about information security.
if there is an audible clicking noise when they intercept a call in progress...
"The greatest trick the Devil ever pulled was convincing the world he didn't exist." -- Keyser Soze
Damn that Keyser Soze, it's obviously him we have to thank for that bloody phrase. Always, the mind of man seeks to dominate and enslave through whatever means possible.
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
The strength of session keys does not matter. Forget difficulty of proprietary protocol reverse engineering, it is child's play.
Key negotiation is where the gold is, and there is only one real security wall that exists today among symmetric security systems: the Public Key Infrastructures with their strong prime factorization wall.
There are no other walls, only hurdles.
If someone were to pass along one little flash drive with the Certificate Authority chain signing and actual operating SSL private keys to NSA, FSB, whomever, Skype security becomes invisible. Same goes for the private keys for Google, others' SSL certs used for webmail/simap/spop3.
And I'm not talking about some dramatic ninja mission impossible burglary either. Suppose Skype, Google, et cetera were merely threatened with something awful, unthinkable --- unless they comply and hand over the keys. Once they do the pressure is off and everyone can go back to pretending everything is secure. And there are no direct corporate liabilities.
Ain't no free security lunch. Only true security that could ever exist is point-to-point between trusting individuals who have exchanged keys in person.
<blink>down the rabbit hole</blink>
Feb 10th 2013's yer last post. Took ya that long to "eat yer words" http://it.slashdot.org/comments.pl?sid=3417867&cid=42756893 eh, after this here http://slashdot.org/comments.pl?sid=3427183&cid=42849825 ? Hahahaha.
Hi there, clue-free stalking APK chatbot! Pleased to see you're back in action.
You do have an interesting obsession though. You spend a lot of effort and try very hard indeed to prove that people 'eat their words' when arguing with you.
You'll never prove anyone a 'beaten opponent', because you cannot rebut a logical argument. Your opponents soon realise there's no value in debating with fools - especially those that mindlessly post lists by way of argument - and move on to more interesting things. To my great amusement, you seem to deal with this differently, instead hanging on to the issue like a little stone baby stuck somewhere deep inside your vagina.
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
Thanks for illustrating my point for me. :-)
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
It also means the FSB has access to the largest porn collection in the world, and they aren't sharing.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Hahhahahahahahaa keep making my argument for me, you sad old manchild.
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
Blah blah blah, obvious APK post is obvious, blah blah blah.
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
Skype is an eavesdropping service. Im sure all users of it should know that. So what if the FSB can listen in. The bigger news is that Microsoft is tapping all your Skype calls... all the time. The encryption option has nothing to do with Microsofts ability to record everything. And why shouldnt they? Its a great way to build a valuable database of our most private moments. Skype is not regulated by telephone privacy protections laws the way a regular phone provider is. This is why some countries in the EU are trying to force Skype to register as a telephone service... to protect the people (somewhat). Clearly, if your using skype and assuming that there is any level of privacy like you get from regular telephones... you have not read the EULA and terms of service. Or not even bothered to read about the company on wikipedia.
Like jingle or SIP with encyption and it's wide adoption. Not that it's happening anytime soon, but a man can dream...
Jingle and SIP with encryption is called ZRTP (it's just adding an encryption layer over the usual RTP channels used for voice/video chat). And is already supported in several software out-of-the-box (like Jitsi which if often talked about here. But also Twinkle, and others).
For message, you have Off-The-Record, which works above almost any messaging channel. It's also supported by serveral software package out-of-the-box (Jitsi again, or Adium) or with a plugin (Pidgin).
These are technologies which exist RIGHT NOW, that you can START USING TODAY, and using your EXISTING XMPP and SIP accounts.
(Well, for obvious reason ZRTP is useless with SIP-to-PTSN gateways as the encryption last only to the gateway, not to the end-point.
And ZRTP is useless with Facebook's XMPP gateway, as they don't support Jingle video/voice chat, but use a Skype plugin instead. But you can still use OTR: both endpoint will be able to chat to each other, while the thing which ends in facebooks servers looks like encrypter crap.
But for anything else it's already doable).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Micro$soft may be providing backdoors now but prior? No way. This is FUD by the Russians.
That's not FUD. Skype's EULA has been clear about it since even before being acquired by Microsoft.
(Or at least it was back when I looked at it)
They will comply with local legal requirement, including investigation assisting.
For me that sounds that back-doors have always been a possibility should they be legally required to include them.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]