Slashdot Log In
Skype Protocol Has Been Cracked
Posted by
Zonk
on Fri Jul 14, 2006 10:43 AM
from the rising-in-the-east dept.
from the rising-in-the-east dept.
nsrCZ writes "The Skype core protocol has been reverse-engineered by a Chinese company. The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it. If it's true, then it could affect the whole eBay/Skype business in many ways, including that they might not get their piece of the emerging Chinese cake." From the article: "By cracking the Skype protocol, the company claims it can also block Skype voice traffic, Paglee said. 'They could literally turn the lights off on Skype in China very, very quickly,' said Paglee, who is also a lawyer and engineer, speaking from California on Friday. The company could transfer the technology to the Chinese government, which has continually sought ways to tighten its filtering and control over the Internet. So far, the company doesn't have any plans to market its blocking capabilities, Paglee said."
Related Stories
[+]
Slashback: SGI, Exploding Dell, Gizmo 110 comments
Slashback tonight brings some clarifications, and updates to previous Slashdot stories including: the possibility of selling OpenGL to save SGI, a denial from Dell that it knew of the overheating battery problem, an update on the Skype competitor Gizmo, and a response from the Chinese folks that reverse-engineered the Skype protocol. Read on for details.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Innovation (Score:3, Insightful)
Re:Innovation (Score:4, Insightful)
Yes, the US have been a good master.
Parent
Re:Innovation (Score:3, Funny)
Re:Innovation (Score:4, Insightful)
Parent
Re:Innovation (Score:4, Insightful)
True, groundbreaking innovation is rarely anything more than a modification of an existing process or practice or idea or thought. An ingenious one, yes - but without the work that came before, there would be nothing. Stopping the work that can come after is nothing short of criminal.
Parent
Re:Innovation (Score:4, Funny)
Parent
Re:Innovation (Score:4, Informative)
Apparently you never heard of the MD5 and SHA-1 breaks.
Parent
Re:Innovation (Score:3, Insightful)
Re:Innovation (Score:5, Insightful)
Parent
Re:Innovation (Score:3, Insightful)
* Quotes intentionally added to "wrong" to allay any possible tangent subthreads about how IP/patents/copyrights are in principal wrong/imorral/broken. Gotta know your audience.
Re:Innovation (Score:5, Insightful)
IF our ancestors were also wrong. . .
It remains to show they were wrong, and in doing so you necessarily question the legitimacy of the USA's sovereignity. We were signatory to no treaties to "respect" British IP and our ip laws still differ. It took a special act of Congress to partially respect the British copyright of Peter Pan (which is, in effect, in perpetuity, forbidden by the US Constitution).
If and when China does not respect American ip they are wrong because we are both signatory to the Berne Convention treaty, even if we were both wrong to do so.
And bearing in mind that the current administration has declared that treaties it has willfully signed are not binding upon it, as that violates American legal sovereignity. Yes, the Supremes have recently bitch slapped them over that, but the current adminstration seems to be gearing itself up to treat that as a legal opinion not actually binding upon it.
And herein lies the real damage that has been done to America's international standing in the past few years. If we declare null and void international law to which we are signatory on war, torture and due process why the fuck should anyone respectfully decline to copy Pauly Shore movies, no matter how cruel that is?
KFG
Parent
Re:Innovation (Score:5, Interesting)
If skype had patented its system, it would have had to disclose elements of its protocols which would make it quite easy for any espionage shop to infiltrate, route around or otherwise frustrate.
Consider, for instance, a lock manufacturer. Their cylinders are described in exquisite detail in their patents. A person skilled in the art of lock-picking might find their patents to be of particular interest. But if the lock incorporates security mechanisms which defeat all potential attacks, it doesn't matter if they are disclosed.
However, if the companies key manufacturing division and distribution network are infiltrated, then a duplicate key can probably be manufactured with a modicum of difficulty. That's why such practices are not disclosed in the patent, and are usually subject to "trade secret" regulations.
P.S. I'm not so sure that the NSA and CIA let IP laws get in the way of espionage.
Parent
Re:Innovation (Score:4, Insightful)
Oh that's right you were born in the 90s and don't remember the 80s.
Kids these days...
Parent
Re:Innovation (Score:5, Insightful)
It's just ignorant xenophobia that allows people to bad mouth an entire nation based on what are essentially standard operating practices anywhere else.
Tom
Parent
Re:Innovation (Score:4, Interesting)
On the flipside some of the stereotypes and comments are well deserved. I mean, read comp.lang.c for a week. You'll get a lot of "I have to write this program and I don't have the first damn clue" types of posts, amazingly enough mostly from India. Look at phishing stats, they're mostly organized by people in Eastern block countries. That's not conjecture or hyperbole that's the truth. China does have a track record for more than just reverse engineering. Classic IP violations are more common than in other nations [although I wouldn't say it's epidemic like some people suggest].
So like all nonsense there is some element of truth to it.
Tom
Parent
Re:Innovation (Score:5, Interesting)
Skype don't get their money from people installing their client, they get their money from people paying for the extra services like SkypeOut, SkypeIn, and so on. They should regard maintaining the Skype clients as an unwanted hassle. What they really want is as many people as possible connecting to their servers and using the extra services. This is separate from the protocol.
If I was an executive at Skype, I would view this as a good thing for the company. It's only going to result in more users. It's strange that Skype didn't voluntarily open up their protocol earlier!
Parent
Re:Innovation (Score:5, Insightful)
Erm, ok, if they patent it, don't they have to disclose details of it? Kinda defeats the purpose of having a secret closed protocol that Skype wanted. I think there might be a better way to protect IP, via "trade secret" or something like it, but I am no specialist in the area
-Em
Parent
Does it really matter? (Score:5, Insightful)
Anyway, Skype is a big no-no for me. I don't like software that connects to who-knows-what and uses bandwidth all the time without any way to know what the heck it's doing.
It could indeed. (Score:5, Funny)
Re:It could indeed. (Score:4, Interesting)
Parent
Wouldn't it depend on perspective? (Score:4, Insightful)
I'm sure Skype's lawyers might see this differently.
If this happened in the US, lawyers would be crying "foul!" on the basis of the protocol being a Trade Secret, and they would have something to say about the agreement that one sees when installing the software. I believe I remember seeing a "no reverse-engineering" clause in there.
This being a Chinese source, though, means that US rules don't necessarily apply.
Re:Wouldn't it depend on perspective? (Score:4, Insightful)
I'm sure the Chinese authorities might not care what they see differently.
Parent
Re:Wouldn't it depend on perspective? (Score:4, Interesting)
Skype's lawyers can see it however they want - but in this instance, they have no legal leg to stand on. It's not illegal to replicate something protected as a trade secret. (It *is* illegal to steal or 'borrow' it, or to hire employees from a rival to 'work on your own _x_'.)
Parent
Isn't that sweet? (Score:3, Interesting)
Don't you just love when people speak with certainties about yet unreleased things? Sure, it may well lack it for about 24 days. Then what happens? I'm not convinced that people would base stand alone software on that protocole anyway. More likely soe SIP clients would implement the protocole as an add on.
If it were patented (Score:3, Interesting)
Blocking (Score:4, Interesting)
Re:Blocking (Score:5, Informative)
*********
1) Skype will initially attempt to contact supernodes, the IPs of which
are in a file stored along with the other files that Skype installs. The
first method of contact is direct. The source ports that Skype attempts
to connect from are non-default ports. From my observations I could see
that the UDP source port 1247 is the initial control channel. Once the
connection is established, the rest of the communications is done in TCP
over non-default source ports with ranges sweeping from 2940-3000.
In general, any company that is serious about its security policy would
have strict egress filtering rules, which makes identifying the
non-default source/destination ports that Skype uses irrelevant since
they would be blocked anyway.
2) If the above fails, Skype will use the proxy server specified in Internet
Explorer, and attempt to tunnel the traffic over port 443 using the SSL
protocol. The destination IPs are of course random as above, which makes
destination blocking out of the question. The only option left is to
block SSL,
which is not really a solution, unless you want to end up excluding all
legal SSL destinations.
Deleting the user's proxy settings would also disallow Skype from
connecting. That would however leave the user without internet access.
Even if the user had no proxy settings, and the proxying was done
transparently (which would definitely include proxying http and https
traffic), the Skype traffic (SSL) would again be transparently proxied,
which puts us back at square one.
********
The aforementioned link however speaks of a somewhat twisted method of blocking out skype by restricting outbound HTTPS to only the requests adressed by FQDN.
Perhaps Skype will eventually just use SSL over 443 for the whole of the communication in order to establish connections, which is quite an effective method of bypassing any kind of firewall or filter put in place by a corporation. And the same technique holds true for any other "undesirable" protocol. With VPNs now starting to use SSL over 443 to evade restrictive outbound ACLs, it's getting more difficult to restrict what leaves your network.
Parent
They renamed the protocol (Score:4, Funny)
Reverse Engineering (Score:5, Informative)
Patenting something does not prevent anyone from reverse engineering it, and in fact they wouldnt need to because the mechanism would be documented in the patent.
Reverse engineering is not 'against the law' in most parts of the world, only the US thanks to the DMCA (C is for copyright, not patent), so therefore they probably have not broken the law if they did this outside the US. At present it is legal in the EU to reverse engineer a competitors product for the purpose of producing a compatible interface, sadly however that may not be the case if the proposed "directive on criminal measures aimed at ensuring the enforcement of intellectual property rights" is ratified.
Further Clarification. (Score:5, Informative)
You are absolutely right about reverse engineering not being illegal. In fact even with the DMCA reverse engineering is still entirely legal. The catch with both the DCMA and patents is what you can do with the protocol once it has been reverse-engineered. In the case of patents, the basic priciples have been disclosed, and you are allowed to distribute any additional information that you learn about the implementation, but you are not allowed to implement the protocol without a patent license.
In the case of the DCMA, you may be* prohibited from disiminating information that you have reverse-engineered, if can be used to circumvent a copyright protection device. I don't think that would apply in this case - what copyrighted work is being protected? The only possibility are the conversations themselves, but this does not allow you to listen in on anothers conversation, it simply allows you to initiate new coversations. Assuming that you are using secure cryptography, revealing the mechanism of the encryption does not weaken the security of the system, only revealing the keys, which in this case are generated per connection, like SSL.
So unless Skype's security is crap, which I don't believe to be true, the DMCA would not restrict you from publishing the details of the protocol, or third party implementations of it. On the other hand patents could. Therefore, the submitter was correct in bringing them up as a potential barrier, even if his wording was not.
* The law contradicts itself, and while there have been some precident setting cases, the interpretation is still very much up in the air.
Parent
Patents != legally uncrackable (Score:5, Informative)
Cracking encryption algorithms is generally only unlawful where the encryption is a method of encrypting copyrighted material, AND the country involved has implemented some variant of the DMCA or EUCD. That's the legal machinery that DVD Jon had problems with. The Skype Protocol won't be covered by DMCA-like provisions.
link to info on skype protocol (Score:5, Interesting)
Silver needle in the Skype at Blackhat Europe [secdev.org]
Re:link to info on skype protocol (Score:5, Interesting)
Parent
No one should use Skype anyway (Score:3, Interesting)
The Skype's the Limit (Score:3, Interesting)
Of course China's mafia government would have found ways to to protect their local "infringers" if it gave them control over Skype's important telecom traffic.
An open protocol using open software from more than a single (point of failure) source is a lot more reliable in the face of large scale attackers, like a government. SIP and IAX are safer.
NSA congratulates Paglee (Score:4, Funny)
Bert
Literally (Score:5, Funny)
No, they could metaphorically turn the lights off on Skype in China very, very quickly.
A lot has been known for a few years now ... (Score:4, Informative)
Re:Tapping (Score:5, Informative)
The company, however, has not been able to decrypt the phone calls passing through those computers and listen in because of the complicated encryption keys used during calls, Paglee said.
So I guess not.
Parent
Closed Protocol != Security (Score:5, Insightful)
Besides, who really cares? Phone conversations can be tapped into. Cell phones, too. Everyone knows not to transmit confidential information over the phone.
Parent
Re:Tapping (Score:5, Interesting)
For all such transactions, whether they are SSL, SSH, or some proprietary technology like Skype, you have to trust the site that holds the server keys or the people that write the software not to embed backdoors or fake keys to allow tapping. There are even technical reasons to permit such forgery: web-proxies for high-availability banking transactions, for example, may want to have their SSL keys multi-hosted. I've sat in on discussions about exactly that sort of approach and its security consequences.
Anyone who assumes that Skype conversations is immune from a legal wiretap order or even an unconstitutional Patriot Act order that Skype dare not publish due to the Patriot Act's nature is engaging in wishful thinking. If you want real end-to-end encryption, you have to have personal control of the key exchange. In fact, that's how PGPphone used to work, if you can still lay your hands on a copy of it. It just never got broadly enough deployed, or provided the convenience and computer->cheap telephone call services that Skype provides.
Parent
Re:Open Source? (Score:4, Funny)
You are a genius.
Parent
Re:Open Source? (Score:4, Insightful)
What the hell is that supposed to mean? First of all, let's address this statement:
Perhaps you wrote this incorrectly, but, by definition, nothing is useful unless you use it. Would you care to elaborate why you think their service is useless crap? Oh yes, this nugget of gold:
What you're saying, implicitly, is that you have no real qualms against Skype aside from their lack of openess with respect to their protocol. That's absurd! I could understand if you disliked this about their service, but to actually hate their service because of this one fact is borderline stupid.
Parent
Re:Open Source? (Score:3, Interesting)
Re:Open Source = Openser (Score:4, Informative)
Asterisk does not currently provide the nuts and bolts of connecting SIP callers. It's SIP integration is not built out so great either. (ex. can't easily connect to a STUN or RTP proxy)
The normal procedure is to use an SIP server with asterisk as a voicemail backend.
The SER and OpenSER SIP server projects both connect to asterisk.
There is no reason to use skype's proprietary protocol. Good for the Chinese for putting a dent in their proprietary methods. Let SIP providers compete on a service basis, not protocol competition.
Parent
Re:Implicitly, Skype has lost its best feature.. (Score:3, Informative)
What this means is that they could configure their application as a SuperNode and intercept conversations, files, text in between.
This is not a valid conclusion. To send out and receive audio when participating in a call it is necessary for a client to have the crypto keys. When the client is running on a general purpose computer the keys are inevitably accessable by the end
Re:DMCA? (Score:5, Informative)
This is why mod points should be more carefully controlled.
The DMCA explicitly protects your right to reverse-engineer for the purposes of interoperability.
Parent
Re:DMCA? (Score:4, Insightful)
The DMCA also prohibits the construction, possession, and/or use of a device to defeat copyright infringement. In a case where the law contradicts itself, the people with the most money win.
Parent
Re:Patent != secrets! (Score:3, Interesting)
I'm sure Skype's EULA forbids reverse engineering the protocol, thus Skype has legal grounds to sue whoever reverse engineers the protocol for violating the license agreement.
Re:Hmm (Score:5, Insightful)
The several million people whose copies only support the current one.
Parent