Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Skype Protocol Has Been Cracked

Posted by Zonk on Fri Jul 14, 2006 11:43 AM
from the rising-in-the-east dept.
nsrCZ writes "The Skype core protocol has been reverse-engineered by a Chinese company. The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it. If it's true, then it could affect the whole eBay/Skype business in many ways, including that they might not get their piece of the emerging Chinese cake." From the article: "By cracking the Skype protocol, the company claims it can also block Skype voice traffic, Paglee said. 'They could literally turn the lights off on Skype in China very, very quickly,' said Paglee, who is also a lawyer and engineer, speaking from California on Friday. The company could transfer the technology to the Chinese government, which has continually sought ways to tighten its filtering and control over the Internet. So far, the company doesn't have any plans to market its blocking capabilities, Paglee said."
+ -
story

Related Stories

[+] Slashback: SGI, Exploding Dell, Gizmo 110 comments
Slashback tonight brings some clarifications, and updates to previous Slashdot stories including: the possibility of selling OpenGL to save SGI, a denial from Dell that it knew of the overheating battery problem, an update on the Skype competitor Gizmo, and a response from the Chinese folks that reverse-engineered the Skype protocol. Read on for details.
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • by Rosco P. Coltrane (209368) on Friday July 14 2006, @11:48AM (#15719317)
    Closed Skype protocol gets cracked in X months == Skype releases a new version with a new closed protocol that'll take X more months to crack. Big deal...

    Anyway, Skype is a big no-no for me. I don't like software that connects to who-knows-what and uses bandwidth all the time without any way to know what the heck it's doing.
  • by Rob T Firefly (844560) on Friday July 14 2006, @11:49AM (#15719327) Homepage Journal
    The company could transfer the technology to the Chinese government
    In other news, my front door could be unlocked with my house key, I could inhale the next time I need oxygen, and water could cause things it touches to become wet.
  • The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it.

    I'm sure Skype's lawyers might see this differently.

    If this happened in the US, lawyers would be crying "foul!" on the basis of the protocol being a Trade Secret, and they would have something to say about the agreement that one sees when installing the software. I believe I remember seeing a "no reverse-engineering" clause in there.

    This being a Chinese source, though, means that US rules don't necessarily apply.
  • Blocking (Score:4, Interesting)

    by slashkitty (21637) on Friday July 14 2006, @11:50AM (#15719347) Homepage
    Do you really have to "crack" the protocol to block the traffic? Were their packets that well disguised?
    • Re:Blocking (Score:5, Informative)

      by Anonymous Coward on Friday July 14 2006, @12:19PM (#15719608)
      Excerpt from http://lists.grok.org.uk/pipermail/full-disclosure /2005-November/038646.html [grok.org.uk] :

      *********

      1) Skype will initially attempt to contact supernodes, the IPs of which
      are in a file stored along with the other files that Skype installs. The
      first method of contact is direct. The source ports that Skype attempts
      to connect from are non-default ports. From my observations I could see
      that the UDP source port 1247 is the initial control channel. Once the
      connection is established, the rest of the communications is done in TCP
      over non-default source ports with ranges sweeping from 2940-3000.
      In general, any company that is serious about its security policy would
      have strict egress filtering rules, which makes identifying the
      non-default source/destination ports that Skype uses irrelevant since
      they would be blocked anyway.

      2) If the above fails, Skype will use the proxy server specified in Internet
      Explorer, and attempt to tunnel the traffic over port 443 using the SSL
      protocol. The destination IPs are of course random as above, which makes
      destination blocking out of the question. The only option left is to
      block SSL,
      which is not really a solution, unless you want to end up excluding all
      legal SSL destinations.
      Deleting the user's proxy settings would also disallow Skype from
      connecting. That would however leave the user without internet access.
      Even if the user had no proxy settings, and the proxying was done
      transparently (which would definitely include proxying http and https
      traffic), the Skype traffic (SSL) would again be transparently proxied,
      which puts us back at square one.

      ********

      The aforementioned link however speaks of a somewhat twisted method of blocking out skype by restricting outbound HTTPS to only the requests adressed by FQDN.

      Perhaps Skype will eventually just use SSL over 443 for the whole of the communication in order to establish connections, which is quite an effective method of bypassing any kind of firewall or filter put in place by a corporation. And the same technique holds true for any other "undesirable" protocol. With VPNs now starting to use SSL over 443 to evade restrictive outbound ACLs, it's getting more difficult to restrict what leaves your network.

  • by Anonymous Coward on Friday July 14 2006, @11:50AM (#15719349)
    It's now call Scrype terraphone and it love you long time
  • Reverse Engineering (Score:5, Informative)

    by ultrasound (472511) on Friday July 14 2006, @11:53AM (#15719378)
    it is not patented and thus it is not against the law to crack it....

    Patenting something does not prevent anyone from reverse engineering it, and in fact they wouldnt need to because the mechanism would be documented in the patent.

    Reverse engineering is not 'against the law' in most parts of the world, only the US thanks to the DMCA (C is for copyright, not patent), so therefore they probably have not broken the law if they did this outside the US. At present it is legal in the EU to reverse engineer a competitors product for the purpose of producing a compatible interface, sadly however that may not be the case if the proposed "directive on criminal measures aimed at ensuring the enforcement of intellectual property rights" is ratified.

    • by pavon (30274) on Friday July 14 2006, @01:15PM (#15720110)
      Patenting something does not prevent anyone from reverse engineering it, and in fact they wouldnt need to because the mechanism would be documented in the patent.
      Well no, because you can't patent a protocol. Instead they could patent a core method upon which the protocol is based, and that method would be made public - in non-specific legalese, that would in itself be practically useless for the purpose of implementing the protocol. The details of the protocol itself would still need to be reverse engineered.

      You are absolutely right about reverse engineering not being illegal. In fact even with the DMCA reverse engineering is still entirely legal. The catch with both the DCMA and patents is what you can do with the protocol once it has been reverse-engineered. In the case of patents, the basic priciples have been disclosed, and you are allowed to distribute any additional information that you learn about the implementation, but you are not allowed to implement the protocol without a patent license.

      In the case of the DCMA, you may be* prohibited from disiminating information that you have reverse-engineered, if can be used to circumvent a copyright protection device. I don't think that would apply in this case - what copyrighted work is being protected? The only possibility are the conversations themselves, but this does not allow you to listen in on anothers conversation, it simply allows you to initiate new coversations. Assuming that you are using secure cryptography, revealing the mechanism of the encryption does not weaken the security of the system, only revealing the keys, which in this case are generated per connection, like SSL.

      So unless Skype's security is crap, which I don't believe to be true, the DMCA would not restrict you from publishing the details of the protocol, or third party implementations of it. On the other hand patents could. Therefore, the submitter was correct in bringing them up as a potential barrier, even if his wording was not.

      * The law contradicts itself, and while there have been some precident setting cases, the interpretation is still very much up in the air.
  • by Aim Here (765712) on Friday July 14 2006, @11:56AM (#15719405)
    The article submitter seems to be a lot confused regarding the law. There's nothing unlawful about cracking a patented algorithm. It might be unlawful to market a device using the same encryption, in those parts of the unfree (softwarewise) world where software patents are implemented, but that's a different thing.

    Cracking encryption algorithms is generally only unlawful where the encryption is a method of encrypting copyrighted material, AND the country involved has implemented some variant of the DMCA or EUCD. That's the legal machinery that DVD Jon had problems with. The Skype Protocol won't be covered by DMCA-like provisions.

  • by throwaway18 (521472) on Friday July 14 2006, @11:59AM (#15719431) Journal
    Lots of info on how skype works, including that the people who run skype could evesdrop on conversations, the possibility of using skype to relay non skype traffic and an overflow security hole (hopfully now fixed) were revealed four months ago.

    Silver needle in the Skype at Blackhat Europe [secdev.org]

  • Literally (Score:5, Funny)

    by RPoet (20693) on Friday July 14 2006, @12:46PM (#15719870) Journal
    They could literally turn the lights off on Skype in China very, very quickly

    No, they could metaphorically turn the lights off on Skype in China very, very quickly.
    • Re:Tapping (Score:5, Informative)

      by Barsema (106323) on Friday July 14 2006, @11:51AM (#15719362) Homepage
      From TFA :

      The company, however, has not been able to decrypt the phone calls passing through those computers and listen in because of the complicated encryption keys used during calls, Paglee said.

      So I guess not.
    • Closed protocols are not a substitute for security. Any traffic that goes over the internet can be intercepted. Once you have the packets, it's just a matter of figuring out what they mean. This certainly does raise concerns that tapping into Skype conversations may become easy, but this was bound to happen eventually and should be no surprise to anyone.

      Besides, who really cares? Phone conversations can be tapped into. Cell phones, too. Everyone knows not to transmit confidential information over the phone.
      • Re:Tapping (Score:5, Interesting)

        by Antique Geekmeister (740220) on Friday July 14 2006, @01:00PM (#15719997)
        I agree with you. Skype, due to its central corporate authentication of the RSA keys for customers, is ripe for law-enforcement mandated man-in-the-middle attacks. Without publising their protocol and any safeguards they've embedded in it, such as a public RSA key repository similar to those used by many GPG users, it's technologically easy for them to authenticate a centralized key upon request for NSA, CIA, FBI, or my aunt-Matilda-if-she-asks-them-nicely tap in the center of any conversation connection.

        For all such transactions, whether they are SSL, SSH, or some proprietary technology like Skype, you have to trust the site that holds the server keys or the people that write the software not to embed backdoors or fake keys to allow tapping. There are even technical reasons to permit such forgery: web-proxies for high-availability banking transactions, for example, may want to have their SSL keys multi-hosted. I've sat in on discussions about exactly that sort of approach and its security consequences.

        Anyone who assumes that Skype conversations is immune from a legal wiretap order or even an unconstitutional Patriot Act order that Skype dare not publish due to the Patriot Act's nature is engaging in wishful thinking. If you want real end-to-end encryption, you have to have personal control of the key exchange. In fact, that's how PGPphone used to work, if you can still lay your hands on a copy of it. It just never got broadly enough deployed, or provided the convenience and computer->cheap telephone call services that Skype provides.
    • Re:Innovation (Score:4, Insightful)

      by Anonymous Coward on Friday July 14 2006, @11:54AM (#15719388)
      I love how the Chinese innovate. Corporate espionage, reverse engineering and overall IP infringement...

      Yes, the US have been a good master.
    • Re:Innovation (Score:5, Insightful)

      by sholden (12227) on Friday July 14 2006, @12:29PM (#15719699) Homepage
      Because the US respected all the British IP in its early days.
        • Re:Innovation (Score:5, Insightful)

          by kfg (145172) * on Friday July 14 2006, @01:51PM (#15720365)
          Even if our ancestors were also "wrong". . .

          IF our ancestors were also wrong. . .

          It remains to show they were wrong, and in doing so you necessarily question the legitimacy of the USA's sovereignity. We were signatory to no treaties to "respect" British IP and our ip laws still differ. It took a special act of Congress to partially respect the British copyright of Peter Pan (which is, in effect, in perpetuity, forbidden by the US Constitution).

          If and when China does not respect American ip they are wrong because we are both signatory to the Berne Convention treaty, even if we were both wrong to do so.

          And bearing in mind that the current administration has declared that treaties it has willfully signed are not binding upon it, as that violates American legal sovereignity. Yes, the Supremes have recently bitch slapped them over that, but the current adminstration seems to be gearing itself up to treat that as a legal opinion not actually binding upon it.

          And herein lies the real damage that has been done to America's international standing in the past few years. If we declare null and void international law to which we are signatory on war, torture and due process why the fuck should anyone respectfully decline to copy Pauly Shore movies, no matter how cruel that is?

          KFG
    • Re:Innovation (Score:5, Interesting)

      by Jeremy Erwin (2054) on Friday July 14 2006, @12:38PM (#15719765) Journal
      Perhaps I'm being unrealistically naive, but the original concept of the patent system was "full disclosure for protection". During the patent term, manufacturers would have to obtain a license to duplicate the patented object, but after those 17 years were up, no assistance (engineering or otherwise_ from the original inventor would have been necessary-- because the invention had been fully disclosed.

      If skype had patented its system, it would have had to disclose elements of its protocols which would make it quite easy for any espionage shop to infiltrate, route around or otherwise frustrate.

      Consider, for instance, a lock manufacturer. Their cylinders are described in exquisite detail in their patents. A person skilled in the art of lock-picking might find their patents to be of particular interest. But if the lock incorporates security mechanisms which defeat all potential attacks, it doesn't matter if they are disclosed.

      However, if the companies key manufacturing division and distribution network are infiltrated, then a duplicate key can probably be manufactured with a modicum of difficulty. That's why such practices are not disclosed in the patent, and are usually subject to "trade secret" regulations.

      P.S. I'm not so sure that the NSA and CIA let IP laws get in the way of espionage.
    • Re:Innovation (Score:5, Interesting)

      by babbling (952366) on Friday July 14 2006, @01:02PM (#15720015)
      Why should Skype have patented this, and how does this negatively affect Skype?

      Skype don't get their money from people installing their client, they get their money from people paying for the extra services like SkypeOut, SkypeIn, and so on. They should regard maintaining the Skype clients as an unwanted hassle. What they really want is as many people as possible connecting to their servers and using the extra services. This is separate from the protocol.

      If I was an executive at Skype, I would view this as a good thing for the company. It's only going to result in more users. It's strange that Skype didn't voluntarily open up their protocol earlier!
    • Re:Innovation (Score:5, Insightful)

      by Em Ellel (523581) on Friday July 14 2006, @01:19PM (#15720143)
      Skype should have patented its technology, but it's not like the Chinese respect IP anyway.

      Erm, ok, if they patent it, don't they have to disclose details of it? Kinda defeats the purpose of having a secret closed protocol that Skype wanted. I think there might be a better way to protect IP, via "trade secret" or something like it, but I am no specialist in the area :-)

      -Em
        • Re:Innovation (Score:5, Insightful)

          by tomstdenis (446163) <tomstdenisNO@SPAMgmail.com> on Friday July 14 2006, @03:36PM (#15721097) Homepage
          And so is reverse engineering skype. I don't see why everyone is harping on China here. It's not like their the only country to do this.

          It's just ignorant xenophobia that allows people to bad mouth an entire nation based on what are essentially standard operating practices anywhere else.

          Tom
    • Re:Hmm (Score:5, Insightful)

      by flooey (695860) on Friday July 14 2006, @01:46PM (#15720341)
      What's to stop them from changing the protocol now?

      The several million people whose copies only support the current one.