Skype Protocol Has Been Cracked 279
nsrCZ writes "The Skype core protocol has been reverse-engineered by a Chinese company. The interesting thing is, that although the protocol is closed, it is not patented and thus it is not against the law to crack it. If it's true, then it could affect the whole eBay/Skype business in many ways, including that they might not get their piece of the emerging Chinese cake." From the article: "By cracking the Skype protocol, the company claims it can also block Skype voice traffic, Paglee said. 'They could literally turn the lights off on Skype in China very, very quickly,' said Paglee, who is also a lawyer and engineer, speaking from California on Friday. The company could transfer the technology to the Chinese government, which has continually sought ways to tighten its filtering and control over the Internet. So far, the company doesn't have any plans to market its blocking capabilities, Paglee said."
Innovation (Score:3, Insightful)
Re:Innovation (Score:4, Insightful)
Yes, the US have been a good master.
Re:Innovation (Score:3, Funny)
Re:Innovation (Score:4, Insightful)
Re:Innovation (Score:4, Insightful)
True, groundbreaking innovation is rarely anything more than a modification of an existing process or practice or idea or thought. An ingenious one, yes - but without the work that came before, there would be nothing. Stopping the work that can come after is nothing short of criminal.
Re:Innovation (Score:3, Insightful)
Re:Innovation (Score:3, Interesting)
Automobiles they have "chery" whose entire line-up are shoddy copies [paultan.org] of cars already produced by other manufacturers.
We have Huawei, who has literally stolen Cisco's router code [microscope.co.uk] to make a "competing product".
And then we have their military who happened to... yes steal [theepochtimes.com] their designs as well (at least the stuff they didn't just purchase from Russia and reverse engineer).
So exactly what are these innovations taking place in China you wanted to defend?
BTW, the
Re:Innovation (Score:2, Insightful)
Re:Innovation (Score:4, Funny)
Re:Innovation (Score:4, Informative)
Apparently you never heard of the MD5 and SHA-1 breaks.
Re:Innovation (Score:3, Insightful)
Re:Innovation (Score:2)
Protocol in itself is not an invention.
You can have a protocol as a part of an invention or rely on an invention to work, but in itself...
The chances of patenting it even in the US are pretty slim.
Re:Innovation (Score:5, Insightful)
Re:Innovation (Score:3, Insightful)
* Quotes intentionally added to "wrong" to allay any possible tangent subthreads about how IP/patents/copyrights are in principal wrong/imorral/broken. Gotta know your audience.
Re:Innovation (Score:2)
Re:Innovation (Score:2)
Re:Innovation (Score:2, Insightful)
Re:Innovation (Score:3, Insightful)
What "infringement"? As TFA says, THERE IS NO PATENT. They reverse-engineered a protocol. A week ago, some Americans did the same to the Galileo GPS signal [slashdot.org]. And that will lead to a direct monetary loss to Galileo. Was that "wrong"?
copyrights are in principal wrong
The word is "principle".
Re:Innovation (Score:5, Insightful)
IF our ancestors were also wrong. . .
It remains to show they were wrong, and in doing so you necessarily question the legitimacy of the USA's sovereignity. We were signatory to no treaties to "respect" British IP and our ip laws still differ. It took a special act of Congress to partially respect the British copyright of Peter Pan (which is, in effect, in perpetuity, forbidden by the US Constitution).
If and when China does not respect American ip they are wrong because we are both signatory to the Berne Convention treaty, even if we were both wrong to do so.
And bearing in mind that the current administration has declared that treaties it has willfully signed are not binding upon it, as that violates American legal sovereignity. Yes, the Supremes have recently bitch slapped them over that, but the current adminstration seems to be gearing itself up to treat that as a legal opinion not actually binding upon it.
And herein lies the real damage that has been done to America's international standing in the past few years. If we declare null and void international law to which we are signatory on war, torture and due process why the fuck should anyone respectfully decline to copy Pauly Shore movies, no matter how cruel that is?
KFG
Re:Innovation (Score:2, Funny)
Jeez, when will you guys get it?
Like information, MUTTON CHOPS WANT TO BE FREE
Re:Innovation (Score:5, Interesting)
If skype had patented its system, it would have had to disclose elements of its protocols which would make it quite easy for any espionage shop to infiltrate, route around or otherwise frustrate.
Consider, for instance, a lock manufacturer. Their cylinders are described in exquisite detail in their patents. A person skilled in the art of lock-picking might find their patents to be of particular interest. But if the lock incorporates security mechanisms which defeat all potential attacks, it doesn't matter if they are disclosed.
However, if the companies key manufacturing division and distribution network are infiltrated, then a duplicate key can probably be manufactured with a modicum of difficulty. That's why such practices are not disclosed in the patent, and are usually subject to "trade secret" regulations.
P.S. I'm not so sure that the NSA and CIA let IP laws get in the way of espionage.
Re:Innovation (Score:4, Insightful)
Oh that's right you were born in the 90s and don't remember the 80s.
Kids these days...
Re:Innovation (Score:5, Insightful)
It's just ignorant xenophobia that allows people to bad mouth an entire nation based on what are essentially standard operating practices anywhere else.
Tom
Re:Innovation (Score:4, Interesting)
On the flipside some of the stereotypes and comments are well deserved. I mean, read comp.lang.c for a week. You'll get a lot of "I have to write this program and I don't have the first damn clue" types of posts, amazingly enough mostly from India. Look at phishing stats, they're mostly organized by people in Eastern block countries. That's not conjecture or hyperbole that's the truth. China does have a track record for more than just reverse engineering. Classic IP violations are more common than in other nations [although I wouldn't say it's epidemic like some people suggest].
So like all nonsense there is some element of truth to it.
Tom
Re:Innovation (Score:5, Interesting)
Skype don't get their money from people installing their client, they get their money from people paying for the extra services like SkypeOut, SkypeIn, and so on. They should regard maintaining the Skype clients as an unwanted hassle. What they really want is as many people as possible connecting to their servers and using the extra services. This is separate from the protocol.
If I was an executive at Skype, I would view this as a good thing for the company. It's only going to result in more users. It's strange that Skype didn't voluntarily open up their protocol earlier!
Re:Innovation (Score:2)
Re:Innovation (Score:5, Insightful)
Erm, ok, if they patent it, don't they have to disclose details of it? Kinda defeats the purpose of having a secret closed protocol that Skype wanted. I think there might be a better way to protect IP, via "trade secret" or something like it, but I am no specialist in the area
-Em
Did "DVD Jon" help them out? (Score:2)
Tapping (Score:2, Insightful)
Re:Tapping (Score:5, Informative)
The company, however, has not been able to decrypt the phone calls passing through those computers and listen in because of the complicated encryption keys used during calls, Paglee said.
So I guess not.
Re:Tapping (Score:2, Funny)
Closed Protocol != Security (Score:5, Insightful)
Besides, who really cares? Phone conversations can be tapped into. Cell phones, too. Everyone knows not to transmit confidential information over the phone.
Re:Tapping (Score:5, Interesting)
For all such transactions, whether they are SSL, SSH, or some proprietary technology like Skype, you have to trust the site that holds the server keys or the people that write the software not to embed backdoors or fake keys to allow tapping. There are even technical reasons to permit such forgery: web-proxies for high-availability banking transactions, for example, may want to have their SSL keys multi-hosted. I've sat in on discussions about exactly that sort of approach and its security consequences.
Anyone who assumes that Skype conversations is immune from a legal wiretap order or even an unconstitutional Patriot Act order that Skype dare not publish due to the Patriot Act's nature is engaging in wishful thinking. If you want real end-to-end encryption, you have to have personal control of the key exchange. In fact, that's how PGPphone used to work, if you can still lay your hands on a copy of it. It just never got broadly enough deployed, or provided the convenience and computer->cheap telephone call services that Skype provides.
PGP Phone (Score:3, Interesting)
Oh, I'm sure you can find it floating around somewhere [slashdot.org].
In His Apartment Earlier (Score:2, Funny)
Little did he know they were in his apartment earlier in the day.
Does it really matter? (Score:5, Insightful)
Anyway, Skype is a big no-no for me. I don't like software that connects to who-knows-what and uses bandwidth all the time without any way to know what the heck it's doing.
It could indeed. (Score:5, Funny)
Re:It could indeed. (Score:4, Interesting)
Re:It could indeed. (Score:2, Informative)
...See the straw in the Chinese's eye and not the beam in your ass... In America they don't even have to make up something later to deport you to Guantanamo, and in Europe you can be abducted [cnn.com], tortured at a military base, and dumped in some sort of Konzentrationlager in some country not too fussy about human rights.
Start worrying about civil rights in yo
Net Neutrality (Score:2, Interesting)
Wouldn't it depend on perspective? (Score:4, Insightful)
I'm sure Skype's lawyers might see this differently.
If this happened in the US, lawyers would be crying "foul!" on the basis of the protocol being a Trade Secret, and they would have something to say about the agreement that one sees when installing the software. I believe I remember seeing a "no reverse-engineering" clause in there.
This being a Chinese source, though, means that US rules don't necessarily apply.
Re:Wouldn't it depend on perspective? (Score:2)
If the packets are coming across their routers then they are pretty fair game, although I doubt they did break it without the software, if asked they [could/should/would] say they only examined packets in transit.
Re:Wouldn't it depend on perspective? (Score:2)
Trade secrets are just that - secrets - and have no protection under law. You find them out, good for you.
Reverse engineering isn't illegal either and that cannot be changed by a EULA. As far as I'm aware a protocol is not an "invention" per se, so it cannot be patented either. Though with the modern state of the US patent office, who knows ....
Re:Wouldn't it depend on perspective? (Score:4, Insightful)
I'm sure the Chinese authorities might not care what they see differently.
Re:Wouldn't it depend on perspective? (Score:2)
Re:Wouldn't it depend on perspective? (Score:4, Interesting)
Skype's lawyers can see it however they want - but in this instance, they have no legal leg to stand on. It's not illegal to replicate something protected as a trade secret. (It *is* illegal to steal or 'borrow' it, or to hire employees from a rival to 'work on your own _x_'.)
Why would a protocol be closed anyway? (Score:2, Interesting)
Isn't that sweet? (Score:3, Interesting)
Don't you just love when people speak with certainties about yet unreleased things? Sure, it may well lack it for about 24 days. Then what happens? I'm not convinced that people would base stand alone software on that protocole anyway. More likely soe SIP clients would implement the protocole as an add on.
If it were patented (Score:3, Interesting)
Blocking (Score:4, Interesting)
Re:Blocking (Score:2)
Re:Blocking (Score:5, Informative)
*********
1) Skype will initially attempt to contact supernodes, the IPs of which
are in a file stored along with the other files that Skype installs. The
first method of contact is direct. The source ports that Skype attempts
to connect from are non-default ports. From my observations I could see
that the UDP source port 1247 is the initial control channel. Once the
connection is established, the rest of the communications is done in TCP
over non-default source ports with ranges sweeping from 2940-3000.
In general, any company that is serious about its security policy would
have strict egress filtering rules, which makes identifying the
non-default source/destination ports that Skype uses irrelevant since
they would be blocked anyway.
2) If the above fails, Skype will use the proxy server specified in Internet
Explorer, and attempt to tunnel the traffic over port 443 using the SSL
protocol. The destination IPs are of course random as above, which makes
destination blocking out of the question. The only option left is to
block SSL,
which is not really a solution, unless you want to end up excluding all
legal SSL destinations.
Deleting the user's proxy settings would also disallow Skype from
connecting. That would however leave the user without internet access.
Even if the user had no proxy settings, and the proxying was done
transparently (which would definitely include proxying http and https
traffic), the Skype traffic (SSL) would again be transparently proxied,
which puts us back at square one.
********
The aforementioned link however speaks of a somewhat twisted method of blocking out skype by restricting outbound HTTPS to only the requests adressed by FQDN.
Perhaps Skype will eventually just use SSL over 443 for the whole of the communication in order to establish connections, which is quite an effective method of bypassing any kind of firewall or filter put in place by a corporation. And the same technique holds true for any other "undesirable" protocol. With VPNs now starting to use SSL over 443 to evade restrictive outbound ACLs, it's getting more difficult to restrict what leaves your network.
Re:Blocking (Score:3, Insightful)
The only way to block this would be to cr
Re:Blocking (Score:3, Interesting)
I don't think NARUS can tell when voice calls start and stop if I'm running remote Terminal Services (RDP and/or Citrix), other VPNs to other customers (within the SSH), web traffic, email, steaming music (last.fm [www.last.fm]. While I'm very unique, and what I do is unique,
Re: (Score:2)
Re:Blocking (Score:2)
Mainly becasue they "borrow" (no such thing as stealing on
Botnet designers have nothing on Skype, except alot to learn.
They renamed the protocol (Score:4, Funny)
Reverse Engineering (Score:5, Informative)
Patenting something does not prevent anyone from reverse engineering it, and in fact they wouldnt need to because the mechanism would be documented in the patent.
Reverse engineering is not 'against the law' in most parts of the world, only the US thanks to the DMCA (C is for copyright, not patent), so therefore they probably have not broken the law if they did this outside the US. At present it is legal in the EU to reverse engineer a competitors product for the purpose of producing a compatible interface, sadly however that may not be the case if the proposed "directive on criminal measures aimed at ensuring the enforcement of intellectual property rights" is ratified.
Re:Reverse Engineering (Score:2)
Further Clarification. (Score:5, Informative)
You are absolutely right about reverse engineering not being illegal. In fact even with the DMCA reverse engineering is still entirely legal. The catch with both the DCMA and patents is what you can do with the protocol once it has been reverse-engineered. In the case of patents, the basic priciples have been disclosed, and you are allowed to distribute any additional information that you learn about the implementation, but you are not allowed to implement the protocol without a patent license.
In the case of the DCMA, you may be* prohibited from disiminating information that you have reverse-engineered, if can be used to circumvent a copyright protection device. I don't think that would apply in this case - what copyrighted work is being protected? The only possibility are the conversations themselves, but this does not allow you to listen in on anothers conversation, it simply allows you to initiate new coversations. Assuming that you are using secure cryptography, revealing the mechanism of the encryption does not weaken the security of the system, only revealing the keys, which in this case are generated per connection, like SSL.
So unless Skype's security is crap, which I don't believe to be true, the DMCA would not restrict you from publishing the details of the protocol, or third party implementations of it. On the other hand patents could. Therefore, the submitter was correct in bringing them up as a potential barrier, even if his wording was not.
* The law contradicts itself, and while there have been some precident setting cases, the interpretation is still very much up in the air.
Patents != legally uncrackable (Score:5, Informative)
Cracking encryption algorithms is generally only unlawful where the encryption is a method of encrypting copyrighted material, AND the country involved has implemented some variant of the DMCA or EUCD. That's the legal machinery that DVD Jon had problems with. The Skype Protocol won't be covered by DMCA-like provisions.
Re:Patents != legally uncrackable (Score:2)
In theory that is.
link to info on skype protocol (Score:5, Interesting)
Silver needle in the Skype at Blackhat Europe [secdev.org]
Re:link to info on skype protocol (Score:3, Interesting)
1) Almost all (if not every bit) of this is not new information, it was already broken in the above referenced article.
2) Blocking the traffic was already described in the article, all the Chinese government had to do was read the paper some time ago instead of waiting for these schmucks to "discover" it.
3) If you read the paper you'll see how much work Skype goes through to make it hard to dissassemble their code and protocols. I'm sure if blocking in China becomes an issue they'll have the
Re:link to info on skype protocol (Score:5, Interesting)
No one should use Skype anyway (Score:3, Interesting)
For more info on the repercussions of this... (Score:2)
Skype Journal [skypejournal.com]
Looks like there are a lot of opportunity for deeper business integration. Wonder if this opens up any vulnerabilities for standard client users?
Paglee means . . . (Score:2, Informative)
Welcome to global communications.
The Skype's the Limit (Score:3, Interesting)
Of course China's mafia government would have found ways to to protect their local "infringers" if it gave them control over Skype's important telecom traffic.
An open protocol using open software from more than a single (point of failure) source is a lot more reliable in the face of large scale attackers, like a government. SIP and IAX are safer.
AsterSkype (Score:2)
Reverse engineering (Score:3, Interesting)
You can be found guilty of contributory infringement if you publish detailed information about how to go about infringing a patent. This is a shady area though, since the patent itself already describes the technology in question so it boils down to an evaluation of the individual's intent.
Re:Reverse engineering (Score:2)
NSA congratulates Paglee (Score:4, Funny)
Bert
Literally (Score:5, Funny)
No, they could metaphorically turn the lights off on Skype in China very, very quickly.
Incorrect view of the law. (Score:2, Insightful)
A lot has been known for a few years now ... (Score:4, Informative)
Re:Open Source? (Score:4, Funny)
You are a genius.
Re:Open Source? (Score:2)
Re:Open Source? (Score:4, Insightful)
What the hell is that supposed to mean? First of all, let's address this statement:
Perhaps you wrote this incorrectly, but, by definition, nothing is useful unless you use it. Would you care to elaborate why you think their service is useless crap? Oh yes, this nugget of gold:
What you're saying, implicitly, is that you have no real qualms against Skype aside from their lack of openess with respect to their protocol. That's absurd! I could understand if you disliked this about their service, but to actually hate their service because of this one fact is borderline stupid.
Re:Open Source? (Score:2)
Re:Open Source? (Score:2)
Re:Open Source? (Score:2)
Re:Open Source? (Score:3, Interesting)
Re:Open Source? (Score:2)
My comment about open source was more of a financial issue, not so much a programming methodology issue. Skype is near the top of most telco's 10 most wanted lists, so I presume they are willing to go that extra mile to provi
Re:Open Source = Openser (Score:4, Informative)
Asterisk does not currently provide the nuts and bolts of connecting SIP callers. It's SIP integration is not built out so great either. (ex. can't easily connect to a STUN or RTP proxy)
The normal procedure is to use an SIP server with asterisk as a voicemail backend.
The SER and OpenSER SIP server projects both connect to asterisk.
There is no reason to use skype's proprietary protocol. Good for the Chinese for putting a dent in their proprietary methods. Let SIP providers compete on a service basis, not protocol competition.
Re:DMCA? (Score:2)
Re:DMCA? (Score:2)
Re:DMCA? (Score:2)
Not that the DMCA is relevant to me, yet (being outside the US), but I like this (currently) hypothetical topic...
Don't the anti-curcumvention provisions in the DMCA only protect the copyright holder? As the person doing the talking over Skype, presumably you are the copyright holder, and thus you are therefore allowed to de
Re:DMCA? (Score:5, Informative)
This is why mod points should be more carefully controlled.
The DMCA explicitly protects your right to reverse-engineer for the purposes of interoperability.
Re:DMCA? (Score:2, Flamebait)
Re:DMCA? (Score:2)
The DMCA explicitly protects your right to reverse-engineer for the purposes of interoperability.
Except when it might interfere with the profits of the MPAA*.
*See DVD Jon
Re:DMCA? (Score:2)
The reverse-engineering clause has many exceptions - not the least of which is "non-infringing uses"
And as a previous poster pointed out, it interoperability didn't stop the MPAA suits against DeCSS.
Re:DMCA? (Score:4, Insightful)
The DMCA also prohibits the construction, possession, and/or use of a device to defeat copyright infringement. In a case where the law contradicts itself, the people with the most money win.
Re:DMCA? (Score:2)
Is it being recorded though, or just transmitted? Something is only copyrighted once it gets fixed into a medium. So if you are recording to disk and then transmitting, that would be protected by copyright. But the user would hold the copyright, not Skype, so Skype couldn't use the DMCA against anybody.
I thought that maybe Skype could include a copyrighted logo or something at the beginning of each transm
Re:Implicitly, Skype has lost its best feature.. (Score:3, Informative)
What this means is that they could configure their application as a SuperNode and intercept conversations, files, text in between.
This is not a valid conclusion. To send out and receive audio when participating in a call it is necessary for a client to have the crypto keys. When the client is running on a general purpose computer the keys are inevitably accessable by the end
Re:Grammar Nazi to the Rescue (Score:2, Insightful)
Re:Grammar Nazi to the Rescue (Score:2, Informative)
Re:Patent != secrets! (Score:3, Interesting)
I'm sure Skype's EULA forbids reverse engineering the protocol, thus Skype has legal grounds to sue whoever reverse engineers the protocol for violating the license agreement.
Re:Interoperability (Score:3, Interesting)
Hear that, everyone?
If you're one of the millions who found a ton of value in Skype before it was cracked, you were very, very wrong, because this anonymous Internet jackass has said so. No matter how valuable you think Skype was before, it really wasn't.
You know all the money you saved on long distance calling since Skype dropped the fees behind North American calls? That didn't happen either.
But, as you'll guess, now Skype will be
Re:Hmm (Score:5, Insightful)
The several million people whose copies only support the current one.