Slashdot Log In
More Skype Back Door Speculation
Posted by
CmdrTaco
on Sat Jul 26, 2008 10:11 AM
from the i'm-your-backdoor-man dept.
from the i'm-your-backdoor-man dept.
An anonymous reader writes "According to reports, there may be a back door built into Skype, which allows connections to be bugged. The company has declined to expressly deny the allegations. At a meeting with representatives of ISPs and the Austrian regulator on lawful interception of IP based services held on 25th June, high-ranking officials at the Austrian interior ministry revealed that it is not a problem for them to listen in on Skype conversations."
Related Stories
Submission: Skype back door speculation. by Anonymous Coward
[+]
Your Rights Online: European Crackdown On Skype "Loophole" 230 comments
angry tapir writes "Suspicious phone conversations on Skype could be targeted for tapping as part of a pan-European crackdown on what law authorities believe is a massive technical loophole in current wiretapping laws, allowing criminals to communicate without fear of being overheard by the police. Eurojust, a European Union agency responsible for coordinating judicial investigations across different jurisdictions, has announced the opening of an investigation involving all 27 countries of the European Union."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Open source VoIP alternatives? (Score:4, Interesting)
I don't use Skype (or VoIP for that matter) but I would be curious if anyone knows of any alternatives that is completely open.
Re:Open source VoIP alternatives? (Score:5, Informative)
I don't use Skype (or VoIP for that matter) but I would be curious if anyone knows of any alternatives that is completely open.
I asked the internet, she donned her Stupomitron Helmet, et voilà [wikipedia.org]
Parent
Re:Open source VoIP alternatives? (Score:5, Informative)
An alternative to what? To Skype? To the PSTN? Software running on a PC is always going to be a poor solution, and is far from your only option for Internet voice communication. You do NOT need some app on your PC to do VoIP. What you want is something called an ATA - its a little box that has a jack for a regular phone, and an ethernet port. They are often supplied with service such as Vonage, but are usually 'locked' down to that provider. You can also but them directly, but you will of course still need 'something else' to initiate SIP connections to. For information about real VoIP networks (both net-to-net, as well as PSTN interconnection), visit voip-info.org
Parent
Re:Open source VoIP alternatives? (Score:5, Funny)
Nothing wrong with Skype,
Except that it might have a backdoor... which was kind of the point of this article in the first place.
Parent
Re:Open source VoIP alternatives? (Score:4, Interesting)
Parent
Re:Open source VoIP alternatives? (Score:5, Interesting)
Oh, for the good old days, when you actually needed a warrant.
Now they just get your packets to route across a border, and then can listen in at will [if you're not in the US].
If you do happen to live in the US, they just declare [as in, speak into the air] "This person is obviously an terrorist, an enemy combatant not in an official uniform, therefore, I can listen to all their phone calls.". Then the phone and/or VOIP company is required to permit the wiretap. This used to require a photocopied letter, but those were just too much of a hassle to carry around...
Parent
Re:Open source VoIP alternatives? (Score:4, Insightful)
Parent
Re:Open source VoIP alternatives? (Score:5, Insightful)
Two words: Network Effect [wikipedia.org]. All the alternatives I have reviewed are harder than skype. Harder to download, setup, use, the list goes on.
Result: Skype is popular - they nailed delivery to the "masses". No screwing around with the microphone, NAT/firewalls, SIP providers, names etc etc. The average joe can just download and install it in just two url clicks, type in a name and begin to use it. Done deal.
All the open source VOIP (most of them SIP) I have seen completely miss this most important point, and so all their development effort is ultimately wasted - walled themselves off to the technically proficient crowd and not benefiting from the network effect.
Parent
Re:Open source VoIP alternatives? (Score:5, Informative)
And the network effect no longer applies if Ekiga users can call Skype users (And they can [tmcnet.com]).
Parent
Re: (Score:3, Informative)
I don't use Skype (or VoIP for that matter) but I would be curious if anyone knows of any alternatives that is completely open.
For Linux there's a decent program called I Hear You (IHU), very simple program, GPL-licensed etc., you can find it at http://ihu.sourceforge.net/ [sourceforge.net]
Re: (Score:3, Informative)
VoIP/SIP is open.
You only need a client [voip-info.org] and an account with any of the free SIP providers. Or you setup asterisk (or another free PBX software) and become your own provider.
The problem with SIP is that few people actually use it whereas skype is everywhere.
Re:Open source VoIP alternatives? (Score:5, Informative)
Several orders of magnitude more daily minutes are done with SIP than Skype. SIP is used for corporate networks and calling card providers and lots of other situations.
Parent
Re:Open source VoIP alternatives? (Score:4, Insightful)
Parent
Re:Open source VoIP alternatives? (Score:4, Informative)
FreeSWITCH (www.freeswitch.org) is completely open, is MPL licensed and supports TLS & SRTP. Make sure you get the right phone with the right firmware because not all phones properly support TLS & SRTP. Ask in the #freeswitch irc channel on freenode.net or the FreeSWITCH mailing list which phones are known to work.
Asterisk has support for TLS in their development tree. Afaik their SRTP support is an untested patch in the bugtracker. At this point in time Asterisk does not seem to offer a working, stable TLS & SRTP solution.
Parent
Re:Open source VoIP alternatives? (Score:4, Informative)
Parent
Re:Open source VoIP alternatives? (Score:5, Informative)
"Unlike its competitor network Skype, the Gizmo5 network uses open standards for call management, the Session Initiation Protocol and Jabber."
Parent
Re:Open source VoIP alternatives? (Score:5, Informative)
using an open standard is not the same thing as being "open source" or "completely open"
Parent
Re: (Score:3, Interesting)
Granted, but Gizmo5 is only a software program that interfaces with the SIP-based network. You can (and I have) used Ekiga as the software front-end that works with an account.
The only downside is that there isn't any encryption, so it'd be pretty trivial to bug.
Re:Open source VoIP alternatives? (Score:4, Insightful)
The only downside is that there isn't any encryption, so it'd be pretty trivial to bug.
I'd say that's a pretty huge downside, given the context in which the question was asked!
Parent
Re: (Score:3, Informative)
If I remember correctly there is at least two solutions to that.
ZRTP are one.
http://swik.net/encryption+sip [swik.net]
http://en.wikipedia.org/wiki/ZRTP [wikipedia.org]
Try OpenWengo (Score:3, Informative)
Re: (Score:3, Informative)
VOIP is peer-to-peer. A server is only used for matchmaking, and bandwidth is minimal.
Besides, OSS != guy in basement. Mozilla, Canonical and Red Hat somehow manage to pay for a few servers and a bit of bandwidth.
Re: (Score:3, Informative)
Re:Open source VoIP alternatives? (Score:5, Insightful)
Why must EVERY conversation on privacy boil down to a few tired questions about "open source" alternatives ?
Because open source alternatives shouldn't have backdoors. And if it does they can be identified and closed. The only reason the conversation is tiresome is because proprietary software seems to have a perpetual stream of backdoors that keep keep bringing it up.
What, like if the source code is open, then that will prevent backdoors ? Erm hello, the client software isn't the problem, it's the network of Skype servers the bloody data passes through that is the weak point in the equation.
Nobody intelligent is asking for an oss skype client. They are asking for an oss replacement to the entire skype service. For precisely the reason you stated.
So who do you trust more with your privacy ? A multi million dollar company, or some nerd in his moms basement, acting as a VOIP connectivity server.
If that nerd is just hosting as a connection service, and the voip data stream itself is end-to-end encrypted and is actually transmitted directly to the recipient, then I trust the nerd in the basement more, because he never even sees the stream, and even if he did, its encrypted.
At least as long as I know I'm -really- using the public key of the called party to encrypt it, that is. But that is biggest weakness of almost all internet uses of encryption.
In my case, I'd chose option "none of the above", but really ... open source is not the answer to ALL the worlds ills.
Not all of them. But it is the answer to this one.
Parent
Re:Open source VoIP alternatives? (Score:5, Informative)
Because something like this will be audited if at all possible. Skype is closed, the binary is encrypted, it auto-exits in the presence of debuggers, and does various other things to prevent reverse-engineering. And, still, someone at BlackHat took it apart and found a remote vulnerability. If it were open source and popular, a lot more people would be poking it for holes.
More important than open source, here, is open standards. In an open standard, lots of cryptographers will look at the protocol for holes without considering the implementation details, and lots of others will look for holes in specific implementations. Implementation-related holes (such as the heap-overflow exploit in Skype) will not affect as many people, because there will be competing implementations and not everyone will be locked in to a single provider. If the hole is in the protocol (and allowing a midpoint to intercept the conversation is a hole in the protocol) then it is more likely to be found if the protocol is subject to peer review, which things like SRTP (which SIP can run on top of) have been.
Parent
Brought to you by closed source (Score:5, Insightful)
Re:Brought to you by closed source (Score:5, Insightful)
You know that as soon as some really unbreakable OSS project takes the place of skype, someone will jump up and claim that OSS is promoting terrorism since it keeps the feds from snooping at you?
What's scary is that a lot of people will nod their head and agree...
Parent
Re: (Score:3, Interesting)
I'd imagine on both sides the command would look like this:
ssh joe@someplace.net 'cat >
Obviously I don't know the exact device name, and you might have to use some other program to read in from the mic and such. IF the connection is slow/choppy, use speex. You should still even be able to do it from the command line, assumi
Re: (Score:3, Funny)
You're promoting terrorism because you're making a stupid "you know that as soon as X happens, people will say Y" doomsaying remark.
There, saved some time.
Re: (Score:3, Insightful)
I'm not saying snooping on my calls is a good thing. However, I don't think free software is the answer here. I make calls from my computer to a land line, how can I prevent my provider, Skype or not, from eavesdropping on my conversations? You don't expect me to convince all my contacts to start using their computer to receive calls, do you?
Problematic. (Score:5, Funny)
Ah, shit.
yes (Score:5, Informative)
Disassembly anyone? (Score:3, Insightful)
I know it's tedious work, but some people actually seem to like it. Isn't it time that people disassemble these suspected binaries in order to issue a report on the matter? Not only on Skype, but on many other suspected programs, libraries and operating systems?
Re:Disassembly anyone? (Score:5, Informative)
If it was easy, someone would have done it by now, and made Gnype, don't you think?
Parent
Re:Disassembly anyone? (Score:5, Insightful)
I don't think competitive code is as much of a threat as simply knowing what the code does is a threat.
I have read through a good portion of the PDF and I agree that the analysis of the breakdown and all of the measures Skype makes to conceal what it's doing are both impressive and worrisome. I suppose, perhaps, an alternative measure might be for some sort of "computing trustworthiness" scale to be created where the worst offenders (like Skype) are ranked as "potentially dangerous" until they [Skype] clears the matter up.
I suppose in the presence of such a [subjective?] scale, there would be a huge list of programs and applications deemed to be offensive in this way, but perhaps a black list such as this could be useful in attempting to get software a bit more open than it is today? After all, if you could cite an application as "2 out of 10" on the trustworthiness scale as a reason not to purchase, people might begin to take notice. I think a scale like this, whether subjective or not, would enable the technically uninterested to read these 'executive summaries' of information and make better decisions -- making it easier for the public to make more informed choices.
Would lawsuits result? Of course. But the lawsuits against RBLs once happened frequently before people decided it was better to just take measures to stay off the lists. Consumer Reports once found itself at the receiving end of legal actions and demands (and probably still does) but in the end, it's worth the effort they make as they are generally accepted as a trustworthy source. We need a Consumer Reports for software that exposes the privacy and security concerns that different software poses.
I know this stuff about Skype has given me reason to pause, but that's just me... I can sort of read and understand most of what I read here. But how about the rest of the uninformed? How can we get the point across to them?
Parent
Re: (Score:3, Funny)
Does skype like back door action? (Score:5, Funny)
Do I have a volunteer from the
No possible way to disprove the claim (Score:3, Interesting)
With closed source and closed protocol specifications there is no way to disprove the claim of an existing backdoor. Regardless of wether there really exist a backdoor or not. Simple but true and it is the drawback of wanting to provide security in a closed source environment.
Skype Monitoring & Staying Anonymous (Score:4, Insightful)
All you have to know to monitor someone's Skype is their password. Login with Skype on another machine, set status to invisible. Anything they type or receive in chat you receive.
1. For IM: Jabber (non-US server) + OTR Plugin + Tor. ... and we don't do waterboarding here) (I hope)
2. For everything else (email/vpn/storage) services as provided by www.xerobank.com will do you good.
3. TrueCrypt Full Drive Encryption. (Check your local laws - under Dutch law they cannot force me to give up the passwords
that's not a surprise (Score:5, Insightful)
You can be sure that these people are also trying to:
You can be equally certain that they are not doing it right and that the backdoors they are trying to put in make your system less secure.
Running open source software is your best bet, but even there, you aren't completely protected.
Of course it's bugged. (Score:5, Insightful)
Assume all communication that uses any kind of monitorable infrastructure is bugged. The capacity is there, and the desire is there.
It is the way of things.
Source secret problem (Score:5, Insightful)
This is going to be a problem with any so called "secure" communication system that relies on source secret clients and unpublished protocols.
There are many ways to build such clients to "assist" external intercept, since they often have to first communicate with some central server to locate users. They could for example have a command that forces the client to always route back through the server (like they do for NAT), and use a simple data transformation rather than full encryption so casual packing snooping makes it "appear" encrypted when it is actually not.
They might also have flaws in their implimentation, particularly with key exchange, that allows an invisible man in the middle. The ZRTP stuff developed by Phil Zimmerman that we use in GNU Telephony secure calling uses extra steps to compute a sas to validate there are not fake public session keys given out by a man in the middle, for one example of how such flaws can effect otherwise "secure in appearence" systems.
Of course, even secure peer-reviewed protocols and foss clients do not gaurantee security. For example, one can tether a bunch of ZRTP softphones to an Asterisk server using PBX enrollment, but this enables and requires said server to decrypt all traffic as it passes through, as it acts as a "trusted" man-in-the-middle.
In the end, the best solution, even with ZRTP, remains using pure peer-to-peer (end-to-end) media connections, and when needed transparent proxy media exchange; the latter for dealing with NAT. In ZRTP, sas negotiation assures any such proxy used for NAT "remains" transparent.
In the case of Skype, source secret clients that can report false call information and source secret protocols are a clear recipe for disaster.
SIP Skype (Score:3, Informative)
Asterisk+SIP+Ekiga is not a good replacement for Skype:
Add to this that Skype has existed for a large number of years (5 years is "long" in "internet time") and it's not exactly known as a big medium for spreading viruses, hack attacks, etc. and you'll realize that security through obscurity actually can work. Of course, past trends are not indication of future behaviour, but you can't argue with results.
Skypes Own Comment (Score:4, Funny)
If you go to the options of the Skype client under the 'Chat Appearance' settings, do have a look at the sample chat displayed. I quote:
-Does Big Brother exist?
-of course he exists. The Party exists. Big Brother is the embodiment of the party
-Does he exist in the same way as I exist?
-You do not exist
-I think I exist. I am conscious of my own identity. I was born and I shall die. I have arms and legs. I occupy a particular point in space. No other solid object can occupy the same point simultaneously. In that sense, does Big Brother exist?
-It is of no importance. He exists.
To me this is quite conclusive.
What keeps me with Skype (Score:5, Insightful)
What keeps me with Skype is that I can have US telephone number. So no matter where I am my friends and family can call me.
If there was another service which allowed me to have a US telephone number for incoming calls and let me call any other POTS number I'd use it.
Re:What keeps me with Skype (Score:4, Informative)
A quick search revealed a bunch of companies. Here are some:
http://sipnumber.com/ [sipnumber.com]
http://www.ipkall.com/ [ipkall.com]
http://www.freedigits.com/ [freedigits.com]
Those are free services. The last one seems to have problems, though. :)
Paid services exist, too. Just google it
Parent
I've long figured there had to be a back door (Score:5, Insightful)
Therefore, if the Chinese have no problem with Skype, Skype must have a back door.
Re:Decode the protocol? (Score:5, Informative)
Parent
Re:Decode the protocol? (Score:5, Interesting)
Parent
Re: (Score:3, Funny)
Speaking as an Aussie there are lots of locals who still manage to confuse "The sound of music" with Guy Sebastian.