Forgot your password?
typodupeerror
Communications Google Security

Eavesdropping On Google Voice and Skype 62

Posted by Soulskill
from the can-i-hear-you-now dept.
Simmons writes with news of research that demonstrated vulnerabilities in Skype and Google Voice that would have allowed attackers to eavesdrop on calls or place unauthorized calls of their own. "The attacks on Google Voice and Skype use different techniques, but essentially they both work because neither service requires a password to access its voicemail system. For the Skype attack to work, the victim would have to be tricked into visiting a malicious Web site within 30 minutes of being logged into Skype. In the Google Voice attack (PDF), the hacker would first need to know the victim's phone number, but Secure Science has devised a way to figure this out using Google Voice's Short Message Service (SMS). Google patched the bugs that enabled Secure Science's attack last week and has now added a password requirement to its voicemail system, the company said in a statement. ... The Skype flaws have not yet been patched, according to James." Reader EricTheGreen contributes related news that eBay may sell Skype back to its original founders.
This discussion has been archived. No new comments can be posted.

Eavesdropping On Google Voice and Skype

Comments Filter:
  • by BadAnalogyGuy (945258) <BadAnalogyGuy@gmail.com> on Sunday April 12, 2009 @12:50PM (#27549277)

    Unlike security vulnerabilities that gain access to your files and keyboard, this only gets access to your phone calls. This means that the hackers would need a very powerful machine to both monitor and save important calls and a means of automating the scanning of calls.

    It's simply not cost effective to listen in on every call. It's much better to gain file or keyboard access and let Perl scan the logs for interesting data.

    • by Anonymous Coward on Sunday April 12, 2009 @01:17PM (#27549435)

      Surely it would be trivial to pipe the calls through some voice recognition software? Then do a text search for 'credit card', 'creedal car', and maybe 'cricket Karl'.

      • Re: (Score:1, Interesting)

        by Anonymous Coward

        Seriously, though even if your voice recognition software just looked for digits and then passed off segments of conversation that included a long string of digits to a human for further analysis. You'd get a lot of false positives (phone numbers, etc) but you'd at least exclude most casual conversations. If you want to data mine more accurately, just look for exactly 16 digits given over N seconds and make sure they form a valid CC with check digit, etc.

        • by bhiestand (157373) *

          Seriously, though even if your voice recognition software just looked for digits and then passed off segments of conversation that included a long string of digits to a human for further analysis. You'd get a lot of false positives (phone numbers, etc) but you'd at least exclude most casual conversations. If you want to data mine more accurately, just look for exactly 16 digits given over N seconds and make sure they form a valid CC with check digit, etc.

          And the point of all of this is to get a bunch of silly credit card numbers? You REALLY think this would be a profitable attack? It's not exactly "trivial" to run a huge mass of voice through voice recognition with a high enough accuracy to make this useful. Then after that, you end up with a bunch of credit card numbers, and not necessarily a name or expiration date... when there are already a ton of credit card numbers out there that are never used for fraud.

          No, attacks like this are far more useful fo

    • Re: (Score:3, Insightful)

      by Jurily (900488)

      It's simply not cost effective to listen in on every call.

      It's most likely not every call. Just by those on the List.

      • Re: (Score:3, Interesting)

        by RulerOf (975607)

        It's most likely not every call. Just by those on the List.

        Now that you mention it, I actually pay $5 a month for an identical service from a company called Callwave, [callwave.com] and their voicemail transcription services aren't 100% unlimited unless you pay for a pretty high tier of service. Ironically, the voicemails that I choose to have the service transcribe for me are actually the ones a thief would want most.

        This kind of attack into a voice portal is nothing new. I sat down with a fellow who owns a business VoIP telephony service and he showed me how he could alter h

    • Hello,

      I work for the NSA and we are recruiting for a currently classified project. Could we give you a call?

    • by s_p_oneil (795792)
      Actually, it's pretty easy for an organization like the NSA to detect which Skype users are logged into which IP without a powerful machine, which lets them listen in on just the Skype users they're interested in. Or they can just scan calls going to/from IP ranges they're interested in (i.e. from the US to North Korea). The hard part is getting all the Skype users to visit the malicious web site.
    • i could still plug any keystroke logger with uneventful data, and still log myself into the bank account I got or plug my cc data online...it all depends on if you force yourself to accept someone is always watching or someone is always logging.

  • Believe it or not (Score:5, Insightful)

    by Landak (798221) <Landak@gmail.com> on Sunday April 12, 2009 @01:14PM (#27549415) Homepage
    Believe it or not, Skype carries the second largest number of international calls in the world, second only to AT&T. With a volume like that, you'd imagine that any potential vulnerability may well find someone interested in applying it, very quickly. Like, for instance, the NSA...
    • Re:Believe it or not (Score:5, Interesting)

      by CRCulver (715279) <crculver@christopherculver.com> on Sunday April 12, 2009 @01:19PM (#27549449) Homepage
      Skype has already been accused of having a half-assed approach to security in order to appease government agencies. It's a pity that there's no widely available encrypted voice applications. A decade ago when the nerd community was toying with PGPfone, it seemed like widespread encrypted telephony was right around the corner. Ekiga announced encryption for the 3.0 release, but then quietly buried those plans, and as nice as it is to have easy encryption in Pidgin, the app remains limited to text chat.
      • by jbn-o (555068)

        Ekiga announced encryption for the 3.0 release, but then quietly buried those plans

        On the Ekiga wiki [ekiga.org] under the heading "Implementation started" one finds "ZRTP (encrypted communication)" suggesting that encryption is being worked on. What exactly were you referring to?

        • by CRCulver (715279)
          That was intended for 3.0, which was already released months ago.
          • Re: (Score:1, Interesting)

            by Anonymous Coward
            It is possible, though, that the NSA, fearing that Ekiga will become popular for security-conscious VOIP users, is forcing the Ekiga team to not include it at all, but simply keep delaying it, under threats of death or imprisonment.
            • by xded (1046894)
              Parent sounds paranoid?

              1. Read this [slashdot.org].
              2. Wonder on Skype diffusion and on lack of encrypted alternatives.
              3. Judge by youself.

              Do you still want to point out that a mircryption chat session is way easier to set up than an encrypted VOIP call? Well, remember that cold war was just yesterday, at least in some politician's heads.
    • by Wowsers (1151731) on Sunday April 12, 2009 @01:44PM (#27549563) Journal

      Luckily* for Linux and Skype users, Skype hasn't been updated in about 2 years, and definitely no 64 bit version. So the vulnerability will be there for who knows how long until Skype (or is it eBay) gets their finger out of their backside and gives Linux/Skype users a better deal.

      * Being sarcastic

      • Luckily* for Linux and Skype users, Skype hasn't been updated in about 2 years, and definitely no 64 bit version. So the vulnerability will be there for who knows how long until Skype (or is it eBay) gets their finger out of their backside and gives Linux/Skype users a better deal.

        * Being sarcastic

        So Skype could solve this most easily by patching the Windows client and dropping support for the Linux client, no? Be careful what you wish for.

    • by bit01 (644603)

      Like, for instance, the NSA...

      The NSA doesn't need an opportunistic vulnerability. They just secretly order one put in [csmonitor.com].

      ---

      Windows and closed source software. The US intelligence [washingtonpost.com] agencies back door [wikipedia.org] to every network connected country and business on earth.

  • Well, if Skype is going back to the founders, I guess that's good. eBay never did anything really interesting with it anyways. I don't understand why skype let other social networking sites (yes, that's what skype is, and it fosters an even closer-knit community than facebook or others ever will, as people actually _talk_ to others, as opposed to poking them.

    What I would like to see would be a tight integration of skype, facebook, and google contacts. In android phones or in the iPhone our contacts info

    • Re: (Score:3, Interesting)

      by Bert64 (520050)

      Skype would be worse than the phone companies, because it is controlled centrally by a single organization... At least there are multiple phone companies, they follow standards and you can interoperate between them.

      A phone company's monopoly in a particular area is often unavoidable due to the cost of laying physical cables, a monopoly of skype is just completely ridiculous and inexcusable.

      • by linhares (1241614)

        Skype would be worse than the phone companies, because it is controlled centrally by a single organization...

        OMG Skype==evil!!!

        As if any one of their competitors couldn't gain ground whenever they screw up royally.

        Google talk is much more dangerous to your monopoly paranoias than Skype.

        • by Bert64 (520050) <bert@noSPam.slashdot.firenzee.com> on Sunday April 12, 2009 @05:37PM (#27550821) Homepage

          Google talk interoperates with other services using XMPP - a published standard... I can talk to google users without having to use their service. People can *choose* to use google's servers and accept the inherent risks, or they can choose not to and still communicate with the same people. I choose not to use their service, but i talk to a few google talk users.

          Skype doesn't interoperate with anything, you have to use their service and their client. Once you have sufficient users locked in to the service, using a competitor becomes pointless because everyone you want to talk to is only contactable using skype, at which point they can screw up however they want.

          • by linhares (1241614)

            Once you have sufficient users locked in to the service, using a competitor becomes pointless because everyone you want to talk to is only contactable using skype, at which point they can screw up however they want.

            Network effects are powerful, but ask these guys [wikipedia.org] or even these guys [wikipedia.org] if that's a sure guarantee of "screwing up however they want".

      • by MrMarket (983874)
        How does skype have a monopoly? They are not the only company offering voice and video chat.
      • by RobertM1968 (951074) on Sunday April 12, 2009 @04:38PM (#27550503) Homepage Journal

        In the US, I was not aware there were multiple phone companies. Wow, you learn something new every day. Last I heard, there was "The Bell Companies" (under a plethora of names - yet still really one massive interrelated entity).

        ATT/Bell/Verizon [wikipedia.org]

        Then... there are a bunch of phone service resellers; who sell either access onto Bell's phone network (they dont own their own after all) via their POC routers, or Bell's; followed by VOIP providers who still largely have to have their calls transferred onto the Bell phone network for delivery to the non VOIP caller (ie: VOIP->landline call or landline->VOIP call).

        And even long distance calls via a carrier that has their own lines, still gets transferred to the local lines, computers and telco switches for delivery to the home(s).

        So, as far as I can see, it's VOIP->VOIP that's the only other option to not going through the one telco monopoly in this country.

        • Re: (Score:3, Informative)

          by Bert64 (520050)

          There is a world outside of the US...

          You are also thinking of fixed line phones, many people use cellphones for general voice calls these days too.

          Here, i have 5 mobile operators to choose from with their own networks (and multiple resellers) and 2 fixed line providers (as well as countless resellers)... Because fixed lines cost more to roll out (ie a monopoly is pretty much unavoidable), the incumbent suppliers are heavily regulated to avoid gouging consumers.

          If you want competitive voip, try finding a pro

          • I didnt realize that cell phones talked directly to each other... ;-)

            But yes, I was talking fixed line phones - since the post I was responding to was - (and the general discussion was talking about VOIP calls - which are usually made from some sort of fixed line connection (Internet from someplace, going through a wire or cable)).

            And here, there are a few mobile carriers - they each talk about the wonderful network they use - but yet again, many share the same one(s).

            Regardless, they get routed from ce

            • by fractoid (1076465)

              I didnt realize that cell phones talked directly to each other... ;-)

              They bloody well should and it's always irked me that they don't. Why talk to a cell tower that's 4km away when I'm phoning someone across the street? And why the hell should I *pay* for it?!

    • ...other social networking sites (yes, that's what skype is, and it fosters an even closer-knit community than facebook or others ever will, as people actually _talk_ to others, as opposed to poking them...

      Why the hell did you post that as AC? What you say is entirely true.

      I don't have a Facebook account, but my wife does. The amount of time she spends on it is scary, though she is definitely intelligent enough to know that it is only a substitute for real interaction. Skype, however, is a genuinely usef
  • Unsurprising (Score:5, Insightful)

    by Alcoholist (160427) on Sunday April 12, 2009 @01:20PM (#27549459) Homepage

    Anyone expecting privacy on these systems is a fool. It's not like either of these companies is regulated in any way, to say nothing of the fact they provide their services over the Internet which you only have read /. for a day to know is not secure.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Anyone expecting privacy on these systems is a fool.

      Maybe, but not for the reasons you give. You just have to look at AT&T to realize that regulation doesn't give you privacy. And providing a service over the Internet doesn't automatically makes it not secure. Security is a layer that you add if you want it, see SSL for an example.

    • by Samschnooks (1415697) on Sunday April 12, 2009 @01:49PM (#27549585)

      Anyone expecting privacy on these systems is a fool. It's not like either of these companies is regulated in any way, to say nothing of the fact they provide their services over the Internet which you only have read /. for a day to know is not secure.

      Exactly. The same goes for traditional cell service. Why just the other day, I was in the grocery store and someone was yacking away about some big business deal in the bread isle. I sat there "shopping" while this guy was talking about financing, etc, etc, etc...

      Then, I moved over to the soda isle, this young chicky apparently was having boyfriend troubles and I offered to help but she got all indignant and looks at me like I was a perv or something.

      Then, over in the fish isle, this middle aged guy was trying to figure out if he should get the Salmon or the Trout and asking his wife, I think, which should he get. I told him the Trout. Great stuff. Again the funny looks! I don't get it?

      The bread isle, this person was pushing their cart talking away and I answered - god I hate those blue tooths! Same thing - weird looks!

      I won't tell you about the guy on the street talking really loudly but without and Bluetooth or Cell - he asked me for money.

      What was this again about privacy and phone calls? I forgot what we're talking about.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        In a used book store, perhaps 8 years ago, I held a conversation with the gentleman next to me for 5 minutes. Then he walked away and kept talking on his phone.

        People who talk on cell phones while being checked out are rude. The cashier is a person and deserves the currtacy of your attention over anyone on a phone conversation.

        Using a cell phone in public is rude.

        Texting/emailing while anyone is talking to you is rude unless they are dictating the contents of the message.

        I'm guilty of talking and emailing

        • Re: (Score:2, Informative)

          by BrokenHalo (565198)
          I'm guilty of talking and emailing when I should be carefully listening to another person.

          So am I from time to time, though I usually prefer to let the phone just ring out. The person to whom you're talking is left with a much more favourable impression, and voicemail does the rest.
      • Re: (Score:2, Funny)

        by mattwarden (699984)

        > Then, over in the fish isle

        People like you are why I never shop on the islands.

    • by tukang (1209392)
      It's not like either of these companies is regulated in any way

      Considering that the gov't does most of the spying, I don't think that using a regulated company's service will necessarily give you more privacy. In fact, I expect that the gov't has a harder time spying on skype/google conversations than they do regular phone lines.

    • Re:Unsurprising (Score:4, Insightful)

      by mattwarden (699984) on Sunday April 12, 2009 @03:42PM (#27550139) Homepage

      > Anyone expecting privacy on these systems is a fool. It's not like either of
      > these companies is regulated in any way

      Amen. As we know, telephone companies that area regulated would never compromise their users' privacy.

      Oops! [slashdot.org]

  • by Wowsers (1151731) on Sunday April 12, 2009 @01:34PM (#27549521) Journal

    For a minute there I thought there was a problem, but nerds have no friends so nobody calls you on Skype anyway.

  • by Alascom (95042) on Sunday April 12, 2009 @03:02PM (#27549963)

    Once again, we see that cloud apps like Google's Grandcentral have a real benefit to security, despite the sensationalist scare mongering.

    When a bug in a cloud based application is identified, it can be patched quickly, in a single location, and the bug disappears. The same cannot be said of locally installed apps (exchange servers, etc) that take years for companies and administrators to eventually get the patches installed.

    • And conversely, a locally-installed, open-source application can be patched on-site or by a collaboration between many users while cloud users are at the mercy of their provider.

      Not that there's anything that really fits this definition for secure VOIP, but just sayin'.

      • by whoop (194)

        So, you're saying that Open Source apps have to wait for someone to fix it, meanwhile cloudies have to wait for someone to fix it? Ah, I see. Don't trust the man!

    • And Skype is the counterexample where if the company sits there and does nothing, the consumer is powerless to improve the situation. If the source code were out in the open, a large user base would devise a solution of it's own.

  • for everything. E-mail is insecure. Service-based VoIP is insecure. Video conferencing via google or skype is going to be insecure since it disappears somewhere in a google/skype cloud.

    Can't you do full video/voice conference, p2p with VideoLAN?

  • You think google voice or skype are bad, go find someone with a youmail or a phonetag account. Spoof the callerID and dial into their voicemail access number. No pin required.
  • Sounds like the cyberspace equivalent of a handset and a couple of alligator clips. Solution: Just don't talk about sensitive stuff over the phone.

1 Billion dollars of budget deficit = 1 Gramm-Rudman

Working...