Eavesdropping On Google Voice and Skype 62
Simmons writes with news of research that demonstrated vulnerabilities in Skype and Google Voice that would have allowed attackers to eavesdrop on calls or place unauthorized calls of their own. "The attacks on Google Voice and Skype use different techniques, but essentially they both work because neither service requires a password to access its voicemail system. For the Skype attack to work, the victim would have to be tricked into visiting a malicious Web site within 30 minutes of being logged into Skype. In the Google Voice attack (PDF), the hacker would first need to know the victim's phone number, but Secure Science has devised a way to figure this out using Google Voice's Short Message Service (SMS). Google patched the bugs that enabled Secure Science's attack last week and has now added a password requirement to its voicemail system, the company said in a statement. ... The Skype flaws have not yet been patched, according to James." Reader EricTheGreen contributes related news that eBay may sell Skype back to its original founders.
Not nearly as interesting as you'd expect (Score:4, Interesting)
Unlike security vulnerabilities that gain access to your files and keyboard, this only gets access to your phone calls. This means that the hackers would need a very powerful machine to both monitor and save important calls and a means of automating the scanning of calls.
It's simply not cost effective to listen in on every call. It's much better to gain file or keyboard access and let Perl scan the logs for interesting data.
Re:Not nearly as interesting as you'd expect (Score:5, Funny)
Surely it would be trivial to pipe the calls through some voice recognition software? Then do a text search for 'credit card', 'creedal car', and maybe 'cricket Karl'.
Re: (Score:1, Interesting)
Seriously, though even if your voice recognition software just looked for digits and then passed off segments of conversation that included a long string of digits to a human for further analysis. You'd get a lot of false positives (phone numbers, etc) but you'd at least exclude most casual conversations. If you want to data mine more accurately, just look for exactly 16 digits given over N seconds and make sure they form a valid CC with check digit, etc.
Re: (Score:2)
Seriously, though even if your voice recognition software just looked for digits and then passed off segments of conversation that included a long string of digits to a human for further analysis. You'd get a lot of false positives (phone numbers, etc) but you'd at least exclude most casual conversations. If you want to data mine more accurately, just look for exactly 16 digits given over N seconds and make sure they form a valid CC with check digit, etc.
And the point of all of this is to get a bunch of silly credit card numbers? You REALLY think this would be a profitable attack? It's not exactly "trivial" to run a huge mass of voice through voice recognition with a high enough accuracy to make this useful. Then after that, you end up with a bunch of credit card numbers, and not necessarily a name or expiration date... when there are already a ton of credit card numbers out there that are never used for fraud.
No, attacks like this are far more useful fo
Re: (Score:3, Insightful)
It's simply not cost effective to listen in on every call.
It's most likely not every call. Just by those on the List.
Re: (Score:3, Interesting)
It's most likely not every call. Just by those on the List.
Now that you mention it, I actually pay $5 a month for an identical service from a company called Callwave, [callwave.com] and their voicemail transcription services aren't 100% unlimited unless you pay for a pretty high tier of service. Ironically, the voicemails that I choose to have the service transcribe for me are actually the ones a thief would want most.
This kind of attack into a voice portal is nothing new. I sat down with a fellow who owns a business VoIP telephony service and he showed me how he could alter h
Re: (Score:2)
Hello,
I work for the NSA and we are recruiting for a currently classified project. Could we give you a call?
Re: (Score:2)
Re: (Score:2)
i could still plug any keystroke logger with uneventful data, and still log myself into the bank account I got or plug my cc data online...it all depends on if you force yourself to accept someone is always watching or someone is always logging.
Believe it or not (Score:5, Insightful)
Comment removed (Score:5, Interesting)
Re: (Score:2)
On the Ekiga wiki [ekiga.org] under the heading "Implementation started" one finds "ZRTP (encrypted communication)" suggesting that encryption is being worked on. What exactly were you referring to?
Re: (Score:2)
Re: (Score:1, Interesting)
Re: (Score:1)
1. Read this [slashdot.org].
2. Wonder on Skype diffusion and on lack of encrypted alternatives.
3. Judge by youself.
Do you still want to point out that a mircryption chat session is way easier to set up than an encrypted VOIP call? Well, remember that cold war was just yesterday, at least in some politician's heads.
Re:Believe it or not (Score:5, Insightful)
Luckily* for Linux and Skype users, Skype hasn't been updated in about 2 years, and definitely no 64 bit version. So the vulnerability will be there for who knows how long until Skype (or is it eBay) gets their finger out of their backside and gives Linux/Skype users a better deal.
* Being sarcastic
Re: (Score:2)
Luckily* for Linux and Skype users, Skype hasn't been updated in about 2 years, and definitely no 64 bit version. So the vulnerability will be there for who knows how long until Skype (or is it eBay) gets their finger out of their backside and gives Linux/Skype users a better deal.
* Being sarcastic
So Skype could solve this most easily by patching the Windows client and dropping support for the Linux client, no? Be careful what you wish for.
Re: (Score:2)
Like, for instance, the NSA...
The NSA doesn't need an opportunistic vulnerability. They just secretly order one put in [csmonitor.com].
---
Windows and closed source software. The US intelligence [washingtonpost.com] agencies back door [wikipedia.org] to every network connected country and business on earth.
Skype back to the founders? (Score:2, Interesting)
What I would like to see would be a tight integration of skype, facebook, and google contacts. In android phones or in the iPhone our contacts info
Re: (Score:3, Interesting)
Skype would be worse than the phone companies, because it is controlled centrally by a single organization... At least there are multiple phone companies, they follow standards and you can interoperate between them.
A phone company's monopoly in a particular area is often unavoidable due to the cost of laying physical cables, a monopoly of skype is just completely ridiculous and inexcusable.
Re: (Score:2)
Skype would be worse than the phone companies, because it is controlled centrally by a single organization...
OMG Skype==evil!!!
As if any one of their competitors couldn't gain ground whenever they screw up royally.
Google talk is much more dangerous to your monopoly paranoias than Skype.
Re:Skype back to the founders? (Score:4, Insightful)
Google talk interoperates with other services using XMPP - a published standard... I can talk to google users without having to use their service. People can *choose* to use google's servers and accept the inherent risks, or they can choose not to and still communicate with the same people. I choose not to use their service, but i talk to a few google talk users.
Skype doesn't interoperate with anything, you have to use their service and their client. Once you have sufficient users locked in to the service, using a competitor becomes pointless because everyone you want to talk to is only contactable using skype, at which point they can screw up however they want.
Re: (Score:2)
Once you have sufficient users locked in to the service, using a competitor becomes pointless because everyone you want to talk to is only contactable using skype, at which point they can screw up however they want.
Network effects are powerful, but ask these guys [wikipedia.org] or even these guys [wikipedia.org] if that's a sure guarantee of "screwing up however they want".
Re: (Score:2)
I have heard of those IM clients, and most of them operate on closed proprietary networks, and most of them have strangleholds in various markets tho none has globally... Because none of them interoperate, it becomes necessary to have accounts on all the different services which is just stupid.
Skype have terrible prices when you compare to some of the SIP providers out there...
Apple shit only works with apple shit, but so what? You can completely ignore apple (as many people do) and suffer no ill effects...
Re: (Score:1)
(And now to the part that's gonna get me modded Troll....)
Like clockwork.
Re: (Score:2)
Re:Skype back to the founders? (Score:4, Interesting)
In the US, I was not aware there were multiple phone companies. Wow, you learn something new every day. Last I heard, there was "The Bell Companies" (under a plethora of names - yet still really one massive interrelated entity).
ATT/Bell/Verizon [wikipedia.org]
Then... there are a bunch of phone service resellers; who sell either access onto Bell's phone network (they dont own their own after all) via their POC routers, or Bell's; followed by VOIP providers who still largely have to have their calls transferred onto the Bell phone network for delivery to the non VOIP caller (ie: VOIP->landline call or landline->VOIP call).
And even long distance calls via a carrier that has their own lines, still gets transferred to the local lines, computers and telco switches for delivery to the home(s).
So, as far as I can see, it's VOIP->VOIP that's the only other option to not going through the one telco monopoly in this country.
Re: (Score:3, Informative)
There is a world outside of the US...
You are also thinking of fixed line phones, many people use cellphones for general voice calls these days too.
Here, i have 5 mobile operators to choose from with their own networks (and multiple resellers) and 2 fixed line providers (as well as countless resellers)... Because fixed lines cost more to roll out (ie a monopoly is pretty much unavoidable), the incumbent suppliers are heavily regulated to avoid gouging consumers.
If you want competitive voip, try finding a pro
Re: (Score:2)
I didnt realize that cell phones talked directly to each other... ;-)
But yes, I was talking fixed line phones - since the post I was responding to was - (and the general discussion was talking about VOIP calls - which are usually made from some sort of fixed line connection (Internet from someplace, going through a wire or cable)).
And here, there are a few mobile carriers - they each talk about the wonderful network they use - but yet again, many share the same one(s).
Regardless, they get routed from ce
Re: (Score:2)
I didnt realize that cell phones talked directly to each other... ;-)
They bloody well should and it's always irked me that they don't. Why talk to a cell tower that's 4km away when I'm phoning someone across the street? And why the hell should I *pay* for it?!
Re: (Score:1)
Why the hell did you post that as AC? What you say is entirely true.
I don't have a Facebook account, but my wife does. The amount of time she spends on it is scary, though she is definitely intelligent enough to know that it is only a substitute for real interaction. Skype, however, is a genuinely usef
Re: (Score:2)
Why the hell did you post that as AC? What you say is entirely true.
I didn't [slashdot.org].
Re: (Score:1)
Re: (Score:2)
Unsurprising (Score:5, Insightful)
Anyone expecting privacy on these systems is a fool. It's not like either of these companies is regulated in any way, to say nothing of the fact they provide their services over the Internet which you only have read /. for a day to know is not secure.
Re: (Score:2, Insightful)
Maybe, but not for the reasons you give. You just have to look at AT&T to realize that regulation doesn't give you privacy. And providing a service over the Internet doesn't automatically makes it not secure. Security is a layer that you add if you want it, see SSL for an example.
Re:Unsurprising (Score:5, Funny)
Anyone expecting privacy on these systems is a fool. It's not like either of these companies is regulated in any way, to say nothing of the fact they provide their services over the Internet which you only have read /. for a day to know is not secure.
Exactly. The same goes for traditional cell service. Why just the other day, I was in the grocery store and someone was yacking away about some big business deal in the bread isle. I sat there "shopping" while this guy was talking about financing, etc, etc, etc...
Then, I moved over to the soda isle, this young chicky apparently was having boyfriend troubles and I offered to help but she got all indignant and looks at me like I was a perv or something.
Then, over in the fish isle, this middle aged guy was trying to figure out if he should get the Salmon or the Trout and asking his wife, I think, which should he get. I told him the Trout. Great stuff. Again the funny looks! I don't get it?
The bread isle, this person was pushing their cart talking away and I answered - god I hate those blue tooths! Same thing - weird looks!
I won't tell you about the guy on the street talking really loudly but without and Bluetooth or Cell - he asked me for money.
What was this again about privacy and phone calls? I forgot what we're talking about.
Re: (Score:2, Insightful)
In a used book store, perhaps 8 years ago, I held a conversation with the gentleman next to me for 5 minutes. Then he walked away and kept talking on his phone.
People who talk on cell phones while being checked out are rude. The cashier is a person and deserves the currtacy of your attention over anyone on a phone conversation.
Using a cell phone in public is rude.
Texting/emailing while anyone is talking to you is rude unless they are dictating the contents of the message.
I'm guilty of talking and emailing
Re: (Score:2, Informative)
So am I from time to time, though I usually prefer to let the phone just ring out. The person to whom you're talking is left with a much more favourable impression, and voicemail does the rest.
Re: (Score:2, Funny)
> Then, over in the fish isle
People like you are why I never shop on the islands.
Re: (Score:2)
Considering that the gov't does most of the spying, I don't think that using a regulated company's service will necessarily give you more privacy. In fact, I expect that the gov't has a harder time spying on skype/google conversations than they do regular phone lines.
Re:Unsurprising (Score:4, Insightful)
> Anyone expecting privacy on these systems is a fool. It's not like either of
> these companies is regulated in any way
Amen. As we know, telephone companies that area regulated would never compromise their users' privacy.
Oops! [slashdot.org]
Nerdy solution (Score:5, Funny)
For a minute there I thought there was a problem, but nerds have no friends so nobody calls you on Skype anyway.
Re: (Score:1, Funny)
Man, it's a sad day when even your mom doesn't dare enter her own basement to tell you that lunch is ready.
Cloud apps improve security (Score:5, Insightful)
Once again, we see that cloud apps like Google's Grandcentral have a real benefit to security, despite the sensationalist scare mongering.
When a bug in a cloud based application is identified, it can be patched quickly, in a single location, and the bug disappears. The same cannot be said of locally installed apps (exchange servers, etc) that take years for companies and administrators to eventually get the patches installed.
Re: (Score:2)
And conversely, a locally-installed, open-source application can be patched on-site or by a collaboration between many users while cloud users are at the mercy of their provider.
Not that there's anything that really fits this definition for secure VOIP, but just sayin'.
Re: (Score:1)
So, you're saying that Open Source apps have to wait for someone to fix it, meanwhile cloudies have to wait for someone to fix it? Ah, I see. Don't trust the man!
Re: (Score:2)
And Skype is the counterexample where if the company sits there and does nothing, the consumer is powerless to improve the situation. If the source code were out in the open, a large user base would devise a solution of it's own.
Increasingly I look for p2p communications (Score:1)
Can't you do full video/voice conference, p2p with VideoLAN?
spoofable voicemail carriers (Score:1)
deja vu (Score:1)