NSA offering 'billions' for Skype eavesdrop solution

http://www.theregister.co.uk/2009/02/12/nsa_offers_billions_for_skype_pwnage/

by CaptainMorgan • 17 years ago

53 61 17 years ago

theregister.co.uk

In other news, Google is launching a free phone service called Google Voice. Perhaps this is their monetization strategy.

g__g2• 17 years ago

Adding to the urban ledgend i've heard so many times: "google is the NSA" :)

yters• 17 years ago

And so is facebook too, donchaknow? Given that HN attracts all the smartest people who would probably figure this stuff out, I'd wager that pg is really a CIA operative. In fact, I suspect Microsoft is as well. I mean, if you are the NSA, what better way is there of looking at everyone's personal, electronic data?

ftse• 17 years ago

You only need to read a few books on the history of spying to know GCHQ, NSA et al have repeatedly made major technological breakthroughs and kept them hushed up to exploit a new edge over their adversaries. You wouldn't expect them to say Skype was easily compromised, would you? They would say the opposite.

alecco4• 17 years ago

The Register on Cryptography and Security is always a good laugh.

tptacek9• 17 years ago

Actually, Dan Goodin at The Reg is a really credible industry reporter, who really does do actual reporting. This runs under someone else's byline, though.

There's no actual publication (outside of academia) that is good on crypto.

alecco4• 17 years ago

OK: s/always/often/

mixmax• 17 years ago

What about Bruce Schneier's blog? I'm not into crypto so asking out of curiosity.

asciilifeform3• 17 years ago

This can only mean that they have already broken the Skype encryption - and want their opponents to use it.

cdr• 17 years ago

They don't need to break it, Skype already offers backdoor access for governments.

MikeCapone2• 17 years ago

Has this really been established, or is it just presumed?

I vaguely remember reading something about the skype team saying they would "cooperate" with law enforcement officials, but I'm not sure if that meant actually listening in on encrypted conversations or just sharing the IPs and time of connections to servers.

brl6• 17 years ago

In the US they are probably required to provide CALEA interception capabilities to law enforcement for their dial-out service, but I doubt they have some secret interception backdoor in the software itself.

If somebody who is reverse engineering Skype found it, and it would eventually be found, the company would be ruined.

brl6• 17 years ago

Are you sure it can't mean anything but that?

Are you sure that the best way to hide the fact that you have found an attack against Skype is to advertise a contest with a billion dollar reward to anybody who can find the same attack (or any other one)?

asciilifeform3• 17 years ago

> Are you sure that the best way to hide the fact that you have found an attack against Skype is to advertise a contest with a billion dollar reward

Can you think of a better way?

maw• 17 years ago

It can "only mean" that? No way, José.

I'm absolutely positive, no doubts whatsoever, totally sure that it means that they can't but by saying that they can't they're trying to get you to think that they can and want their opponents to use something else.

My reasoning is iron-clad.

tptacek9• 17 years ago

Does anyone here actually believe that the NSA would pay billions to crack the protocol for an app that runs primarily on Windows machines?

cperciva• 17 years ago

Not billions, but I could certainly imagine them paying millions if someone provided them with a passive break.

Much easier to tap a few fibre optic cables (either with or without the cooperation of telcos) than to crack individual systems -- and the risk of discovery is much less, too.

tptacek9• 17 years ago

Sure. But that's not what the report said. People have all sorts of crazy stories about what the NSA did or didn't say. I think this one is BS.

brl6• 17 years ago

What does Windows have to do with anything?

The NSA is hoovering up packets at AT&T switching stations and now they want to listen to some encrypted phone calls.

Here's my interpretation of the offer. They have no intention of paying for an attack. If somebody attempts to claim the reward they will say "Oh, no thanks, we don't really want your attack" and then rediscover the attack themselves.

tptacek9• 17 years ago

The overwhelming majority of "persons of interest" using Skype are on Windows, but substitute any other OS and the equation is no different: you're suggesting that the NSA would pay billions of dollars for a break in a protocol that runs exclusively on endpoints that the NSA can get a shell on at will.

CaptainMorgan3• 17 years ago

I run Linux and use Skype, it's available for Mac's too... why the assumption that Windows is the main player?

http://www.skype.com/download/skype/linux/choose/?cm_sp=sv|d...

But I like brl's interpretation...

g__g2• 17 years ago

I use it on linux too and know way too many people who use it on Macs. I agree, its not quite right to limit it to Windows.

edfrghjk• 17 years ago

The problem with skype isn't listening in on the calls, it's finding the links between people.

The P2P nature of Skype makes it difficult to identify links of bad guys (or innocent guys that happen to be in the wrong place wrong time).

Listening in on calls isn't that useful - unless you know that "the goose flies south for winter" means we attack at dawn.

tptacek9• 17 years ago

As a practitioner I would be shocked (shocked!) if there wasn't a way within the Skype protocol to pop a shell on anyone running a Skype-branded Skype client.

whughes• 17 years ago

What kind of communication app worth cracking would not run primarily on Windows machines? That's practically a prerequisite to widespread use.

slater• 17 years ago

That's bizarre, considering Skype already has built-in hooks for the police force to use

sdfx• 17 years ago

Heise reported last year that the Austrian police is able to listen in on Skype connections. Neither Austria nor Skype confirmed or denied the story back then.

http://www.heise.de/english/newsticker/news/113353

tdonia• 17 years ago

this sounds like a diversion - it doesn't address what would seem to be a much larger problem of knowing which conversations are worth listening to. also wouldn't help establish the context of the conversation/decode its actual meaning.

bluishgreen• 17 years ago

Related: http://zfoneproject.com/faq.html (from the creator of PGP software)

emilis_info• 17 years ago

Thanks for the link.

The Zfone FAQ page mentions, that Skype uses VBR codec for audio which is insecure:

"Johns Hopkins University researchers have observed that when voice is compressed with a variable bit-rate (VBR) codec, the packet lengths vary depending on the types of sounds being compressed. This leaks a lot of information about the content even if the packets are encrypted, regardless of what encryption protocol is used. We strongly recommend that you avoid using VBR codecs if you want to make a secure phone call.

<...>

...This means that Skype is vulnerable to VBR leakage regardless of the quality of Skype's built-in crypto."

omfut• 17 years ago

Iam not sure if NSA is serious about the money. However, iam sure NSA can force skype to provide them with the encryption algorithm for wiretapping. So instead of spending billions of money on third-party vendor, they might as well can work with skype. My 2 cents

CaptainMorgan3• 17 years ago

How are you sure? It's not a U.S. based company- it doesn't appear NSA would have any holding over it.

"The company won't disclose details of its encryption, either, and isn't required to as it is Europe based."

Hence, their alleged offering of "billions".

whatusername• 17 years ago

Didn't they get bought by Ebay? Aren't ebay US based?

bprater• 17 years ago

Offering "billions" sounds a bit ridiculous. Wouldn't you start with a couple million and see if there are any contenders before you break out the big blank check? Something's fishy...

Andys• 17 years ago

Isn't it enough money to just pay for the phone calls?

See the headlines now - NSA offers free VOIP service - no payment necessary, no advertising, just the fact that you have to be OK with them listening in on your calls.

braindead_in2• 17 years ago

By its very nature, eavesdropping on P2P is a tough. How do you monitor all the packets that are routed through different paths? The only way would be Deep Packet Inspection. But again the packets are encrypted with 128 bit key. So even if you get the packets, you'll have a tough time decrypting it.

The Skype binary also is heavily obfuscated. It wont even run if a ring 0 debugger is on your system.

It definitely deserves a billion dollar bounty.

tptacek9• 17 years ago

Um, the best antireversing/antidebugging people in the world still don't have casual game crackers beat. For "a billion dollars", I might substitute "free xbox".

brl6• 17 years ago

I hear that 'Tom Clancy's Splinter Cell' is kind of annoying to break the protection on :)

michaelneale• 17 years ago

I don't see the connection between game cracking and grabbing lots of p2p traffic reliably.

axod• 17 years ago

Skype is pretty much based on the Kazaa p2p stack. Which was cracked by quite a few people. It was quite an impressive reasonably secure system, but not rocket science.

braindead_in2• 17 years ago

Did Kaaza support real time packet transfer? I guess the voice part was added on to Kaaza by the Skype Team. Or the team behind the P2P framework. I forget the name. Its owned by a Estonian Company if I'm right.

But you're right. Its definitely breakable. Kind of challenge that tickles those brain cells.

globalrev• 17 years ago

Doesn't Skype make money(as in profit not just revenue)?

Caligula• 17 years ago

I don't think the encryption issue is the big problem. I am sure skype's codec has been hacked already. The p2p issue could be addressed by just placing giant routers in isp's like the US did at the telcos. The bigger problem would be transcribing a million streams at once. Also, transcribing arabic words. Thats probably what they are mostly interested in.

There are good acoustic models for english but I doubt there are for arabic. Even if there were, the processing power requirement would be insane. I doubt amazon EC could handle a million streams at once even if they used smaller grammars focusing on suspicious words.

pageman• 17 years ago

more Pashto (http://www.ethnologue.com/show_language.asp?code=pbt) than Arabic (http://www.ethnologue.com/show_language.asp?code=arb) there's less than 10 million Pashto speakers in the world (about 8M are in Afghanistan) vs. 250M++ for Arabic.

NSA offering 'billions' for Skype eavesdrop solution

Related Stories