Vulnerabilities / Threats
6/3/2011
11:48 AM
50%
50%

Skype Protocol Cracked

Security researcher publishes reverse engineered source code in the wake of reports that Middle Eastern governments have Skype-eavesdropping tools.

A researcher named Efim Bushmanov claims to have reverse engineered the Skype protocol.

"My aim is to make Skype open source," he said in a blog post on Thursday, which included links to download executable files compatible with Skype versions 1.4, 3.8, and 4.1, plus IDA Pro disassembly database files, and source code.

Bushmanov said he decided to publicize his efforts in the wake of a story published this week in the Wall Street Journal, detailing how Middle Eastern countries' security agencies possessed tools that enabled them to eavesdrop on Skype communications. He's also hoping to recruit more people to help him finish the Skype reverse engineering, which he says isn't yet complete.

In response, Skype appears to be preparing for a fight. "This unauthorized use of our application for malicious activities like spamming/phishing infringes on Skype's intellectual property," said the company in an emailed statement. "We are taking all necessary steps to prevent/defeat nefarious attempts to subvert Skype's experience. Skype takes its users' safety and security seriously and we work tirelessly to ensure each individual has the best possible experience."

But is Bushmanov operating in the clear? Typically, copyright law makes an exception for reverse engineering software, provided it's done correctly. One of the most famous examples of reverse engineering done right happened in the 1980s, when Phoenix Technologies wanted to build a BIOS that was compatible with IBM's proprietary BIOS.

To protect itself against accusations that it had copied IBM's BIOS, Phoenix created a team that used a Chinese wall approach. Namely, the team observed the IBM BIOS, and described everything it did without referencing any code. Next, a different team of developers with no previous BIOS experience of any kind took the first group's specifications, then wrote their own BIOS, ultimately enabling companies to begin building IBM-compatible PCs.

Another famous reverse engineering case involved Andrew Tridgell, who studied Microsoft's Server Message Block (SMB) protocol until he understood it well enough to write Samba. This open source code now enables Unix, Linux, and Mac OS X systems to communicate with Microsoft Windows networks and clients, including Active Directory domains.

Key to Tridgell's work, however, was that "he didn't decompile any of Microsoft's code. He simply watched the traffic generated by SMB implementations until he understood it well enough to produce an alternative implementation," said Paul Ducklin, Sophos' head of technology for Asia Pacific, in a blog post.

Has Bushmanov done his reverse engineering by the book, as Tridgell did with Samba? "If Bushmanov hasn't taken this 'clean' approach--and the presence of IDB files (IDA Pro disassembly databases) amongst his published downloads suggests that he has not--then this could end up in an interesting legal battle," said Ducklin.

But recent court cases involving device or software modifications haven't always ended in manufacturers' favor, legally or otherwise. Notably, in January, Sony sued well-known hacker George Hotz (aka Geohot), together with 100 other people (mostly unnamed), alleging that they'd "jailbroken" the PlayStation 3, circumventing its security measures in violation of the Digital Millennium Copyright Act and allowing people to play unauthorized or pirated games. In March, Sony settled with Hotz. Terms of the settlement were not disclosed, although Hotz agreed to not publish any further, related code.

Sony claimed victory, but it was short-lived, as the company soon began suffering a crippling series of data breaches in apparent retaliation for its lawsuit.

Skype, of course, was recently acquired by Microsoft for $8.5 billion, which means that the next move in this case is Microsoft's. But an open source version of Skype may actually benefit Microsoft, said Ducklin. For starters, it might quiet Skype critics who want to know the security protocols it relies on. Furthermore, it might prevent people from building Skype competitors, instead treating Skype as a standard, and creating their own clients.

"Microsoft could simply give up on the existing Linux and OS X code bases without creating any bitterness amongst those communities," he said. "They'd be able to take up the software development reins--just as gung-ho open sourcers are supposed to if they don't like what's already on offer."

In this new Tech Center report, we profile five database breaches--and extract the lessons to be learned from each. Plus: A rundown of six technologies to reduce your risk. Download it here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

CVE-2014-8090
Published: 2014-11-21
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nes...

CVE-2014-8469
Published: 2014-11-21
Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?