NSA offering 'billions' for Skype eavesdrop solution
theregister.co.uk
theregister.co.uk
I vaguely remember reading something about the skype team saying they would "cooperate" with law enforcement officials, but I'm not sure if that meant actually listening in on encrypted conversations or just sharing the IPs and time of connections to servers.
This reads as FUD they made up to sell ad views.
If somebody who is reverse engineering Skype found it, and it would eventually be found, the company would be ruined.
Even if skype came out and said they were recording every conversation, I don't know if all that many people would stop using it. There wasn't all that much outrage over immunity for the big telcos, for instance.
Or did you mean the company would be ruined for some other reason besides loss of reputation? Maybe I misunderstood the comment.
It's more intentionally malicious to distribute software with a backdoor than to do what AT&T did so I really think it would upset people more.
Remember the Sony 'rootkit' fiasco? And that wasn't even really harmful, just annoying.
Are you sure that the best way to hide the fact that you have found an attack against Skype is to advertise a contest with a billion dollar reward to anybody who can find the same attack (or any other one)?
Can you think of a better way?
Maybe not talk about Skype attacks at all. You know, keep it a secret.
We aren't dealing with a police agency, remember. We are dealing with a "national security" agency, and that phrase is an umbrella term that covers every type of shady business governments have engaged in since time immemorial. The NSA does not deal in "evidence" and "courts." It deals in "should we sic CIA assassins on this leader?" and "should we orchestrate a smear campaign against these nearly successful activists?" and other fun questions.
I'm absolutely positive, no doubts whatsoever, totally sure that it means that they can't but by saying that they can't they're trying to get you to think that they can and want their opponents to use something else.
My reasoning is iron-clad.
The Zfone FAQ page mentions, that Skype uses VBR codec for audio which is insecure:
"Johns Hopkins University researchers have observed that when voice is compressed with a variable bit-rate (VBR) codec, the packet lengths vary depending on the types of sounds being compressed. This leaks a lot of information about the content even if the packets are encrypted, regardless of what encryption protocol is used. We strongly recommend that you avoid using VBR codecs if you want to make a secure phone call.
<...>
...This means that Skype is vulnerable to VBR leakage regardless of the quality of Skype's built-in crypto."
There are good acoustic models for english but I doubt there are for arabic. Even if there were, the processing power requirement would be insane. I doubt amazon EC could handle a million streams at once even if they used smaller grammars focusing on suspicious words.
See the headlines now - NSA offers free VOIP service - no payment necessary, no advertising, just the fact that you have to be OK with them listening in on your calls.
The Skype binary also is heavily obfuscated. It wont even run if a ring 0 debugger is on your system.
It definitely deserves a billion dollar bounty.
[edit]
Context:
http://rdist.root.org/2007/04/19/anti-debugger-techniques-ar...
But you're right. Its definitely breakable. Kind of challenge that tickles those brain cells.
"The company won't disclose details of its encryption, either, and isn't required to as it is Europe based."
Hence, their alleged offering of "billions".
"But corporate parent eBay, having had to write down $1.4bn already following its $2.6bn purchase of Skype back in the bubble-2.0 days of 2005, might see an opportunity here. A billion or two from the NSA for a backdoor into Skype might make the acquisition seem like a sensible idea."
By "parent", if they get into trouble with an agency like the NSA and Ebay is U.S based (for the sake of argument), even though Skype was acquired, couldn't they 'break free' so-to-speak, and head back to Europe with their main operations? Correct me if I'm wrong, but Europe appears to still be their main base of operations while Ebay is like a corporate funding "parent"... that's how I view it from the article, but I could no doubt be mistaken.
There's no actual publication (outside of academia) that is good on crypto.
Much easier to tap a few fibre optic cables (either with or without the cooperation of telcos) than to crack individual systems -- and the risk of discovery is much less, too.
The NSA is hoovering up packets at AT&T switching stations and now they want to listen to some encrypted phone calls.
Here's my interpretation of the offer. They have no intention of paying for an attack. If somebody attempts to claim the reward they will say "Oh, no thanks, we don't really want your attack" and then rediscover the attack themselves.
http://www.skype.com/download/skype/linux/choose/?cm_sp=sv|d...
But I like brl's interpretation...
The P2P nature of Skype makes it difficult to identify links of bad guys (or innocent guys that happen to be in the wrong place wrong time).
Listening in on calls isn't that useful - unless you know that "the goose flies south for winter" means we attack at dawn.