11 ms·
A Backdoor in Skype for Mac OS X
- dangerlibrary 10y agoMost generous interpretation: this could easily be an old, deprecated API in an enormous, complicated codebase on an engineering team with high turnover.
- gr3yh47 10y agomore realistic interpretation: Intentional backdoor for NSA programs as skype has already been shown to be a part of. http://arstechnica.com/tech-policy/2014/12/newly-published-nsa-documents-show-agency-could-grab-all-skype-traffic/ http://arstechnica.com/tech-policy/2014/12/newly-published-n...
- Gaelan 10y agoIf Skype wanted to give user data to the NSA, they would send it over from their servers instead of implementing a backdoor that requires the NSA to already already have software on the target's computer (at which point, assuming they managed to get root, they could circumvent whatever protections Skype was using anyway).
- nkw 10y agoBig corporations are, by definition, large complex organizations. There is legal, executive management, developers, ops, etc. Hypothesizing about their actions as a singular entity can over simplify things. I don't know about the specifics in the article, but as a general rule there are a number instances where an intelligence agency may approach only a developer, an ops person, or someone in legal to obtain what they want instead of showing up and serving the corporate entity with a NSL. Saying the organization as a whole could provide data exfiltration much more efficiently by other means, does not rule out the possibility that other techniques could be used instead for various non-technical reasons.
- linkregister 10y agoCan you give an example of one of these instances? I've heard of this sort of thing outside of the U.S. (James Bond bribes East German clerk to get the microfilm), but I haven't heard of domestic agencies doing this in the U.S. Isn't it already disclosed in the Snowden documents that Skype has received NSLs?
- nkw 10y agoHere is a recent article discussing the DEA doing this: https://www.washingtonpost.com/news/powerpost/wp/2016/09/30/want-to-make-a-million-become-a-dea-informant/ https://www.washingtonpost.com/news/powerpost/wp/2016/09/30/... $600k to a particular airline employee, $1 million for a single parcel worker (this was over a few years). Also there is the various NSA efforts to insert people into the encryption standards process, as well as use cooperative sources within companies to insert vulnerabilities in the commercial encryption systems: http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html?_r=1& http://www.nytimes.com/interactive/2013/09/05/us/documents-r... Also the FBI/Yahoo email program was apparently done by just the CEO, a lawyer, and a few members of the email team. The security team wasn't informed, nor the board. https://www.theguardian.com/technology/2016/oct/04/yahoo-secret-email-program-nsa-fbi https://www.theguardian.com/technology/2016/oct/04/yahoo-sec...
- linkregister 10y agoThe DEA program is pretty shocking and a great example, thanks for sharing! The second one sounds more like an interdiction program, where vulnerabilities are inserted into the devices (this is a thing that was in the Snowden documents). The document gives no details. The highlights on the side are from an NYT journalist, not source material. I disagree that the last example is an example of that. It's still unclear what the scanning was doing.
- Spooky23 10y agoThe Yahoo thing is a huge deal. Email providers do interception all of the time and have strong procedural controls. The idea that people could bypass those processes and controls is a tremendous liability that no board would ever approve.
- colanderman 10y agoYou forget that Skype used to be peer-to-peer.
- atmosx 10y agoIn the "Athens" affair, most commentators dismissed CIA involvement saying that if the US gov needed the data, they could just ask. Well after the investigation went through and some data came out regarding the Vodafone server hack it was clear that the organizations that could pull something like this, there like ... Maybe 5 with CIA the most likely candidate. So, we like to oversimplify but life is way more complicated. BTW I think that the Athens affair is one of the top 3 hacking stories that I know of.
- jlgaddis 10y agoSkype used to be a peer-to-peer application and did not use nor require any "central" servers. Then, Microsoft bought it and that all changed.
- RachelF 10y agoSkype claimed that the move to central servers was because peer-to-peer would not work on smartphones which were becoming their user base. The old Skype for Windows was really locked and obfuscated. I remember that it would not even start on my PC with a debugger installed, even though it was not running in the debugger.
- Galanwe 10y agoDisclaimer: ex Skype employee here While this simple reasoning is appealing, I have to disagree. Both its premises (Skype was peer to peer before MS) and conclusion (MS made it a client-server system because Evil). - Real peer to peer on internet is not really possible, since most end users are behind NAT. Skype resorts to a number of hole punching techniques, but really only uses STUN/ICE, effectively using super-nodes as relay for sessions. This directly means that all these communication are transiting through a third party, and not peer to peer. - Super-nodes used to be regular end users (with some simple algorithm to elect as supernode users with high up-time, high throughput. Fun fact: only windows client users were possible super-nodes). This model proved to be too fragile. In case the network falls down (which happened some years ago), then the super-nodes are no longer available, and get instantly DoS when coming back up due to every other node trying to get back. This is a vicious cycle in which the network cannot get back up. So for a long time now (before MS) super-nodes are just backed by Skype-hosted servers in data-centers. - Thin clients are a real thing in e.g. the african market, where a lot of very old phones are still in circulation, no "apps" are possible. Think of your old Nokia 3310. - Persistent group chats. Users wanted it. - And on a more "political" aspect: MS needed to promote its cloud infrastructure (Azure), lower its physical resources fingerprint (get rid of Skype datacenters), and unify its technical stack (Linux/C++ now Windows/C#)
- nabanics 10y agoYou mean more paranoid interpretation. Microsoft controls the servers, they don't need a client backdoor to access messages.
- cmdrfred 10y agoBut if they wanted plausible deniability when they get caught...
- gr3yh47 10y ago>You mean more paranoid interpretation. honestly it amazes me that people still call such interpretations paranoid in a world where information about the rampancy of such programs is readily available, including for this specific application Edit: it's not paranoia if there's demonstrable history of such things. It's making a reasonable assumption from available facts. further, all the arguments against this interpretation assume that those introducing security vulnerabilities for surveillance purposes abide by some kind of logic - which by the very nature of such activities they demonstrate that they do not. They (3 letter agencies) want every possible vector of information gathering regardless of the privacy, security, and legal issues that arise.
- bcook 10y agoJust because it has happened doesn't mean it's always happening. Without any proof of intent, yeah, I'd consider it (plausible?) paranoia.
- danudey 10y agoIt seems to me to be a paranoid interpretation because if Microsoft wants to hand Skype-related user data over to the NSA, they'll do so on the server side and not the client side. Secondly, this is a pretty stupid way of doing it. 'If you use this client identifier than anything goes' seems vastly more like a stupid coding mistake than it does a sneaky covert backdoor into accessing Skype from the local machine.
- sitkack 10y ago
- pvg 10y agoThat is not at all a realistic interpretation. This is an 'authentication bypass' for a Skype API for locally executed code. Any even slightly serious attacker who has got to that point has already won - they don't need a 'Skype backdoor'.
- MichaelGG 10y agoAre Mac OS apps unable to debug other applications or generally mess with their process space? If so, like on Windows, then this API is basically a courtesy and not a real security boundary in the first place.
- bonzini 10y agoThere is some basic sandboxing, for example a debugger cannot attach to a running copy of iTunes (but you can start it under gdb and bypass the call that enables the sandbox).
- pvg 10y agoI'm really just going by basic idea that once an attacker can run arbitrary code on your desktop, it's game over. That attacker doesn't gain anything by engineering and organizing some 'backdoor' into Skype, they've already owned you.
- eth0up 10y agoOr, the inherent backdoor in poorly encrypted VOIP without proper packet padding: http://cs.unc.edu/~fabian/papers/tissec2010.pdf http://cs.unc.edu/~fabian/papers/tissec2010.pdf EDIT: Also: http://www.cs.unc.edu/~fabian/papers/foniks-oak11.pdf http://www.cs.unc.edu/~fabian/papers/foniks-oak11.pdf
- tribby 10y agomost likely, too -- we can go on about state involvement etc, but without evidence I think ockham's razor applies here.
- x1798DE 10y agoI think it's more in Hanlon's razor territory than Ockham's razor. It's absolutely not unheard-of to see deliberate backdoors in a lot of commercial software (usually as some debugging port that the devs didn't think anyone would find), but it's just much more likely that it's a product of incompetence than malice.
- atmosx 10y agoThe problem with this interpretation is Snowden. If Snowden didn't happen I would most likely believe that this was just bad engineering or something. Post Snowden your interpretation sounds like extremely naive.
- tinus_hn 10y agoThe backdoor allows access to the Skype application which is running in the same environment as the process 'abusing' it. It's stupid programming and perhaps could be used for convenience by a worm or virus but it does not allow privilege escalation. Worst case scenario there is a bug in the API that allows privilege escalation, then it might be a sandbox escape, if it is possible to use the API from inside the sandbox which I doubt.
- 72deluxe 10y agoOut of curiosity, why is the API so massive? I have not seen Skype's core features change over ~10 years. I know the architecture has been redesigned but the ability to make calls and send IMs surely goes through an underlying network shim. Why the rest of it? Is it overengineered? Am I missing something?
- y_u_no_rust 10y agocalling this a backdoor is pretty disingenous
- ht85 10y agoAn access that bypasses regular security / auth, isn't that the definition of a backdoor?
- shuntress 10y ago'backdoor' comes with the implication that it was included intentionally to allow for future (secret) access. Where it could instead be a bug or mistake that was not intentionally included.
- ht85 10y agoMaybe I misunderstood the current situation? Of course other services exploiting it isn't intentional, but giving a free pass to one of their own services was definitely intentional?
- shuntress 10y agoThe article mentions: "the actual Skype Dashboard widget does not seem to utilize the backdoor into the Skype Desktop API despite the name" which, to me, lends more credence to the assumption that this was perhaps a test or a prototype and only included in the shipped version accidentally.
- brianbarker 10y agoNo. A backdoor is considered to be deliberate and obfuscated from easy discovery, with the intent to be secret access. If every system flaw or coding bug is a backdoor, then defects like OpenSSL's Heartbleed would be deemed backdoors, and they're not. Unless you're wearing a heavy tin foil hat and think the coding mistake for Heartbleed was intentional. I guess I can't dissuade you from that train of thought.
- hashhar 10y agoCalling this a backdoor is an extreme measure. I wasn't able to see any working example, nor any responsible disclosure which seems bad. Also, if somebody has the ability to run arbitrary code on your machine, I would think that it's game over at that point - backdoor or not. This is not a remote exploitable backdoor it seems.
- jlg23 10y ago> Calling this a backdoor is an extreme measure. How else would you call the possibility to sidestep access controls by setting a specific string as identifier? > I wasn't able to see any working example, nor any responsible disclosure which seems bad. First, those two statements kind of contradict each other. Second, from the advisory linked from the article: 10/13/2016 - Vulnerability disclosed to vendor 10/26/2016 - Patch released by vendor 12/12/2016 - Advisory published > Also, if somebody has the ability to run arbitrary code on your machine, I would think that it's game over at that point. Yes, it has been game over all the time: People execute arbitrary code on their machines by installing free programs they downloaded from somewhere. But that's not the point. The point is that some application that has control over very sensitive data includes a possibility (to avoid the word "backdoor") to access that data without user-confirmation and alarms, which are otherwise built into the application on a design level.
- hamburglar 10y agoThis is unequivocally a backdoor, by definition. They backdoored their own API for the benefit of their own plugin being allowed to run unauthenticated. What we can't say is whether this is a backdoor created for nefarious purposes. All we can say is that the backdoor exists and, if we accept that authentication on this API is valuable, then it's an egregious violation of security principles by effectively having some hardcoded credentials which bypass a security layer. You can wave it away as local-only and claim that if you have code running on the box, it's already pwned, but this is rationalization: this backdoor bypasses a layer of security that is otherwise present. Can an otherwise unprivileged process (e.g. one from another user) call this API? The details are not specified. I tend to think this looks more like incompetence perpetrated a long time ago and forgotten, but that doesn't make it any less of a back door.
- campuscodi 10y agoLooks more like an ancient and unmaintained API. This is AV security-firm-hype at its best.
- bitmapbrother 10y agoThis wouldn't be the first time Microsoft has worked with the NSA https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...
- ryanlol 10y agoWhy would Microsoft be working with the NSA on this?
- jwtadvice 10y agoOn this specifically, I'm doubtful. The 'backdoor' isn't very high value. In many other cases technology transfer, joint management/ownership, market access, political favors, lucrative contracts, direct infiltration, nationalist instincts, and bribery are all reasons for Microsoft to work with the NSA and other intelligence agencies. They were caught providing backdoor access along with Google to all outlook (and gmail) emails to the FBI, for example.
- duskwuff 10y agoGiven the context of this API, it would be of very little value to the NSA. (It is only accessible by applications that are already running on the user's computer, and only provides access to Skype.) If the NSA wanted to intercept or forge Skype conversations and had access to Microsoft to do so, they would have a much easier time doing so on the server side.
- discreditable 10y agoThe article says the backdoor has been present for "5+ years". Microsoft's acquisition of Skype was completed in Oct. 2011 (just over 5 years ago). Based on the timing, that seems unlikely unless MS's first order of business was to backdoor Skype.
- linkregister 10y agoI respond to this link earlier in these comments. The so-called collaboration is of the same nature as any other communications company in the world responds to warrants, subpoenas, etc in their home country. Despite the tone of the article, there is nothing to suggest that anyone at Microsoft was doing anything more than creating the most cost-effective method to handle requests it was coerced to fulfill. Alternatives to "collaboration": 1. Deny all requests. Get held in contempt of court. Go out of business. 2. Have dedicated staff to manually dig through every data repository to handle each request in a bespoke manner.
- milge 10y agoI thought it was already well-known and assumed Skype has backdoor(s) in their software.
- deleted 10y ago[deleted]
- ryanlol 10y agoSuper unlikely this is an intentional backdoor. OS X privesc vulns definitely aren't nearly rare enough to come by to justify backdooring software like Skype for local privesc.
- ryanmccullagh 10y agoI'm surprised to this company on the front page of HN.
- klodolph 10y agoI've heard rumors that the Skype codebase is a giant mass of unmaintainable code "approaching a singularity" and for this reason alone you wouldn't expect it to be terribly secure. At one time I wondered if I was too paranoid for adding another user account for the sole purpose of running Skype, but I no longer wonder. That and the fact that OS X security is not fantastic to begin with, and I don't want anything weird showing up in screen sharing with job interviews (say, in search history).
- prdonahue 10y ago> That and the fact that OS X security is not fantastic to begin with. Which OS do you use/prefer for better security?
- davrosthedalek 10y agoAny not-too-common linux distribution with a recent kernel is probably a comparably good choice.
- lima 10y agoLess common = less attention to security.
- tachion 10y agoThe train of thoughts here is that less common == smaller exposure, therefore less likely to be a target. Also, your statement isn't entirely true, for example, OpenBSD, albeit not being a linux distribution, is a project orders of magnitude smaller, yet with equal, if not greater, focus on security.
- lima 10y agoOpenBSD has a much larger market share than most fringe Linux distributions. They also have a focus on security and many high-profile experts. Example: http://blog.linuxmint.com/?p=2994 http://blog.linuxmint.com/?p=2994
- haddr 10y agoThe backdoor aside, but using Skype seems to be a real pain recently. It used to be something that offered unmatched quality and service, but with time passing it is lagging behind. Skype on Mac OS X now starts like in 10 seconds and even the shutdown takes 10-15 seconds (on SSD). Video calls are fine, but the fans are quickly 100%. It's funny but the (long unmaintened) Linux skype seems to be better at video calls. This news only proves that the Skype codebase must be an unmanageable mess. I can undetsrand that. But also it seems that MS is moving to the web version of skype, in the meantime not taking care too much about the native clients.
- nness 10y agoSkype for Business, the Lync replacement, is equally if not more of a mess. You can break conference calls just by muting people.
- thedutchguy 10y agoGood. All things should have backdoors. /s
- EugeneOZ 10y agoWhat wonders me is absence of urgent update after such news...