7 ms·

more realistic interpretation: Intentional backdoor for NSA programs as skype has already been shown to be a part of. http://arstechnica.com/tech-policy/2014/1

by gr3yh47 10y ago

more realistic interpretation: Intentional backdoor for NSA programs as skype has already been shown to be a part of. http://arstechnica.com/tech-policy/2014/12/newly-published-nsa-documents-show-agency-could-grab-all-skype-traffic/ http://arstechnica.com/tech-policy/2014/12/newly-published-n...

Gaelan 10y ago
If Skype wanted to give user data to the NSA, they would send it over from their servers instead of implementing a backdoor that requires the NSA to already already have software on the target's computer (at which point, assuming they managed to get root, they could circumvent whatever protections Skype was using anyway).
- nkw 10y ago
  Big corporations are, by definition, large complex organizations. There is legal, executive management, developers, ops, etc. Hypothesizing about their actions as a singular entity can over simplify things. I don't know about the specifics in the article, but as a general rule there are a number instances where an intelligence agency may approach only a developer, an ops person, or someone in legal to obtain what they want instead of showing up and serving the corporate entity with a NSL. Saying the organization as a whole could provide data exfiltration much more efficiently by other means, does not rule out the possibility that other techniques could be used instead for various non-technical reasons.
  - linkregister 10y ago
    Can you give an example of one of these instances? I've heard of this sort of thing outside of the U.S. (James Bond bribes East German clerk to get the microfilm), but I haven't heard of domestic agencies doing this in the U.S. Isn't it already disclosed in the Snowden documents that Skype has received NSLs?
    - nkw 10y ago
      Here is a recent article discussing the DEA doing this: https://www.washingtonpost.com/news/powerpost/wp/2016/09/30/want-to-make-a-million-become-a-dea-informant/ https://www.washingtonpost.com/news/powerpost/wp/2016/09/30/... $600k to a particular airline employee, $1 million for a single parcel worker (this was over a few years). Also there is the various NSA efforts to insert people into the encryption standards process, as well as use cooperative sources within companies to insert vulnerabilities in the commercial encryption systems: http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html?_r=1& http://www.nytimes.com/interactive/2013/09/05/us/documents-r... Also the FBI/Yahoo email program was apparently done by just the CEO, a lawyer, and a few members of the email team. The security team wasn't informed, nor the board. https://www.theguardian.com/technology/2016/oct/04/yahoo-secret-email-program-nsa-fbi https://www.theguardian.com/technology/2016/oct/04/yahoo-sec...
      - linkregister 10y ago
        The DEA program is pretty shocking and a great example, thanks for sharing! The second one sounds more like an interdiction program, where vulnerabilities are inserted into the devices (this is a thing that was in the Snowden documents). The document gives no details. The highlights on the side are from an NYT journalist, not source material. I disagree that the last example is an example of that. It's still unclear what the scanning was doing.
        Spooky23 10y ago
        The Yahoo thing is a huge deal. Email providers do interception all of the time and have strong procedural controls. The idea that people could bypass those processes and controls is a tremendous liability that no board would ever approve.
    - __jal 10y ago
      NKW gave a nice summary of some recent actions. For more historical examples, I highly suggest any of James Bamford's excellent books on the NSA. _The Puzzle Palace_ is a massive tomb, but a very good read. I haven't had a chance to read _Shadow Factory_ yet, but it is in my pile.
  - tptacek 10y ago
    You didn't respond to the substance of his objection. The problem with the "NSA backdoor" hypothesis is that it doesn't make logistical sense: it requires the NSA to already have installed software on the victim's computer. If the NSA has installed software on your machine that it can control, you are going to, in the parlance of our times, "get Mossad'd".
    - benevol 10y ago
      > it doesn't make logistical sense: it requires the NSA to already have installed software on the victim's computer. Well, if you have any of the closed-source companies' software on your system (and by definition, that is +/- 310mio citizens, in the US alone), you are sure to have NSA backdoors on your system. Such backdoors certainly do not require manual intervention for them to be exploited on large scale.
      - tptacek 10y ago
        Explain?
        jonathankoren 10y ago
        No one outside of the software provider can audited the code, and presumably even they haven't audited the code. Recently there was the source code backdoor that was suspected to had been placed inside Juniper routers by the NSA. If I remember correctly, it wasn't found because it was hidden on a high right column.
        simonh 10y ago
        The Juniper backdoor was a bit particular in that it was known that the code in question had been developed and distributed by the NSA. It's more of a stretch to accuse every single vendor of proprietary code in the USA of building NSA back doors into their products. It would require the knowing assistance of tens of thousands of people across those companies.
  - deleted 10y ago
    [deleted]
- colanderman 10y ago
  You forget that Skype used to be peer-to-peer.
- atmosx 10y ago
  In the "Athens" affair, most commentators dismissed CIA involvement saying that if the US gov needed the data, they could just ask. Well after the investigation went through and some data came out regarding the Vodafone server hack it was clear that the organizations that could pull something like this, there like ... Maybe 5 with CIA the most likely candidate. So, we like to oversimplify but life is way more complicated. BTW I think that the Athens affair is one of the top 3 hacking stories that I know of.
- jlgaddis 10y ago
  Skype used to be a peer-to-peer application and did not use nor require any "central" servers. Then, Microsoft bought it and that all changed.
  - RachelF 10y ago
    Skype claimed that the move to central servers was because peer-to-peer would not work on smartphones which were becoming their user base. The old Skype for Windows was really locked and obfuscated. I remember that it would not even start on my PC with a debugger installed, even though it was not running in the debugger.
  - Galanwe 10y ago
    Disclaimer: ex Skype employee here While this simple reasoning is appealing, I have to disagree. Both its premises (Skype was peer to peer before MS) and conclusion (MS made it a client-server system because Evil). - Real peer to peer on internet is not really possible, since most end users are behind NAT. Skype resorts to a number of hole punching techniques, but really only uses STUN/ICE, effectively using super-nodes as relay for sessions. This directly means that all these communication are transiting through a third party, and not peer to peer. - Super-nodes used to be regular end users (with some simple algorithm to elect as supernode users with high up-time, high throughput. Fun fact: only windows client users were possible super-nodes). This model proved to be too fragile. In case the network falls down (which happened some years ago), then the super-nodes are no longer available, and get instantly DoS when coming back up due to every other node trying to get back. This is a vicious cycle in which the network cannot get back up. So for a long time now (before MS) super-nodes are just backed by Skype-hosted servers in data-centers. - Thin clients are a real thing in e.g. the african market, where a lot of very old phones are still in circulation, no "apps" are possible. Think of your old Nokia 3310. - Persistent group chats. Users wanted it. - And on a more "political" aspect: MS needed to promote its cloud infrastructure (Azure), lower its physical resources fingerprint (get rid of Skype datacenters), and unify its technical stack (Linux/C++ now Windows/C#)
nabanics 10y ago
You mean more paranoid interpretation. Microsoft controls the servers, they don't need a client backdoor to access messages.
- cmdrfred 10y ago
  But if they wanted plausible deniability when they get caught...
- gr3yh47 10y ago
  >You mean more paranoid interpretation. honestly it amazes me that people still call such interpretations paranoid in a world where information about the rampancy of such programs is readily available, including for this specific application Edit: it's not paranoia if there's demonstrable history of such things. It's making a reasonable assumption from available facts. further, all the arguments against this interpretation assume that those introducing security vulnerabilities for surveillance purposes abide by some kind of logic - which by the very nature of such activities they demonstrate that they do not. They (3 letter agencies) want every possible vector of information gathering regardless of the privacy, security, and legal issues that arise.
  - bcook 10y ago
    Just because it has happened doesn't mean it's always happening. Without any proof of intent, yeah, I'd consider it (plausible?) paranoia.
  - danudey 10y ago
    It seems to me to be a paranoid interpretation because if Microsoft wants to hand Skype-related user data over to the NSA, they'll do so on the server side and not the client side. Secondly, this is a pretty stupid way of doing it. 'If you use this client identifier than anything goes' seems vastly more like a stupid coding mistake than it does a sneaky covert backdoor into accessing Skype from the local machine.
    - sitkack 10y ago
pvg 10y ago
That is not at all a realistic interpretation. This is an 'authentication bypass' for a Skype API for locally executed code. Any even slightly serious attacker who has got to that point has already won - they don't need a 'Skype backdoor'.
- MichaelGG 10y ago
  Are Mac OS apps unable to debug other applications or generally mess with their process space? If so, like on Windows, then this API is basically a courtesy and not a real security boundary in the first place.
  - bonzini 10y ago
    There is some basic sandboxing, for example a debugger cannot attach to a running copy of iTunes (but you can start it under gdb and bypass the call that enables the sandbox).
  - pvg 10y ago
    I'm really just going by basic idea that once an attacker can run arbitrary code on your desktop, it's game over. That attacker doesn't gain anything by engineering and organizing some 'backdoor' into Skype, they've already owned you.
eth0up 10y ago
Or, the inherent backdoor in poorly encrypted VOIP without proper packet padding: http://cs.unc.edu/~fabian/papers/tissec2010.pdf http://cs.unc.edu/~fabian/papers/tissec2010.pdf EDIT: Also: http://www.cs.unc.edu/~fabian/papers/foniks-oak11.pdf http://www.cs.unc.edu/~fabian/papers/foniks-oak11.pdf

by gr3yh47 10y ago

Gaelan 10y ago

If Skype wanted to give user data to the NSA, they would send it over from their servers instead of implementing a backdoor that requires the NSA to already already have software on the target's computer (at which point, assuming they managed to get root, they could circumvent whatever protections Skype was using anyway).

nkw 10y ago
Big corporations are, by definition, large complex organizations. There is legal, executive management, developers, ops, etc. Hypothesizing about their actions as a singular entity can over simplify things. I don't know about the specifics in the article, but as a general rule there are a number instances where an intelligence agency may approach only a developer, an ops person, or someone in legal to obtain what they want instead of showing up and serving the corporate entity with a NSL. Saying the organization as a whole could provide data exfiltration much more efficiently by other means, does not rule out the possibility that other techniques could be used instead for various non-technical reasons.
- linkregister 10y ago
  Can you give an example of one of these instances? I've heard of this sort of thing outside of the U.S. (James Bond bribes East German clerk to get the microfilm), but I haven't heard of domestic agencies doing this in the U.S. Isn't it already disclosed in the Snowden documents that Skype has received NSLs?
  - nkw 10y ago
    Here is a recent article discussing the DEA doing this: https://www.washingtonpost.com/news/powerpost/wp/2016/09/30/want-to-make-a-million-become-a-dea-informant/ https://www.washingtonpost.com/news/powerpost/wp/2016/09/30/... $600k to a particular airline employee, $1 million for a single parcel worker (this was over a few years). Also there is the various NSA efforts to insert people into the encryption standards process, as well as use cooperative sources within companies to insert vulnerabilities in the commercial encryption systems: http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html?_r=1& http://www.nytimes.com/interactive/2013/09/05/us/documents-r... Also the FBI/Yahoo email program was apparently done by just the CEO, a lawyer, and a few members of the email team. The security team wasn't informed, nor the board. https://www.theguardian.com/technology/2016/oct/04/yahoo-secret-email-program-nsa-fbi https://www.theguardian.com/technology/2016/oct/04/yahoo-sec...
    - linkregister 10y ago
      The DEA program is pretty shocking and a great example, thanks for sharing! The second one sounds more like an interdiction program, where vulnerabilities are inserted into the devices (this is a thing that was in the Snowden documents). The document gives no details. The highlights on the side are from an NYT journalist, not source material. I disagree that the last example is an example of that. It's still unclear what the scanning was doing.
      - Spooky23 10y ago
        The Yahoo thing is a huge deal. Email providers do interception all of the time and have strong procedural controls. The idea that people could bypass those processes and controls is a tremendous liability that no board would ever approve.
  - __jal 10y ago
    NKW gave a nice summary of some recent actions. For more historical examples, I highly suggest any of James Bamford's excellent books on the NSA. _The Puzzle Palace_ is a massive tomb, but a very good read. I haven't had a chance to read _Shadow Factory_ yet, but it is in my pile.
- tptacek 10y ago
  You didn't respond to the substance of his objection. The problem with the "NSA backdoor" hypothesis is that it doesn't make logistical sense: it requires the NSA to already have installed software on the victim's computer. If the NSA has installed software on your machine that it can control, you are going to, in the parlance of our times, "get Mossad'd".
  - benevol 10y ago
    > it doesn't make logistical sense: it requires the NSA to already have installed software on the victim's computer. Well, if you have any of the closed-source companies' software on your system (and by definition, that is +/- 310mio citizens, in the US alone), you are sure to have NSA backdoors on your system. Such backdoors certainly do not require manual intervention for them to be exploited on large scale.
    - tptacek 10y ago
      Explain?
      - jonathankoren 10y ago
        No one outside of the software provider can audited the code, and presumably even they haven't audited the code. Recently there was the source code backdoor that was suspected to had been placed inside Juniper routers by the NSA. If I remember correctly, it wasn't found because it was hidden on a high right column.
        simonh 10y ago
        The Juniper backdoor was a bit particular in that it was known that the code in question had been developed and distributed by the NSA. It's more of a stretch to accuse every single vendor of proprietary code in the USA of building NSA back doors into their products. It would require the knowing assistance of tens of thousands of people across those companies.
- deleted 10y ago
  [deleted]
colanderman 10y ago
You forget that Skype used to be peer-to-peer.
atmosx 10y ago
In the "Athens" affair, most commentators dismissed CIA involvement saying that if the US gov needed the data, they could just ask. Well after the investigation went through and some data came out regarding the Vodafone server hack it was clear that the organizations that could pull something like this, there like ... Maybe 5 with CIA the most likely candidate. So, we like to oversimplify but life is way more complicated. BTW I think that the Athens affair is one of the top 3 hacking stories that I know of.
jlgaddis 10y ago
Skype used to be a peer-to-peer application and did not use nor require any "central" servers. Then, Microsoft bought it and that all changed.
- RachelF 10y ago
  Skype claimed that the move to central servers was because peer-to-peer would not work on smartphones which were becoming their user base. The old Skype for Windows was really locked and obfuscated. I remember that it would not even start on my PC with a debugger installed, even though it was not running in the debugger.
- Galanwe 10y ago
  Disclaimer: ex Skype employee here While this simple reasoning is appealing, I have to disagree. Both its premises (Skype was peer to peer before MS) and conclusion (MS made it a client-server system because Evil). - Real peer to peer on internet is not really possible, since most end users are behind NAT. Skype resorts to a number of hole punching techniques, but really only uses STUN/ICE, effectively using super-nodes as relay for sessions. This directly means that all these communication are transiting through a third party, and not peer to peer. - Super-nodes used to be regular end users (with some simple algorithm to elect as supernode users with high up-time, high throughput. Fun fact: only windows client users were possible super-nodes). This model proved to be too fragile. In case the network falls down (which happened some years ago), then the super-nodes are no longer available, and get instantly DoS when coming back up due to every other node trying to get back. This is a vicious cycle in which the network cannot get back up. So for a long time now (before MS) super-nodes are just backed by Skype-hosted servers in data-centers. - Thin clients are a real thing in e.g. the african market, where a lot of very old phones are still in circulation, no "apps" are possible. Think of your old Nokia 3310. - Persistent group chats. Users wanted it. - And on a more "political" aspect: MS needed to promote its cloud infrastructure (Azure), lower its physical resources fingerprint (get rid of Skype datacenters), and unify its technical stack (Linux/C++ now Windows/C#)

nabanics 10y ago

You mean more paranoid interpretation. Microsoft controls the servers, they don't need a client backdoor to access messages.

cmdrfred 10y ago
But if they wanted plausible deniability when they get caught...
gr3yh47 10y ago
>You mean more paranoid interpretation. honestly it amazes me that people still call such interpretations paranoid in a world where information about the rampancy of such programs is readily available, including for this specific application Edit: it's not paranoia if there's demonstrable history of such things. It's making a reasonable assumption from available facts. further, all the arguments against this interpretation assume that those introducing security vulnerabilities for surveillance purposes abide by some kind of logic - which by the very nature of such activities they demonstrate that they do not. They (3 letter agencies) want every possible vector of information gathering regardless of the privacy, security, and legal issues that arise.
- bcook 10y ago
  Just because it has happened doesn't mean it's always happening. Without any proof of intent, yeah, I'd consider it (plausible?) paranoia.
- danudey 10y ago
  It seems to me to be a paranoid interpretation because if Microsoft wants to hand Skype-related user data over to the NSA, they'll do so on the server side and not the client side. Secondly, this is a pretty stupid way of doing it. 'If you use this client identifier than anything goes' seems vastly more like a stupid coding mistake than it does a sneaky covert backdoor into accessing Skype from the local machine.
  - sitkack 10y ago

pvg 10y ago

That is not at all a realistic interpretation. This is an 'authentication bypass' for a Skype API for locally executed code. Any even slightly serious attacker who has got to that point has already won - they don't need a 'Skype backdoor'.

MichaelGG 10y ago
Are Mac OS apps unable to debug other applications or generally mess with their process space? If so, like on Windows, then this API is basically a courtesy and not a real security boundary in the first place.
- bonzini 10y ago
  There is some basic sandboxing, for example a debugger cannot attach to a running copy of iTunes (but you can start it under gdb and bypass the call that enables the sandbox).
- pvg 10y ago
  I'm really just going by basic idea that once an attacker can run arbitrary code on your desktop, it's game over. That attacker doesn't gain anything by engineering and organizing some 'backdoor' into Skype, they've already owned you.

eth0up 10y ago

Or, the inherent backdoor in poorly encrypted VOIP without proper packet padding: http://cs.unc.edu/~fabian/papers/tissec2010.pdf http://cs.unc.edu/~fabian/papers/tissec2010.pdf EDIT: Also: http://www.cs.unc.edu/~fabian/papers/foniks-oak11.pdf http://www.cs.unc.edu/~fabian/papers/foniks-oak11.pdf