14 ms·
Skype protocol reverse engineered, source available
- iwwr 15y agoBetter start uploading this to torrents if its legit. Skype will issue takedowns any moment.
- vdm 15y agoAlready done by OP.
- michael_dorfman 15y agoMy aim is to make skype open source. Isn't that decision up to the folks who own the rights to the original code? Personally, I'd be hesitant to get into a project that has more need for lawyers than coders.
- crocowhile 15y agoI think that claim would be better off if rephrased as "my aim is to make a skype compatible open source software"
- michael_dorfman 15y agoThat still doesn't mitigate the need for lawyers. The protocol is still intellectual property, and reverse engineering it may not be without consequences.
- johkra 15y ago"intellectual property" That's a really muddy term. How exactly can you protect a protocol? Trade secret? Patents? Copyright shouldn't apply if it's a reimplementation. Edit: s/since/if/
- michael_dorfman 15y agoThe easiest way to is to restrict the right to reverse-engineer in the Terms of Service of the Skype client (which he needs to use, in order to have something to reverse engineer.)
- JoshTriplett 15y agoTerms of Service don't necessarily have any legal force, and many jurisdictions have legal protections for the right to reverse-engineer, particularly for interoperability purposes.
- deleted 15y ago[deleted]
- JoshTriplett 15y agoWhile copyright wouldn't apply to an independent reimplementation, the article included links to decompiled versions of the Skype binaries, which would definitely fall under Skype's copyrights. Nothing wrong with using those decompiled binaries to reverse-engineer and document the Skype protocol, and I hope this produces useful results there, but that doesn't make it OK to directly redistribute the decompiled binaries.
- _delirium 15y agoI don't believe it's possible to secure any sort of intellectual-property protection for a mere protocol. The usual way of protecting them, though, is to patent some essential feature needed to implement the protocol, which may or may not be the case here.
- michael_dorfman 15y agoActually, as I've said elsewhere, one easy way of protecting a protocol is to explicitly restrict the right to reverse engineer in in the Terms of Service of the client that implements the protocol. Without that client, there's nothing to reverse engineer.
- barrkel 15y agoI'm not sure that's necessarily enforceable everywhere; it can be interpreted as an illegal barrier to competition.
- michael_dorfman 15y agoThat might be true; but do you want to be responsible for hiring the team of lawyers to go head-to-head against Microsoft's lawyers on that point?
- lurker19 15y agoThanks for reminder to contribute to the EFF this year. We have strength in numbers.
- dmc 15y agoWhat about if a developer were to now download the source code available here? Could they, in theory, develop with it as they've never attempted to reverse engineer it themselves? By using ToS, you're limiting enforcement to the people who do the RE, rather than an implementation, surely?
- 15y ago
- unicornporn 15y agoThis being illegal in the US does not mean it is illegal everywhere. People (Americans?) often seem to forget this. US law is not world law.
- angusgr 15y agoIANAL, but might the DMCA exemption on reverse engineering for program-to-program interoperability possibly apply in the US?[1] Of course I have NFI what country the skype-open-source poster is in. FWIW the blog host (blogspot) is obviously in the US, the depositfiles.com file host has DNS registered in Seychelles but seemingly resolves to a US server... [1] http://www.chillingeffects.org/reverse/faq.cgi#QID210 http://www.chillingeffects.org/reverse/faq.cgi#QID210
- angusgr 15y ago(Follow up: JCR's comment seems to make it clear that's what is being distributed here doesn't constitute reverse engineering in the legal sense. I hadn't actually looked at the files. Ah well.)
- cookiecaper 15y agoAnd what are jcr's credentials? Not everyone that posts on HN is an expert or should be assumed to understand their subject matter.
- TheAmazingIdiot 15y agoHmm, so you aren't smart enough to attack JCR's ideas, so you go after his character? Are you stupid or what? Can we even believe anything that cookiecaper says? I mean, what's HIS credentials? (see what I did there? Ad hominem attacks are just that: logical fallacies. Please don't do them.)
- cookiecaper 15y agoIt wasn't an ad hominem attack and I have nothing against jcr. I don't even disagree. I just felt it was important to advise people to check their sources since the parent comment seemed to be putting a lot of trust in a comment that could easily contain misinformation. No offense intended. :)
- 15y ago
- deleted 15y ago[deleted]
- celalo 15y agoyou just cost Microsoft $8.5 billion
- dennis714 15y agoIt is looking like result of Hex-Rays decompiler.
- crocowhile 15y agoCan you say more?
- michael_dorfman 15y agoA simple Google search turns up this: http://www.hex-rays.com/decompiler.shtml http://www.hex-rays.com/decompiler.shtml
- crocowhile 15y agoyes, I saw that. I just cannot believe that this is simply the digested work of a (yet special) decompiler.
- yread 15y agowith identifiers like unpack_41_715680 and the_thing it is not exactly easy to read
- zerd 15y agoThat's life for reverse engineered stuff. If you don't really know what a function does, how do you name it?
- daeken 15y agoYou come up with a name based on the observed behavior. I'm honestly amazed that they've made it as far as they have without decent naming conventions -- the use of good identifiers in your IDBs cuts reversing time way, way down.
- deleted 15y ago[deleted]
- braindead_in 15y agoIt seems that the encryption algorithm has been reverse engineered. I guess you'll still need the keys to decrypt the voice data using this algorithm, assuming it works. It's a big deal if has been done, because a lot of people have been trying to crack it. Some governments are going to love this. The Skype client itself has a lot of obfuscation to prevent something like this.
- JoshTriplett 15y agoThe ability to interoperate with Skype as one of the participants in a call has little to do with the ability to intercept and decrypt Skype calls as a non-participant in a call, unless Skype uses broken crypto (a very real possibility).
- 46Bit 15y agoI think it's fair to surmise that those intelligence agencies that care have probably had the algorithm for a long time and searched for weaknesses. Bear in mind that at one time they were complaining about it's use by criminals to avoid phonetaps.
- braindead_in 15y agoThere has been some speculation about a backdoor in Skype which it has shared with intelligence agencies. Never confirmed by Skype of course. But this could allow anyone to decrypt a Skype conversation stream. All you need is a Skype supernode to get started. Or some kind of spyware on the subject's computer which stores/transmits the data stream.
- gst 15y agoIf you've got spyware installed on one of the endpoints you don't need any backdoor in Skype. Just dump the audio output and input directly from the audio card.
- braindead_in 15y ago
- Animus7 15y agoIf the goal is to open up Skype, this isn't the way. Even if some insane insomniac de-twiddles the pages upon pages of optimized indirection in this code (which I seriously doubt), all Skype has to do is tweak the protocol or encryption and the researcher is back to square one. It's a losing battle. And that's not even getting into the legality of it it all. How about instead of trying to fruitlessly crack Skype, we spend the time making something that's both open and better?
- JoshTriplett 15y agoBoth seem quite valuable. Long-term, we want an open peer-to-peer encrypted communication system. Short-term, until Skype dies, it would help to have the ability to interoperate with people who use it. Similarly, while XMPP represents the right open standard for chat, existing Open Source chat programs still need to know how to interoperate with MSN, AIM, and Yahoo
- werg 15y agoIf the system can successfully masquerade as an older Skype version it stands a chance. That is unless Skype has a baked-in not yet understood mechanism for pushing protocol changes to its clients. Skype would have to find discerning features, implement it on their servers and possibly even push it to their client updates. Whenever such discerning features were found it's a simple matter of arms race, i.e. a difficult but fair chance. Alternatively Skype can start blocking older versions which is rather unlikely. Concerning the open and better issue; There definitely are open alternatives. None of them have quite the firewall-defying capabilities of Skype. Nor the user base for that matter. Building any kind of social network is fraught with chicken&egg problems and those first to reach mass have it made. Just check how one of the richest and most powerful technology companies Google is struggling to get a foot in Facebook's market.
- jacobr 15y agoThere is WebRTC (http://sites.google.com/site/webrtc/ http://sites.google.com/site/webrtc/) for Real Time Communication/Conferencing which Google just open sourced. I think that's the way forward rather than developing a separate "Skype-killer" protocol/app.
- VMG 15y agoHow easy is it for skype to change the protocol?
- eleusive 15y agoNot very easy if they want to maintain compatibility with existing clients (especially considering they haven't updated their linux client for years now).
- neworbit 15y agoBackwards compatibility with linux clients probably isn't the top priority of Skype now that they're being rolled into MS, but I suspect embedded deployments on handheld devices might still keep them from deprecating.
- evanwolf 15y agoActually Skype runs large clouds of linux clients (or a version of the Linux client) as part of gateways hosted with some mobile operators. They care a great deal about keeping linux compatibility.
- ysangkok 15y agoThe latest Linux version is from April this year.
- tttp 15y agoTwo major issues: http://skype-open-source.blogspot.com/2011/06/skype-under-rc4-layer-arithmetic.html http://skype-open-source.blogspot.com/2011/06/skype-under-rc... || Copyright (c) 2004-2009 by VEST Corporation. || All rights reserved. Strictly Confidential! The project is using existing code, and "All rights reserved" is not an approved OSI license I believe ;) And things like compression algorithm are patented, and that's very likely skype is using some of it. Reminds me of a project by Intel of providing an implementation of g729 (a voice codec). The source was available, but it was "non commercial usage only" because of the patents mostly. An interesting project, but doubt we'll see any usable implementation anytime soon IMO. And even if it does, skype will probably alter a bit the protocol to make it fail if it reaches a critical mass.
- drdaeman 15y agoSoftware patents are mostly US-only problem. As Efim's probably a Russian, this is not an issue. And Skype can't really easily alter the protocol because of all sort of skype-compatible devices (IP phones and so on).
- TerryS 15y ago"All rights reserved" is not an obstacle to an OSI license. If you open source some code then you can still reserve all your rights to the code. This mean that you can redistribute/sell/license it under any other licensing schemes you wish to. Other people, of course, can only use it under the license you grant them.
- Joeboy 15y agoFrom what I understand, the big unsolved problem open VOIP options have isn't the voice bit, it's negotiating a connection through NAT/firewalls/dodgy routers etc. I doubt this helps with those problems.
- __rkaup__ 15y agoWhat makes VoIP different from any other protocols, like HTTP?
- Joeboy 15y agoI won't pretend to have any actual expertise on the subject, but here is some relevant discussion by someone that does: http://linux.slashdot.org/comments.pl?sid=2170464&cid=36188120 http://linux.slashdot.org/comments.pl?sid=2170464&cid=36...
- code_duck 15y agoI don't believe most people are thinking there's something exciting about Skype's technology. They just want to be able to make things compatible with Skype.
- senko 15y agoRelatedly: there was a presentation about (reversing) Skype internals on BlackHat Europe 2006 (warning, PDF): http://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-biondi/bh-eu-06-biondi-up.pdf http://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-... Skype probably updated their client/protocol since, but still an interesting read.
- foxhill 15y agoaside from the awesome technical exersize in hacking, i don't see this as any net benefit for VOIP. the time would have been much better spent working on the GNU VOIP client, not only would improvements have been usable without legal issues, they would be there in an (ostensibly, perhaps) understandable format - working code.
- pyre 15y agoThey could reverse engineer and document the firewall/nat negotiation bit, which could then be incorporated into the GNU client.
- foxhill 15y agoannoying and tedious that sort of code is, i agree, but not impossible? besides, i was under the impression that audio/video chats went through skype servers? (i've never actually checked though)
- pyre 15y agoFirewall negotiation uses the p2p aspect of Skype. It either goes through a regular peer or a super node, IIRC.
- evanwolf 15y agoSkype voice and video calls route media directly among participants with two exceptions. First, some thin clients on mobile phones and a few embedded devices don't connect directly to the Skype network, so media streams through Skype gateways operated by Skype or by Skype mobile operator partners. The other exception is for group video calling, a premium service, which redirects video streams through Skype servers to push computational loads for media transcoding from the desktop or mobile clients to Skype's cloud.
- bergie 15y agoThe right way to go about that would be to have a Telepathy provider that talks Skype. That is actually how Skype works in N900, but the implementation there is obviously proprietary.
- jcr 15y agoI wouldn't venture to say this doesn't belong on HN since it really is interesting (if it was actually done correctly), but the files available for download are most likely illegal, were most likely created with pirated tools (IDA Pro/Hex-Rays, and yes, as a customer of theirs for over a dozen years I've reported it), and of course, the usual vilification of reverse engineering. If you're reading this on a desktop or laptop system (rather than a phone), then you are most likely using an "IBM PC Compatible" even if you're using an Intel based Apple, and hence, you're using the fruits of completely legal reverse engineering. The way to do reverse engineering legally is to have one team reverse engineer the target and completely document how it works. Once it's documented, another disconnected team writes a new implementation from the documentation. This process is how you're using an IBM PC Compatible today, so yes, reverse engineering for compatibility is perfectly legal. If there is a patented algorithm required, it's not a sure thing. There are most likely compatible ways around the patent, but there's also the fact that the patent is only valid in the US. With open source hosted in some other country, who are you going to sue? The users in the US? --Nope, users are the ones paying for skype. You might say, "But we forbid reverse engineering in our license!!!" Contract clauses forbidding reverse engineering are invalid in many countries and jurisdictions, and of course, you also have to prove the other party agreed to the contract/license. With this said, it's very easy to create a international jurisdictional nightmare to render any such contract clause tactically impossible to enforce. The easiest way to think about this is security research. The folks finding and reporting exploitable flaws in software are obviously reverse engineering it. Occasionally companies have tried to legally go after people who have published security research on their products, but usually this ends very badly for the company. Additionally, doing security research is protected use in some countries and jurisdictions. In short, competition is good for markets, and competing by studying and mimicking the competition is both normal and legal. For the "rights" advocates out there, there are legal problems with the three file downloads available: 1.) According to the first file name, the original binaries are being redistributed which may be (and usually is) against the license terms and default rights granted by copyrights. 2.) The IDA Pro database (most likely) contains the entire target binary, so you do have (illegal) redistribution of a copyrighted work. You can load only parts of a target binary into IDA, but that doesn't matter since it is still a portion of the original work. As for whether or not said portion could fall under fair use is debatable (i.e. lawsuit). In general usage, the entire binary is loaded, since without it, you're limited to static analysis (i.e. no debugging). 3.) Decompilation, and to a lesser degree disassembly, are equivalent to "machine translation" in the sense of copyright. Creating a translation is considered creating a "derivative work" and unless you have been given rights to create derivative works, then you're in trouble. One of the comments here on HN claims the "source code" file is the output of the Hex-Rays Decompiler. I've never used skype and I've never read their license so I don't know if they specifically allow redistribution. I have no love for skype or microsoft, but if this had been done CORRECTLY by releasing written documentation so an entirely new implementation could be written, then I'd have no problem with it. There are right ways and wrong ways to legally create compatible (open source) software through reverse engineering, and this is a perfect example of the wrong way.
- dkalmnekfaiksmf 15y agoMirror available at http://thepiratebay.org/torrent/6442887 http://thepiratebay.org/torrent/6442887
- tibbon 15y agoPastebin of the unpack-4142.c : http://pastebin.com/AY3abgEJ http://pastebin.com/AY3abgEJ
- brad22 15y agogiven this move, if microsoft open standardizes the protocol ... my respect for microsoft will go +100
- ezioamf 15y agoSkype superiority will finish when IPV6 be fully adopted. When this will happen? Never?
- gcb 15y agoSo microsoft really bought skype and is already playing the bait-and-switch game?!
- mihaelamj 15y agoMicrosoft bought Skype to kill Asterisk (since Cisco is not a competition really). Skype for Asterisk project killed, will stop working in 2 years
- evanwolf 15y ago>Microsoft bought Skype to kill Asterisk (since Cisco is not a competition really) Um, how does this make any sense?
- varjag 15y agoIt doesn't. Asterisk hums happily in million entry-level PBXes around the world and will likely continue to dominate the niche. I fail to see how it really can even be seen as Skype competitor.
- gcb 15y ago...i was mostly making a joke. but this indeed is a classical bait-and-switch move. no clue what microsoft is trying to kill. but i bet it's google voice.
- nextparadigms 15y agoI haven't tried Skype since 4.0, and I just tried it again now. When did it become such bloatware? I don't think I'll ever want to use it again if it stays this way. The new interface looks pretty confusing, too.
- evanwolf 15y agoHas anyone actually read the revealed code? Aside from the commented copyright text at the top, can you explain what the code does well enough to document Skype protocols? Is this in any way useful if you want to talk to Skype servers or clients?
- jduran 15y agothis is just shady
- skypeopensource 15y agoOh, yes.
- nikcub 15y agotwo things: 1. I would love it if MSFT, as the new owner, gave up on the cat-and-mouse of security through obscurity and obfuscation and settled on a published and peer-reviewed protocol. I am sick of the memory footprint and cpu spikes in having to run skype clients because 70% of its resources are dedicated to hiding what is really going on. I would love a nice, clean, light version 2. we can well assume that if this is happening in the public domain then it was probably done a few years ago behind closed doors at the NSA et al
- skypeopensource 15y agorofl! http://skype-open-source.blogspot.com/2011/06/my-interview-to-east-west-digital-news.html http://skype-open-source.blogspot.com/2011/06/my-interview-t...