4 ms·
It seems that the encryption algorithm has been reverse engineered. I guess you'll still need the keys to decrypt the voice data using this algorithm, assuming
by braindead_in 15y ago
It seems that the encryption algorithm has been reverse engineered. I guess you'll still need the keys to decrypt the voice data using this algorithm, assuming it works. It's a big deal if has been done, because a lot of people have been trying to crack it. Some governments are going to love this. The Skype client itself has a lot of obfuscation to prevent something like this.
- JoshTriplett 15y agoThe ability to interoperate with Skype as one of the participants in a call has little to do with the ability to intercept and decrypt Skype calls as a non-participant in a call, unless Skype uses broken crypto (a very real possibility).
- 46Bit 15y agoI think it's fair to surmise that those intelligence agencies that care have probably had the algorithm for a long time and searched for weaknesses. Bear in mind that at one time they were complaining about it's use by criminals to avoid phonetaps.
- braindead_in 15y agoThere has been some speculation about a backdoor in Skype which it has shared with intelligence agencies. Never confirmed by Skype of course. But this could allow anyone to decrypt a Skype conversation stream. All you need is a Skype supernode to get started. Or some kind of spyware on the subject's computer which stores/transmits the data stream.
- gst 15y agoIf you've got spyware installed on one of the endpoints you don't need any backdoor in Skype. Just dump the audio output and input directly from the audio card.
- braindead_in 15y agoEasier said then done. The most reliable way to dump audio output is by API Hooking, which isn't easy in the first place and detectable by AV, Spybot etc. It much simpler to intercept the network traffic.
- pipaman 15y agoWe at http://internals.nektra.com http://internals.nektra.com have done this for several customers. It's not easy but it really works.
- 46Bit 15y agoQuite possibly, and certainly I think they could get it if they really wanted. Certainly it can't be much worse that typical public email providers where law enforcement seem to pretty much just have to type an email into a form to browse your inbox.
- zokier 15y agoIf it had a backdoor, it should be visible in the decompiles, right? Of course it could be rather obfuscated, but still, careful analysis could prove either way.
- hfakfa 15y agoNot necessarily. As someone else pointed out all you need is a super node.