5 ms·
NSA offering 'billions' for Skype eavesdrop solution
- chaosmachine 18y agoIn other news, Google is launching a free phone service called Google Voice. Perhaps this is their monetization strategy.
- g__g 18y agoAdding to the urban ledgend i've heard so many times: "google is the NSA" :)
- yters 18y agoAnd so is facebook too, donchaknow? Given that HN attracts all the smartest people who would probably figure this stuff out, I'd wager that pg is really a CIA operative. In fact, I suspect Microsoft is as well. I mean, if you are the NSA, what better way is there of looking at everyone's personal, electronic data?
- nir 18y agoHey, and Digg is run by the government!
- ftse 18y agoYou only need to read a few books on the history of spying to know GCHQ, NSA et al have repeatedly made major technological breakthroughs and kept them hushed up to exploit a new edge over their adversaries. You wouldn't expect them to say Skype was easily compromised, would you? They would say the opposite.
- alecco 18y agoThe Register on Cryptography and Security is always a good laugh.
- tptacek 18y agoActually, Dan Goodin at The Reg is a really credible industry reporter, who really does do actual reporting. This runs under someone else's byline, though. There's no actual publication (outside of academia) that is good on crypto.
- alecco 18y agoOK: s/always/often/
- mixmax 18y agoWhat about Bruce Schneier's blog? I'm not into crypto so asking out of curiosity.
- briansmith 18y agoHe almost never talks about crypto anymore.
- alecco 18y agoMaking it worse, he often takes loud stances on things he is not experienced.
- tptacek 18y agoWithout getting into drama, let me suggest that Schneier's personality and notoriety may not match his nuts-and-bolts contributions to the field. I wonder what cperciva thinks about that, but he's also far more polite than me.
- alecco 18y agoI second that. And also rise to very questionable policies, in particular patenting things not clearly his. Also personal experience with his people not playing ball in standards committees.
- asciilifeform 18y agoThis can only mean that they have already broken the Skype encryption - and want their opponents to use it.
- cdr 18y agoThey don't need to break it, Skype already offers backdoor access for governments.
- MikeCapone 18y agoHas this really been established, or is it just presumed? I vaguely remember reading something about the skype team saying they would "cooperate" with law enforcement officials, but I'm not sure if that meant actually listening in on encrypted conversations or just sharing the IPs and time of connections to servers.
- MikeCapone 18y agoI guess what I meant in short is: Please cite your sources.
- jrockway 18y agoThe article has this problem too. "An anonymous source says a friend of a friend said he knows someone that thinks..." This reads as FUD they made up to sell ad views.
- brl 18y agoIn the US they are probably required to provide CALEA interception capabilities to law enforcement for their dial-out service, but I doubt they have some secret interception backdoor in the software itself. If somebody who is reverse engineering Skype found it, and it would eventually be found, the company would be ruined.
- kennon 18y ago
- tptacek 18y agoDoes anyone here actually believe that the NSA would pay billions to crack the protocol for an app that runs primarily on Windows machines?
- cperciva 18y agoNot billions, but I could certainly imagine them paying millions if someone provided them with a passive break. Much easier to tap a few fibre optic cables (either with or without the cooperation of telcos) than to crack individual systems -- and the risk of discovery is much less, too.
- tptacek 18y agoSure. But that's not what the report said. People have all sorts of crazy stories about what the NSA did or didn't say. I think this one is BS.
- brl 18y agoWhat does Windows have to do with anything? The NSA is hoovering up packets at AT&T switching stations and now they want to listen to some encrypted phone calls. Here's my interpretation of the offer. They have no intention of paying for an attack. If somebody attempts to claim the reward they will say "Oh, no thanks, we don't really want your attack" and then rediscover the attack themselves.
- tptacek 18y agoThe overwhelming majority of "persons of interest" using Skype are on Windows, but substitute any other OS and the equation is no different: you're suggesting that the NSA would pay billions of dollars for a break in a protocol that runs exclusively on endpoints that the NSA can get a shell on at will.
- CaptainMorgan 18y agoI run Linux and use Skype, it's available for Mac's too... why the assumption that Windows is the main player? http://www.skype.com/download/skype/linux/choose/?cm_sp=sv|download-_-site|sidebar-_-download_lnk|en_us http://www.skype.com/download/skype/linux/choose/?cm_sp=sv|d... But I like brl's interpretation...
- slater 18y agoThat's bizarre, considering Skype already has built-in hooks for the police force to use
- sdfx 18y agoHeise reported last year that the Austrian police is able to listen in on Skype connections. Neither Austria nor Skype confirmed or denied the story back then. http://www.heise.de/english/newsticker/news/113353 http://www.heise.de/english/newsticker/news/113353
- tdonia 18y agothis sounds like a diversion - it doesn't address what would seem to be a much larger problem of knowing which conversations are worth listening to. also wouldn't help establish the context of the conversation/decode its actual meaning.
- bluishgreen 18y agoRelated: http://zfoneproject.com/faq.html http://zfoneproject.com/faq.html (from the creator of PGP software)
- emilis_info 18y agoThanks for the link. The Zfone FAQ page mentions, that Skype uses VBR codec for audio which is insecure: "Johns Hopkins University researchers have observed that when voice is compressed with a variable bit-rate (VBR) codec, the packet lengths vary depending on the types of sounds being compressed. This leaks a lot of information about the content even if the packets are encrypted, regardless of what encryption protocol is used. We strongly recommend that you avoid using VBR codecs if you want to make a secure phone call. <...> ...This means that Skype is vulnerable to VBR leakage regardless of the quality of Skype's built-in crypto."
- omfut 18y agoIam not sure if NSA is serious about the money. However, iam sure NSA can force skype to provide them with the encryption algorithm for wiretapping. So instead of spending billions of money on third-party vendor, they might as well can work with skype. My 2 cents
- CaptainMorgan 18y agoHow are you sure? It's not a U.S. based company- it doesn't appear NSA would have any holding over it. "The company won't disclose details of its encryption, either, and isn't required to as it is Europe based." Hence, their alleged offering of "billions".
- whatusername 18y agoDidn't they get bought by Ebay? Aren't ebay US based?
- CaptainMorgan 18y agoYou could definitely be correct. But the article isn't that old, unless they got bought in the last thirty or so days. Quoting the article this time shows an interesting choice of words: "But corporate parent eBay, having had to write down $1.4bn already following its $2.6bn purchase of Skype back in the bubble-2.0 days of 2005, might see an opportunity here. A billion or two from the NSA for a backdoor into Skype might make the acquisition seem like a sensible idea." By "parent", if they get into trouble with an agency like the NSA and Ebay is U.S based (for the sake of argument), even though Skype was acquired, couldn't they 'break free' so-to-speak, and head back to Europe with their main operations? Correct me if I'm wrong, but Europe appears to still be their main base of operations while Ebay is like a corporate funding "parent"... that's how I view it from the article, but I could no doubt be mistaken.
- bprater 18y agoOffering "billions" sounds a bit ridiculous. Wouldn't you start with a couple million and see if there are any contenders before you break out the big blank check? Something's fishy...
- Andys 18y agoIsn't it enough money to just pay for the phone calls? See the headlines now - NSA offers free VOIP service - no payment necessary, no advertising, just the fact that you have to be OK with them listening in on your calls.
- braindead_in 18y agoBy its very nature, eavesdropping on P2P is a tough. How do you monitor all the packets that are routed through different paths? The only way would be Deep Packet Inspection. But again the packets are encrypted with 128 bit key. So even if you get the packets, you'll have a tough time decrypting it. The Skype binary also is heavily obfuscated. It wont even run if a ring 0 debugger is on your system. It definitely deserves a billion dollar bounty.
- tptacek 18y agoUm, the best antireversing/antidebugging people in the world still don't have casual game crackers beat. For "a billion dollars", I might substitute "free xbox".
- brl 18y agoI hear that 'Tom Clancy's Splinter Cell' is kind of annoying to break the protection on :)
- tptacek 18y agoHey, I totally went out and bought that title. I just never got around to it. If you wanted to call me out on it, you might be doing me a favor. [edit] Context: http://rdist.root.org/2007/04/19/anti-debugger-techniques-are-overrated/ http://rdist.root.org/2007/04/19/anti-debugger-techniques-ar...
- michaelneale 18y agoI don't see the connection between game cracking and grabbing lots of p2p traffic reliably.
- tptacek 18y agoThe argument was made that Skype is a hard target, in part because they went through some trouble to obscure the binary. I'm just refuting that portion of the argument.
- 18y ago
- globalrev 18y agoDoesn't Skype make money(as in profit not just revenue)?
- Caligula 18y agoI don't think the encryption issue is the big problem. I am sure skype's codec has been hacked already. The p2p issue could be addressed by just placing giant routers in isp's like the US did at the telcos. The bigger problem would be transcribing a million streams at once. Also, transcribing arabic words. Thats probably what they are mostly interested in. There are good acoustic models for english but I doubt there are for arabic. Even if there were, the processing power requirement would be insane. I doubt amazon EC could handle a million streams at once even if they used smaller grammars focusing on suspicious words.
- pageman 18y agomore Pashto (http://www.ethnologue.com/show_language.asp?code=pbt http://www.ethnologue.com/show_language.asp?code=pbt) than Arabic (http://www.ethnologue.com/show_language.asp?code=arb http://www.ethnologue.com/show_language.asp?code=arb) there's less than 10 million Pashto speakers in the world (about 8M are in Afghanistan) vs. 250M++ for Arabic.