Skype security

[[Category:Articles that may contain original research from July 2 is a Voice over Internet Protocol (VoIP) system developed by Skype Technologies S.A. It is a peer-to-peer network in which voice calls pass over the Internet rather than through a special-purpose network. Skype users can search for other uvege Scharff]]</ref>

Skype says that it uses 256 bit AES to encrypt communication between users, although when calling a telephone or mobile, the part of the call over the PSTN is not encrypted.[1][2] User public keys are certified by the Skype server at login with 1536 or 2048-bit RSA certificates. Skype's encryption is inherent in the Skype Protocol and is transparent to callers. Skype is not considered to be a secure VoIP system as the calls made over the network do not make use of end-to-end encryption, allowing for routine monitoring by Microsoft and by microsoft-nsa-collaboration-user-data|publisher=The Guardian|title=Microsoft handed the NSA access to encrypted messages|author1=Glenn Greenwald|author2=Ewen MacAskill|author3=Laura Poitras|author4=Spencer Ackerman|author5=Dominic Rushe|date=12 July 2013}}</ref>

Security policy

The company's security policy states that:

  1. Usernames or other authentication credential.
  2. Each caller provides the other with proof of identity and privileges whenever a session is established. Each verifies the other's proof before the session is allowed to carry messages.
  3. Messages transmitted between Skype users (with no PSTN users included) are encrypted from caller to caller.[1] No intermediate node (router) has access to the meaning of these messages. This claim was undermined in May 2013 by evidence that Microsoft (owner of Skype) has pinged unique URLs .com/2013/05/22/microsofts-reading-skype-messages/|title=Microsoft is reading Skype messages}}</ref> this could only happen if Microsoft has access to the unencrypted form of these messages.

Implementation and protocols

Registration

Skype holds registration information both on the ca server. Skype uses this than an impostor. Skype says that it uses [[public key en accomple key, and distributes that key's public counterpart with every copy of the software. As part of user registration, the user selectslly generates public and private keys. The private key and a hash of the password are stored on the usenced Encryption Standard|AES]]-encrypted session is exists as long as communication continues and for a fixed time afterward. As part of connecting a call, Skype securely transmits the session key to the call recipient. That session key is then used to encrypt messages in ]]. This returns the key stream, which is then XORed with the message against playback attacks, creation of RSA key pairs, and a proprietary, symmetric protocol. To protect against a playback attack, the peers challenge each other with random 64-bit nonces. The challenge response is to customize the challenge in a proprietary way and returned it signed with the responder's private key.

The peers exchange Identity Certificates and confirm that these certificates are legitimate. Because an Identity Certificate contains a public key, each end can then confirm signatures created by the other peer. Each peer contributes 128 random bits to the 256-bit session key.

Automatic updates

Another security risk are automatic updates, which cannot be disabled from version 5.6 on,[3][4] both on Mac OS and Windows branches, although in the latter, and only from version 5.9 on, automatic updating can be turned off in certain cases.[5]

Eavesdropping by design

Chinese, Russian and United States law enforcement agencies have the ability to eavesdrop on Skype conversations and to have access to Skype users' geographic locations. In many cases, a simple request for information is sufficient, with no court approval needed. This ability was deliberately added by Microsoft for law enforcement agencies around the world after they purchased Skype in 2011. This is implemented by switching the Skype client for a particular user account from the client-side encryption to the server-side encryption, allowing dissemination of an unencrypted data stream.[6][7][8]

Actual and potential flaws

While Skype encrypts users' sessions, other traffic, including call initiation, can be monitored by unauthorized parties.

The other side of security is whether Skype imposes risk on its users' computers and networks. In October 2005 a pair of security flaws were discovered and patched. Those flaws made it possible for hackers to run hostile code on computers running vulnerable versions of Skype. The first security bug affected only Microsoft Windows computers. It allowed the attacker to use a buffer overflow to crash the system or to force it to execute arbitrary code. The attacker could provide a malformed URL using the Skype URI format, and lure the user to request it to execute the attack. The second security bug affected all platforms; it used a heap-based buffer overflow to make the system vulnerable.

Issues, including several potentially affecting security, include:

  • The Skype code is proprietary and closed source, and it is not planned to become open-source software, according to Niklas Zennström, co-founder of Skype, who responded in 2004 to questions on the Skype security model saying "We could do it but only if we re-engineered the way it works and we don't have the time right now".[9] If the software source were available peer review would be able to verify its security.[10]
  • On 13 November 2012 a Russian user published a flaw in Skype security which allowed any non-professional attacker to take over a Skype account knowing only the victim's email in seven simple steps.[11][12] This vulnerability was claimed to exist for months, and was not corrected until more than 12 hours after it was published widely.
  • By default, Skype records data about calls (but not the message contents) in a "History" file saved on the user's computer. Attackers who gain access to the computer can obtain the file.[13]
  • Skype can consume other users' bandwidth. Although this is documented in the license agreement (EULA), there is no way to tell how much bandwidth is being used in this manner.[14]
  • There are some 20,000 supernodes out of many millions of users logged on. Skype Guide for network administrators claims that supernodes carry only control traffic up to 10 kB/s and relays may carry other user data traffic up to 15 kB/s (for one audio conference call). A relay should not normally handle more than one "relayed connection".[14][15]
  • Skype's file-transfer function does not integrate with any antivirus products, although Skype claims to have tested its product against antivirus "Shield" products.[14]
  • Skype does not document all communication activities. This lack of clarity as to content means that systems administrators cannot be sure what it is doing. (The combination of an invited and a reverse-engineered study taken together suggest Skype is not doing anything hostile). Skype can be easily blocked by firewalls.[14]
  • Skype consumes network bandwidth, even when idle (even for non-supernodes, e.g., for NAT traversal). For example, if there were only 3 Skype users in the world and 2 were communicating, the 3rd computer would be taxed to support the application, even if not using Skype at the time. The large number of Skype computers means that this activity is diffuse, it can lead to performance issues on standby Skype users, and presents a conduit for security breaches.[16][10]
  • Skype implicitly trusts any message stream that obeys its protocols[10]
  • Skype does not prohibit a parallel Skype-like network[10]
  • Skype makes it hard to enforce a corporate security policy[10]
  • Skype prior to version 3.0.0.216 created a file called 1.com in the temp directory which was capable of reading all BIOS data from a PC.[17] According to Skype this was used to identify computers and provide DRM protection for plug-ins. They later removed this file, but it is not known whether the BIOS-reading behavior was removed.[18][19]
  • The URI handler that checks URLs for verification of certain file extensions and file formats uses case sensitive comparison techniques and doesn’t check all potential file formats.[20][21]
  • While Skype does encrypt most of its communications, unencrypted packets containing advertisements are pulled from several places, exposing a cross-site scripting vulnerability. These ads can easily be hijacked and replaced with malicious data.[22]
  • The privacy of Skype traffic may have limits. Although Skype encrypts communication between users, a Skype spokesman did not deny the company's ability to intercept communication. On the question of whether Skype could listen in on their users' communication, Kurt Sauer, head of the security division of Skype, replied evasively: "We provide a secure means of communication. I will not say if we are listening in or not."[23] In China text is filtered according to government requirements. This suggests that Skype has the capacity to eavesdrop on connections.[24] One of Skype's minority owners, eBay, has divulged user information to the U.S. government.[25][26]
  • Security researchers Biondi and Desclaux have speculated that Skype may have a back door, since Skype sends traffic even when it is turned off and because Skype has taken extreme measures to obfuscate their traffic and functioning of their program.[27] Several media sources have reported that at a meeting about the "Lawful interception of IP based services" held on 25 June 2008, high-ranking but unnamed officials at the Austrian interior ministry said that they could listen in on Skype conversations without problems. Austrian public broadcasting service ORF, citing minutes from the meeting, have reported that "the Austrian police are able to listen in on Skype connections".[28][29] Skype declined to comment on the reports.[30]
  • The Skype client for Linux has been observed accessing the Firefox profile folder during execution.[31] This folder contains all the saved passwords in plain text if no master password is used, it also contains the user's browsing history. Access to this file was confirmed by tracing system calls made by the Skype binary during execution.[32]
  • The Skype client for Mac has been observed accessing protected information in the system Address Book even when integration with the Address Book (on by default) is disabled in the Skype preferences. Users may see a warning about Skype.app attempting to access protected information in address book under certain conditions, e.g. launching Skype while syncing with a mobile device. Skype has no legitimate reason to access the Address Book if the integration is not enabled. Further, the extent of the integration is to add all cards from the Address Book to the list of Skype contacts along with their phone numbers, which can be accomplished without accessing any protected information (neither the name nor numbers on cards are protected) and thus the attempt to access information beyond the scope of the integration, regardless of whether or not that integration is enabled, raises deeper questions as to possible spying on users.
  • The United States Federal Communications Commission (FCC) has interpreted the Communications Assistance for Law Enforcement Act (CALEA) as requiring digital phone networks to allow wiretapping if authorized by an FBI warrant, in the same way as other phone services. In February 2009 Skype said that, not being a telephone company owning phone lines, it was exempt from CALEA and similar laws which regulate US phone companies. It is also not clear whether wiretapping of Skype communications is technically possible.[33] According to the ACLU, the Act is inconsistent with the original intent of the Fourth Amendment to the U.S. Constitution;[34] more recently, the ACLU has expressed the concern that the FCC interpretation of the Act is incorrect.[35][36]
gollark: <@&358173303816323072> Can someone catch my experiment in ~15 minutes?
gollark: Anyone available in 5ish hours? I have two experiments running.
gollark: Smallish ND experiments don't really say much about the effectiveness of various things, because NDs are highly random, and there don't seem to be any attempts to do larger-scale ND experiments which control for the many variables involved.
gollark: I've done neglection a bit last year, which is where I got... some stuff or other, I forget... from.
gollark: ... now I need to figure out what to do with them.

References
  1. Template:Cite web Skype
  2. Lynn Hathaway (June 2003). [/pdf/cnssp_15_fs.pdf "National Policy on the Use of the Advanced Encryption Standard (AES) to Protect National Security Systems and National Security Information"] Check |archiveurl= value (help) (PDF). Archived from the original (PDF) on 2008-05-28. Retrieved 2008-11-02.
  3. "Skype 5.6 for Mac". Archived from the original on 2012-04-06.
  4. "I want to turn off automatic updates".
  5. "Skype 5.9 for Windows". Archived from the original on 2012-04-14.
  6. Елизавета Серьгина; Алексей Никольский; Александр Силонов (14 March 2013). "Российским спецслужбам дали возможность прослушивать Skype" [Russian law enforcement has been granted the ability to eavesdrop on Skype conversations]. Ведомости (Vedomosti) (in Russian). Retrieved 25 July 2020.
  7. Bogdan Popa (20 June 2013). "Skype Provided Backdoor Access to the NSA Before Microsoft Takeover (NYT)". Softpedia.
  8. Bogdan Popa (31 December 2014). "Leaked Documents Show the NSA Had Full Access to Skype Chats". Softpedia.
  9. "VoIP suffers identity crisis". The Register. June 15, 2004.
  10. Biondi, Philippe; DESCLAUX, Fabrice. "Silver Needle in the Skype" (PDF). blackhat. Retrieved 2006-03-02.
  11. "Skype accounts can be hacked with an email address".
  12. "Уязвимость в skype, позволяющая угнать любой аккаунт".
  13. Simson Garfinkel - VoIP and Skype Security
  14. Max, Harry. "Skype: The Definitive Guide". Que Publishing. Retrieved 2006-08-22.
  15. "Guide for network admins" (PDF).
  16. This is similar to the type of granted access that the SETI download applications presented.
  17. pagetable.com » Blog Archive » Skype Reads Your BIOS and Motherboard Serial Number
  18. Skype Security Blog - Skype Extras plug-in manager Archived 2008-10-19 at the Wayback Machine
  19. The Register » Skype snoop agent reads mobo serial numbers
  20. "Vulnerabilities in Skype". Retrieved 2008-01-17.
  21. Claburn, Thomas. "Skype Addresses Cross-Zone Scripting Vulnerability - Security". InformationWeek. Retrieved 2010-06-09.
  22. "Skype File URI Security Bypass Code Execution Vulnerability". Skype.com. Retrieved 2010-06-09.
  23. ZDNet: Interview with Kurt Sauer „Telefonieren übers Internet: Wie sicher ist Skype wirklich?“, February 13, 2007
  24. guli.com: Textfilter in China, 19. April 2006
  25. "heise online - eBays neue Richtlinien in der Kritik". Heise.de. Retrieved 2010-06-09.
  26. "Skype-Gespräche unantastbar?". intern.de. 2007-11-23. Retrieved 2010-06-09.
  27. Biondi P., Desclaux F (2–3 March 2006). "Silver Needle in the Skype" (PDF). EADS Corporate Research Center. Retrieved 26 January 2009.
  28. Sokolov, David AJ (24 July 2008). "Speculation over back door in Skype". Heise Security UK. Archived from the original on 13 July 2010. Retrieved 26 January 2009.
  29. Leyde, John (24 July 2008). "Austrian official fuels Skype backdoor rumours". The Register UK. Retrieved 29 January 2009.
  30. Vilde, Boris (27 July 2008). "Skype Has Back Door for Cops' Eavesdropping". Ohmproject. Retrieved 29 January 2009.
  31. "Skype Linux Reads Password and Firefox Profile - Slashdot". August 26, 2007.
  32. "Skype 1.4.0.99 reads /etc/ passwd and firefox profile! - Skype Community". August 25, 2007. Archived from the original on October 13, 2011.CS1 maint: unfit url (link)
  33. "Skype Secrecy Under Attack Again". VoIP News. 2009-02-24. Retrieved 2010-10-10.
  34. "Big Brother in the Wires: Wiretapping in the Digital Age". ACLU. Retrieved 23 March 2009.
  35. "CALEA feature page". ACLU. Retrieved 23 March 2009.
  36. "German Authorities Raiding Homes To Find Skype Tapping Whistleblower". Techdirt. 18 September 2008. Retrieved 31 March 2009.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.