Chris Soghoian has a good piece breaking down what we know, and don’t know, about Skype’s VoIP security. While not mentioned, it’s helpful to keep in mind that the security and anonymity offered by Skype is questionable regardless of whether the company provides a private key/enables MITM/etc for law enforcement agencies. Such questions are, and have been raised by academics for some time, as evidenced by the body of academic research on Skype and security.
To be clear: the following list is not a comprehensive accounting of literature that has been critical of Skype or VoIP encryption. Instead, the list is meant to show that researchers have been evaluating Skype’s security promises for a very long time. The present controversy around Skype’s security stance – i.e. can or can’t the company decrypt VoIP communications for law enforcement – should be read as an ongoing part of this narrative instead of as a revelatory moment that “changes everything.”
Phonotactic Reconstruction of Encrypted VoIP Conversations: Hookt on fon-iks (2011)
Abstract: In this work, we unveil new privacy threats against Voice-over-IP (VoIP) communications. Although prior work has shown that the interaction of variable bit-rate codecs and length-preserving stream ciphers leaks information, we show that the threat is more serious than previously thought. In particular, we derive approximate transcripts of encrypted VoIP conversations by segmenting an observed packet stream into subsequences representing individual phonemes and classifying those subsequences by the phonemes they encode. Drawing on insights from the computational linguistics and speech recognition communities, we apply novel techniques for unmasking parts of the conversation. We believe our ability to do so underscores the importance of designing secure (yet efficient) ways to protect the confidentiality of VoIP conversations.
Analysis of information leakage from encrypted Skype conversations (2010)
Abstract: Voice over IP (VoIP) has experienced a tremendous growth over the last few years and is now widely used among the population and for business purposes. The security of such VoIP systems is often assumed, creating a false sense of privacy. This paper investigates in detail the leakage of information from Skype, a widely used and protected VoIP application. Experiments have shown that isolated phonemes can be classified and given sentences identified. By using the dynamic time warping (DTW) algorithm, frequently used in speech processing, an accuracy of 60% can be reached. The results can be further improved by choosing specific training data and reach an accuracy of 83% under specific conditions. The initial results being speaker dependent, an approach involving the Kalman filter is proposed to extract the kernel of all training signals.
Recovery of Skype Application Activity Data from Physical Memory (2010)
Abstract: The use of Internet based communication technologies has become more prevalent in recent years. Technologies such as Skype provide a highly secure and decentralised method of communication. These technologies may also leave little evidence on static media causing conventional digital forensic processes to be ineffective. This research looks at exploiting physical memory to recover evidence from Internet based communication technologies where conventional methods cannot. The paper first proposes a set of generic target artefacts that defines information that may be targeted for recovery and the meaning that can be inferred from this. A controlled test was then undertaken where Skype was executed and the memory from the target machine collected. The analysis showed that it is feasible to recover the target data as applied to Skype, which would not be otherwise available. As this is the first set of tests of a series, the future direction is also discussed.
Blocking Skype through Deep Packet Inspection (2009)
Abstract: Skype is a peer-to-peer (P2P) voice over IP (VOIP) chat program. It provides its clients with an inexpensive means to communicate worldwide via the Internet through wired and wireless networks. In the past this application was limited strictly to computers, yet with continuous advancements in mobile communication, Skype phones and other mobile devices have recently hit the market in an attempt to capitalize on Skype’s reliable connection algorithms. However, despite the success of this application, it is important to note that due to Skype’s connection algorithm and the nature of P2P, a number of vulnerabilities emerge that threaten both users and their networks. This paper outlines how to block the Skype application through the use of deep packet inspection. This novel approach is completely scalable to networks of any size as a means of blocking one of the largest threats to commercial and government networks today.
Identifying Skype Traffic by Random Forest (2007)
Abstract: Despite of the great popularity, little is known about Skype network attributed to proprietary protocol. End-to-end encryption disables the traditional traffic detection methods. We presented genetic algorithm based Random Forest algorithm to identify Skype traffic using only transport layer statistics. Experimental results show that the proposed approach can immune to the encryption of the payload and be capable of detecting Skype traffic with accuracy over 95% while low computational complexity is required.
Revealing skype traffic: when randomness plays with you (2007)
Abstract: Skype is a very popular VoIP software which has recently attracted the attention of the research community and network operators. Following a closed source and proprietary design, Skype protocols and algorithms are unknown. Moreover, strong encryption mechanisms are adopted by Skype, making it very difficult to even glimpse its presence from a traffic aggregate. In this paper, we propose a framework based on two complementary techniques to reveal Skypetraffic in real time. The first approach, based on Pearson’sChi-Square test and agnostic to VoIP-related trafficcharacteristics, is used to detect Skype’s fingerprint from the packet framing structure, exploiting the randomness introduced at the bit level by the encryption process. Conversely, the second approach is based on a stochastic characterization of Skype traffic in terms of packet arrival rate and packet length, which are used as features of a decision process based on Naive Bayesian Classifiers.In order to assess the effectiveness of the above techniques, we develop an off-line cross-checking heuristic based on deep-packet inspection and flow correlation, which is interesting per se. This heuristic allows us to quantify the amount of false negatives and false positives gathered by means of the two proposed approaches: results obtained from measurements in different networks show that the technique is very effective in identifying Skype traffic. While both Bayesian classifier and packet inspection techniques are commonly used, the idea of leveraging on randomness to reveal traffic is novel. We adopt this to identify Skype traffic, but the same methodology can be applied to other classification problems as well.
VoIP and Skype Security (2005)
A critical evaluation of Skype’s security stance as juxtaposed against other peer-to-peer models, ISDN/VoIP services, and what we can take away from Skype’s claims about encryption and voice security.
Skype Security Evaluation (2005)
Since 1 June 2005 I have been analyzing the security properties of Skype software and services, with a focus on the current and planned uses of cryptography. I have had unimpeded access to Skype engineers and to Skype source code. I have found out a lot about Skype. The more I found out, the happier I became.
Any pieces of literature you think are absolute must adds to this list?
Excited Pixels 