Category: Links

Categories
Links Writing

Some Literature on Skype Security

Chris Soghoian has a good piece breaking down what we know, and don’t know, about Skype’s VoIP security. While not mentioned, it’s helpful to keep in mind that the security and anonymity offered by Skype is questionable regardless of whether the company provides a private key/enables MITM/etc for law enforcement agencies. Such questions are, and have been raised by academics for some time, as evidenced by the body of academic research on Skype and security.

To be clear: the following list is not a comprehensive accounting of literature that has been critical of Skype or VoIP encryption. Instead, the list is meant to show that researchers have been evaluating Skype’s security promises for a very long time. The present controversy around Skype’s security stance – i.e. can or can’t the company decrypt VoIP communications for law enforcement – should be read as an ongoing part of this narrative instead of as a revelatory moment that “changes everything.”

Phonotactic Reconstruction of Encrypted VoIP Conversations: Hookt on fon-iks (2011)

Abstract: In this work, we unveil new privacy threats against Voice-over-IP (VoIP) communications. Although prior work has shown that the interaction of variable bit-rate codecs and length-preserving stream ciphers leaks information, we show that the threat is more serious than previously thought. In particular, we derive approximate transcripts of encrypted VoIP conversations by segmenting an observed packet stream into subsequences representing individual phonemes and classifying those subsequences by the phonemes they encode. Drawing on insights from the computational linguistics and speech recognition communities, we apply novel techniques for unmasking parts of the conversation. We believe our ability to do so underscores the importance of designing secure (yet efficient) ways to protect the confidentiality of VoIP conversations.

Analysis of information leakage from encrypted Skype conversations (2010)

Abstract: Voice over IP (VoIP) has experienced a tremendous growth over the last few years and is now widely used among the population and for business purposes. The security of such VoIP systems is often assumed, creating a false sense of privacy. This paper investigates in detail the leakage of information from Skype, a widely used and protected VoIP application. Experiments have shown that isolated phonemes can be classified and given sentences identified. By using the dynamic time warping (DTW) algorithm, frequently used in speech processing, an accuracy of 60% can be reached. The results can be further improved by choosing specific training data and reach an accuracy of 83% under specific conditions. The initial results being speaker dependent, an approach involving the Kalman filter is proposed to extract the kernel of all training signals.

Recovery of Skype Application Activity Data from Physical Memory (2010)

Abstract: The use of Internet based communication technologies has become more prevalent in recent years. Technologies such as Skype provide a highly secure and decentralised method of communication. These technologies may also leave little evidence on static media causing conventional digital forensic processes to be ineffective. This research looks at exploiting physical memory to recover evidence from Internet based communication technologies where conventional methods cannot. The paper first proposes a set of generic target artefacts that defines information that may be targeted for recovery and the meaning that can be inferred from this. A controlled test was then undertaken where Skype was executed and the memory from the target machine collected. The analysis showed that it is feasible to recover the target data as applied to Skype, which would not be otherwise available. As this is the first set of tests of a series, the future direction is also discussed.

Blocking Skype through Deep Packet Inspection (2009)

Abstract: Skype is a peer-to-peer (P2P) voice over IP (VOIP) chat program. It provides its clients with an inexpensive means to communicate worldwide via the Internet through wired and wireless networks. In the past this application was limited strictly to computers, yet with continuous advancements in mobile communication, Skype phones and other mobile devices have recently hit the market in an attempt to capitalize on Skype’s reliable connection algorithms. However, despite the success of this application, it is important to note that due to Skype’s connection algorithm and the nature of P2P, a number of vulnerabilities emerge that threaten both users and their networks. This paper outlines how to block the Skype application through the use of deep packet inspection. This novel approach is completely scalable to networks of any size as a means of blocking one of the largest threats to commercial and government networks today.

Identifying Skype Traffic by Random Forest (2007)

Abstract: Despite of the great popularity, little is known about Skype network attributed to proprietary protocol. End-to-end encryption disables the traditional traffic detection methods. We presented genetic algorithm based Random Forest algorithm to identify Skype traffic using only transport layer statistics. Experimental results show that the proposed approach can immune to the encryption of the payload and be capable of detecting Skype traffic with accuracy over 95% while low computational complexity is required.

Revealing skype traffic: when randomness plays with you (2007)

Abstract: Skype is a very popular VoIP software which has recently attracted the attention of the research community and network operators. Following a closed source and proprietary design, Skype protocols and algorithms are unknown. Moreover, strong encryption mechanisms are adopted by Skype, making it very difficult to even glimpse its presence from a traffic aggregate. In this paper, we propose a framework based on two complementary techniques to reveal Skypetraffic in real time. The first approach, based on Pearson’sChi-Square test and agnostic to VoIP-related trafficcharacteristics, is used to detect Skype’s fingerprint from the packet framing structure, exploiting the randomness introduced at the bit level by the encryption process. Conversely, the second approach is based on a stochastic characterization of Skype traffic in terms of packet arrival rate and packet length, which are used as features of a decision process based on Naive Bayesian Classifiers.In order to assess the effectiveness of the above techniques, we develop an off-line cross-checking heuristic based on deep-packet inspection and flow correlation, which is interesting per se. This heuristic allows us to quantify the amount of false negatives and false positives gathered by means of the two proposed approaches: results obtained from measurements in different networks show that the technique is very effective in identifying Skype traffic. While both Bayesian classifier and packet inspection techniques are commonly used, the idea of leveraging on randomness to reveal traffic is novel. We adopt this to identify Skype traffic, but the same methodology can be applied to other classification problems as well.

VoIP and Skype Security (2005)

A critical evaluation of Skype’s security stance as juxtaposed against other peer-to-peer models, ISDN/VoIP services, and what we can take away from Skype’s claims about encryption and voice security.

Skype Security Evaluation (2005)

Since 1 June 2005 I have been analyzing the security properties of Skype software and services, with a focus on the current and planned uses of cryptography. I have had unimpeded access to Skype engineers and to Skype source code. I have found out a lot about Skype. The more I found out, the happier I became.

Any pieces of literature you think are absolute must adds to this list?

Categories
Links

The Pwnies Are Out

I admit to having a preference for the attack on MySQL. The description:

“Are we there yet?” MySQL Authentication Bypass (CVE-2012-2122)

Credit: Sergei Golubchik

On vulnerable versions of MySQL simply asking to authenticate repeatedly enough times is enough to bypass authentication: “Can I log in as root now?”
”How about now?”
”Now?”

That said, the various nominees for Epic Ownage are pretty hilarious as well:

“Flame” Windows Update MD5 Collision Attack

Flame Authors

Any attack that requires a breakthrough in cryptography to pull off is pretty cool in our book. And being able to pwn any Windows machine through Windows Update is pretty mass 0wnage.

Certificate Authorities

Everyone

It turns out that Certificate Authorities themselves are one massive security vulnerability. How many more CAs need to get popped before we as an industry realize that allowing Bob’s Bait, Tackle, and Certificates to issue wildcard certificates is a bad idea?

iOS Jailbreaks

iPhone Dev Team and Chronic Dev Team

We love the jailbreakers and you should too. They publicly drop all of their exploits as 0day, convince millions of users to disable the security features on their own devices, and then keep those devices vulnerable to the released exploits until new exploits can be developed and released in the patched versions of iOS.

It’s been a ‘good’ year for massive security deficits. Check up on the Pwnies – and watch the various streams from the summer’s security conferences – to appreciate why pencil and paper (or, barring that, actual fiscal and legal liability for writing bad code) is an ever-appealing idea.

Categories
Links Writing

Origin Stories and the Internet

There are a large list of origin stories and myths surrounding the ‘net. Some are far better than others. Given a recent (significantly misguided) piece by WSJ a quick couple of responses have gone up at Ars (not bad, not great) and by Robert Graham (pretty good). I’m not going to write an origin myth – though I’ve got one that I’m writing for future publication, and have been ‘teaching the myth’ to students of late – but in no particular order is a list of good/interesting books on the topic.

Categories
Aside Links

SandForce Controllers and Encryption

Rob Graham has a good look at the challenges facing SandForce controllers – which are used by a large number of the solid state hard drives on the consumer market – as related to disk encryption. I highly recommend reading it but, if you just don’t have the time, here’s the key takeaway: “The problem with a SandForce controller is that all its features are lost when using full disk encryption, but all its downsides remain. Thus, if you plan on using an SSD for your notebook computer, you should plan on getting something other than a SandForce controller.”

Categories
Links Writing

Can Nulpunt “Abolish Government Secrecy?”

In a word: No.

Nulpunt is an online database that lets individuals subscribe to topics and, when a freedom of information request on the topic becomes available, ‘pushes’ the content to the user. This mediates the present format for such requests, where individuals tend to be hunting for specific information and the population generally has no effective means to see or understand the information divulged to fellow citizens.

The aspiration of the service is that government secrecy can be undermined by making information more prominently available. I’m not confident that this can possibly be the case because the service fails to address the primary means by which states keep citizens in the dark: it does not prevent state agents from refusing requests nor from redacting significant elements from released documents.

While it may be effective in nations such as the Netherlands, which have recently adopted new transparency laws, I can’t imagine Canada or the US moving to entirely new document release processes without a significant stick. Nulpunt is not, and cannot, function as that stick so long as governments refuse to recognize their situatedness as servants, rather than masters, of the population at large.

Categories
Links Writing

VPNs becoming more common amongst youth

The risks that onerous copyright laws pose for law enforcement are rarely considered, despite such laws (potentially) threatening national security operations. In Sweden, following efforts to dissuade file sharing, the population is increasingly moving to encrypted VPN connections to continue their sharing. From an article over at Torrentfreak,

according to new research from the Cybernorms research group at Sweden’s Lund University, an increasing proportion of the country’s population are taking measures to negate the effects of spying on their online activities.

The study reveals that 700,000 Swedes now make themselves anonymous online with paid VPN services such as The Pirate Bay’s iPredator.

What does this have to do with law enforcement? As the Swedish population moves to encrypted communications it limits authorities’ insights into the data traffic moving through Swedish networks. Consequently, the copyright lobby is (unintentionally) increasing the challenges of applying digital ‘wiretaps’ on Swedish citizens. While not something that the copyright lobbies are necessarily concerned with, these developments can be problematic for national security agencies.

I’m not advocating that communications should necessarily be easier for such agencies to investigate – far from it – but do I think that before aligning legislative efforts with copyright groups it is critical for legislators to think of the broader implications associated with ‘strong’ copyright laws. While such laws might dissuade some file sharing, are the benefits derived from limiting file sharing sufficient to justify disadvantaging national security and intelligence operation?

Categories
Links Writing

The Importance of ZTE Security Deficits

A great of speculation exists around mobile companies of all stripes: are they secure? Do they secretly insert backdoors for government? What kinds of assurances do customers and citizens have around the devices?

Recently these concerns exploded (again) following a Reuters article that notes serious problems in ZTE mobile phones. There are a series of reasons that security agencies can, and do, raise concerns about foreign built equipment (some related more to economics than good security practice). While it’s possible that ZTE’s vulnerabilities were part of a Chinese national-security initiative, it’s entirely likely (and more probable) that ZTE’s backdoor access into their mobiles is a genuine, gigantic, mistake. Let’s not forget that even ‘our’ companies are known for gross security incompetence.

In the ZTE case it doesn’t matter if the backdoor was deliberate or not. It doesn’t matter if the company patches the devices, either, because a large number of customers will never apply updates to their phones. This means that, for all intents and purposes, these devices will have well publicized security holes for the duration of their existence. It’s that kind of ongoing vulnerability – one that persists regardless of vendor ‘patches’ – that is increasingly dangerous in the mobile world, and a threat that is arguably more significant (at the moment) than whether we can trust company X or Y.

Categories
Links Writing

Canada Post Sees Today, In The Future

National mail carriers are important for loads of reasons, including legal protections around letters carried by them versus those carried by couriers. These mail carriers are far less agile than their private competitors and have been incredibly slow to recognize the need to change existing processes and practices. They desperately need to find new growth avenues to remedy declining gross and net revenues.

As a demonstration of how little Canada Post ‘gets’ the market and business it’s in today, we can turn to this comment:

Canada Post chief executive officer Deepak Chopra foresees a future in which consumers receive and pay their bills, get their paycheques, renew drivers’ licences, pay parking tickets, buy magazines and receive personalized ad pitches – all online, through ePost.

This isn’t a future: it’s the present. The only ‘future’ part of what he is outlining is that all these (already daily) functions would be routed through ePost. Unless Canada Post has an incredible value proposition – security, government mandates, or somehow implementing these functions better than existing services are mechanisms that immediately come to mine – I can’t see how the organization will exist in any semblance of what it is today, tomorrow.

Categories
Links Writing

RIM Demoing the Value of NFC-Enabled Devices

I admit it: I’m really curious to see how NFC technologies are adopted by various vendors and developers. To date, however, the integration has been poor and what adoption there has been tends to focus on payment solutions. Payment solutions scare the crap out of me because they increase the reasons attackers have to compromise my phone: it’s bad enough they want my personal information; I don’t want them after my digital wallet as well!

RIM has a neat bit of technology they’ve recently released, which leverages the NFC functionality in their new phones with Bluetooth pairing systems. Specifically, it enables rapid syncing between phones and audio-output devices (i.e., speakers). While the product is pretty “meh” as released today, it could be pretty exciting were vehicle manufacturers and speaker manufacturers to generally integrate NFC-pairing capabilities with their respective products. It’s presently a pain to listen to music stored on a mobile through vehicle speakers (using Bluetooth) or a friend’s speakers in their home. RIM has offered a partial solution to the Bluetooth pairing problem; now it’s up to the larger ecosystems to actually integrate RIM’s idea in a omnipresent and highly functional way.

Categories
Links Writing

The Financial Liability Game

Ars Technica has reported that a German court has found a victim of a phishing attack liable for successfully being phished. The finding is, at least in part, based on the bank’s position that they had previously warned customers about phishing attacks.

The court’s placement of liability is significant for a variety of reasons. Of course it’s important that the individual was victimized. The liability placement also defers expenses (likely through insurance) that the bank would have to assume were they at least partially liable for the customers’ actions. This said, we can understand (and perhaps disagree…) that, from a liberal position, individual citizens are responsible for their actions.

What is most significant are the consequences of placing liability on the individual. Specifically, it reduces the incentive that banks have to exercise their influence to address phishing. I’m not suggesting that the banks could hope to eliminate phishing by waving a gold-plated wand, but they are financially in a position to influence change and act on a global scale. Individuals – save for the ultra-rich – lack this degree of influence and power. While banks will be motivated to protect customers – and, more importantly, their customers’ money – if banks were found even partially liable for successful phishing attacks they would be significantly more motivated to remedy these attacks.