Skype Discloses Subscriber Info to Private Investigators

In a not-particularly-surprising move, Skype handed over a 16 year old’s subscriber information to a firm hired by Paypal. No warrant was required, as the information was provided to a private party, and that party subsequently gave it to police. In essence, a very large telecommunications service provider (TSP) made available personally identifiable information that, ultimately, led to an arrest without authorities having to convince a judge that they had legitimate grounds to get that information from the TSP.

At a talk I recently attended, a retired Assistant RCMP Commissioner emphasized time and time again that Canadians need to be more worried about corporations like Skype, Google, and Facebook than they do the federal or provincial governments. He correctly, I believe, spoke to the social harms that these companies can and do cause to individuals who both subscribe and do not subscribe to the companies’ service offerings.

Non-controversially, we know that many large companies can take actions that are harmful to individuals, as can states themselves. What is less recognized, however, is that there are more and more cases where private intermediaries are acting as one or two degrees of separation between public institutions and large private data stores. Such ‘intermediary protection’ often lets states access and use personal data that they otherwise cannot access without considerable difficulty. Worse, where authorities refuse to bring intermediary-provided data to court it can be challenging for accused persons to argue that an investigation was predicated on inappropriate access to their personal data. More time has to be spent considering the role of these data intermediaries and thinking through how to prevent the disclosure of personal data to state authorities in the absence of judicial oversight. Failure to tackle this problem will simply lead to more and more inappropriate access to corporate data by authorities, and critically to access without adequate or necessary judicial oversight.

Some Literature on Skype Security

Chris Soghoian has a good piece breaking down what we know, and don’t know, about Skype’s VoIP security. While not mentioned, it’s helpful to keep in mind that the security and anonymity offered by Skype is questionable regardless of whether the company provides a private key/enables MITM/etc for law enforcement agencies. Such questions are, and have been raised by academics for some time, as evidenced by the body of academic research on Skype and security.

To be clear: the following list is not a comprehensive accounting of literature that has been critical of Skype or VoIP encryption. Instead, the list is meant to show that researchers have been evaluating Skype’s security promises for a very long time. The present controversy around Skype’s security stance – i.e. can or can’t the company decrypt VoIP communications for law enforcement – should be read as an ongoing part of this narrative instead of as a revelatory moment that “changes everything.”

Phonotactic Reconstruction of Encrypted VoIP Conversations: Hookt on fon-iks (2011)

Abstract: In this work, we unveil new privacy threats against Voice-over-IP (VoIP) communications. Although prior work has shown that the interaction of variable bit-rate codecs and length-preserving stream ciphers leaks information, we show that the threat is more serious than previously thought. In particular, we derive approximate transcripts of encrypted VoIP conversations by segmenting an observed packet stream into subsequences representing individual phonemes and classifying those subsequences by the phonemes they encode. Drawing on insights from the computational linguistics and speech recognition communities, we apply novel techniques for unmasking parts of the conversation. We believe our ability to do so underscores the importance of designing secure (yet efficient) ways to protect the confidentiality of VoIP conversations.

Analysis of information leakage from encrypted Skype conversations (2010)

Abstract: Voice over IP (VoIP) has experienced a tremendous growth over the last few years and is now widely used among the population and for business purposes. The security of such VoIP systems is often assumed, creating a false sense of privacy. This paper investigates in detail the leakage of information from Skype, a widely used and protected VoIP application. Experiments have shown that isolated phonemes can be classified and given sentences identified. By using the dynamic time warping (DTW) algorithm, frequently used in speech processing, an accuracy of 60% can be reached. The results can be further improved by choosing specific training data and reach an accuracy of 83% under specific conditions. The initial results being speaker dependent, an approach involving the Kalman filter is proposed to extract the kernel of all training signals.

Recovery of Skype Application Activity Data from Physical Memory (2010)

Abstract: The use of Internet based communication technologies has become more prevalent in recent years. Technologies such as Skype provide a highly secure and decentralised method of communication. These technologies may also leave little evidence on static media causing conventional digital forensic processes to be ineffective. This research looks at exploiting physical memory to recover evidence from Internet based communication technologies where conventional methods cannot. The paper first proposes a set of generic target artefacts that defines information that may be targeted for recovery and the meaning that can be inferred from this. A controlled test was then undertaken where Skype was executed and the memory from the target machine collected. The analysis showed that it is feasible to recover the target data as applied to Skype, which would not be otherwise available. As this is the first set of tests of a series, the future direction is also discussed.

Blocking Skype through Deep Packet Inspection (2009)

Abstract: Skype is a peer-to-peer (P2P) voice over IP (VOIP) chat program. It provides its clients with an inexpensive means to communicate worldwide via the Internet through wired and wireless networks. In the past this application was limited strictly to computers, yet with continuous advancements in mobile communication, Skype phones and other mobile devices have recently hit the market in an attempt to capitalize on Skype’s reliable connection algorithms. However, despite the success of this application, it is important to note that due to Skype’s connection algorithm and the nature of P2P, a number of vulnerabilities emerge that threaten both users and their networks. This paper outlines how to block the Skype application through the use of deep packet inspection. This novel approach is completely scalable to networks of any size as a means of blocking one of the largest threats to commercial and government networks today.

Identifying Skype Traffic by Random Forest (2007)

Abstract: Despite of the great popularity, little is known about Skype network attributed to proprietary protocol. End-to-end encryption disables the traditional traffic detection methods. We presented genetic algorithm based Random Forest algorithm to identify Skype traffic using only transport layer statistics. Experimental results show that the proposed approach can immune to the encryption of the payload and be capable of detecting Skype traffic with accuracy over 95% while low computational complexity is required.

Revealing skype traffic: when randomness plays with you (2007)

Abstract: Skype is a very popular VoIP software which has recently attracted the attention of the research community and network operators. Following a closed source and proprietary design, Skype protocols and algorithms are unknown. Moreover, strong encryption mechanisms are adopted by Skype, making it very difficult to even glimpse its presence from a traffic aggregate. In this paper, we propose a framework based on two complementary techniques to reveal Skypetraffic in real time. The first approach, based on Pearson’sChi-Square test and agnostic to VoIP-related trafficcharacteristics, is used to detect Skype’s fingerprint from the packet framing structure, exploiting the randomness introduced at the bit level by the encryption process. Conversely, the second approach is based on a stochastic characterization of Skype traffic in terms of packet arrival rate and packet length, which are used as features of a decision process based on Naive Bayesian Classifiers.In order to assess the effectiveness of the above techniques, we develop an off-line cross-checking heuristic based on deep-packet inspection and flow correlation, which is interesting per se. This heuristic allows us to quantify the amount of false negatives and false positives gathered by means of the two proposed approaches: results obtained from measurements in different networks show that the technique is very effective in identifying Skype traffic. While both Bayesian classifier and packet inspection techniques are commonly used, the idea of leveraging on randomness to reveal traffic is novel. We adopt this to identify Skype traffic, but the same methodology can be applied to other classification problems as well.

VoIP and Skype Security (2005)

A critical evaluation of Skype’s security stance as juxtaposed against other peer-to-peer models, ISDN/VoIP services, and what we can take away from Skype’s claims about encryption and voice security.

Skype Security Evaluation (2005)

Since 1 June 2005 I have been analyzing the security properties of Skype software and services, with a focus on the current and planned uses of cryptography. I have had unimpeded access to Skype engineers and to Skype source code. I have found out a lot about Skype. The more I found out, the happier I became.

Any pieces of literature you think are absolute must adds to this list?


Skype, the FBI, and MegaUpload

In the aftermath of the MegaUpload seizures we’ll hopefully learn more about how the FBI gained access to Skype transcripts. As reported by CNet:

The FBI cites alleged conversations between DotCom and his top lieutenants, including e-mail and Skype instant-messaging logs. Some of the records go back nearly five years, to MegaUpload’s earliest days as a cyberlocker service–even though Skype says “IM history messages will be stored for a maximum of 30 days” and the criminal investigation didn’t begin until a few months ago.

Sources told CNET yesterday that Skype, the Internet phone service now owned by Microsoft, was not asked by the feds to turn over information and was not served with legal process.

The U.S. Department of Justice told CNET that it obtained a judge’s approval before securing the correspondence, which wouldn’t have been necessary in the case of an informant. “Electronic evidence was obtained though search warrants, which are reviewed and approved by a U.S. court,” a spokesman for the U.S. Attorney for the Eastern District of Virginia said.

Skype saves chat records with contacts in a directory on the local hard drive, which could be accessed by FBI-planted spyware.

While it wouldn’t necessarily be surprising if spyware was used, it would be interesting to see more details of this come to public light. Moreover, was the spyware/electronic access authorization acquired in the US and then the malware implanted on computers in foreign jurisdictions, or did it target local (American) computers? If it was implanted on foreign computers, were local authorities aware of what was going on and did they have to give their approval?