Archive:Skype protocol: Difference between revisions
m Task 18 (cosmetic): eval 23 templates: del empty params (2×); hyphenate params (11×); del |orig-year= (1×); |
|||
| Line 10: | Line 10: | ||
The Skype network is not [[interoperable]] with most other [[Voice over IP]] (VoIP) networks without proper licensing from Skype. Numerous attempts to study and/or [[reverse engineering|reverse engineer]] the protocol have been undertaken to reveal the protocol, investigate security or to allow unofficial clients. | The Skype network is not [[interoperable]] with most other [[Voice over IP]] (VoIP) networks without proper licensing from Skype. Numerous attempts to study and/or [[reverse engineering|reverse engineer]] the protocol have been undertaken to reveal the protocol, investigate security or to allow unofficial clients. | ||
On June 20, 2014, Microsoft announced the deprecation of the old Skype protocol. Within several months from this date, in order to continue using Skype services, Skype users had to update to Skype applications released in 2014, and users were not able to log into older Skype versions (clients).<ref>{{cite web|url=https://blogs.skype.com/news/2014/06/20/making-way-for-the-next-generation-of-skype-on-desktop/|title=Making Way for the Next Generation of Skype on Desktop|date=20 June 2014 | On June 20, 2014, Microsoft announced the deprecation of the old Skype protocol. Within several months from this date, in order to continue using Skype services, Skype users had to update to Skype applications released in 2014, and users were not able to log into older Skype versions (clients).<ref>{{cite web|url=https://blogs.skype.com/news/2014/06/20/making-way-for-the-next-generation-of-skype-on-desktop/|title=Making Way for the Next Generation of Skype on Desktop|date=20 June 2014}}</ref><ref>{{cite web|url=http://www.computerworld.com/s/article/9249275/Update_Skype_to_retire_recent_editions_for_Windows_Mac_upgrades_mandatory|title=Update: Skype to retire recent editions for Windows, Mac; upgrades mandatory|first=Gregg|last=Keizer}}</ref> No announcement has been made on whether SmartTV and hardware phones with built-in Skype functionality will continue to work without interruptions. The new Skype protocol—[[Microsoft Notification Protocol#MSNP24|Microsoft Notification Protocol 24]]—promised better offline messaging and better messages synchronization across Skype devices. The deprecation became effective in the second week of August, 2014.<ref>{{cite web|title=Skype stops working on older Android phones leaving Linux users in the dark|url=http://www.theinquirer.net/inquirer/news/2360604/skype-stops-working-on-older-android-phones-leaving-linux-users-in-the-dark|publisher=[[CNET]]|access-date=2 October 2014|author=Chris Merrimen|date=15 August 2014}}</ref> | ||
==Peer-to-peer architecture== | ==Peer-to-peer architecture== | ||
Skype was the first [[peer-to-peer]] IP telephony network.<ref>{{cite arXiv |eprint=cs/0412017v1 |title= An analysis of the Skype peer-to-peer Internet telephony protocol |year= 2004 |author1= Salman A. Baset |author2= Henning Schulzrinne |page=11}}</ref> The network contains three types of entities: ''[[Supernode (networking)|supernodes]]'', ordinary nodes, and the login server. Each client maintains a ''host cache'' with the [[IP address]] and port numbers of reachable supernodes. The Skype user directory is decentralized and distributed among the supernodes in the network. Supernodes are grouped into ''slots'' (9–10 supernodes), and slots are grouped into ''blocks'' (8 slots). | Skype was the first [[peer-to-peer]] IP telephony network.<ref>{{cite arXiv |eprint=cs/0412017v1 |title= An analysis of the Skype peer-to-peer Internet telephony protocol |year= 2004 |author1= Salman A. Baset |author2= Henning Schulzrinne |page=11}}</ref> The network contains three types of entities: ''[[Supernode (networking)|supernodes]]'', ordinary nodes, and the login server. Each client maintains a ''host cache'' with the [[IP address]] and port numbers of reachable supernodes. The Skype user directory is decentralized and distributed among the supernodes in the network. Supernodes are grouped into ''slots'' (9–10 supernodes), and slots are grouped into ''blocks'' (8 slots). | ||
Previously any client with good bandwidth, no restrictions due to [[firewall (networking)|firewall]] or [[network address translation]] (NAT), and adequate processing power could become a supernode. This placed an extra burden on those who connected to the Internet without NAT, as Skype used their computers and Internet connections as third parties for [[UDP hole punching]] (to directly connect two clients both behind NAT) or to completely relay other users' calls. In 2012, Microsoft altered the design of the network, and brought all supernodes under their control as hosted servers in data centres.<ref>{{cite news|last=Branscombe|first=Mary|title=Forget the conspiracy theories: Skype's supernodes belong in the cloud|url=http://www.zdnet.com/forget-the-conspiracy-theories-skypes-supernodes-belong-in-the-cloud-7000001720/| | Previously any client with good bandwidth, no restrictions due to [[firewall (networking)|firewall]] or [[network address translation]] (NAT), and adequate processing power could become a supernode. This placed an extra burden on those who connected to the Internet without NAT, as Skype used their computers and Internet connections as third parties for [[UDP hole punching]] (to directly connect two clients both behind NAT) or to completely relay other users' calls. In 2012, Microsoft altered the design of the network, and brought all supernodes under their control as hosted servers in data centres.<ref>{{cite news|last=Branscombe|first=Mary|title=Forget the conspiracy theories: Skype's supernodes belong in the cloud|url=http://www.zdnet.com/forget-the-conspiracy-theories-skypes-supernodes-belong-in-the-cloud-7000001720/|access-date=17 June 2013|newspaper=500 words into the future (ZDNet)|date=27 July 2012}}</ref> Microsoft at the time defended the move, saying they "believe this approach has immediate performance, scalability and availability benefits for the hundreds of millions of users that make up the Skype community."<ref>{{cite news|title=Skype replaces P2P supernodes with Linux boxes hosted by Microsoft (updated)|url=https://arstechnica.com/business/2012/05/skype-replaces-p2p-supernodes-with-linux-boxes-hosted-by-microsoft/|access-date=17 June 2013|newspaper=Ars Technica|date=2 May 2012}}</ref> At the time there was some concern regarding the privacy implications of the change,<ref>{{cite news|last=Kosner|first=Anthony|title=Will Microsoft's Changes To The Architecture Of Skype Make It Easier To Snoop?|url=https://www.forbes.com/sites/anthonykosner/2012/07/18/did-microsoft-change-the-architecture-of-skype-to-make-it-easier-to-snoop/|access-date=17 June 2013|newspaper=Forbes blog|date=18 July 2012}}</ref> which appear to have been proven true with the revelation of the [[PRISM (surveillance program)|PRISM]] surveillance program in June 2013.<ref>{{cite news|last=Gallagher|first=Ryan|title=Newly Revealed PRISM Snooping Makes Verizon Surveillance Look Like Kids' Stuff|url=http://www.slate.com/blogs/future_tense/2013/06/06/nsa_prism_surveillance_private_data_from_google_microsoft_skype_apple_yahoo.html|access-date=17 June 2013|newspaper=Slate blog|date=6 June 2013}}</ref><ref>{{cite news|last=Greenwald|first=Glenn|author-link=Glenn Greenwald|title=NSA Prism program taps in to user data of Apple, Google and others|url=https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data|access-date=17 June 2013|newspaper=The Guardian|date=7 June 2013}}</ref> | ||
Skype does not support the use of the [[IPv6]] protocol,<ref>{{cite web|url=https://twitter.com/SkypeTalks/status/264057558262747136|title=Skype does not support IPv6.|publisher=Skype official Twitter account|date=1 Nov 2012| | Skype does not support the use of the [[IPv6]] protocol,<ref>{{cite web|url=https://twitter.com/SkypeTalks/status/264057558262747136|title=Skype does not support IPv6.|publisher=Skype official Twitter account|date=1 Nov 2012|access-date=4 Nov 2012}}</ref> which would greatly reduce the complexity associated with the aforementioned IPv4 communication structure. | ||
Supernodes relay communications on behalf of two other clients, both of which are behind firewalls or "one-to-many" network address translation. | Supernodes relay communications on behalf of two other clients, both of which are behind firewalls or "one-to-many" network address translation. | ||
| Line 40: | Line 40: | ||
===Protocol detection=== | ===Protocol detection=== | ||
Many networking and security companies claim to detect and control Skype's protocol for enterprise and carrier applications. While the specific detection methods used by these companies are often proprietary, [[Pearson's chi-squared test]] and stochastic characterization with [[Naive Bayes classifier]]s are two approaches that were published in 2007.<ref>{{cite journal |url=https://www.dpacket.org/articles/revealing-skype-traffic-when-randomness-plays-you |author=Dario Bonfiglio |display-authors=etal | Many networking and security companies claim to detect and control Skype's protocol for enterprise and carrier applications. While the specific detection methods used by these companies are often proprietary, [[Pearson's chi-squared test]] and stochastic characterization with [[Naive Bayes classifier]]s are two approaches that were published in 2007.<ref>{{cite journal |url=https://www.dpacket.org/articles/revealing-skype-traffic-when-randomness-plays-you |author=Dario Bonfiglio |display-authors=etal |title=Revealing Skype Traffic: When Randomness Plays with You |journal=ACM SIGCOMM Computer Communication Review |volume=37 |issue=SIGCOMM 2007 |pages=37–48 |url-status=dead |archive-url=https://web.archive.org/web/20110430074127/https://www.dpacket.org/articles/revealing-skype-traffic-when-randomness-plays-you |archive-date=2011-04-30 }}</ref> | ||
==Obfuscation layer== | ==Obfuscation layer== | ||
| Line 48: | Line 48: | ||
The XOR of these two 32-bit values is transformed to an 80-byte RC4 key using an unknown key engine. | The XOR of these two 32-bit values is transformed to an 80-byte RC4 key using an unknown key engine. | ||
A notable misuse of RC4 in Skype can be found on TCP streams (UDP is unaffected). The first 14 bytes (10 of which are known to the user, since they consist of a hash of the username and password) are XOR-ed with the RC4 stream. Then, the cipher is reinitialized to encrypt the rest of the TCP stream.<ref>{{cite conference |author1=Fabrice Desclaux |author2=Kostya Kortchinsky |date=2006-06-17 |title=Vanilla Skype part 2 | | A notable misuse of RC4 in Skype can be found on TCP streams (UDP is unaffected). The first 14 bytes (10 of which are known to the user, since they consist of a hash of the username and password) are XOR-ed with the RC4 stream. Then, the cipher is reinitialized to encrypt the rest of the TCP stream.<ref>{{cite conference |author1=Fabrice Desclaux |author2=Kostya Kortchinsky |date=2006-06-17 |title=Vanilla Skype part 2 |book-title=RECON2006 |url=http://www.recon.cx/en/f/vskype-part2.pdf }}</ref> | ||
==TCP== | ==TCP== | ||
| Line 94: | Line 94: | ||
==Legal issues== | ==Legal issues== | ||
[[Reverse engineering#Legality|Reverse engineering]] of the Skype protocol by inspecting/disassembling binaries is prohibited by the terms and conditions of Skype's license agreement. However European Union law allows reverse-engineering a computer program without getting a permission from an author for inter-operability purposes.<ref>[http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:111:0016:01:EN:HTML Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs]</ref> In the United States, the [[Digital Millennium Copyright Act]] provides protections for reverse engineering software for the purposes of interoperability with other software.<ref>17 U.S.C. Sec. 1201(f).</ref><ref>[[WIPO Copyright and Performances and Phonograms Treaties Implementation Act]]</ref> There are also legal precedents in the United States when the reverse-engineering is aimed at interoperability of file formats and protocols.<ref>Sega vs Accolade, 1992</ref><ref>Sony vs Connectix, 2000</ref><ref>{{cite journal |author=Pamela Samuelson |author2=Suzanne Scotchmer |name-list-style=amp |title=The Law and Economics of Reverse Engineering |volume=111 |journal=Yale Law Journal |pages=1575–1663 |date=May 2002 |doi=10.2307/797533 |jstor=797533 |url=http://www.yalelawjournal.org/pdf/111-7/SamuelsonFINAL.pdf |author-link=Pamela Samuelson | | [[Reverse engineering#Legality|Reverse engineering]] of the Skype protocol by inspecting/disassembling binaries is prohibited by the terms and conditions of Skype's license agreement. However European Union law allows reverse-engineering a computer program without getting a permission from an author for inter-operability purposes.<ref>[http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:111:0016:01:EN:HTML Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs]</ref> In the United States, the [[Digital Millennium Copyright Act]] provides protections for reverse engineering software for the purposes of interoperability with other software.<ref>17 U.S.C. Sec. 1201(f).</ref><ref>[[WIPO Copyright and Performances and Phonograms Treaties Implementation Act]]</ref> There are also legal precedents in the United States when the reverse-engineering is aimed at interoperability of file formats and protocols.<ref>Sega vs Accolade, 1992</ref><ref>Sony vs Connectix, 2000</ref><ref>{{cite journal |author=Pamela Samuelson |author2=Suzanne Scotchmer |name-list-style=amp |title=The Law and Economics of Reverse Engineering |volume=111 |journal=Yale Law Journal |pages=1575–1663 |date=May 2002 |doi=10.2307/797533 |jstor=797533 |url=http://www.yalelawjournal.org/pdf/111-7/SamuelsonFINAL.pdf |author-link=Pamela Samuelson |access-date=2015-03-17 |url-status=dead |archive-url=https://web.archive.org/web/20110716095222/http://www.yalelawjournal.org/pdf/111-7/SamuelsonFINAL.pdf |archive-date=2011-07-16 }}</ref> | ||
In addition, some countries specifically permit a program to be copied for the purposes of reverse engineering.<ref>In the French "intellectual property" law set, there is an exception that allows any software user to reverse engineer it. See [http://legifrance.gouv.fr/affichCodeArticle.do?cidTexte=LEGITEXT000006069414&idArticle=LEGIARTI000006278920&dateTexte=20080329&categorieLien=cid ''code de la propriété intellectuelle''] {{in lang|fr}}. This law is the national implementation of a piece of EU legislation: [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31991L0250:EN:NOT Council Directive 91/250/EEC], since then repealed by [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32009L0024:EN:NOT Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs] which also has a very similar provision allowing reverse engineering/decompilation for the purposes of development and testing of independent but inter-operating programs).</ref> | In addition, some countries specifically permit a program to be copied for the purposes of reverse engineering.<ref>In the French "intellectual property" law set, there is an exception that allows any software user to reverse engineer it. See [http://legifrance.gouv.fr/affichCodeArticle.do?cidTexte=LEGITEXT000006069414&idArticle=LEGIARTI000006278920&dateTexte=20080329&categorieLien=cid ''code de la propriété intellectuelle''] {{in lang|fr}}. This law is the national implementation of a piece of EU legislation: [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31991L0250:EN:NOT Council Directive 91/250/EEC], since then repealed by [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32009L0024:EN:NOT Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs] which also has a very similar provision allowing reverse engineering/decompilation for the purposes of development and testing of independent but inter-operating programs).</ref> | ||