Lze spehovat skype komunikaci?

[LM]

Doporucuji precist studii "Silver Needle in the Skype" (jedna se o rozbor skype "protokolu", samotne aplikace,...)
dostupna napr. zde: http://www.secdev.org/conf/skype_BHEU06.handout.pdf

...
We developed an add-on to Scapy from the “binary
specifications”
It uses the Oracle Revelator shellcode and a TCP←→UNIX
relay to de-obfuscate datagrams
It can reassemble and decode obfuscated TCP streams
It can assemble Skype packets and speak Skype
...

...
Make your own network?
Generate your own 13 moduli
Build a login server with a big database to store users’
passwords
And burn a new binary!
Job’s done
You are the head of a new world wide P2P network
...

Conclusion:

Good points
Skype was made by clever people
Good use of cryptography

Bad points
Hard to enforce a security policy with Skype
Jams traffic, can’t be distinguished from data exfiltration
Incompatible with traffic monitoring, IDS
Impossible to protect from attacks (which would be
obfuscated)
Total blackbox. Lack of transparency.
No way to know if there is/will be a backdoor
Fully trusts anyone who speaks Skype.


takze sledovani IMO mozne je.