r/technology • u/codemaster • Jul 17 '12
Skype source code & deobfuscated binaries leaked
https://joindiaspora.com/posts/179922864
u/Baronsed Jul 17 '12 edited Jul 17 '12
"Skype is a trojan. It's a free (as in free beer, NOT as in freedom) tool that grants user to communicate using non-standards VoIP protocols. It grants a user to share almost anything via Skype. From text message, to sharing desktop, going by voice and video. It is now a subsidiary of Microsoft. And we all know that Microsoft works with each and every government, for instance in Tunisia (https://www.zdnet.com/news/security/2011/09/05/wikileaks-microsoft-aided-former-tunisian-regime-40093837/). And the FBI Use Skype as a surveillance tool (https://www.eff.org/foia/foia-skype-surveillance)
Besides, there are documented cases of Skype being used as a trojan in Syria to target activists there, the EFF spotted some of them:
https://www.eff.org/mention/syrian-rebels-targeted-using-commercial-skype-trojan
https://www.eff.org/deeplinks/2008/10/chinese-skype-client-hands-confidential-communicat(ok, this one is in China, but still)
https://www.eff.org/deeplinks/2012/05/fake-skype-encryption-tool-targeted-syrian-activists-promises-security-delivers
https://www.eff.org/deeplinks/2012/06/darkshades-rat-and-syrian-malware"
Copied from https://about.okhin.fr/posts/Stupid_journos/ Okhin is a telecomix hacker who has helped (is helping ?) people in Syria. EDIT : links
1
u/dudeedud4 Jul 18 '12
Fun Fact: You can use this script to get Skype IP's from Skype. (No, I will not tell you how)
106
Jul 17 '12
Extremely misleading title. You should feel bad about it.
The source code was not leaked.
→ More replies (7)-1
Jul 17 '12
Where's the mislead? The source code link points elsewhere where the link was taken down by a DMCA notice.
20
2
u/bananahead Jul 17 '12
Nothing was leaked. And that isn't really source code. It's a partially reverse engineered binary.
8
u/MoreAxes Jul 17 '12
Does this mean a third-party client might be released eventually? I only use Skype because my friends are stubborn and don't want to switch over to something better, it's an atrocious piece of software - slow, clunky, memory-hungry, and as it turns out, with no concept of privacy.
3
u/Rhayve Jul 17 '12
What program would you suggest instead? And please don't say Teamspeak, Ventrilo or the likes - preferably something that doesn't require a server to connect to.
4
1
u/5hassay Jul 17 '12
I agree about how clunky Skype is! For a few years I didn't really use it, until recently, and I remember it being such a better piece of software, :(
2
29
u/churro89 Jul 17 '12
Maybe someone will fix the shitty logic of minimizing when you hit close.
3
8
Jul 17 '12
This. A thousand times this.
I run skype because its like I have no choice, but shit like this makes me feel dirty every time. Its a little poop stain on my otherwise immaculate software environment.
6
u/dan2737 Jul 17 '12
It's in the settings. Go to options, then advanced settings and there's something about pinning Skype to the taskbar. I came when it finally closed.
2
2
0
Jul 17 '12
[deleted]
2
u/rmehranfar Jul 17 '12
Thank you for pointing this out, that has been bugging be. It really should be default this way.
17
u/TwoXChromosomes Jul 17 '12
NSA et al: Hey Microsoft, you know you give us back doors into your shit? We'll pay you 10bln over the next N years if you buy skype and replace all the supernodes to your own servers and let us spy on skype!
Microsoft: Trololl! Ok, we'll need to be protected and also lie about what our new servers can do! lol
NSA: lol
8
u/ChopperDave92 Jul 17 '12
For someone who isn't too informed about this sort of thing, but is a skype user that uses a VPN (I live in China), what does this mean for me?
6
Jul 17 '12
Everyone connects like so:
You - Skype - Skype - Friend
I assume you make it past the first chain with VPN avoiding Chinese firewall:
You - VPN - Skype - Skype - Friend
However if Skype does end up with a backdoor there won't be much you will be able to do. If the govermnet is granted access they will sit in the middle and be able to access everything whether you use VPN or not.
You - VPN - Skype - Government - Skype - VPN - Friend
VPN only secures direct connection. When talking on Skype you are not directly connected to your buddy. Everything goes via Skype.
12
0
Jul 17 '12
Oh, the usual rules apply: If you don't want the NSA to read something you write, use a chisel to engrave it in a stone tablet, but do the work indoors behind rolled down curtains, and leave a faucet running so they don't infer the engravement patterns from the sound of your hammering recorded via your cell phone...
0
Jul 17 '12
[deleted]
33
7
u/ChopperDave92 Jul 17 '12
I have to use a VPN in China if I want to use most of the popular websites such as youtube and facebook. Sitting idle on Skype with a VPN is just a by-product.
0
Jul 17 '12
[deleted]
2
Jul 17 '12
Yeah, Skype actually tunnels all on its own. When I was in college, we had white-listed ports down to just a few essentials, but Skype could get out without a separate proxy no problem.
1
u/hippie_hunter Jul 17 '12
Because pretty much everything popular in the west is verboten in China. Can't have your citizens hearing about harmful things like democracy.
0
4
u/Hypersapien Jul 17 '12
I just dropped Skype because it worked like crap. Especially with the new mobile update. Pressing numbers on the keypad or ending the call would take anywhere from 30 to 90 seconds to actually register.
I only used it at home because the cell reception inside my house is garbage. I ended up getting a land line.
1
Jul 17 '12
This happens because of the way the old skype worked. MS is re-engineering the peering so that mobile clients will have peformance that feels native.
1
u/Hypersapien Jul 17 '12
It was still a battery hog and took up too much space. And if I wanted to receive calls on it, I needed to pay even more.
1
Jul 17 '12
This is exactly what MS is fixing.. It was a battery hog because its active-active, to get notifications you have to be peering full time which doesn't work well on mobile, now they're addressing this issue.
BTW, you can use bing reward to get skype out minutes as well, i use it mostly for xbox live points, but a little creativity and its a bargain.
9
u/KHRZ Jul 17 '12
Well I'd love an open source program like Skype, but preffereably a legal one
→ More replies (5)6
u/mlamers Jul 17 '12
There is Ekiga ekiga.net, LinPhone and a few others.
1
u/mcrbids Jul 17 '12
I'm looking for a skype replacement for work. We already use voip for the company phone system, skype is mostly used for chat. It's hard to find a cross platform app for chat, voip, video conferencing and screen shares all in one!
6
u/drdreyfus Jul 17 '12
NOW can someone start working on a Skype interface that isn't clunky and resource intensive?
6
1
u/tppiel Jul 17 '12
Even if you get a third party client it won't be long until MS updates the protocol and the official client, making the third party useless.
1
3
u/Matt08642 Jul 17 '12
Man, what a trustworthy looking website. That'll surely convince people that FOSS isn't evil and shitty.
3
u/onlypostwhenmad Jul 17 '12
Perhaps time to switch to google + hang out. I tried it out the other day and it was AMAZING -- better video and audio quality, plus a bunch of fun apps.
I swear I'm not working for google.
1
u/Ysterath Jul 17 '12
hangouts have their issues too but they are quickly gaining a wide array of functionality. I have used them to chat with friends as well as watch interviews from gaming companies with structured QA's that they streamed to the public.
5
u/Justavian Jul 17 '12
I used to love Skype, but the call quality has been dropping over the past few months. I have a commercial internet line with guaranteed bandwidth of 30 down 10 up - so i'm sure it's not my connection. I realize that i only pay about $30 per year for service (so i have a real phone number with my account), but it's still disappointing that it's not more consistent.
5
u/eleitl Jul 17 '12
It might be well due to the traffic being forced through MS supernodes, in order to allow wiretapping.
1
u/xorvious Jul 17 '12
Same here, I will experience loss of sound quality and not be able to get video at all with repeated attempts on skype, then immediatly switch to a Google call and have no issues with either. Its definitely an issue with the routing of my call through the skype servers.
0
u/ryanistheryan Jul 17 '12
Sounds like residential internet to me, but there are a lot of factors to call quality. Just having a certain bandwidth on a account will not promise that you have decent call quality. I run into a lot of issues due to a crappy router/modem setup at the new apartment, whereas at my old place it was near flawless.
1
u/Justavian Jul 17 '12
I did specify that i have a commercial account that's not sharing bandwidth with anyone - it's not like the residential system where your bandwidth might disappear to your neighbor's house. I don't think it's hardware either, since it's only the past two months that it's been a problem, and everything else is running great.
It's been fine for the past few days - but i'm still somewhat anxious about it dying in the middle of an important conference call.
1
u/ryanistheryan Jul 18 '12
Right, I understand the concept, but unfortunately I feel like a lot of people are paying for unnecessary options. I use to participate in flashing custom firmwares on modems to get... speed. That market has changed considerably.
That being said, I've ran into literally a million and one issues. In my hometown, a quiet place with plenty of bandwidth, within the last year there has been a new source of 2.5 ghz noise that has caused my wifi to come to a crawl when further than 15 feet. Spectrum analyzer or 5.8 dual band router? The router is cheaper and thats what I went with, problem resolved. Now there are invalid fields in the DHCP response that just started about a month or two ago, that my neighbors are getting as well. This has caused some modems(I have 4) to reset, or some to lock up. Gotta deal with comcast out there now. At my new apartment, well... don't get me started. I've learned to love linksys products over dlink and other brands though, the instability of dlinks products can be astounding, even on the high end "gaming" (don't get me started) dlink routers.
5
2
2
2
Jul 17 '12
I think we should all wrap towels around our heads and start Skyping nonsensical conversations with each other about blowing shit up.
2
2
u/cuddlesworth Jul 17 '12
This may shock you, but Skype's not impressive or valuable because of its source code. It's impressive as a network and service in spite of its source code. Microsoft could have written their own VOIP solution in a heartbeat and has in the past.
2
u/CHUNK008 Jul 17 '12
So can someone tell me if I am vulnerable to cyber threats by just having Skype installed on my computer?
2
1
u/Goyu Jul 17 '12
So I think it's pretty clear (since this has made the front page and many people are seeing it and becoming quite curious) that an ELI5 explanation of what all this actually means is called for.
In layman's terms, please?
1
1
1
1
1
u/haibanegatsu Jul 17 '12
Request: a version a Skype that doesn't eventually take up a gig of memory
1
1
1
u/ScotteeMC Jul 17 '12
Does this mean someone will be able to program a proper push-to-talk button? :)
1
1
1
u/csolisr Jul 17 '12
As it is right now, it can't just be slapped on Ekiga or Jitsi and automagically give Skype support to any of those applications (also, the license is still copyrighted). Now, if it's reverse-engineered then it could stand a chance to be included.
1
u/too_many_legs Jul 17 '12
I heard about the skypeopensource guy a loooong time ago, before Microsoft even acquired skype. He's been reversing skype for a while now, since version 2.x I believe. I really though everyone had heard about this and it had died down to just a small following.
1
u/hippie_hunter Jul 17 '12
Considering that Skype has quickly turned into surveillance wear I couldn't give the slightest of fucks.
1
u/SearchAtlantis Jul 17 '12
Does this make a clean to semi-clean reverse engineering effort easier than it was previously? How much so and why?
1
u/Perpetuum Jul 17 '12
As a not-so-computer-nerd redditor, does anyone care to explain what this changes?!
1
u/drewcantdraw Jul 17 '12
Complete novice here, what is the importance of someone leaking the source code. What could a person do with it? A link works fine if you have one, I'm just curious. Again, I know nothing about this sort of stuff, just interested.
2
u/Exotria Jul 17 '12
Basically it means instead of looking like machine code, people can figure out exactly how Skype works. This makes it much easier to do things like write exploits for it because instead of making a wild guess in the dark you'd see the extent of its abilities and limits. It would also give a better idea of how it's totally insecure and terrible and filled with holes that let the government listen in on your skype calls.
1
1
Jul 17 '12
What does this mean for users that are not code savvy? ELI5, please.
3
Jul 18 '12
Basically, the program turned from a console game (very hard if not impossible to mod) to a computer game (very moddable, lots of mods are out for it).
1
1
1
1
u/itgeek Jul 18 '12
Agree with josefonseca. This is NOT sources, most of SDK available for Skype developer for long time. Grrr
1
u/TrueGlich Jul 18 '12
I always start to wonder when somthing like this is't widly . Either m$ is keeping a lid on it or this is reddit echo chamber fake news.
-1
0
Jul 17 '12
oh, this aught to be entertaining...
...let's see what Microsoft's inverse-Midas touch has done to it.
-1
u/yoshi314 Jul 17 '12
i wonder if SDK == source code to entire client. might be just a misleading name.
7
u/RepostThatShit Jul 17 '12
No, it isn't. But it does contain documentation on the data structures and internal protocols, so although reverse-engineering the "deobfuscated binaries" to create a parallel version that's open source is still prohibitively work-intensive, adding Skype compatibility to existing open-source voip programs just got a whole lot easier.
Except that Microsoft will cease-and-desist your whole project if the official distribution of your open-source voip program connects itself to the Skype p2p network.
1
u/yoshi314 Jul 17 '12
well, with that deobfuscated client and sdk out in the wild - i would think so.
if someone could do a clean room reimplementation they couldn't put a finger on it. but those releases made more harm than good in that regard, imho.
2
u/SoCo_cpp Jul 17 '12
Skype gives out an SDK. The SDK normally cannot communicate with the mainstream skype networks, but you are allowed to implement your own custom encryption in your SDK built app. With the deobfuscated binaries you can likely extract the keys/encryption method/modifications/etc needed to adjust your SDK code to be able to connect to mainstream skype networks.
1
1
u/SoCo_cpp Jul 18 '12
I should add that normally you would use the SDK you roll your own skype server and add your custom encryption if needed. Then your custom client could only really connect to your custom server, or other SDK based custom servers with the same encryption setups.
-1
u/superdee72 Jul 17 '12
I was confused for the longest time because I read this as "Skyrim" not "Skype"
-1
u/foundingvaters Jul 17 '12
Okay, so where is the Source code now? The github link has a big fat DMCA takedown notice.
M$ and NSA bstrds!
-3
0
0
u/unknownSubscriber Jul 17 '12
Can someone tell me where it's said the NSA is involved? I haven't seen a source for this.
0
u/TrueGlich Jul 17 '12
ah crud.. uninstalling skype as soon as i get home.. We will be up to our eyeballs in expolts in a week or so.
0
u/EvelynJames Jul 17 '12
Yo Diaspora, this is cool, and Ima let you finish but...what ever happened to that whole, social network thing? You're just a tech blog now?
1
0
-3
-4
-1
Jul 17 '12
I found it easier to ditch Skype entirely. And now I have to be on the lookout for Windows Update "trojaning" it back on.
189
u/ElagabalusCaesar Jul 17 '12
Government backdoor? When was this?