Feeds

Skype crypto stumps German cops

Police boss attempts to justify Trojan plan

Securing Web Applications Made Simple and Scalable

Uncrackable Skype?

Skype provides end to end encryption for connections between users, which is not to say that calls are guaranteed to be absolutely confidential.

Security chiefs at the firm talk about providing a "safe communications experience" rather than the rather more robust claims of the likes of, for example, Phil Zimmermann's Zfone project.

Skype uses widely trusted encryption techniques, such as Advanced Encryption Standard to encrypt conversations and RSA for key negotiation. But unlike Zfone, its source code has not been publically released.

In a presentation (pdf) at Black Hat Europe 2006 Philippe Biondi and Fabrice Desclaux argued that without access to the source code we can't be sure if Skype is secure. The researchers also expressed concerns that Skype has the keys to decrypt calls or sessions, a contention the firm itself denies.

Often law enforcement agencies are just as interested in who someone is talking to and for how long. Skype offers confidentiality, but not anonymity.

Last year, however, a fugitive chief exec was tracked down to Sri Lanka after a Skype call. Quite how he was tracked down remains unclear, beyond the availability of papers on tracking anonymous peer-to-peer VoIP traffic.

Spys 'R Us

Ziercke argued that the ability to plant "Trojan horse" spyware on the PCs of suspected terrorists would be an important tool in the armoury of law enforcement officials.

The former East Germany, and the country as a whole before the war, has a dark history of official surveillance. Ziercke said civil rights concerns about the law enforcement Trojan plan were overblown because online searches would be needed only on rare occasions.

"We currently have 230 proceedings related to suspected Islamists. I can imagine that in two or three of those we would like to do this," he said.

Ziercke suggested the ability to conduct online searches of computer hard drives of suspected terrorists are especially important in cases where suspects suspect they are monitored and leave dodgy material on their hard drives. These comments bug the question, not answered by Ziercke, of how effective a tactic emailing custom-built Trojan to paranoid suspects might be in these circumstances.

Would-be terrorists need only use Ubuntu Linux to avoid the ploy. And even if they stuck with Windows their anti-virus software might detect the malware. Anti-virus firms that accede to law enforcement demands to turn a blind eye to state-sanctioned malware risk undermining trust in their software, as evidenced by the fuss created when similar plans for a "Magic Lantern" Trojan for law enforcement surfaced some years ago. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.