Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are mobile application development company.

Due to security of Source Code and other file, we need to restrict Skype file transfer outside of LAN.

How to restrict Skype file transfer outside of LAN?

share|improve this question
5  
Ultimately you can't (I have some really interesting ways to send data across skype), really you need to be able to trust the employees and educate them to be an integral part of the security system. –  ewanm89 Nov 14 '12 at 10:48
    
Great Comment, +1 for Nice Comment. –  Md. Mahbubur R. Aaman Nov 14 '12 at 11:17
    
Maybe you should start trusting your developers?! And that drag&drop failure is likely to be noticed quickly - maybe even before the other end accepted the transfer - or goes to someone with no malicious intent who won't spread the file. –  ThiefMaster Nov 14 '12 at 18:23

2 Answers 2

up vote 9 down vote accepted

It's exceedingly difficult to block Skype file transfers at the network level. They've designed it to use common ports (80 / 443) and proprietary encryption (albeit an extension to SSL) along with UPnP NAT holepunching to ensure absolutely minimal conflicts and setup issues. Remote file transfers go through supernodes as part of a P2P architecture, so it's not possible to blacklist a server to prevent the transfer.

You can disable the file transfer ability of Skype entirely, though. It's done via a registry key.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Skype\Phone

You may need to create this key first. Once you've found / created it, make a value called DisableFileTransfer as a DWORD and set its value to 1. This will completely disable file transfers within Skype. You may need to restart Skype or the whole computer for it to take effect.

After the transfers are disabled, you can use an alternative file sharing mechanism within your LAN, such as shared drives.

Note that you'll need to restrict access to the registry on those computers. Your users should run as limited accounts, and you should use group policy to deny access to administrative tools like regedit.

share|improve this answer
2  
And that stops the user sitting down and dictating the source code across Skype how? What about whistling morse? Using an audio coupled modem? I expect the also have POTS landline that is also vulnerable... –  ewanm89 Nov 14 '12 at 11:04
    
+1 for Great Answer @Polynomial. Most of our users use Windows. But, We have Mac and Linux User too (As we develop iPhone and Android Applications), What should we do for those users? –  Md. Mahbubur R. Aaman Nov 14 '12 at 11:21
1  
@ewanm89 Nothing. It's about proving intent. It's potentially possible for a user to accidentally send a confidential file over Skype to a 3rd party due to a drag-drop misclick, but if they intentionally send source code over Skype you've got better evidence for a prosecution. Skype logs conversations to %AppData%\Skype\main.db (along with other stuff) so you could set up a hard link to a networked drive and have that file regularly backed up. –  Polynomial Nov 14 '12 at 11:35
1  
@Polynomial Yeah I was just pointing out that there are plenty of methods once one has an open connection of any kind. –  ewanm89 Nov 14 '12 at 13:44
    
Limited accounts for developers are a horrible idea... –  ThiefMaster Nov 14 '12 at 18:25

As another suggestion, are you only using Skype internally? If so, there are other platforms available that you could use for an internal experience that is very similar. Depending on your size, Microsoft Lync can be a nice (I'll be it, not free) option that behaves very similarly to Skype. There are also a number of open source and/or free options out there that provide text chat, but lack some of the more advanced features or ease of use that Skype has, but many of them can provide server side logging and prevent outside connections which is often a good best practice for internal communications unless outside connectivity is needed for a business reason.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.