Tag Info

Hot answers tagged

10

Yes, be alarmed. It looks like something injected into Skype is trying to communicate with an untrusted server in Ukraine. There's no reason for Skype to be doing this normally. A bit of investigation on the domain returns this information: domain: pakko.ua admin-c: PC226-UANIC tech-c: IMENA-UANIC status: OK-UNTIL 20131123175521 dom-public: ...


9

It's exceedingly difficult to block Skype file transfers at the network level. They've designed it to use common ports (80 / 443) and proprietary encryption (albeit an extension to SSL) along with UPnP NAT holepunching to ensure absolutely minimal conflicts and setup issues. Remote file transfers go through supernodes as part of a P2P architecture, so it's ...


7

This might simply be a Skype Supernode (I no longer think so), that said, I think there are some red flags: The server is in Ukraine and it belongs to a company that doesn't seem to have business with Microsoft/Skype, and they don't seem to be in a position to host a Skype Supernode. Server is running ProFTPD 1.2.10 behind an open port 21. I don't see why ...


6

They may be able to gather some details about your connection since I believe that Skype at least used to go direct from one user to the other when in a voice call, so they could potentially identify your IP address, however they would be limited to what Skype allows them to do or any bugs in Skype allow for. If Skype is bug free, they shouldn't be able to ...


5

There have been several suggestions that skype is indeed backdoored and evesdroppable. If your concerned about it because Microsoft is now the owner, there are plenty of other alternatives to Skype which I would suggest as the easiest and cleanest solution (besides, if MS is your competitor, why would you buy their services). Some of the alternatives like ...


4

That Skype might be backdoored has long been a concern. See link below. https://ultraparanoid.wordpress.com/2007/06/19/why-skype-is-evil/ I also noted in a past review I did that the official, independent crypto review and the description gained by a reverse engineering team differed significantly. The latter had design flaws and working exploits. Also, ...


4

According to Vanilla Skype Part 2 [page 67], when you ask Skype to save your password, it takes a hash md5(username\nskyper\npassword) then it encrypts it using AES-256 and it stores it /home/USER/.Skype/SKYPE_USER/config.xml (config->Lib->Account->Credentials3). I have just tried to copy config->Lib->Account->Credentials3 to a config.xml ...


3

Skype uses a Peer to Peer model to route "calls" through the internet which means that part of the lookup function is being routed through unknown third parties. Microsoft (when they bought Skype) changed the model earlier this year so that it mainly routes through semi-trusted nodes (i.e. not some guys home broadband!) which they call "Supernodes" - ...


3

Although Skype uses robust mechanism and cryptography to authenticate a user, a password can be compromised in many ways from many different points. For example: From your endpoint, e.g. malware stealing your password, using a keylogger, etc. From external parties, e.g. password reused on another system/application which has been hacked, password manager ...


3

Here's the answer to the technical part of the question. As for the legal bit, well... here's the technical bit: All three services are encrypted, but there's some concern about the scope of that encryption: Client-only encryption: Me Provider You +-------+ +----------+ +-------+ | Plain |========| Plain ...


2

PGP/GPG is the defacto standard, getting a non-technical user started can be done. Take into consideration that there are applications that can hemp the non-technical user, but the user must become more security aware if he does not one to leak his private key. There is a tool called Silent Circle which was created by Phill Zimmerman, the man behind PGP, ...


2

No, there isn't any plugin for Skype that would plug into its transport layer and custom encrypt calls peer-to-peer, and there likely won't be any as: Skype uses a closed proprietary protocol, which they do not publish. Skype intentionally does not interoperate with the rest of the VoIP industry, which is built on open standards. [1] Skype is now ...


2

First off, I'd consider calling support: https://support.skype.com/en/faq/FA109/i-ve-forgotten-my-password Secondly, a recovery process has been outlined here: http://insecurety.net/?p=427 It is NOT as simple as running JTR on the conf.xml file ....


1

If you have admin access to the users' systems you can start by dumping the list of open sockets and connected processes with "netstat -nab" on Windows or "netstat -nap" on Linux. Just look for the source and destinations you are seeing in the proxy. That may make it clear what is connecting. You can also try connecting to the server side to collect its ...


1

It is really hard to judge its percentage of security with a couple of queries. Obviously none of the users who gives "Remember password" option or automatic authentication wants their password to get compromised. If you really do not want your Microsoft services to be accessed by any other application, then i suggest you consider not merging it with ...


1

I would ask a lawyer about HIPAA compliance -- that's a legal question, not a technical one. However, I would consider the following: http://greenwirehealthcare.com/hipaa/is-voip-hipaa-compliant/ Skype and Google+ both encrypt data between the client and the server, but do not provide end-to-end encryption.


1

Without using PGP or some similar client based system, the best bet is a trusted mail server on both ends that enforce TLS to be used for e-mail exchange. It may or may not be possible for TLS to be broken by a highly sophisticated attacker like the NSA using quantum computers at this time, but it would still be highly expensive and thus unlikely they would ...


1

This will probably be your best bet (assuming you're more interested in getting your account back quickly, rather than hacking around): https://support.skype.com/en/faq/FA109/i-ve-forgotten-my-password I no longer use the email address I registered when I created my Skype account and I have never paid for any Skype product Even if you’ve never ...


1

In a virtual machine, install Skype, make note of every file on the computer and get a checksum of the files. Then log in with a Skype account and save the password. This will change or add some file on your computer. From there you can find where Skype store their password. An alternative option is to call customer support and see if they can help you ...



Only top voted, non community-wiki answers of a minimum length are eligible