Tag Info

Hot answers tagged

32

Today, Skype do not route communication through other users machines. This is done by Microsoft servers in datacenters. But back in the days, in the early versions of the Skype protocol, every user with strong-enough bandwidth and not behind a NAT (with routable IP address), can become a supernode and route the traffic of other users that are behind NAT. ...


23

As others have already answered: Yes, Skype originally did sometimes use other Skype users to route some calls. BUT!!! What the other replies didn't say was: This was actually A GOOD THING! Because Skype was initially Peer-2-Peer based not server based (as Microsoft made it) and all traffic was encrypted from end-to-end it gave Skype two big advantages ...


10

Yes, be alarmed. It looks like something injected into Skype is trying to communicate with an untrusted server in Ukraine. There's no reason for Skype to be doing this normally. A bit of investigation on the domain returns this information: domain: pakko.ua admin-c: PC226-UANIC tech-c: IMENA-UANIC status: OK-UNTIL 20131123175521 dom-public: ...


9

It's exceedingly difficult to block Skype file transfers at the network level. They've designed it to use common ports (80 / 443) and proprietary encryption (albeit an extension to SSL) along with UPnP NAT holepunching to ensure absolutely minimal conflicts and setup issues. Remote file transfers go through supernodes as part of a P2P architecture, so it's ...


7

This might simply be a Skype Supernode (I no longer think so), that said, I think there are some red flags: The server is in Ukraine and it belongs to a company that doesn't seem to have business with Microsoft/Skype, and they don't seem to be in a position to host a Skype Supernode. Server is running ProFTPD 1.2.10 behind an open port 21. I don't see why ...


6

According to Vanilla Skype Part 2 [page 67], when you ask Skype to save your password, it takes a hash md5(username\nskyper\npassword) then it encrypts it using AES-256 and it stores it /home/USER/.Skype/SKYPE_USER/config.xml (config->Lib->Account->Credentials3). I have just tried to copy config->Lib->Account->Credentials3 to a config.xml ...


6

There have been several suggestions that skype is indeed backdoored and evesdroppable. If your concerned about it because Microsoft is now the owner, there are plenty of other alternatives to Skype which I would suggest as the easiest and cleanest solution (besides, if MS is your competitor, why would you buy their services). Some of the alternatives like ...


6

They may be able to gather some details about your connection since I believe that Skype at least used to go direct from one user to the other when in a voice call, so they could potentially identify your IP address, however they would be limited to what Skype allows them to do or any bugs in Skype allow for. If Skype is bug free, they shouldn't be able to ...


5

That Skype might be backdoored has long been a concern. See link below. https://ultraparanoid.wordpress.com/2007/06/19/why-skype-is-evil/ I also noted in a past review I did that the official, independent crypto review and the description gained by a reverse engineering team differed significantly. The latter had design flaws and working exploits. Also, ...


5

Down at the bottom-right corner of the Gmail inbox is a "last account activity" line with a "details" link. You can click on that link to get a list of IP addresses that the account has been accessed from.


4

As for the other part of the question: why are users sticking with it while there are better solutions? Two words: market penetration. Average John Doe doesn't care about security or abusing (in the olden days) other network users. He just wants to make calls, this just works and he's not going to persuade all his friends to use something else when ...


3

Chat history and contacts are saved in a windows directory : C:\Documents and Settings\\Application Data\Skype\ . Network admin has access to those files and can access them. So basically, Yes. Network admin can view your chat history or even export them without you noticing.


3

Here's the answer to the technical part of the question. As for the legal bit, well... here's the technical bit: All three services are encrypted, but there's some concern about the scope of that encryption: Client-only encryption: Me Provider You +-------+ +----------+ +-------+ | Plain |========| Plain ...


3

No, there isn't any plugin for Skype that would plug into its transport layer and custom encrypt calls peer-to-peer, and there likely won't be any as: Skype uses a closed proprietary protocol, which they do not publish. Skype intentionally does not interoperate with the rest of the VoIP industry, which is built on open standards. [1] Skype is now ...


3

If you like to chat in a secure way: Use any XMPP service (e.g. jabber) and overlay them with OTR. A List of supported programs can also be found on the wikipedia. Videochatting is not supported...


3

Skype uses a Peer to Peer model to route "calls" through the internet which means that part of the lookup function is being routed through unknown third parties. Microsoft (when they bought Skype) changed the model earlier this year so that it mainly routes through semi-trusted nodes (i.e. not some guys home broadband!) which they call "Supernodes" - ...


3

Although Skype uses robust mechanism and cryptography to authenticate a user, a password can be compromised in many ways from many different points. For example: From your endpoint, e.g. malware stealing your password, using a keylogger, etc. From external parties, e.g. password reused on another system/application which has been hacked, password manager ...


3

Payload encryption means they can't know what the communication content is, but in some cases they can still know what protocol you're using (In this case Skype). This is how countries block Tor, for example. Methods to detect the protocol being used even if it's encrypted: IP-based: TCP is not encrypted even if the payload is encrypted (So that computers ...


3

It seems strange that odd behavior only occurs when using Skype. If there was a RAT (remote administration Trojan), which can include key logging functions, your computer would be compromised across the board. The loading/processing cursor icon might not be signalling malware at all, its strange that you would suddenly think this is a sign of a virus. If ...


2

If you type '/showplaces' on any Skype conversation, Skype will show you the "endpoints" used by your account. Send this information to "Skype Police Dept" (polrequest@skype.net) and they help you out.


2

First off, I am not associated with Facebook in any way, shape or form and I have no idea how the site code actually works. That said, this doesn't have to be a security issue at all. In very broad terms, here's how I suspect it's happening in the backend: Somewhere in FB's vast, vast database of user info there is a table that basically lists "The ...


2

Any application can be compromised. It is unlikely that Microsoft would infect its customers computers, but it is not impossible. There was a big case many years ago where Sony installed root-kits on people's computers. It is also possible that their could be a vulnerability in Skype (which there have been in the past) which a third party could utilize. A ...


2

https://prism-break.org/en/all/#video-voice This is a list of alternatives to Skype, all of which are encrypted.


2

First off, I'd consider calling support: https://support.skype.com/en/faq/FA109/i-ve-forgotten-my-password Secondly, a recovery process has been outlined here: http://insecurety.net/?p=427 It is NOT as simple as running JTR on the conf.xml file ....


2

PGP/GPG is the defacto standard, getting a non-technical user started can be done. Take into consideration that there are applications that can hemp the non-technical user, but the user must become more security aware if he does not one to leak his private key. There is a tool called Silent Circle which was created by Phill Zimmerman, the man behind PGP, ...


2

I would ask a lawyer about HIPAA compliance -- that's a legal question, not a technical one. However, I would consider the following: http://greenwirehealthcare.com/hipaa/is-voip-hipaa-compliant/ Skype and Google+ both encrypt data between the client and the server, but do not provide end-to-end encryption.


1

If you have admin access to the users' systems you can start by dumping the list of open sockets and connected processes with "netstat -nab" on Windows or "netstat -nap" on Linux. Just look for the source and destinations you are seeing in the proxy. That may make it clear what is connecting. You can also try connecting to the server side to collect its ...


1

Skype traffic travels through the Skype central servers. You cannot directly connect.


1

This will probably be your best bet (assuming you're more interested in getting your account back quickly, rather than hacking around): https://support.skype.com/en/faq/FA109/i-ve-forgotten-my-password I no longer use the email address I registered when I created my Skype account and I have never paid for any Skype product Even if you’ve never ...


1

In a virtual machine, install Skype, make note of every file on the computer and get a checksum of the files. Then log in with a Skype account and save the password. This will change or add some file on your computer. From there you can find where Skype store their password. An alternative option is to call customer support and see if they can help you ...



Only top voted, non community-wiki answers of a minimum length are eligible