PDA

View Full Version : How to intercept Skype calls



Glass
29th May 2011, 07:30 PM
Linguists bypass encryption and rebuild conversations base on speech patterns.
Researchers have discovered a trick that allows encrypted VoIP calls like Skype to be deciphered without the need to crack encryption.

The method, dubbed "Phonotactic Reconstruction", exploited the Linear Predictive Filter, a system used by Voice over Internet Protocol platforms to transmit conversations by creating data sets from spoken English.

Data sets were used to rebuild Skype conversations because they resemble the fragments of spoken words, or phonemes, on which they were modelled.

Linguists were helped further because the scripts and file sizes of the data sets, even after encryption, matched phonemes. Rules of spoken language mean that phonemes have a strict placement within words, which helped linguists reconstruct conversations.

While the exploit meant the University of North Carolina linguists did not need to crack encryption –an expensive process of complex mathematics and onerous compute resources – it could produce high-quality reconstructed conversations.

“Our results show that the quality of the recovered transcripts is far better in many cases than one would expect,” the researchers wrote in a paper (pdf).

“While the generalised performance is not as strong as we would have liked … one would hope that such recovery would not be at all possible since VoIP audio is encrypted precisely to prevent such breaches of privacy.”

“It is our belief that with advances in computational linguistics, reconstructions of the type presented will only improve.”

While Linear Predictive Filtering weakens cryptography because encrypted data bears a statistical relationship to the source data, it is used by VoIP systems because it provides the best type of compression.

But while reconstruction is possible, the researchers said Skype cannot be considered safe. “No reconstruction, even a partial one, should be possible; indeed, any cryptographic system that leaked as much information as shown here would immediately be deemed insecure.


Link....... (http://www.crn.com.au/News/258827,how-to-intercept-skype-calls.aspx?eid=4&edate=20110530&utm_source=20110530&utm_medium=newsletter&utm_campaign=daily_newsletter)

So. This raises a bunch of questions to me. I assume this linguist stuff is based on English as being the spoken language. Patterns and idiosyncrasies of speech are language and culturally influenced. The other thing is pretty obvious. They do not need to crack any encryption to know what you said. So basically they are saying, we can tell what you say even if we can't hear what you said.

So we, the Govt experts, can make up stuff you said and then tell everyone we know what you said because we can guess what you said and is sounded like such and such so that's what you said.

You said what we say you said! Of course you won't have a copy of the conversation to prove you said something other than what they said you said.

General of Darkness
29th May 2011, 07:48 PM
Ed Steele right there.

Glass
29th May 2011, 09:05 PM
Yep that's right GoD. Beware thge govt official that says you did something you didn't or that you didn't say something you did say. We have those laws down here in Oz and I am caught up arguing with them about it. It's all Futile of course.

So I did a bit more digging on encrypting Skype. I haven't turned up anything that encrypts skype but I did turn up some useful information on how to encrypt other types of internet phone calls. The thing with Skype is, is that it is not a true VoIP based system but uses a proprietary system rather than something like SIP.

One application which can encrypt VoIP calls is Zfone (http://www.zfoneproject.com/).

Now this is a program written by the PGP guy. PGP was widely considered to be the industry leader in security key based privacy systems. It was released under a GPL but it led the pay for providers in technical capabilities. This is often the way with GPL type solutions. Not always but usually the best, most robust solutions start life as a GPL. Anyway there was a sell out moment in the end which resulted in the Govt - aka private enterprise slash CIA/FBI getting a hold of all the good stuff in the PGP platform rendering it insecure against US Govt intrusion.

This application works with a lot of VoIP applications but not skype. To read the FAQ about why it does not work with skype it becomes clear that it does not work because of the encoding that skype uses which is the very same reason why skype encryption can be "easily interpreted" by these super duper brainiac guys who claimed to have cracked it in the OP. Basically skype uses VBR codecs or variable bit rate codecs which because of their very nature can give away the content of the message. If anyone has heard encrypted audio before it is a bit like hearing ham radio when not quite on the exact frequency but you can still hear the conversation. It is possible to discern the different people who are talking and yes you can kind of guess what the conversation is about but that depends on the encryption system being used.

I hear people using scramblers on radio communications from time to time and depending on which encryption model they use you can sometimes make out the gist of things. It's like squiting at something and it gets a little more comprehendable even if it is not very clear.

Here is the link to the FAQ portion dealing with Skype: http://www.zfoneproject.com/faq.html#skype

That mentions the VBR codec stuff of which there is a lot more information: http://www.zfoneproject.com/faq.html#vbr

I guess this is probably of more interest to tech heads but some of you might be interested in secure comms either over the air or over the wire. It would be possible to use a PC based VoIP application to encrypt audio that is then transmitted over the air and picked up by another radio which plays into a PC and the same VoIP application which decrypts and plays it over the speakers. I think with some of the cheap handheld radios you can get out of china, the cheap repeater controllers you can get for these and the possibility of using some kind of andriod device you could possibly have a local (i.e. low power) and very portable repeater system with encryption. Of course some handhelds can have encryption options but the cost could be higher than this type of setup.