Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Backdoor in Skype for Mac OS X

trustwave.com

Post reply on HN
Print view View original

101–110 of 112 posts

Re: A Backdoor in Skype for Mac OS X

#101

Post by sleepychu »

hamburglar wrote: post #58
hashhar wrote: post #13

Calling this a backdoor is an extreme measure. I wasn't able to see any working example, nor any responsible disclosure which seems bad. Also, if somebody has the ability to run arbitrary code on your machine, I would think that it's game over at that point - backdoor or not. This is not a remote exploitable backdoor it seems.

This is unequivocally a backdoor, by definition. They backdoored their own API for the benefit of their own plugin being allowed to run unauthenticated. What we can't say is whether this is a backdoor created for nefarious purposes. All we can say is that the backdoor exists and, if we accept that authentication on this API is valuable, then it's an egregious violation of security principles by effectively having som…

> They backdoored their own API for the benefit of their own plugin being allowed to run unauthenticated.

Well, something with its name.

"Curiously, the actual Skype Dashboard widget does not seem to utilize the backdoor into the Skype Desktop API despite the name "Skype Dashbd Wdgt Plugin"."

Re: A Backdoor in Skype for Mac OS X

#102

Post by sleepychu »

BoorishBears wrote: post #97
scentedmeat wrote: post #91

Earlier quoted context omitted.

Well, let's just look at the source code and we can see when/where it got added.

If it's really malicious and was done with coordination at MS, what would stop them from putting a backdoor in a binary build? Sure people who build it from source would be protected, but that's still not the majority of users for a product like Skype. I don't get the OSS cause being shoehorned into every conversation.

Can you verify the binaries by reproducing them and comparing hashes? (obviously not of the whole binary but maybe some portion)

That would protect the users of those binaries.

Re: A Backdoor in Skype for Mac OS X

#103

Post by 72deluxe »

dangerlibrary wrote: post #2

Most generous interpretation: this could easily be an old, deprecated API in an enormous, complicated codebase on an engineering team with high turnover.

Out of curiosity, why is the API so massive? I have not seen Skype's core features change over ~10 years. I know the architecture has been redesigned but the ability to make calls and send IMs surely goes through an underlying network shim.

Why the rest of it? Is it overengineered? Am I missing something?

Re: A Backdoor in Skype for Mac OS X

#104

Post by simonh »

jonathankoren wrote: post #98
tptacek wrote: post #64

Earlier quoted context omitted.

Explain?

No one outside of the software provider can audited the code, and presumably even they haven't audited the code. Recently there was the source code backdoor that was suspected to had been placed inside Juniper routers by the NSA. If I remember correctly, it wasn't found because it was hidden on a high right column.

The Juniper backdoor was a bit particular in that it was known that the code in question had been developed and distributed by the NSA. It's more of a stretch to accuse every single vendor of proprietary code in the USA of building NSA back doors into their products. It would require the knowing assistance of tens of thousands of people across those companies.

Re: A Backdoor in Skype for Mac OS X

#105

Post by rocqua »

sleepychu wrote: post #102
BoorishBears wrote: post #97

Earlier quoted context omitted.

If it's really malicious and was done with coordination at MS, what would stop them from putting a backdoor in a binary build? Sure people who build it from source would be protected, but that's still not the majority of users for a product like Skype. I don't get the OSS cause being shoehorned into every conversation.

Can you verify the binaries by reproducing them and comparing hashes? (obviously not of the whole binary but maybe some portion) That would protect the users of those binaries.

Deterministic compilation isn't commonplace yet. I'm not even sure if it's really usable at all yet.

Generally, we rely on signed binaries.

Re: A Backdoor in Skype for Mac OS X

#106

Post by curried_haskell »

danudey wrote: post #36
gr3yh47 wrote: post #24

Earlier quoted context omitted.

>You mean more paranoid interpretation. honestly it amazes me that people still call such interpretations paranoid in a world where information about the rampancy of such programs is readily available, including for this specific application Edit: it's not paranoia if there's demonstrable history of such things. It's making a reasonable assumption from available facts. further, all the arguments against this interpre…

It seems to me to be a paranoid interpretation because if Microsoft wants to hand Skype-related user data over to the NSA, they'll do so on the server side and not the client side. Secondly, this is a pretty stupid way of doing it. 'If you use this client identifier than anything goes' seems vastly more like a stupid coding mistake than it does a sneaky covert backdoor into accessing Skype from the local machine.

Intelligence agencies want as many possible vectors for attack as possible. Especially unknown ones that you are not prepared for them to exploit. Everyone is assuming they wouldn't bother with a client backdoor... That right there is enough reason for them to get a client backdoor!

Re: A Backdoor in Skype for Mac OS X

#107

Post by curried_haskell »

tptacek wrote: post #47
gr3yh47 wrote: post #24

Earlier quoted context omitted.

>You mean more paranoid interpretation. honestly it amazes me that people still call such interpretations paranoid in a world where information about the rampancy of such programs is readily available, including for this specific application Edit: it's not paranoia if there's demonstrable history of such things. It's making a reasonable assumption from available facts. further, all the arguments against this interpre…

So far you haven't said anything more than "NSA exists, therefore all software insecurities are reasonably attributable to them".

If you have reading comprehension problems, sure, that's what he said.

Re: A Backdoor in Skype for Mac OS X

#108

Post by curried_haskell »

gr3yh47 wrote: post #69
tptacek wrote: post #54

Earlier quoted context omitted.

It's the facts that are the problem with your weird theory: this doesn't even make sense as an NSA backdoor. It only works if they've already backdoored your computer.

Does any NSA surveillance vulnerability stand up to logical scrutiny? No, because introducing security vulnerabilities to keep us secure is inherently illogical.

This is also the biggest fallacy in economic, and even political theory. The assumption of rational actors.

Re: A Backdoor in Skype for Mac OS X

#109

Post by hamburglar »

sleepychu wrote: post #101
hamburglar wrote: post #58

Earlier quoted context omitted.

This is unequivocally a backdoor, by definition. They backdoored their own API for the benefit of their own plugin being allowed to run unauthenticated. What we can't say is whether this is a backdoor created for nefarious purposes. All we can say is that the backdoor exists and, if we accept that authentication on this API is valuable, then it's an egregious violation of security principles by effectively having som…

> They backdoored their own API for the benefit of their own plugin being allowed to run unauthenticated. Well, something with its name. "Curiously, the actual Skype Dashboard widget does not seem to utilize the backdoor into the Skype Desktop API despite the name "Skype Dashbd Wdgt Plugin"."

Well, it seems obvious that some version of this plugin probably used to use this API and doesn't anymore.

Re: A Backdoor in Skype for Mac OS X

#110

Post by jonathankoren »

simonh wrote: post #104
jonathankoren wrote: post #98

Earlier quoted context omitted.

No one outside of the software provider can audited the code, and presumably even they haven't audited the code. Recently there was the source code backdoor that was suspected to had been placed inside Juniper routers by the NSA. If I remember correctly, it wasn't found because it was hidden on a high right column.

The Juniper backdoor was a bit particular in that it was known that the code in question had been developed and distributed by the NSA. It's more of a stretch to accuse every single vendor of proprietary code in the USA of building NSA back doors into their products. It would require the knowing assistance of tens of thousands of people across those companies.

My point was that you don't actually know, and you don't technically need all the vendors. Just the big ones, and there's not really that many. Even more to the point, you don't even need all of the big ones, just the ones on the biggest network, which honestly probably just one vendor on the whole network due to volume purchase discounts and interoperability concerns.

But more to the point, you don't know what's going on in closed source code. It's trust. However the trust can, and has been violated in the past (whether by the provider or by a third party is immaterial). You just don't know. Now that doesn't mean that open source software is immune. I seem to remember there was a backdoor found in the Linux kernel a few years ago. These things happen, but at least it's easier to audit.

Post reply on HN