Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Backdoor in Skype for Mac OS X

trustwave.com

Post reply on HN
Print view View original

11–20 of 112 posts

Re: A Backdoor in Skype for Mac OS X

#11

Post by MichaelGG »

pvg wrote: post #7
gr3yh47 wrote: post #4

Earlier quoted context omitted.

more realistic interpretation: Intentional backdoor for NSA programs as skype has already been shown to be a part of. http://arstechnica.com/tech-policy/2014/12/newly-published-n...

That is not at all a realistic interpretation. This is an 'authentication bypass' for a Skype API for locally executed code. Any even slightly serious attacker who has got to that point has already won - they don't need a 'Skype backdoor'.

Are Mac OS apps unable to debug other applications or generally mess with their process space? If so, like on Windows, then this API is basically a courtesy and not a real security boundary in the first place.

Re: A Backdoor in Skype for Mac OS X

#12

Post by eth0up »

gr3yh47 wrote: post #4
dangerlibrary wrote: post #2

Most generous interpretation: this could easily be an old, deprecated API in an enormous, complicated codebase on an engineering team with high turnover.

more realistic interpretation: Intentional backdoor for NSA programs as skype has already been shown to be a part of. http://arstechnica.com/tech-policy/2014/12/newly-published-n...

Or, the inherent backdoor in poorly encrypted VOIP without proper packet padding: http://cs.unc.edu/~fabian/papers/tissec2010.pdf

EDIT: Also: http://www.cs.unc.edu/~fabian/papers/foniks-oak11.pdf

Re: A Backdoor in Skype for Mac OS X

#13

Post by hashhar »

Calling this a backdoor is an extreme measure. I wasn't able to see any working example, nor any responsible disclosure which seems bad.

Also, if somebody has the ability to run arbitrary code on your machine, I would think that it's game over at that point - backdoor or not. This is not a remote exploitable backdoor it seems.

Re: A Backdoor in Skype for Mac OS X

#14

Post by linkregister »

nkw wrote: post #10
Gaelan wrote: post #5

Earlier quoted context omitted.

If Skype wanted to give user data to the NSA, they would send it over from their servers instead of implementing a backdoor that requires the NSA to already already have software on the target's computer (at which point, assuming they managed to get root, they could circumvent whatever protections Skype was using anyway).

Big corporations are, by definition, large complex organizations. There is legal, executive management, developers, ops, etc. Hypothesizing about their actions as a singular entity can over simplify things. I don't know about the specifics in the article, but as a general rule there are a number instances where an intelligence agency may approach only a developer, an ops person, or someone in legal to obtain what the…

Can you give an example of one of these instances? I've heard of this sort of thing outside of the U.S. (James Bond bribes East German clerk to get the microfilm), but I haven't heard of domestic agencies doing this in the U.S.

Isn't it already disclosed in the Snowden documents that Skype has received NSLs?

Re: A Backdoor in Skype for Mac OS X

#16

Post by bonzini »

MichaelGG wrote: post #11
pvg wrote: post #7

Earlier quoted context omitted.

That is not at all a realistic interpretation. This is an 'authentication bypass' for a Skype API for locally executed code. Any even slightly serious attacker who has got to that point has already won - they don't need a 'Skype backdoor'.

Are Mac OS apps unable to debug other applications or generally mess with their process space? If so, like on Windows, then this API is basically a courtesy and not a real security boundary in the first place.

There is some basic sandboxing, for example a debugger cannot attach to a running copy of iTunes (but you can start it under gdb and bypass the call that enables the sandbox).

Re: A Backdoor in Skype for Mac OS X

#18

Post by shuntress »

ht85 wrote: post #15
y_u_no_rust wrote: post #3

calling this a backdoor is pretty disingenous

An access that bypasses regular security / auth, isn't that the definition of a backdoor?

'backdoor' comes with the implication that it was included intentionally to allow for future (secret) access.

Where it could instead be a bug or mistake that was not intentionally included.

Re: A Backdoor in Skype for Mac OS X

#19

Post by pvg »

MichaelGG wrote: post #11
pvg wrote: post #7

Earlier quoted context omitted.

That is not at all a realistic interpretation. This is an 'authentication bypass' for a Skype API for locally executed code. Any even slightly serious attacker who has got to that point has already won - they don't need a 'Skype backdoor'.

Are Mac OS apps unable to debug other applications or generally mess with their process space? If so, like on Windows, then this API is basically a courtesy and not a real security boundary in the first place.

I'm really just going by basic idea that once an attacker can run arbitrary code on your desktop, it's game over. That attacker doesn't gain anything by engineering and organizing some 'backdoor' into Skype, they've already owned you.

Re: A Backdoor in Skype for Mac OS X

#20

Post by brianbarker »

ht85 wrote: post #15
y_u_no_rust wrote: post #3

calling this a backdoor is pretty disingenous

An access that bypasses regular security / auth, isn't that the definition of a backdoor?

No. A backdoor is considered to be deliberate and obfuscated from easy discovery, with the intent to be secret access.

If every system flaw or coding bug is a backdoor, then defects like OpenSSL's Heartbleed would be deemed backdoors, and they're not.

Unless you're wearing a heavy tin foil hat and think the coding mistake for Heartbleed was intentional. I guess I can't dissuade you from that train of thought.

Post reply on HN