Skype Eavesdropping

There is an exciting rumor that the National Security Agency (NSA) is offering big money to anybody who can provide a means to eavesdrop on Skype conversations. You would think that this would not be a terribly difficult task for hard core hackers. Skype uses P2P style communications to send messages across the network.

The Skype P2P protocol is not an open one. However you would think that there are former Skype employees who know the secrets. It has also been mentioned that Skype itself could use some extra cash, and might be tempted to sell out to the NSA. I know this sounds a bit evil. However this is just business after all.

How would one go about breaking the Skype protocol? Well you could hook up a packet sniffer, filter out anything other than Skype, then participate in a Skype conversation. This is a reverse engineering exercise. The advantage is that you know what you are communicating over Skype.

I imagine this is not a simple task to reverse engineer the Skype protocol. But when a lot of money is at stake, I bet a motivated hacker can figure it out. Heck. I might even get myself Skype and take a crack at it. However I will not be sharing my findings with you. I will be going directly to the NSA or whoever else is willing to pay up.

Back to Coding

It has been a while since I have released a program on this blog. Times have been very busy. But now I am getting a breather. So I thought I would whip up a program and share it here. Today I give you Easy Grader.

This programs requires the Java 1.6 runtime. I am learning the Java programming language now. So I am going to write programs in Java rather than my normal C++ these days.

Somebody actually asked me to write this program. If you are grading papers, and there are a total of n questions on the paper, this program will give you a percentage out of 100 given that the student missing x questions.

Yes you could easily do this with a calculator. But when you have a stack of 100+ papers, you want to be able to convert to a percentage quickly. That's the easy in Easy Grader. I am sure you could use this to figure out what you score is based on how many questions you got wrong on a quiz or test at school. The real lesson here is to download and install the Java 1.6 runtime so you can run my program.

Sometimes You Have to Hack

I like to write code that is clean. This takes a deliberate effort and a lot of time. It also takes skill and experience. In the long run, this is a best practice if you are going to use that code any time in the future.

However there comes a time when you just need to slap something together and get it work. This is usually caused by some external time constraint. Maybe you have entered a challenge and have seven days to clone a game like Angband.

More often than not, there is a customer demand which requires you to just hack a fix without regard to future maintainability. Often times such a customer needs a fix yesterday and does not care about the long term ramifications. The problem is that you have to pay sooner or later.

Permutations

My customer's organization allow us to lot into their network using a VPN. This means we do not have to be on site to gain access to needed resources. Normally I work from my company's office. However I also have the ability to connect from home as well.

There is a two phase authentication. First we need to be able to type in our username and password. Then we are challenged with some codes to enter. These codes are based on a set of combinations that are unique to each person. You would think that this was a very strong defense against intrusion. However I found something weird about the secondary layer.

You are told to enter some codes in order. There are only n numbers. If you chose all the combination and permutations of those n numbers, there is a universe of possible choices. However if you restrict the codes so that they must always be in order, you have cut down the problem space of the possibilities significantly.

I am not a Math major. However I bet I could study up a bit and determine exactly how much less secure the ordered code entry is. This is very strange. My customer is a big organization. You would think they would have top notch security. They would most likely blame their security vendor.

Back to Crypto API

Recently I have been busy trying to get Oracle certified. So I have not had a lot of time to devote to my Black Hat duties. In addition, I am entering a programming contest this week. There goes another chunk of my time. However I thought I would share some insight into the Crypto API that I have learned by studying the documentation from Microsoft.

Authentication in the Crypto API uses a digital certificate. The encoding and decoding is conducted using a standard called Abstract Syntax Notation One (ASN.1). The certificates contain information about an entity and its public key. The certificates are issued by a certificate authority.

The Crypto API makes use of Cryptographic Service Providers (CSPs). These are lower level routines which the Crypto API calls to do the dirty work of encryption and decryption. The Crypto API is a uniform layer above the CSPs. The CSPs themselves are shipped as a dynamic link library (DLL) and a signature file.

Microsoft itself ships the Microsoft Base Cryptographic Provider with the Crypto API., It uses 40 bit session keys, and 512 bit public keys. Now that we have used the term “session keys” to characterize the Microsoft CSP, I had better define it. Session keys are also called symmetric keys. The key changes for each message that gets encrypted. However the same key is used to encrypt and later decrypt the message.

Symmetric keys are used with symmetric encryption algorithms. Such algorithms include RC2, RC4, and DES. I will go over these algorithms in more detail later (in some future blog posts). The symmetric key is kept internally in the CSP. There are other types of keys. I will also go into those at a later time.

John Schiefer Imprisoned

The CEO of a company recently said he would stand behind an employee of his that was convicted. This was John Schiefer. He was charged back at the end of 2007 for doing some misdeeds. He installed his botnet on a lot of Microsoft Windows computers. Then he used this botnet to do things like install other software for money, collect PayPal information, and steal identities.

A big shame was that this guys was a security consultant. He was only 26 years old when he was caught. And he went by the handle acidstorm. Schiefer had some accomplices doing the crime. He plead guilty and could have received up to 60 years in prison. Instead he was given four years in prison. The strange part about this case is that I had never heard of Schiefer before his CEO blogged about his stance on the controversial subject.

Do you know this guy? Ever heard of acidstorm? Yeah. Me neither. Let's hope his botnet is deactivated by now. Maybe prison will reform him. You can't hold it against a guy for learning how to write botnet software. But it is plain evil to steal people's identities and then rip off their PayPal info. Not cool.

Oracle and Java

Ok people I have not forgot about you. I am just in super study mode. My short term goal is to get Oracle certified. That is a tall order. I need to get it done in my month to get my company to pay for it. Although I do know some Oracle, passing the certification tests is taking it to a whole new level.

I am also engaged in a community college class on Java. Hopefully this will give the knowledge to write evil applets that do all kinds of fun things in your browser. As always I will share what I learn and know.

Did you know you can get all kinds of free tools to do Java programming? You should start by taking a look at the Sun Microsystems web page. They are the inventors of the language. And they provide a free development kit to compile and run Java programs. You can also download a free copy of the NetBeans integrated development environment.

I am an old school hacker. So I like writing my code in a text editor. Or better yet I use an IDE from Microsoft which does not do Java. That way I don't rely on the tool. I rely on my own knowledge to write the code from scratch. That is, I do this until I truly learn the language. After that I will get down with a free Java IDE like Eclipse. More on that later.