skype-open-source

Happy New Year

2012-01-01T03:15:00.010+04:00

The End of Democracy in Russia

2011-12-05T03:25:00.013+04:00

Yes, this is the end of Democracy in Russia.

Official TV reports that "United Russia" got about 50% of citizen voices. But in reality it is 10-30% maximum. Now, this party already has 10 years of power in 2001-2011. And will be for next five years till 2016. So, "Sovet Union" times comeback, when only one party dominated in politics.

New "Communist Party of the Soviet Union" (CPSU or KPSS) now is "United Russia" (Edinaya Rossiya).

New Stalin is a Putin.

Democracy is over. It was funny 20 years.

Links:
http://www.france24.com/en/20111204-arrested-100-moscow-protest-irregularities-saint-petersburg-state-duma-elections-russia
http://www.france24.com/en/20111204-ruling-united-russia-party-putin-medvedev-state-duma-lower-house-vote-majority
http://www.nytimes.com/2011/12/05/world/europe/russians-vote-governing-party-claims-early-victory.html
http://www.guardian.co.uk/world/2011/dec/04/vladimir-putin-majority-complaints-violations
http://www.guardian.co.uk/world/2011/dec/07/russia-anti-putin-protest-grow
http://en.wikipedia.org/wiki/Putinism

Vladimir Putin: A Potemkin election
http://www.guardian.co.uk/commentisfree/2011/dec/07/vladimir-putin-russia-election-editorial

Don't be fooled by "Russia Today" TV lie. Do not enter or arrive in Russia.

It is Red again.

Status update

2011-10-01T08:45:00.020+04:00

So, for now, anyone can test Epycs and try to send messages to a skype user.

However, this code is based on emulating skype v1.4 protocol session handshake. But this version is not supported anymore. It cannot login to a network, even if binary is patched to represent 4.x version.

Current protocol capabilities may be shown like this:

skype14 -> skype14
skype14 -> skype3x
skype14 -> skype4x
skype14    skype5x

So there's no reason to work on a skype14.exe binary anymore. But it has received many patches for debugging reasons (analyzing connection and handshake flow) previously.

For now I have to patch skype v4.1 and 3.8 extensively, before they will be ready for future work. And then we can continue analyzing and writing a new (updated) protocol for session handshake to send messages to any skype version, including skype v5.x binary.

It will allow sending messages:

skype38    skype14 (no need for this anymore)
skype38 -> skype3x
skype38 -> skype4x
skype38 -> skype5x

The bad thing is that (in skype38 and skype41) in many parts of code the debug info was removed and also code addresses and places changed a lot. I can not simply find an old part of code from skype14 in the new skype38 binary. So, almost all the hard work needs to be done again.

The old protocol can be still usable(for 3.x, 4x versions), but debugging and testing it will be very hard because skype14.exe is not working in skype network anymore (cannot login).

I don't have much time to work on it now. But i will be slowly working on skype41.exe to patch it and log all needed info for reconstructing skype41-> skype5x protocol for send message session.

That's all, for now.

DMCA counter-notice confirmed

2011-08-03T22:47:00.003+04:00

I got confirmation from Blogger about my counter-notice.

---
The Blogger Team blogger-support@google.com to me
show details 9:02 PM (1 hour ago)
Hello,

Thanks for reaching out to us.

In accordance with the DMCA, we have completed processing your
infringement complaint and the content in question no longer appears on
the following URL(s):

http://skype-open-source.blogspot.com/2011/07/great-skype-testing-day.html

Please let us know if we can assist you further.
---

So, i restore links in my post.

DMCA takedown number three

2011-08-03T22:00:00.009+04:00

And again. LOL.
Skype Inc or some anonymous, haters gona hate?

---

from support@blogger.com
to skypeopensource@gmail.com
cc blogger-dmca-notification@google.com
date Wed, Aug 3, 2011 at 9:01 PM
subject Blogger DMCA takedown notification
mailed-by blogger.bounces.google.com
signed-by blogger.com
Important mainly because of the people in the conversation.
hide details 9:01 PM (57 minutes ago)
Blogger has been notified, according to the terms of the Digital Millennium Copyright Act (DMCA), that certain content in your blog is alleged to infringe upon the copyrights of others. As a result, we have reset the post(s) to "draft" status. (If we did not do so, we would be subject to a claim of copyright infringement, regardless of its merits. The URL(s) of the allegedly infringing post(s) may be found at the end of this message.) This means your post - and any images, links or other content - is not gone. You may edit the post to remove the offending content and republish, at which point the post in question will be visible to your readers again.
A bit of background: the DMCA is a United States copyright law that provides guidelines for online service provider liability in case of copyright infringement. If you believe you have the rights to post the content at issue here, you can file a counter-claim. For more information on our DMCA policy, including how to file a counter-claim, please see http://www.google.com/dmca.html.
The notice that we received, with any personally identifying information removed, will be posted online by a service called Chilling Effects at http://www.chillingeffects.org. We do this in accordance with the Digital Millennium Copyright Act (DMCA). You can search for the DMCA notice associated with the removal of your content by going to the Chilling Effects search page at http://www.chillingeffects.org/search.cgi, and entering in the URL of the blog post that was removed. If it is brought to our attention that you have republished the post without removing the content/link in question, then we will delete your post and count it as a violation on your account. Repeated violations to our Terms of Service may result in further remedial action taken against your Blogger account including deleting your blog and/or terminating your account. If you have legal questions about this notification, you should retain your own legal counsel.
Sincerely,
The Blogger Team
Affected URLs:
http://skype-open-source.blogspot.com/2011/07/great-skype-testing-day.html

---

I think its just anonymous abuse of this form:
http://www.google.com/support/bin/request.py?contact_type=lr_dmca&product=blogger
There is not need any confirmation for takedown any blog or post.

I filled counter-notice against it twise.
Will see how it will end.

UPD. I got counter-notice confirm. So, i guess i can restore links.

DMCA takedown again

2011-07-27T11:53:00.010+04:00

Here is a letter on my email.

---
Blogger DMCA takedown notification

Blogger has been notified, according to the terms of the Digital Millennium Copyright Act (DMCA), that certain content in your blog is alleged to infringe upon the copyrights of others. As a result, we have reset the post(s) to "draft" status. (If we did not do so, we would be subject to a claim of copyright infringement, regardless of its merits. The URL(s) of the allegedly infringing post(s) may be found at the end of this message.) This means your post - and any images, links or other content - is not gone. You may edit the post to remove the offending content and republish, at which point the post in question will be visible to your readers again.

A bit of background: the DMCA is a United States copyright law that provides guidelines for online service provider liability in case of copyright infringement. If you believe you have the rights to post the content at issue here, you can file a counter-claim. For more information on our DMCA policy, including how to file a counter-claim, please see http://www.google.com/dmca.html.

The notice that we received, with any personally identifying information removed, will be posted online by a service called Chilling Effects at http://www.chillingeffects.org. We do this in accordance with the Digital Millennium Copyright Act (DMCA). You can search for the DMCA notice associated with the removal of your content by going to the Chilling Effects search page at http://www.chillingeffects.org/search.cgi, and entering in the URL of the blog post that was removed. If it is brought to our attention that you have republished the post without removing the content/link in question, then we will delete your post and count it as a violation on your account. Repeated violations to our Terms of Service may result in further remedial action taken against your Blogger account including deleting your blog and/or terminating your account. If you have legal questions about this notification, you should retain your own legal counsel.

Sincerely,
The Blogger Team

Affected URLs:
http://skype-open-source.blogspot.com/2011/07/great-skype-testing-day.html
---

It contains links *on my own code*, wtf?
I think in this case no reason for takedown at all.
Where was no patched binaries or something. Just my code.

Hmm.

P.S. Here available first DMCA takedown notice:
https://www.chillingeffects.org/dmca512c/notice.cgi?NoticeID=89716
Interesting discussion about this post on reddit.

Great skype testing day

2011-07-23T04:05:00.013+04:00

Hello,

This is some compilable proofs with binaries. Worked with 3.x/4.x skype versions only. And also its limited to *one time* usage per credentials per user. Because this code just step by step repeat of packets from dump on "send message" user action.

Download:
http://github.com/downloads/skypeopensource/skypeopensource/Epycs.zip

Mirrors:
http://depositfiles.com/files/k13j24xjn
http://www.mediafire.com/file/3c63ab1grkfyecb/Epycs.zip
http://rghost.ru/15494571

Big Thanks to dose for skydumpcred code.

P.S. All links also can be found in comments.

P.S2. Links restored.

Some thoughts

2011-06-08T16:00:00.013+04:00

Why security and trust is important.

[politics on]

I rethinking all of this.

In other words, Skype got caught in Egypt to provide not SAME level of security for all skype users.

Think something about not viruses or trojans or local audio channel compromise.

But about MITM attack with uncorrected signed by skype CA suspected users 'skypename' certificate. For allow Man-in-the-middle attacks.

Or better way.
Signed by Skype 'minor update' which contain government spyware code for monitor dissident activity(and stealing they private keys and/or skype passwords). Even more, it not should be a 'signed spyware', but voice codec, with security hole, or something like that. Big brother calling you. Oops. You got owned. Ha-ha!

This is major security breach in encryption infrastructure. Which apparently they allow it. And now was down for this 'unfair' action.

C'est la vie.

P.S. I bet what they 'playing to the end'(endgame) with they 'high prices' eyesdropping solutions.
Which they start providing since Facebook and Twitter revolutions or even more early.

[politics off]

P.S.

So, yet some facts to thinks about Skype Inc(main RSA secret of PKI) - Certificate Authority private key - Compromised.

Compromised by owners.

For money.

Lulz!

2011-06-08T01:09:00.006+04:00

HA-HA!

Microsoft in action.

"Blogger DMCA takedown notification"

---
Blogger has been notified, according to the terms of the Digital Millennium Copyright Act (DMCA), that certain content in your blog is alleged to infringe upon the copyrights of others. As a result, we have reset the post(s) to "draft" status. (If we did not do so, we would be subject to a claim of copyright infringement, regardless of its merits. The URL(s) of the allegedly infringing post(s) may be found at the end of this message.) This means your post - and any images, links or other content - is not gone. You may edit the post to remove the offending content and republish, at which point the post in question will be visible to your readers again.

A bit of background: the DMCA is a United States copyright law that provides guidelines for online service provider liability in case of copyright infringement. If you believe you have the rights to post the content at issue here, you can file a counter-claim. For more information on our DMCA policy, including how to file a counter-claim, please see http://www.google.com/dmca.html.

The notice that we received, with any personally identifying information removed, will be posted online by a service called Chilling Effects at http://www.chillingeffects.org. We do this in accordance with the Digital Millennium Copyright Act (DMCA). You can search for the DMCA notice associated with the removal of your content by going to the Chilling Effects search page at http://www.chillingeffects.org/search.cgi, and entering in the URL of the blog post that was removed. If it is brought to our attention that you have republished the post without removing the content/link in question, then we will delete your post and count it as a violation on your account. Repeated violations to our Terms of Service may result in further remedial action taken against your Blogger account including deleting your blog and/or terminating your account. If you have legal questions about this notification, you should retain your own legal counsel.

Sincerely,

The Blogger Team

Affected URLs:

http://skype-open-source.blogspot.com/2011/06/skype-protocol-reverse-engineered.html
http://skype-open-source.blogspot.com/2011/06/skype-under-rc4-layer-arithmetic.html
---

Should i host blog in china now?

P.S.
I don't find anything about this on http://www.chillingeffects.org.

And why http://skype-open-source.blogspot.com/2011/06/skype-under-rc4-layer-arithmetic.html is mention? Here is no binaries.

Uhm.

Crypto, skype and politics

2011-06-07T14:05:00.036+04:00

Please, don't take this too serious.
Its just nice theory about future, cryptoalgorithms and politics.

[politics on]

Someone ask good question.

@anonymous at 7 June 2011 02:17
> why you release files now?

So, time to talk about politics and my try to effort a little support to "Navalny".

Please, start read carefully at first post.
And try draw you own conclusion.

Hint tags: dissident, security, politics, eavesdropping, belarus, egypt freedom.

I don't want to Russia FSB (Fima Sergeevich Bushmanov, haha) to stop process of Liberty. And to allow overtake it by Putin regime.

I don't want another one-political-party-for-all like 'KPSS' to be present here for ages. 'Edinaya Rossia' should take away from political scene for next years.

See http://navalny.livejournal.com/ blog for details. If there is no political competitions, there is no freedom. This is way to hell and Stalinism(Putinism).

I like two political parties at least, like in USA or EUROPE.

So, i want provide info about strong VOIP encryption way for all dissidents. Now, only skype software provide unbreakable strong level of voice encryption and widely used. Skype owned by MS, i bet, will not provide that, because of money and political engagement.

Only 'individual' vs 'big corporations' can do this.

My aim is to overtake political regime in Russia(Ha-ha!), if it will probably take in stagnation, because of Putin or Medvedev indirect corruption support.

Check http://russian-untouchables.com/ site. For get a alternative political view of Russia today.

In worst cases scenario, we can change skype RSA 'main' public and secret Certification Authority (learn PKI) key, and use our own secure network 'based on skype binary' for allow rebellion flashmobs. We just need change ip addresses of login server, and change CA public key certificate in binary.

Take a look on "Strategy 31" group in Russia.
Yes, they a morons, but they are try to make freedom for all of us.

Regional elections was already illegally(but they claims it was legal, of course) overtaken by current 'Edinaya Rossia' and Putin administration regim.

So, regional politics people will count, like "Pi == 10 in war times".
In 2011 December.

We should not admit or allow it.

Have the true securely private communication is one most important point to overtake regime. Egypt proof of it.

So, take very, *very* care about FSB trojans and viruses. But still use Skype for securely communication. Even, if someone claim that it insecure. It is secure. Until someone hack in your or your's peer computer. Or until someone break AES - American Encryption Standard(and until Skype CA trusted). And it will be even more secure, when we will have open-source Skype protocol specification.

Yes, i am talk like crazy-russian-bear.
But it was like i thinking.

[politics off]

Interview to East-West Digital News

2011-06-05T23:27:00.017+04:00

Hey folks, over the weekend I was written up in East-West Digital News, the Russian based IT journal. They contacted me to ask a few questions and reported on my blog, but I had a long talk with the the Editor and he offered to give me a full interview. It was a busy weekend! You can read the article here and the interview here.

This is the links on both:
http://www.ewdn.com/2011/06/04/skype-reverse-engineered-by-russian-geek/
http://www.ewdn.com/2011/06/05/ewdn-exclusive-an-interview-with-efim-bushmanov/

P.S. My first meet with press. ROFL, i become famous.

P.S2. This one i also like:
http://www.eweekeurope.co.uk/interview/russian-reverse-engineer-praises-skype-30956

Russian language:
http://www.marchmont.ru/story.php?story_id=17287
http://telecomblog.ru/?p=7405

Some words about how to test this

2011-06-03T10:25:00.002+04:00

As you can possible try, sending not work as expected.

It will not work at all on any 5.x skype and will not work for 3.x/4.x without new 'login' certificate(they call it 'credentials'). Cert issued by skype login server each time when you enter password, or once in around 30 days if you mark 'remember password' checkbox.

First (and main) problem for now, its about skype14. Which stops connect to network supernodes. Because, as i think, 5.x skype stop support its too oldy proto.

If you will take a try to connect with skydump(its only need ip:port) to 3.x or 4.x skype, it will work, but with 5.x this will fail.

Where is two methods to get credentials(certificate) for 'login' into network.

Easy method was by manually login via skype14 and dump certificate from log file(with help of get_creds.pl), which was specially patched for this. Now, its not work anymore, because skype14 can't connect to 5.x supernodes.

Second method, is use Sean's 'skype_login.c' code. Which have a little messy things with headers. But, keep in mind, what skype Inc maybe already change something in this process since 2009.

I have no 5.x clean binary, so its also bad thing and a big problem.

I think, for now, better way will be in patching 4.x for dump credentials into log file. I will try to do it in near future.

But, if you dump credentials somehow, when you may try to send skype message to 3.x or 4.x without problem, and be sure what code 'works'. You can also may use old certificate(check 'a_cred.txt'), but you only got 'credentials expired' in you peer client logs.

So, keep in touch.

When binary files is not just general binaries

2011-06-02T17:55:00.001+04:00

Some words about binaries. Its not just usual exe files redistributed by Skype Inc.

Its specially patched for remove autoupdate, anti-debugging and obfuscation thnigs. So, its will be easy for you to load it into ollydbg or another debugger and got whole control on 'clean' binary. They also already patched for some usefull things like logging in most interesting parts.

Skype under rc4 layer - arithmetic encoding

2011-06-02T11:05:00.013+04:00

Here is most complex arithmetic encode of skype.

unpack-4142.c :
<skipped>

P.S. I wonder, why this post was mentioned, but anyway:

--- skype & microsoft & DMCA was here ---

Check it on The Pirate Bay and GitHub.

P.S2. Link on pastebin with "unpack-4142.c" you can find in comments.

Skype protocol reverse engineered, source available for download

2011-06-02T05:17:00.040+04:00

Hello, I'am Efim Bushmanov a freelance researcher and here is my project files on skype research.

While "Wall Street Journal" makes politics and skype today's trend, i want to publish my research on this. My aim is to make skype open source. And find friends who can spend many hours for completely reverse it.

Now, most of hard things already done(for 1.x/3.x/4.x versions of skype). Including rc4 and arithmetic compression.

You have unique chance to take a look on skype internal protocol and encryption. You will see what it uses strong AES and RSA encryption with public key infrastructure.

Here is yet a working "send message to skype" code. However, this is based on old skype 1.4 version protocol, which now slightly changed.

Part of this code, idb files and decrypted binares was get from VEST corporation.
Common info for first stage research was from EADS.net "vanilla-skype" presentation.

Downloads:
--- oops, no more binaries, skype & microsoft & DMCA was here ---
skype_part2_ida.zip
--- oops, no more binaries, skype & microsoft & DMCA was here ---

P.S. Here is a torrent file:
--- oops, no more binaries, skype & microsoft & DMCA was here ---

And github:
--- oops, no more binaries, skype & microsoft & DMCA was here ---

UPD: 2011.06.13 depositfiles hosting removed files

P.S2. All links can be found in comments.