Today I came across a post by Tom Keating at TMCnet advising of a security vulnerability in Skype for iPhone 3.0.1 and possibly Skype for iPad if it is a full iOS issue. Dan York has subsequently written about it, including a statement from Skype:

We are working hard to fix this reported issue in our next planned release which we hope to roll out imminently. In the meantime, we always recommend people exercise caution in only accepting friend requests from people they know and practice common sense Internet security as always. [Author’s bold]

Both posts include a video demonstrating the vulnerability posted by the initial reporter of the vulnerability at the SUPEREVR Security Blog .

Bottom line is “know your contacts”. As Dan states:

Skype’s mitigation recommendation is a good one as the default privacy setting is typically that you can only receive chat messages from people on your Contact list. Therefore, the attacker would have to be someone who you have authorized and added to your contact list.

Hopefully we will see a new release of Skype for iPhone any day now and, if also affected, Skype for iPad. In the meantime “practice safe Skype” by knowing your contacts.

Over the past couple of years I have attended quarterly briefings given by CheckPoint Canada that give me some perspective on Internet security issues from a third party (relative to Microsoft, Google, Facebook, Skype, etc.) who understands not only the issues that challenge a business’s Internet security but also how they are changing over time. I’m more interested in the security issues overview and what business issues need to be considered and addressed, not the technology details. (I’ll trust CheckPoint’s sales results to be the guide as to their credibility.) CheckPoint Canada’s presentations are quite educational in this respect, in part due to the knowledge and passion of their lead technical resource for Canada.

At the most recent presentation two weeks ago I learned (i) about the evolution of CheckPoint’s new approach to addressing security at the enterprise level and (ii) about an experience that demonstrated one simple example of CheckPoint’s thoroughness at identifying and addressing Internet security issues at a personal engagement level.

In taking a new approach there are several changes in the business environment that challenge the ability of simple solutions such as firewalls and IP address identification to manage security, including intrusions such as malware and business data loss.

• Users have more than one device: a PC, a smartphone, maybe even a tablet.
• Employees need to be able to carry on personal activities, such as banking, from their place of employment
• this creates data privacy issues
• IP address-based policies no longer work – users no longer belong to one network.
• The emerging IPv6 standard means that it will become very difficult to track activity via a “single” IP address; also the IPv6 protocol is not a simple extension of IPv4’s nnn.nnn.nnn.nnn format.
• Security policies need to synchronize with a customer’s internal business processes as the priority.
• Use of collaboration tools and services is on the rise; not everyone is at one “secure” location.
• Security needs to address permission issues involving both websites and applications
• 189 new websites were created every minute in 2010
• The rise of video use for, say, marketing and support create bandwidth issues

Yet businesses obviously continue to seek protection against security breaches and data loss at minimal overhead and costs to the operation.

CheckPoint addresses these issues with a focus on the business’s policies, people (employees and contractors who need access) and enforcement as opposed to the underlying technology infrastructure. This is reflected in their unique ability to configure their installations to meet a business’s needs. In its infrastructure CheckPoint maintains a dynamically updated database of critical data.

In part CheckPoint addresses these issues through engagement of users as they attempt to visit a website or use an application:

• For instance, when accessing Facebook, a notification comes to the user advising of company policy and a warning about the information that cannot be shared on Facebook.
• Exceptions can be established to permit access to, say, an online banking site without inspecting data.
• All traffic is inspected to ensure SSL certification where appropriate.

One issue CheckPoint addresses is data loss prevention, both internally and externally. Here is one example of how CheckPoint has a significantly complete offering that provides a warning to the individual employee’s activity.

CheckPoint Canada’s Regional Security Engineering Manager was recently checking out one of Checkpoint’s new data loss prevention (“DLP”) tools on his home network (no, they do not have a home product, yet). He attempted to check into an Air Canada flight via the Air Canada application on his iPhone. But the DLP software identified an issue:

His personal information data – including his Aeroplan number – was going across the Internet to Air Canada as unencrypted clear text. Apparently doing an Air Canada check-in via their website is encrypted; however, until Air Canada addresses this issue for their iPhone application (they have been notified), Kellman will not be doing check-ins via his iPhone (and probably the same applies to their BlackBerry application).

Bottom Line: What I can say from the presentation is that CheckPoint has developed not only the technology expertise but also the business experience that addresses they dynamic nature of the Internet, its growth, its usage and its security threats while ensuring that individual users can be comfortable with their work and personal activities. As with business use of social media, engagement of the individual user is a key to their ongoing success. (And their recent sales growth is the best indicator of that success.)

One final comment: CheckPoint employees are heavy users of Skype and, in fact, CheckPoint has no qualms about allowing usage; in the case below, the CheckPoint customer is giving permission for its sales department to use Skype. I’ll have more to say in another post about Kellman’s use of Skype to keep in touch with his young family while having a heavy travel schedule across Canada and to CheckPoint’s headquarters in Israel.

Today Skype released the promised Hotfix to Skype for Mac 5.1 that addresses the security vulnerability that was the subject of much Internet angst last Friday.

Click on Skype | Check for Updates … and you will get this:

Release notes, such as they are, mention three issues addressed:

• Security updates
• Resolves video freezing in high-packet loss networks
• Fixes minor bugs

Dan York has put on his enterprise enterprise security manager hat in posting: Skype Issues 2nd Mac 5.1 Hotfix for “Security Issues” – But What Are Those Issues? and concludes with:

Seriously, Skype… security matters… and even more, communication about security matters. We all know that with any system there are security issues… no system is perfect and attackers will always try to compromise systems. We get that. It is how you react and communicate about those security issues that is so incredibly critical.

Update: Adam Asher, Chief Information Security Officer at Skype, has provided a post outlining why Skype is holding back on details of the security issue addressed by this hotfix as well as confirmation from Pure Hacking (who originally found the issue) that the vulnerability has gone away.

My approach on releases is to always wait for the majority of our users to update before detailing / discussing any of the specific issues that have been fixed. This minimizes the amount of time that would-be attackers have to try and exploit those of our users that haven’t upgraded yet.

Bottom Line: if you are running Skype for Mac 5.1 (or 5.0), do the update. If you chose to stay on Skype for Mac 2.8 while Skype addresses some much larger issues with Skype 5.x, you need do nothing.

Note: as of the time of writing this post, Dan reports that “Check for Updates” is not working for him. Probably needs to clear U.S. customs or similar border security issue. You can also get the download here.

Related articles

• Skype Security Blog: Security Vulnerability in Mac Client Has Been Addressed (blogs.skype.com)

Over at Disruptive Telephony, Best Practices Chair of the VoIP Security Alliance, Dan York, summarizes recent reports on a security vulnerability in Skype for Mac.

Given that I basically live inside of Skype for Mac and use it extensively every day, this is obviously extremely concerning. Particularly because I do let anyone on Skype send me messages… and my Skype ID is easily found on my websites and many other locations (and since is rather obvious – “danyork”).

As a heavy user of Skype for Mac’s group chat feature, Dan questions why there has been no communications from Skype other than a response to ZDNet UK’s story where they say:

UPDATE (5:13pm): Skype has just sent ZDNet UK a statement promising a fix next week. The statement reads: “We are aware of this and will release a fix early next week to resolve the issue. We take our users privacy very seriously and are working quickly to protect Skype users from this vulnerability.”

This evening Skype has responded in their blog post, Security Vulnerability in Mac Client Has Been Addressed. To summarize:

• Skype acknowledges they were aware of the vulnerability, not only via Pure Hackers but also their own internal processes
• The issue was addressed in a “minor” update, version 5.1.0.922 released on April 14, 2011

This vulnerability … is related to a situation when a malicious contact would send a specifically crafted message that could cause Skype for Mac to crash. Note, this message would have to come from someone already in your Skype Contact List, as Skype’s default privacy settings will not let you receive messages from people that you have not already authorized, hence the term malicious contact.

However, they also stated:

As there were no reports of this vulnerability being exploited in the wild, we did not prompt our users to install this update, as there is another update in the pipeline that will be sent out early next week.

And go on to point out that customers will prompted to install a more comprehensive update to be released next week. But they made the following statement:

In the meantime, we recommend you update your software with the fix made available on April 14th, just click on Skype -> Check for Updates or you can download the software here.

I checked my installed version; it was 5.1.0.914. I did the “Check for Updates” and was told there were “no updates”.

Bottom line: download the updated software here (version 5.1.0.9220 and install it to ensure you have no exposure to this vulnerability. And expect to be notified of a more comprehensive update next week.

You can’t win … when customers are heavily prompted to update, there are complaints; when they are not prompted the story somehow gets out  anyway. Decisions, decisions….

One final question: will this update address any of the issues discussed not only in my recent posts but also in several other online discussions (listed at the end of some of these posts).

Update: Dan questions why this issue even had to come to light in ??Skype’s Security Communication FAIL – Why Issue a HotFix If You Don’t Tell Anyone?

Related articles

• Skype Bug Leaves Mac Users Vulnerable to Exploit (macstories.net)
• Expert: Skype for Mac hole can be used in remote attack (news.cnet.com)
• A bug in Skype for Mac could give hackers root access to OS X (thenextweb.com)
• Skype bug gives attackers root access to Mac OS X (theregister.co.uk)
• Skype vulnerability discovered by Pure Hacking (purehacking.com)

Yesterday’s announcement of the Skype for SIP beta created lots of commentary in the blogosphere; it remained the leading topic on Techmeme for several hours.

• Phil Wolff over at Skype Journal, in “Skype For SIP: Big Money, Skypeless, Brand Destroyer”, outlines some of the positioning with respect to Skype for Asterisk, channel schism issues and worries that it abandons Skype’s central tenants and could undermine the brand.
• Alec Saunders, in “Skype embraces SIP; announces beta service for business users”, talks about the impact on businesses using legacy PBX’s, the increased pressure on international long distance markets and a reminder that about 1/3 of all current Skype traffic is business related.
• Jason Goecke at Ahearsion, a Skype for Asterisk beta developer, worries about the impact on the market for Skype for Asterisk in “Skype for SIP = Skype for Asterisk DOA?”

But most interesting was the Voice On The Web Public Chat session that ensued. Being on a vacation I was away from my laptop for about seven hours (yes, it was a great day to be golfing) but when I returned I found a session that not only provided the flavor of the vibrant debate going on but also many answers. The key – Chris Moore, Skype’s Senior Product Manager responsible for Skype for SIP joined into the discussion to make several points:

• Most importantly – this is Skype for SIP beta; his team is looking for feedback from a range of beta testers, not only third party developers but also the IP PBX vendors themselves. To quote Chris:
  

  Yep, whole idea is to get feedback, see what people want/don’t want to help prioritize development of new features. Our group, Skype For Business, is getting a lot of focus and its a key strategic focal point for Skype now. We’ll never get it completely right at the start, but a start is still a start

• To qualify as a beta tester you need to have some experience with configuring IP PBX’s that are currently in the market. For instance, “you must have, and be able to configure, your own SIP Enabled PBX that supports G.729 codec.”
• Beta testers will need to create a temporary Skype name to use in the beta program; the issue of a separate SkypeID and how it was handled was hotly debated.
  One point to clarify:

  Skype for SIP actually can allow multiple Skype IDs to be mapped through to a single SIP identity. However, during the beta period, we are only supporting a 1 to 1 mapping due to the fact that Skype’s advanced Business Control Panel (BCP) configuration portal is not yet available at this time. If a company wishes to configure multiple Skype ID’s mapped to a SIP identity, we can accommodate this for a subset of the beta trial participants.

• The key connections made by Skype for SIP are:
  

  - PBX –> SkypeOut (PSTN)
  - SkypeIn/Online numbers (PSTN) –> PBX
  - Skype Clients –> PBX

• The business model, including pricing, has yet to be worked out. It will require Skype to determine a means to separate out business users from “consumer” users on both Skype for SIP and Skype for Asterisk. The principle here is that business benefits from the various features of these offerings; where such significant value-add exists there is a market for the services. But any pricing for either offering is yet to be determined, keeping in mind that both offerings’ desire to make significant market penetration will be a key moderator on pricing. Again quoting Chris:
  

  no new road is easy and enhancing our focus so Skype can support business users as a distinct group differently from consumers takes some work

• Differentiation from Skype for Asterisk will be an ongoing challenge. Initially Skype for Asterisk, which will be an Asterisk channel, includes handling SIP—>Skype calls, Skype-to-Skype calls and will incorporate presence information. (My comments on an ignored aspect differentiating these are below.)
• While SFS may incorporate some “Skype trunking” capability, SFS also offers the handling of inbound calling from Skype Online numbers.
• As for the current status of SFS, Chris says the focus at the moment is on getting voice connections right as this is the feature most demanded in the market:
  

  and this is baby steps for Skype, there are many more UC services to come, voice for SIP is the biggest ask from customers. Video/presence etc only make  sense when codecs are common between skype clients and SIP endpoints.Some work left there!

• Codecs are an issue. The initially supported G.729 codec requires licensing. The Skype for Business team is working on incorporation of G.711 within a few weeks but eventually hopes to assist with the adoption of the SILK codec across the industry by supporting SILK. But this also requires SILK support at the end points. Bottom line: codecs have both a technology and business issues to be resolved.
• Security is an issue that will probably provide one of the major challenges as Skype opens up access to its cloud from both Skype for Business offerings.

My own observations, not having been around for the discussion:

• Skype for SIP and Skype for Asterisk: the discussion yesterday centered on technical issues but totally ignored the market channel issues.
• Skype for SIP requires working with the various IP PBX vendors who have their own distribution channels; Skype for Asterisk is a partnering project with Digium who has its own unique distribution channels. These channels are both looking for innovation that keeps them in business. Yes, the common issue is that SFS and SFA both threaten the long distance market, but the VAR’s and System Integrators in these channels will need new offerings that meet this challenge.
• A significant challenge for both SFA and SFS will be the User Interface. How much will either of these products make the installation,  configuration and operational aspects so user friendly that outside support requirements are minimized or eliminated. This is a huge challenge in the SMB market as many small business owners will simply not want to be involved with such issues; they have their own business specialty to focus on. The value-add of VAR’s and SI’s serving any business market comes in making business communications low cost, seamless to the business operation and five 9’s uptime for their customers.
• There is not one solution that will meet the complete world of business needs. Currently in this SMB space we have several vendors: Cisco, Microsoft Response Point, Avaya, Siemens, etc. The world would be up in arms if there were only one offering for providing the disruptive innovation for which Skype can provide support to these channels.
• The issue of addressing consumer users vs business issues recalls the PC market twenty years ago when PC hardware vendors, initially Compaq, finally figured out how to differentiate and address these markets. This was a major issue I had to deal with in setting up a PC reseller network at the time. Today we see Dell addressing these various markets as soon as you launch into their website.

The Skype-enabled world is only healthy if there are alternative offerings and channels. Recall the theme of Skype President Josh Silverman’s reminder to the analysts last week: “Skype is a software company but we plan to be everywhere”. The Skype for Business group is focusing on making the software required to support these offerings; this software will leverage the IP PBX vendors and Digium distribution channels to drive adoption through into the various regional business market channels worldwide.

Update: While Om’s post, Skype Now Means Business, Friends the SIP World, demonstrates that he has not been following very closely the strategy being laid out by Skype’s new executive team over the past few months, the comment stream it triggered  is well worth reading. For instance, check out SFA developer Tim Panton’s comment about the opportunity for innovation he has found in SFA:

That aside, I’m a huge fan of S4A and our experience to date has been positive. We leverage the improved identity management (vs PSTN or SIP) and low costs of Skype to do some very cool integration with business processes and web applications by routing Skype calls through the extensible and scriptable platform of Asterisk. [author’s bold]

Next Post: Why Skype needs to get Skype Public Chat back into the latest release of Skype for Windows 4.0. The discussion referenced above demonstrates that this is the major failing of this version.

Update: Andy Abramson at VoIP Watch: Skype and SIP Equals A Takeaway of Toll Free

Related articles by Zemanta

• Skype Taps ShoreTel for Enterprise Play (gigaom.com)

During our conversations with Skype COO Scott Durchslag last week at CES, Scott outlined Skype’s criteria for its software development going forward.

First was the emphasis on “liquid communications” through statements such as “Skype Whenever, Wherever”. Just as today you can pick up any PC or mobile platform and find all the Google Tools (Search, Maps, News, Reader, etc.) Skype wants to be on virtually any platform or device.

Pick up a smartphone, find the Skype button. Turn on the TV, find a Skype button, have a conversation. Open a web browser; start a Skype session. All this to complement Skype on the desktop. Today, besides on the desktop, you can find Skype on over 200 mobile phone handsets, several (Sony) mobile devices, Skypephone and Apple TV. But Scott emphasized, this is only the beginning. It will only start to get real when we see Skype on higher profile devices such as the iPhone and BlackBerry or when we start to see Skype seriously back into the hardware device business with vendors such as Philips and iPevo.

Then Scott outlined four benchmark criteria that every implementation of a Skype on any platform or device must meet:

• High call quality
• Simple and easy user interface
• Consideration for battery life
• Security

Last week’s hotfix upgrade of Skype for Windows 4 beta 3 included the first implementation of Skype’s three year effort to develop the SILK codec, increasing the audio bandwidth to 12 KHz while effectively reducing the Internet bandwidth consumed during a Skype call.

A key reason for Skype’s rapid and widespread adoption has been associated with its ease-of-use. Yet Scott says the Skype conversation user experience needs to be even easier to encourage adoption by a broader user base. Developing a more effective user interface has certainly been a focus of the Skype for Windows 4 beta program. At the Skype CES press conference Scott reported that, in a recent survey of users, 88% preferred the new UI to the previous Skype for Windows 3.8. But I’m still wondering if the Skype for Windows team could take a look at Skype for Mac and implement a “drawer” type interface to manage and select the active conversation. For the longer term evolution of Skype clients hopefully Skype also has a look at Dan York’s post on Skype’s fragmented product strategy.

Battery life on smartphones was a key issue that prevented Truphone, who uses a native VoIP client for calls over WiFi, from launching a native VoIP smartphone client running over 3G networks. Instead they launched Truphone Anywhere that takes advantage of the underlying network 3G GSM voice channel and uses the data channel to set up a call via a server that, in turn, sets up a VoIP client. That voice channel tends to make much less use of the device battery than a constantly compressing/decompressing VoIP client that devours the underlying processor activity. Addressing the battery life issue is a major reason why we see Skype using a similar calling architecture when launching the Skype Lite Java client on over 100 Java-enabled cell phones, including those based on Google Android.

Security is an issue that I’ll leave to Dan York and others who are able to cover this issue more knowledgeably and effectively. Suffice it to say that we would expect security to continue to be a feature of all Skype products, including those that use the mobile voice channel for placing calls from mobile phones.

Two take-aways from these statements:

• Fundamentally we should expect Skype, going forward, to be a provider of real time conversation-enabling software on desktop, web, TV and mobile platforms. To use an old telegraphy term: Full Stop! For instance, rather than developing their own social network, we should expect Skype to seek out agreements with other social network service providers, such as the MySpace agreement. Skype is an enabler of real time conversations; it is not in the community building or social networking business. Facebook, Twitter and MySpace, amongst others have already captured that space and done an excellent job at it.
• These benchmarks also provide a basis not only for deciding what product offerings Skype will develop but also when they are in a position to release a product.

The new Skype executive team is finally starting to set some benchmarks and guidelines against which we can not only measure executed performance but also have a better understanding of where Skype wants to go.

Powered by Qumana

This is the fourth and final of four posts resulting from an interview with Nart Villeneuve, principle investigator of the Citizen Lab report “Breaching Trust”.

Having discussed some background to Nart’s research, the activities of the Citizen Lab and answers to Phil’s questions, Nart had a couple of recommendations for Skype going forward. As background, the Citizen Lab is a affiliated with the BerkmanCenter for Internet & Society’s “Principles on Free Expression and Privacy” initiative “to protect and advance individuals’ rights to free expression and privacy on the Internet through the creation of a set of principles and supporting mechanisms for ICT companies”.

The goal of this project is:

Through the articulation of a broad set of common principles, the development of resources for implementation and a compliance structure, this collaborative effort is working to formulate an industry-wide response to guide businesses when they encounter laws and practices that may contravene international human rights standards or be at odds with law or culture in their home jurisdiction.

Participants in this project include Microsoft, Google, Yahoo along with several human rights organizations. It is hoped that having a joint industry-activist initiative would help companies avoid situations similar to the one which Skype has encountered in its TOM-Skype relationship.

Update: as I was writing this post today, a New York Times story on this initiative, now called the Global Network Initiative, broke and has more details.

An initial draft document (update: final document to be released tomorrow) is under review amongst the participants but Nart brought out three recommendations for Skype that would be consistent with the guidelines in the draft document:

1. Include in Skype and/or the TOM-Skype client, as appropriate, an ability to provide notification to all participants in a conversation that a contact is participating in the conversation via the TOM-Skype client. In effect, this could be included in a more general identification of the version of Skype that other participants in a conversation are using. The reasoning for the providing version information was to let other participants know, via the version number, which feature set a participant can use in their Skype client installation.
2. When a user types a message that is diverted via the TOM-Skype filter, a message, indicating that the recipient is missing content due to government regulations, comes back to the initiating party. For example: “To comply with local laws, this message has not been displayed to your contact.” Often Nart found conversations where someone would type a message repeatedly when it was apparent the receiving party was not understanding the message being sent, yet the sender did not realize that the message was being filtered.
3. Become a participant in the Global Network Initiative and its dialogue.

The hope is that, through an industry-wide initiative, foreign companies entering the Chinese market would have more negotiating power and a protocol for addressing issues that are raised in the process of establishing a business relationship in countries where the climate for free expression and human rights is restrictive. In an Opinion piece today, Om has other thoughts on the morality of this approach.

Tags: TOM-Skype, Skype, Nart Villeneuve, Citizen Lab, Global Network Initiative

This is the third of four posts resulting from an interview with Nart Villeneuve, principle investigator of the Citizen Lab report “Breaching Trust”.

Two weeks ago Phil republished an April 2006 Skype Journal post with about sixteen questions related to the TOM-Skype security breach discovered by Nart. My interview provided answers to several of these questions but I ran them by Nart for more completeness, where an answer or response was feasible.

1. Is TOM only filtering chats where at least one of the callers’ accounts were signed up by TOM Online?

A: One party must have the TOM-Skpe client installed. For example, if you (a normal skype user) sign in via a friends Tom_Skype client you’ll be filtered. If you (tom user) sign in on a normal Skype client, you won’t be filtered.

2. Will TOM filter chats if both parties are Chinese nationals but outside the PRC, say traveling in the US?

A: It is all dependent on which client software is installed. If you are using TOM-Skype you’ll be filtered no matter where you are (although the degree to which you are filtered may be dependent on your IP address). TOM-Skype would definitely have the Call Detail Record associated with the call.

3. Is TOM only filtering conversations where at least one of the parties are using the custom [TOM-Skype] version of the Skype client written for the joint venture?

A: Yes

4. Will TOM filter conversations using the TOM client being used by non-PRC nationals who are outside of China?

A: Since you have a TOM-Skype client here, Yes.

5. Does TOM’s contract with Skype provide for disclosure to Skype and Skype users when their information is provided to a government official? Not at this time.

A: I don’t know. It would be nice to have a Chinese speaker read the EULA you agree to on the install.

6. Are records of what the filter does kept? If so, by whom? Does Skype have or keep copies of those records?

A: Yes: TOM-Skype’s servers: unknown.

7. Does the filtering mechanism use a list of keywords? If so, is the list public? May I have a copy? Who has the list? How often does it change?

A: There is an encrypted keyfile that the TOM-Skype client downloads that I believe contains the keywords. There are also a few entries from the keyfile hardcoded in skype.exe (TOM-Skype version)

8. Are the keywords only in Simplified Chinese or are they in other languages too?

A: All languages but 60% English and 40% Chinese for the majority of conversations. English appears to be swear words, Chinese appears to be political.

9. Is China the only country where Skype and Skype’s partner have set up filtering? Have you done any testing for any other countries?

A: I haven’t tested any others.

10. Do all Skype chats have the potential for a hidden participant, whether human or a robot? ??

A: I don’t know.

11. Are filenames for transfer subject to filtering?

A: There are logged messages that are essentially the “this file was shared with participants of this conversation” message.

12. Are people’s names among the keywords?

A: Possibly SkypeID’s (but not real names), but also names of Chinese political people e.g. Hu Jintao

13. Are the content of files transferred via Skype also subject to filtering?

A: Unknown.

14.. Does Skype encrypt end-to-end the IMs that are subject to filtering? ??

A: Yes. TOM added an addition layer to the client that uploads the messages.

15. In a multiparty, multinational chat, can I as an American citizen have my text to a British subject filtered if someone from Shanghai is in that chat too?

A: I am not sure about it being filtered (such as not to be displayed in the recipient’s chat window) but it can be logged.

16. Are audio conversations, where at least one party is in China, being listened to, filtered or recorded?

A: Only the Call Detail Record, there appears to be no interception of the voice stream.

17. Are all calls filtered, or only if users meet certain criteria, or are conversations selected for filtering randomly?

A: Other than the call detail record I don’t have evidence that suggests the content of voice calls were being filtered or monitored, but I wouldn’t rule it out as a possibility.

Bottom Line: If your chat conversation includes someone using TOM-Skype, you can assume there may be filtering of chat messages and/or logging of Call Detail Records. Conversations where all participants are using the normal Skype client cannot be filtered or logged.

Next post: Nart’s recommendations to Skype.

This is the second of four posts resulting from an interview with Nart Villeneuve, principle investigator of the Citizen Lab report “Breaching Trust”.

After discussing the report itself and some of the follow up activity, we went on to talk about The Citizen Lab, its mission and its activities. From their own website they are “focusing on advanced research and development at the intersection of digital media and world civic politics”. Nart described their activity as research on the politics of technology.

Under the leadership of Professor Ronald Diebert, their activities are carried out by graduate students with an undergraduate degree in either computer science or political science who join the lab to build up expertise in the other discipline while carrying out their research. They explore issues using their strong understanding of technology to “lift the hood” behind various politically and/or economically motivated intervention of web-based information exchange by governments and other agencies.

Assisted by a worldwide network of volunteers and a check list of relevant websites, they can develop a sense of the content that governments are censoring. According to Nart, all governments do some form of surveillance but definitely not to equal levels of resulting actions. At one extreme one finds outright blocking of content but the UAE has economic motivation to block Skype to protect a local communications monopoly. Apparently the Saudis are most interested in blocking porn. China obviously allows “uncensored” content to pass through but we are aware that Skype Journal is often blocked.

They will look at filtering techniques used by various countries, the type of content being blocked and try to determine the “local” government’s policy environment in which filtering is taking place. At this point in time most filtering addresses websites but gradually some countries are moving into screening applications (as we have seen with TOM-Skype). There is also “social filtering” censorship activity that involves blocking of porn, drugs and gambling.

At this point companies, such as Google, Microsoft and Yahoo, are modifying their products to address various “local” issues. For instance, Google has modified their process for enquiries from designated countries to “pre-filter” results delivered from their own servers in the U.S.. But then they put out a notification for “filtered” results with the wording for some search results: “to comply with local law, some results are not displayed”. On the other hand Google will not offer GMail accounts with a “.cn” domain name and does not make Blogger available in China.

The Citizen Lab also participates in a broader effort to develop guidelines for Internet companies operating in China. But, given that has much broader implications, it will be the subject of another post.

Next post: Answers to Phil’s Questions

Tags: Citizen Lab, censor, filter, Nart Villeneuve, Ronald Diebert

This is the first of four posts resulting from an interview with Nart Villeneuve, principle investigator of the Citizen Lab report “Breaching Trust”.

Last Tuesday afternoon I returned to a University of Toronto building I had last visited in its role as an engineering students’ residence in the mid-1960′s. Abandoned as a residence in the 1980′s, the building was restored in the late 1990′s to house the Munk Centre for International Studies, when the university’s Centre for International Studies was designated as a strategic priority for future growth. In the basement of the former Devonshire Place South House, I found the Citizen Lab, “an interdisciplinary laboratory focusing on advanced research and development at the intersection of digital media and world civic politics”.

I spent 90 minutes with Nart Villeneuve, the PhD student and Psiphon Fellow, who was the principle investigator resulting in the Citizen Lab’s recently published “Breaching Trust: An analysis of surveillance and security practices of China’s TOM-Skype platform”. We covered a wide range of issues related to this report, from the initial contact with New York Times through to the follow up activities as a result of the report’s release. We also discussed the broader mission of the Citizen Lab and some recommendations for how Skype should address the challenge of participating in the China market while making all parties aware that their conversation activity may be tracked.

Key points about the report and the follow up activity:

• A major issue to address in dealing with the media has been the confusion resulting because there is a need to separate out the security breach that allowed Nart to gather the data he has gathered and the functionality of the TOM-Skype servers resulting in the capture and logging of chat conversations and Skype calling activity. (There was no evidence of capturing voice calls themselves).
• As a result of reporting this breach prior to release of the document to New York Times, the security breach itself has been closed but there is no evidence that the actual information capture activity has ceased. Nart has been checking daily to confirm that the security breach remains closed.
• There was a period of several hours between finally establishing contact with someone at Skype who could initiate action to address the security breach and the final close down of the breach. During this time Nart observed blocking of read access to the directories but since he knew the file names he was still able to follow a reconfiguration of the web servers, removal of sensitive files, such as an encryption key, and disappearance of the log files such that they were not accessible.
• While they have captured a significant quantity of call log data going back a year, they are being careful not to expose any of the detailed information which comprised both chat message logs and what amounts to call detail records for voice calls; more details are in the report itself. Basically they don’t want to compromise anyone individually.
• While the log files are still under analysis, they have been encrypted while he continues to mine them for any additional information they may expose. Eventually it is his intention to destroy even these files.
• Messages were about 40% Chinese, 60% English with a small smattering of other languages.
• While it would be very difficult to reconstruct an entire conversation thread, as only each individual message was logged with no ready reference to other messages within the thread, they could build social graphs of conversing parties.
• There are at least two versions of the TOM-Skype client: a normal version and a second version with additional features such as a Baidu Toolbar; however the promote.dll module in this can trigger off anti-virus scanners such as Norton.
• Other evidence that the servers had been compromised was the discovery that the servers were hosting “pirate” movies and had the appropriate software to support Bit Torrent transfers.

Nart had three definite recommendations for Skype; we also covered the broader issue of global enterprises doing business in China. These will be covered in future posts.

Next post: The Citizen Lab: Its broader mission and findings.

Tags: Skype, Citizen Lab, Breaching Trust, TOM Online, TOM-Skype, Nart Villeneuve, Munk Centre for International Studies

I’ll be iBold enough to say that, applying physics terminology so much appreciated by RIM’s co-CEO, Blackberry Bold will reduce the half-life of the iPhone in the business and prosumer market by an order of magnitude.

Tuesday evening I attended RIM’s annual shareholders meeting in Waterloo at the Perimeter Institute for Theoretical Physics, initially funded by RIM co-CEO Mike Lazaradis. A full house in the lecture theatre, including many RIM managers, all the Waterloo Region residents who had invested in RIM and the usual assortment of analysts and media. Full disclosure; this was my eleventh RIM AGM – the last ten as a shareholder of a minute quantity. More importantly RIM has become one of the most highly capitalized companies in Canada, competing with the Royal Bank for highest market capitalization on the Toronto Stock Exchange. RIM is to the Canadian technology scene what Nokia is to Finland and Skype to Estonia. From numbers heard at the AGM about 7,000 of their close to 10,000 employees are Canadians.

I attend each of these meetings, not simply to catch up with some acquaintances who participate, but mainly to listen to co-CEO Mike Lazaradis’ overview of the RIM’s technology and platform development. He has a way to articulate the technology within the framework of the the end user experience, developer program requirements, five nines availability, battery life, carrier benefits and other factors that have lead to their success. Coming out of the presentation, which largely focused on the forthcoming Blackberry Bold, I learned about:

• the Bold’s high-resolution (HVGA 480 x 320) display with a widescreen format and integrated lens technology.
• the new Blackberry browser (yes, you can flick your thumb to zoom without leaving thumb oil on the display cover)
• a new Clock application, complete with “bedside” mode; the picture to the right only gives a hint of what’s in store here.
• Blackberry Unite! allowing families, “friend groups”, and workgroups to communicate and share in many ways beyond voice and text via their Blackberries and desktops
• Blackberry Bold’s true GPS (that works with navigation software) but most importantly not only supports A-GPS to faciliate in-building location but also offers “Fast GPS Fix Times” – traditionally an issue with most GPS-based navigation devices.
• the extent of the Blackberry Enterprise platform that includes not only desktop (email/PIM) activities but also voice systems that allow your Blackberry to become simply an extension of the enterprise phone system, intranet web services involving SAP, Oracle IBM Websphere and all the current web services platforms and protocols and, finally, integration with real time enterprise collaboration services such as Lotus Sametime and MS Live Communication Server.
• Blackberry’s security validations with NATO and several national governments
• Blackberry Partners Fund to finance third party software development partners.
• The extent of Blackberry’s Developer programs with both prosumer general use offerings (via, say, Handango) and vertical enterprise applications.
• On the personal entertainment side, Blackberry’s new Media Sync creates a direct connection between your iTunes music collection and the Blackberry. (and will also be made available to all Blackberry devices with a media card – Pearl, Curve, 88xx – through both a firmware and desktop software upgrade).

In response to one question about why RIM will continue to prosper, Mike explained how RIM now has many years of experience in dealing with the laws of physics related to understanding both the mobile and wireless environment in which they have to operate. Wireless spectrum management, rf transmit/receive technology (across 7 bands in the Blackberry Bold), an operating system optimized for wireless data devices, data management that optimizes compression while minimizing packets transported over the wireless connections with no information loss are amongst the issues that RIM understands most succinctly. It’s what has allowed them to be able to provide longer battery life, increase the rf range and provide the overall reliability required to satisfy a broader range of, especially enterprise customer, needs. Not only are the end user needs considered but also carriers have demands on minimizing bandwidth while providing quality voice and reliable data exchange. Nobody need look to any outsource supplier for key rf and chip technology information beyond the various Intel processors incorporated into the Blackberry; most of the rest is all built in-house. It is this “legacy” experience in dealing with these laws of physics that gives RIM a significant lead in its ability to offer compelling new devices such as the Blackberry Bold and to keep open a window of opportunity for unique new applications and user needs.

Following the meeting a RIM employee demonstrated to me a couple of the Bold’s features. Better at this point to reference a comment made by Boy Genius in his recent pre-release review of Blackberry Bold:

We said this before, but this really is the screen to beat. It might be a little too “contrasty” at times, if you know what we mean, but overall, it steals the show. It is the most vibrant, color-rich, sharp screen we’ve ever seen on a mobile device.

To which I can only say, Amen! An astonishingly stunning HVGA (480 x320) display approaching 200 dpi resolution. I watched a Star Wars action segment and an auto racing clip. You really have to see it to understand how impressive its HD video quality is. But then I saw how this display’s features were applied to Office documents. A complaint about previous Blackberries has been the lack of an ability to display email attachments. The Blackberry Bold not only has the capability to display Office document attachments but does it in a manner that blows away any previous “mininalist” experience with, say, spreadsheets on handhelds. You can actually do some reasonably significant spreadsheet activity on it. Having seen this I could only react by saying that this is one key feature that will sustain Blackberry’s lead in the business and prosumer markets. Apparently there is also a way to manage the display of Power Point presentations onto an overhead projector (details unknown).

And to check out one more aspect of the Blackberry ecosystem: determine what applications were available for my current Blackberry 8820, I went to Handango and selected my model.

Between the unpublicized infrastructure mentioned above for supporting the wireless-enabled enterprise and the features I saw Tuesday evening, I can only say that Blackberry Bold will significantly disrupt Apple’s efforts to enter the business market. The iPhone is left with two markets: younger generation consumers who want an expensive toy and Mac afficiandos who can use the iPhone as an extension of their Mac experience.

• Crackberry.com lists the Bold’s features and specifications.
• Crackberry.com’s reviews of Blackberry Bold.
• In a related story about carrier data plans: Score One for the Blogosphere – Immense PR Turmoil – Rogers Caves. Did prospective iPhone users raise such a fuss because the iPhone is not as efficient at handling wireless data?

Tags: Research in Motion, RIM, Blackberry, Blackberry Bold, iPhone, Mike Lazaradis, Handango, Crackberry.com, Perimeter Institute, Blackberry Unite!

Our choice of PC’s and the associated applications are becoming a factor in the definition of our personality:: Windows or Mac? IBM or Dell? Our smartphone choices are becoming a factor in the definition of our personality. Blackberry, iPhone or, Nokia?

But just as important is how these associations are also playing a role in how IT departments are losing control over our IT platforms. I recall a story when the first IBM PC’s came out where a major Canadian bank Vice-President chastised an employee for having a modem connection — insecurity written all over his face and the modem ordered removed! My first cell phone required both a rather large handset device that was screwed into my dashboard and connected to a black box stored in the luggage compartment of my station wagon. And those external cell phone aerials attached to a rear window were a status symbol that you were “connected” anytime, anywhere. But the employer would usually define what you would have (@$3,600 for my first cell phone in 1986, you bet!). CFO’s wrestled with the expense, wondering why anyone would want to talk while driving.

Jonathan Christensen, Skype’s GM for Audio and Video, in two recent guest posts on Saunderslog.com talks about how IT is becoming personal. In the first post he talks about how “The Web is My IT”

But, we have more freedom when it comes to the applications we download and run. I use Skype for *all* of my telephony that is not mobile. I use Google Reader as an info clipping service. I use Gmail to manage my online subscriptions and travel arrangements. I use Twitter to stay up to date. With the myriad of great choices available, users are finding ways to make “personal technology” work for them. None of these are IT-sanctioned applications, but they are enormously helpful in my work (and personal) life… and I am saving my company real money on telecom and infrastructure costs.

Slowly, this shift is happening at the hardware level too. Our machines are reflections of our personal styles and tastes. At Skype, we are in two camps: the Lenovo loyalist and the Mac fan club. Apple has a reputation for inspiring fanatical loyalty, but ThinkPad users are every bit as rabid as the MacBook fans. They know every model number past and present. They reminisce about great machines they have retired and passionately compare notes about DIMMs, hard drives and battery configurations (I carry a MacBook Air – and thank goodness that Apple makes these decisions for me).

He starts off his concluding paragraph with “The long-term effect when users migrate to personal technology is that the IT-approved applications slowly lose traction.” Coming from a former employee of Microsoft whose revenue depends highly on IT-sponsored implementations of its server-based applications, it’s a powerful statement with lots of implications for the challenges ahead at Microsoft.

In his second post “IT Gets Personal – Mobility and the Desktop”, Jonathan talks about how, while Blackberry, with its Blackberry Enterprise Server, still controls authentication and authorization policies, RIM is broadening its market approach to encompass the prosumer and even consumers. He talks about the iPhone “thumbing its nose at IT managers”:

However, aside from the Blackberry/Exchange relationship, the IT department has had little to do with our mobile technology choices. My mobile is MY business, thank you. I use it primarily for work, but it is not an IT-approved device. Oh, by the way, thanks for picking up the airtime charges.

Certainly a noticeable trend lately is how, when someone leaves an employer, the two constant in his/her contact information is the mobile phone number and, if they have one, the SkypeID.

Jonathan goes on to talk about the decreasing role of the PBX, becoming identified with your personal mobile number and the adoption of desktop communications applications in the workplace, especially IM.

There is more rich interaction in these sessions. People are sending links, copying and pasting text and sharing files in real time. Today’s knowledge worker roams seamlessly between Mobile calls, SMS, IM, Blackberry email and PC calling. Nearly 30 percent of Skype users are using it for business and 28 percent of Skype-to-Skype calls include video. The old desktop phone just can’t keep up.

His bottom line:

Users are taking control of their communications channels. They are innovating, making personal mashups with the new tools, and they are creating a new namespace to go with it (e.g., Gmail address + Mobile phone number + Twitter ID + Skype ID). And all of this is happening outside the IT department’s “walled garden.” It’s good news for users and productivity, but what does this loss of control mean for the IT department and the organization? What does it mean for PBX vendors? And, if the users are happy, does it really matter?

Interesting perspectives from someone who has been integrally involved with the rise of IP-based communications and the extension of voice messaging to incorporate text chat, video and mobility over the past one-and-a-half decades.

The PC is transitioning to the lightweight laptop (many of my acquaintances have a MacBook Air); smartphones fit in the shirt pocket or purse or hang from a belt clip. The IT department is becoming more ethereal as in “figures light and aeriform come unlooked for and melt away”. Both posts (once again here and here) are well worth the read.

(And did anyone notice that, while RIM tried to distinguish consumer and business markets by having a camera in the Pearl and Curve but not in the 88×0 series, the about-to-be-released Blackberry Bold has everything – camera, new media player with iTunes support, GPS: all-in-one – and addresses both markets.)

Guest Post: Hudson Barton is a communicatons consultant whose Borderless Communicator blog not only talks about Skype and related IP communications activity but also attempts to track Skype’s “real usage”. According to his analysis, Skype has just cracked the 30 million real or” currenlty active” user number (based on tracking Users Online vs time-of-day). What follows is his post earlier this week summarizing some issues that were raised and discussed on the Skype 3.x discussion Public Chat forum following Dan York’s recent guest post on SIP/Skype interconnectivity.

Skype’s competitors and critics continually point out that Skype’s VOIP architecture is closed and that its API is not adequate for creating a direct connection between the Skype “cloud” and the SIP “cloud”. This of course is true, but there are good reasons for it.

1. The security and reliability of the Skype cloud would be seriously compromised if SIP hackers were given the tools to create direct VOIP connections between Skype and the outside world.
2. A SIP gateway to Skype might work if it were handled like SkypeIn/Out. However, I don’t think there’s a large enough population of SIP users out there to justify the cost of SIPIn/Out. Skype is growing at a rate of 500k-1000k “real users” per month, which is probably 10x faster than the rest of the VOIP world combined. A third party could build these gateways with the presently available API, but nobody is trying it to my knowledge… presumably because there is no demand for it. In any case, the developer (even if it were Skype) would have to justify the cost of such a gateway.
3. An IM (text-only) gateway is very possible and would not compromise Skype’s security or strategic position. Look for future interconnections with major players like AIM, gTalk, Yahoo, and MSN.
4. The Skype cloud is far more complex and has far more features than the clouds of any of its competitors. It is not rational to expect any of them to create a feature-for-feature mirror of Skype even if this were something that would be good for Skype (which it is NOT). A partial list of these features: video, SMS, encryption, and file transfer.
5. Relationships between Skype and social networks like MySpace are already possible if there is a partnership agreement. It does not require a change to the Skype API. Note that MySpace is a social network… not a VOIP carrier.
6. Skype may double its revenues this year and it’s already profitable. No other VOIP carrier is profitable (unless you want to count a few of the hosted VOIP services from the Telecoms and cable companies). A gateway to Skype will help Skype’s competitors far more than it will help Skype, so from a strategic perspective it makes no sense to help the competitors survive. Without Skype’s help, they (SunRocket and Vonage for example) are failing at a rapid rate. Meanwhile, “successful” competitors like Packet8 are monetizing themselves by selling off intellectual property. Obviously they “see the writing on the wall.”

Tags: Skype, SIP Gateway, Hudson Barton, Borderless Communicator, Packet8, Dan York

Reports of a Skype vulnerability have been addressed by Skype through disabling the Dailymotion video service until the relevant feature has been fixed. This disablement is indicated by the absence of the Dailymotion tab in the “Add Video to Chat” window. For the geek inclined, technical details are here.

With respect to the second issue raised in the article, there is simply one question: “What Skype ads?” There are no ads in the Skype clients (certainly not in mine).

Tags: Skype, Skype vulnerability, Dailymotion

It’s been a busy week:

• The previously announced (eight months ago) MSN/Yahoo IM federation became real. Yawn.
• Phil Wolff and Alec Saunders have commented on the Skype code cracking by a Chinese engineering team.
• Ken Camp has linked both the U3 Skype/SanDisk announcement and any potential Skype code cracking to corporate security policy implications.

I tend to be more pragmatic in terms of looking at how can I use Skype more effectively as a business and personal communications tool as opposed to worrying about all the implications of any Skype protocol publication. For instance, I have been evaluating a couple of the new Nokia N-series personal communications accessories; they are much more than just a wireless phone! And certainly represent an excellent platform for personal accessory convergence; I have found a wealth of uses for them.

However, since they are based on the Symbian S60 Series operating system, there is currently no opportunity to use Skype for Mobile. The one aspect I miss much more than the voice communications is the absence of any Instant Messaging with my Skype contacts. I mention this only as background to how important Instant Messaging has become to those who have incorporated any version of Instant Messaging into their daily activities.

Today Alec has published one of his insightful benchmark posts, Detente in IM’s Cold War, on the opportunities that could arise from the (currently theoretical) public availability of certain Skype protocols (whether directly from Skype or via “cracked code”). He sees where, with the right approach to publication of the appropriate Skype protocols, Skype could set the leadership standard for the federation of Instant Messaging. In particular :he views Skype from its potential as a platform and from its business model that is significantly differentiated from that of the MSN/Yahoo/AOL portal models:

Today, unlike Google Talk, Skype has brand, momentum, a large customer base, and an active ecosystem of partners. These are the ingredients for a successful platform play. Unlike the dominant players, Skype makes their money from traffic across network bridges, from applications partnerships (like TellMe), and from downloadable add-on’s to the application. They are much less dependent on monetizing eyeballs than AOL, MSN, or Yahoo. There wouldn’t be the tension between their existing business model and a platform model which AOL, MSN, and Yahoo have to contend with. As the incumbents, AOL, MSN and Yahoo would be victims of the Innovators Dilemma. Skype would be the disruptor.

And challenges Skype management to take the leadership role in IM federation. Punt to Niklas (and Alex).

Seems like there are several Skype-related stories out this week:

Andy at VoIP Watch, in a post entitled Skype Giving More Away, has commented on the SkypeOut International calling promotion that Bill brought to our attention yesterday.

In my view this Skype is acting more and more like a real phone company, using promotions such as this, which is clearly sampling. In many ways this is much like the old MCI or Sprint switch campaigns that did battle with AT&T in the pre-divestiture and post divestiture era of the 1980′s.

PC Magazine has a report on security threats in 15 of the most popular software applications, including Skype. Bottom line: keep your software updated and you’ll minimize these threats. Many, such as Windows and Smyantec’s Norton products, incorporate an automatic update feature. While Skype has improved their update process in Skype 2.5, it is still not an “automatic”. Given they are going after a broader consumer market, let’s hope they get there in a future release. (Bill advised getting this upgrade a month ago in a post immediately after its release.)

Skype for Couch Potatoes? Om dug out Skype, Now on Your TV, commenting on Oregon Networks’ settop media browser “which allows information such as Skype’s in-coming caller ID and message alerts to be displayed on the television screen “. Looks like a feature that should be into TiVo as an option.

Plus ça change, plus c’est la même chose! (The more things change, the more they stay the same.) Andy’s post, We Too, We Also, We Copy, brings back memories of my days with a formerly major utility software company where we always had to be super-careful about discussing new products with Microsoft personnel. Hopefully Scoble’s legacy of humanizing the people behind Microsoft and, by implication, putting out a more favorable public perception of Microsoft, has not withered away just as he is departing for a new venture. Only time will tell if Microsoft’s new offering competes with or complements iotum’s Relevance Engine. (And congratulations to iotum on winning another award.)