Why Does Skype Read the BIOS?

pfp writes "Myria at pagetable.com, among others, noticed that Skype reads the machine's BIOS code on startup. This probably would've gone unnoticed if the operation didn't fail on 64-bit windows. From the post: 'It's dumping your system BIOS, which usually includes your motherboard's serial number, and pipes it to the Skype application. I have no idea what they're using it for, or whether they send anything to their servers, but I bet whatever they're doing is no good given their track record... If they hadn't been ignorant of Win64's lack of NTVDM, nobody would've noticed this happening.'"

Processor info?

This is a random guess, but it could be part of skype determining the make and model of your CPU. They had made a deal with Intel a while back to only allow large conferences on their processors, and the BIOS reading could be part of that or anticipation of other deals to come.

Re:Processor info?

Reading your BIOS to determine CPU ain't gonna be useful. I doubt any BIOSes store info on which CPU is on the board. Especially since there's easy ways to identify the CPU. I bet windows has a syscall that gives you CPU information.

Re:Processor info?

Not entirely correct.

GetSystemInfo() in Win32 and GetNativeSystemInfo() in WoW64 will give you some CPU information:
It will tell you if your running on Intel, IA64 or AMD64, it will also identify 386, 486 and Pentium, Processor Level and Stepping and processor Revision. I think this will be sufficient in most cases to identify the CPU.

Re:Processor info?

Maybe reading the BIOS will tell them if you are running Skype in a virtual machine that emulates an Intel processor which keep Skype from being fooled into running 10 connections on AMD.

Re:Processor info?

Reading your BIOS to determine CPU ain't gonna be useful. I doubt any BIOSes store info on which CPU is on the board.

As a former BIOS coder, I'll second that. Even if the BIOS did store some system specific info in Flash (on Embedded BIOSs sometimes this is done because CMOS is not reliable), there is NO way that Skype would know the format/place/meaning of this. It would be specific to a certain build of a specific BIOS for a specific board by a specific vendor.

In any case, the method described to dump the BIOS is not very likely to get anything close to the complete, original BIOS image to begin with. By dumping memory at F000:0000 through F000:FFFF, a 16 bit DOS program, under Windows, will get the memory resident part of the BIOS. Most BIOSs are far bigger than 64KB and the memory resident part is the decompressed runtime part, which is nothing like what the actual BIOS image looks like at boot time.

They are most likely using this in combination with other more or less 'unique' things to identify a specific machine. It wouldn't surprise me if after this some people would do a more in-depth analysis of their code and find out that it also reads the serial number of the harddrive and gets the MAC address of the Ethernet adapter.

Re:Processor info?

Fact 1: 0xF0000-0xFFFFF are the SHADOWED copy of BIOS on almost every BIOS. It's write-enable-able.

Fact 2: That's usually where the SMBIOS pointer is found.

Fact 3: It's easy (and the only way really) to scan for SMBIOS and find it.

Fact 4: SMBIOS *does* often contain serial numbers and hardware details.

Don't like it one bit.

They are most likely using this in combination with other more or less 'unique' things to identify a specific machine. It wouldn't surprise me if after this some people would do a more in-depth analysis of their code and find out that it also reads the serial number of the harddrive and gets the MAC address of the Ethernet adapter.

This seems pretty logical. Since they got rid of that hackneyed scheme a while back to give each processor a serial number (wait -- did they get rid of that?), some sort of hash of the BIOS memory, plus the Ethernet MAC, plus the HD serial number, all concatenated together, is probably as close to a unique identifier as you're likely to find on a "per machine" basis.

That said, it doesn't make me feel any better. I wasn't a fan of the processor serial number concept, and not just because it was a serial number in the processor; there were serious privacy concerns with any uniquely identifying, per-machine serialization concept, and that's true whether it's a dedicated number that's being used, or some sort of combination of semi-unique factors.

It's just one more piece of information, sitting in a database somewhere, that could be subpoenaed and used to generally cause trouble. Particularly given how close-mouthed the Skype people are about how their network actually operates (e.g. their alleged encryption, peer to peer communications), I'm not ready to run right out and trust them.

I wonder if it would be possible to run Skype in a sandbox, where the information it's fed could be carefully controlled? On further thought, I wonder what happens when you run it in VMWare or Wine? Do they actually pass information about the hardware up to guest applications? It seems like this behavior would be one that the user should be given an option about, at the very least; I can only think of a few programs who have any reason to be getting the drive serial number, or the Ethernet MAC address, and for the most part they are not userland apps.

Re:Don't like it one bit.

the original hardcoded MAC address is always visible to the OS somehow. Just changing the setting does not lose that information.

I was under the impression that there was no such thing as a hard-coded number. Why do I say this? Because one fine day many years ago I received a shipment of 100 ethernet cards all with identical MACs. That was one fun day as those cards rolled out into the network...

Processor serial numbers are about as innocuous as a privacy concern as if you used your grocery store loyalty card. To say that someone is going to target you because you have a certain loyalty to the grocery store is ludicrous.

I don't share your ambivalence, yet agree with your point. They might haul you into jail, however, for buying large amounts of plastic forks, rubbing alcohol, and a couple of other items though.

Uniquely identifying systems is ESSENTIAL to the current internet and DRM problems.

Wrong. It's completely irrelevant and impossible to uniquely identify a system on the internet. It is ESSENTIAL to have unique connections. Identity is essential for law enforcement types, not the internet. For instance, do I care that I connect to machine 1 or 1,000,000 of those answering for google.com? DRM in this scenario is irrelevant, and any argument in support of that is already terminally flawed. (DRM's problems are that DRM exists at all)

Just think, if a processor serial number had become a standard, they may not have decided so fast that they needed TPM and per-machine iTunes authorizing so hackneyed, and so on. Of course you can be uniquely identified on the internet. How much crazy hashing crap like this would it have made totally unecessary?

TPM exists purely to serve DRM. See above. QED.

Re:Don't like it one bit.

No, the TPM design is indeed inherently evil.

Your explanation otherwise... it's like citing the vitamins and minerals in a poisoned apple. Apples where you are forbidden to have anything but an apple with a cyanide pill inside. The TPM is explicitly designed to secure the computer against the owner, the TPM technical specification even explicitly refers to the owner as an "attacker" to be defended against. Yes, I have read the entire (several hundred pages) TPM technical specification.

You very can easily get *all* of the benefits for the owner, including the secure startup you reference, and eliminate the cyanide pill and eliminate *all* of the abuses, from virtually identical hardware that is *not* secured against the owner.

The problem with the TPM, the cyanide pill that makes it inherently evil, is the fact that the owner is forbidden to know his own master key. In technical terms we are talking about the PrivEK - Private Endorsement Key. (* footnote)

Take absolutely identical hardware with absolutely identical capabilities, and simply offer people the option to receive a printed copy of their PrivEK (their master key) along with their machine when they buy it. Simple as that. It is identical hardware with identical capabilities to secure your computer for you. The mere fact that you may *know* your own master key (if you wanted it) does not alter that functionality. However the fact that you can know your master key then means that your computer cannot be secured against you. With your master key you can control and alter your security settings at will. With your master key you can override any lockout and escape any lock-in. With your master key you can ensure you can unlock your own encrypted files if you need to.

The Trusted Computing Group and the Trusted Computing specifications absolutely *forbid* you to ever get your master key. They forbid you to have an apple without the cyanide pill inside. A poisoned apple is not a "neutral tool" because it has vitamins and minerals in it... not when you are being forbidden to have normal nutritious non-poisoned apples. Not when you could so easily get all of the benefits and eliminate all of the abuses.

(*)Footnote: Being able to know your PrivEK is the minimum to guarantee you can maintain full control over your computer, but for very technical reasons only knowing your PrivEK leads to a more complex and less secure solution. You really want both your PrivEK and your RSK - Root Storage Key. Aside from the option to get a printed copy of your PrivEK, the chip should gain a single added function - the ability to output the RSK encrypted to the PrivEK. That keeps the RSK properly secured and only usable in conjunction with the PrivEK.

-

Re:Goddammit ! It is FREE so what do you care ?

so it is free but still requires something from me. To me, that is the difference between free and not free. Hence, skype seems not to be free, but to be paid for with information.

Re:Goddammit ! It is FREE so what do you care ?

That's a reasonable perspective, but if you are, as you say, "paying with information," wouldn't you prefer that your decision to do so be an informed one? After all, Skype doesn't appear to be particularly straightforward with this information, and therefore your payment is taken without your knowledge, which could be considered by some to be fraudulent.

bad history?

What is Skypes bad history?

Re:bad history?

I think he was talking about the company who owns it. They also made kazaa, which was full of spyware and other harmful malware.

Re:bad history?

How did you know he lived in France?

Re:bad history?

While it is true that the developers were responsible for Kazaa, currently Skype is owned by eBay. They bought them on Oct. 14, 2005 for around $2.6 billion.

Re:bad history?

That's even worse!

Re:bad history?

Actually, the original Kazaa (which WAS dev'd by the same people as skype) was -not- full of spyware and adware. Kazaa was made an atrocity by Sharman, who still owns it.

Re:bad history?

They could be referring to the time where Skype would only allow 10-way conference calling on dual-core Intel processors [slashdot.org]. Those running AMD processors could only have 5-way conference calls. At the time they cited the "technical superiority" of Intel processors over AMD ones.

Of course thie gave bad publicity to both Intel and Skype after AMD issued a subpoena [slashdot.org] against Skype and the fact that it was discovered that the software simply checked the processor ID and enabled the feature based on that. A patched version [slashdot.org] was also released which bypassed this artificial limitation.

Theres...

nothing to see here. move along.

we are not spying on you. we swear.

oh btw.. your wife is cheating on you.

Dammit!

I KNEW that bitch was using an aimbot!

To prevent abuse? Usage statistics?

What better unique identifier than the system bios? Ip addresses are becoming less reliable since many people use wireless internet and mobile phones for skype.

Skype is probably just looking for abusive users who sign up for their low margin unlimited calling plan only to share it with their relatives and friends accross the world. If they say detect say 5 different machines calling 5 different people all within a span of 10 minutes, then something is likely wrong.

Of course they could just be collecting system info such as the system manufacturer, processor type, number of processors, sound card, etc. This could be combined with the survey results regarding phone quality they ask you to take after every few calls. In the end it could result in a better product and better service. Of course many other software products already do this (such as firefox, ms windows, ms office) but they are more open about it and at least give you the option of participating.

Re:To prevent abuse? Usage statistics?

Yeah, and those bastards, requiring some sort of unique number to identify people using a telephone! Who ever heard of such trickery!

Here's a question for you....

I once read somewhere that the only identifying information that you could legally acquire, being installed on someone's computer, was MAC, IP, and Nickname. Anything else (Pentium 3 fiasco, anyone?) constituted a breach of privacy. Dunno if it's true, or not, but personally, I don't want you trying to identify what the hell makes up my system. Perhaps I'm building it SECRETLY for a fucking reason. You don't need to know what CPU or HDD I have installed - the only reason you would want to would be to directly target advertisements at their own users, concerning their own fucking hardwaer. If Skype did that, they'd lose not every bit of faith from me, but I'd go tell my company that I work for, which uses SKYPE on a regular basis. I can guarantee you that IT is so stupid they'd drop Skype and install Asterisk on a whim if I told them too, since I usually end up having to fix their intranet when it goes down.

Re:Here's a question for you....

I once read somewhere that the only identifying information that you could legally acquire, being installed on someone's computer, was MAC, IP, and Nickname. Anything else (Pentium 3 fiasco, anyone?) constituted a breach of privacy.

I doubt it. Besides, one can change their Mac address, IP address and 'Nickname' without replacing hardware.

You don't need to know what CPU or HDD I have installed - the only reason you would want to would be to directly target advertisements at their own users, concerning their own fucking hardwaer.

Or maybe... Just maybe... They could make design decisions based on the majority of users.

What proccessor speed do the majority have? What OS? How much RAM? How much harddrive space?

It's important to know about who you're making software for.

If Skype did that, they'd lose not every bit of faith from me

Did you know Skype is owned by Paypal and eBay now?

I can guarantee you that IT is so stupid they'd drop Skype and install Asterisk on a whim if I told them too, since I usually end up having to fix their intranet when it goes down.

Asterisk and what? What SIP providers? What solution exactly? -- Asterisk is not a easy solution to setup compared to Skype. The end user can setup Skype, but Asterisk? I doubt it.

Re:Here's a question for you....

Asterisk is very easy to set up. You just have to be good at setting Asterisk up. The way to get good at setting Asterisk up is to set Asterisk up. For your first assignment, use just two hardware SIP phones. Once you have got them talking to each other, then you can think about adding more phones and things like POTS gateways.

Within weeks you'll be writing advanced dial plans to do things like ring all the phones in a department or divert calls to your mobile if you haven't picked up in twelve rings, and you'll have DHCP and TFTP set up so each phone on the network can configure itself at switch-on. Then it'll all be working exactly how you want it to, with nothing for you to do except occasionally unplug and replug a misbehaving telephone.

About a year or eighteen months later, you will want to add a simple new feature. Unfortunately, by this time you will have forgotten altogether how you set everything up in the first place.

Re:Here's a question for you....

Joke ---->
    O
   -+-
    |  <- You
   / \

Re:To prevent abuse? Usage statistics?

Of course they could just be collecting system info such as the system manufacturer, processor type, number of processors, sound card, etc.

That's complete nonsense. Windows has a perfectly standard way of finding out about system devices. Reading the BIOS would tell you almost none of the things you listed to begin with.

About figures

Wouldn't it be nice of the Operating System helped you protect it from intrusive applications? No, you don't get to silently spam half baked crap into /etc/rc.d/init.d just because the you actually need sufficient privilege to do some other thing on install. No, my registry is NOT a free-for-all; you get to put just what you need in there and not go on a fishing expedition or 'fix' stuff you're not compatible with. No, the BIOS isn't for you because you're just a VOIP app and have no business whatsoever mucking around with the nonvolatile CMOS I need to boot. No, I don't need a fourth JVM crammed into my PATH, thanks.

Vendors would be forced to detail the mucking around they do, probably leading to much less mucking around in general. Indifferent users could just do what they always do and bang on the 'accept/yes/ok' widgets. Those of us who know enough to care (or get paid to) would then have an actual chance.

Too much to ask I guess.

Re:About figures

265mb of RAM, eh? Where'd you get the 9mb stick?

Re:About figures

The problem is not with disk space, but with unnecessary duplication of functions, which leads to having different versions of the same libs on your system, some of which might have security holes. Besides, it's totally unelegant and contrary to all concepts of modularization. Might as well ship a VM for every app.

Operating Systems, Applications, and Trust

Wouldn't it be nice of the Operating System helped you protect it from intrusive applications? No, you don't get to silently spam half baked crap into /etc/rc.d/init.d just because the you actually need sufficient privilege to do some other thing on install. No, my registry is NOT a free-for-all; you get to put just what you need in there and not go on a fishing expedition or 'fix' stuff you're not compatible with. No, the BIOS isn't for you because you're just a VOIP app and have no business whatsoever mucking around with the nonvolatile CMOS I need to boot. No, I don't need a fourth JVM crammed into my PATH, thanks.

Right on!

Coming from the Mac world, where I know there's most often no technical reason why an app couldn't just be drag-and-drop "installed" (i.e. just copy the app bundle to wherever the hell you want it and run it from there), I raise a suspicious eyebrow every time I download some program which should be entirely a userland thing (a game, a document or media editor or player of some sort, etc) which insists that I run an installer program that asks me for an admin password. I feel like asking the devs, "Why exactly do you need write access to anything outside your app bundle? Give me a damn good reason why I should entrust my system to you."

I want my OS to serve me like I want my government to serve me: stay out of my way unless I ask it for something (and have useful services available for the asking), except to keep people from doing bad things to me and my property, in which case I want it to proactively defend me. This means that no programs are running that I don't want running or don't know are running; nothing can *get* running without my telling it to or at least granting it permission to; and no files get written anywhere, perhaps outside of a few sandbox areas like the user's Preferences folder, without my permission.

OSX does most of this right already. The only more-stringent thing I would really ask for is that installers/etc which ask for an admin password not just get blanket permission to do whatever they want; I'd prefer it if the system instead told me, for each item the app wanted to install, that:

"The application FooBar wants permission to create the folder "Beezelbub" in System/Library/YourMom/. The justification it provides for this is:
Beezelbub is a video codec needed to play cutscenes in FooBar: The Quest For Metasyntax.
Do you wish to allow FooBar to create this item? [Yes] [Yes To All] [No] [No To All]."

And if you click one of the "Yes" buttons, THEN it prompts you for an admin password.

Of course, the app would be allowed to write whatever the hell it wants into folders it creates, so you don't have to get this prompt for every one of the thousand little files that some library or codec might include, unless those files are scattered to the winds and not in one nice neat package like they should be. Currently existing apps of course would not have such justification strings built into them, but even still, this would be a more secure way that would allow users who care to selectively allow the installation of crap on their system. And of course, users who don't care can always say "Yes To All" and be no worse off than they are today.

But users like me would feel much less suspicious, no longer wondering "what the heck does this installer want with my admin password? Why does this program need an installer in the first place?"

A related thing I might like would be if the system notified me any time any program tried to open up a network connection of any sort; to which I could say "allow", "always allow" (for trusted things), "disallow", or "always disallow" (for things you think are spyware). Include similar justification strings as the above dialogue does. This would work well to combat any sort of trojan spyware you might have gotten (that is, programs you downloaded and installed yourself, which are sending data to someone that you don't want it to send; since the way O

Interesting usage statistics

They could use this for tracking the number of computers the program is installed on, which would work independently of current user, IP, or even reinstalls. Combined with other things this could be a unique and interesting statistic that's hard (impossible) to test by other methods.

Random generator?

could it be that skype uses bios data to generate random numbers for the crypted communication layer?

Ah! A primitive form of humor.

Wait, I know the answer to this one!!

Because it was stapled to the punk rocker's face!!!1

Go to the source

Has anyone asked them for their explanation? I feel now would be a good time for them to exercise their right to tell us why they do this.
Might I suggest mailto:[e-mail] [mailto]

I would do so I myself, but I assume there's a paying Skype user here who would garner a bit more attention than I would.

Done

Dear Sir/Madam,

As a Skype customer (adpsimpson) and software developer who has used skype-out from across the world to stay in touch with folk at home, I read with some interest on http://slashdot.org/ [slashdot.org] this morning that Skype appears to read the system bios on start up.

While I am aware that there are legitimate reasons that some software may do this, I cannot immediately think what a VOIP application would require the data for.

Using closed source software is always a second-best from my point of view, especially in terms of privacy and transparency of the software's function - this in fact is what led me to Skype, since it runs on Linux. As such I am slightly concerned about unexpected application behaviour.

What does Skype do with this information? Is it transmitted across the network in any form? Is it identifiable?

I look forward to your response,

Yours,
Andrew Simpson

Re:Done

Dear Mr. Simpson,

Thank you for inquiring about Skype service. Please let me be you informed about our respect for the privacy of you. Skype wants only good things for the customers of Skype and only uses information for good things, not bad things.

Sincerely,
Apu Nahasapeemapetilon
Skype. Take a deep breath.

P.S.
Now that you have a deep breath taken, you should really see a doctor about that rash and ask your daughter about where she's *really* going this weekend (hint: it's not the Tijihuana Bible Camp). And whatever you do, don't ever come home early on a Wednesday unless you want a nasty surprise. That's the day the missus "gets the carpet cleaned."

Why does it read the BIOS?

Because it's bored and can't find a good book.

Why does Skype read the BIOS?

...
To know what's written there. ...

What about Macs ?

Can someone tell me how can I check if its doing the same on my Macbook?
Thanks

Re:What about Macs ?

Use a debugger.

The amount of information required to teach one how to use a debugger and understand it goes far beyond the amount of text Slashdot would even allow in a single post. However there are many websites on Google that can help you learn with this matter.

Good hunting.

Re:What about Macs ?

Skype won't run if you have softice installed on windows. Pretty funny - I guess they don't want you to look.

Ollydbg still works though.

Re:What about Macs ?

Skype contains encrypted code, self-modifying code, timing loops to detect whether it's running inside a debugger, and any number of other tricks to prevent reverse engineering. Which hasn't stopped people trying:

http://www.recon.cx/en/f/vskype-part1.pdf [recon.cx]
http://www.recon.cx/en/f/vskype-part2.pdf [recon.cx]

Re:What about Macs ?

Can someone tell me how can I check if its doing the same on my Macbook?

There's really no need. Macs are secure by default even when running Windows.

In the unlikely event that a rogue piece of software does manage to send out some of your personal info, an electronic version of Steve Jobs will shoot down the wire after it and destroy the packets before they reach their destination. Probably using one of those frisbees out of Tron.

Sorry whats the big deal?

Read my bios settings, I have no problem with this. There is no information on my BIOS that I would consider sensitive, maybe a touch of chargin if if turns out I have my RAM config set wrong(?) but thats it.

Writing to my BIOS.... now thats a different matter and one I would take exception to.

Copyright on the BIOS ???

It took a minute for the penny to drop, but is it not downloading the BIOS code rather than the system setup info held in CMOS ?

If that is the case then transmission of that BIOS back to Skype HQ must be a breach of Phoenix/... copyright.

Look what they try to do if you or I copy someone's code ...

Why Does Skype Read the BIOS

There's someone teach the skype 'reading'

Identification?

Couldn't it just be that they want to identify individual computers? If they can read a serial number from the motherboard then they don't have to count that computer again? The actual number of installations made (and used) is quite important for a company whose stock price depends on the number of customers but whose product is free to download...

Serves You Right

If you run closed-source software on your machine, then you deserve everything you get.

If the suppliers of software weren't ashamed of it, they would gladly show you what was inside, beaming with pride as you carefully inspected each immaculately-tooled part. If they won't let you look, it's always for one of two reasons. Either it's doing something they don't want you to know about (*cough* ActiveX *cough*), or it's so badly written that they wouldn't want to admit to it (*cough* StarOffice *cough*).

Stick to open standards like SIP and IAX. Only download Skype if you're planning to try to force it open.