Forgot your password?
typodupeerror
Communications Encryption Security IT

Hiding Secret Messages In Skype Silences 79

Posted by samzenpus
from the sound-of-silence dept.
Orome1 writes "A group of researchers from the Institute of Telecommunications of the Warsaw University of Technology have devised a way to send and receive messages hidden in the data packets used to represent silences during a Skype call. After learning that Skype transmits voice data in 130-byte packets and the silences in 70-byte packets, the researchers came upon the idea of using the latter to conceal the sending and receiving of additional messages."
This discussion has been archived. No new comments can be posted.

Hiding Secret Messages In Skype Silences

Comments Filter:
  • Apparently a consortium of "socialites" in Tampa, FL and a bevy of four star generals in Pentagon, searched through their couch cushions and scrounged up enough spare change to fund this project.
  • by Keruo (771880) on Monday January 07, 2013 @02:57PM (#42508715)
    If you talk long conversation, specific pauses might simply work as morse code.
    • by Baloroth (2370816)

      True, but the data rate would be much much lower than this can achieve, TFA says they can get almost 1 kilobit/second, good luck getting morse code that fast using pauses. And it would be easily decrypted assuming you didn't use a cipher on top of the Morse code system, while this is (supposedly) undetectable.

    • by Kjella (173770)

      If the people who are talking together wants to have some secret communication, then their whole conversation might be code. Side channel attacks are much more insidious because in any high security environment the source and destinations of traffic are closely monitored. So this looks like Alice is talking to Bob and that is entirely above board and legitimate, but in addition we're piggybacking secret data from Alice's computer that we've compromised to Bob who is our mole on the inside. Secure communicat

  • I wonder why Skype needs 70 bytes to transmit essentially nothing. Maybe they already do use it for secret data transmission, just to their own servers?

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      UDP overhead is 28 bytes for ipv4. Add in overhead for the audio codec to represent a timeframe for a sound and 70 bytes become reasonable.

      • Re: (Score:2, Interesting)

        by vlm (69642)

        My guess is they even added in the 38 byte ethernet overhead. Yielding 66 bytes. Add 4 bytes for the codec and its fairly reasonable.

        Of course they probably didn't use the 8021q ethernet overhead which is 42 bytes, or they wouldn't have any payload at all! (I suppose its possible... an empty payload is intuitively about as "silent" as you can get)

        • That doesn't make any sense. If they were including Ethernet and TCP/IP then Skype must have the most efficient voice codec ever to transmit voice with 60 bytes.
          Remember it is 70 for silence but only 130 for voice.

          Also how do you get 1kbit/s in the silence with 4 bytes per packet?

          No Skype is definitely sending silence with 70 bytes.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Btw, Silence is a sound for computers which is represented by a flat line or basically the value of 0. Not getting packets and getting a value of 0 are different things whereas the former can be due to packet lost and broken connection while the latter is an actual value.

      • If they were talking IPv6, UDP packet overhead is 48 bytes, leaving only 22 for keeping the CODECs synchronized and specifying how much silence is being encoded.

        I note that some carriers deliberately inject what is called "comfort noise" - a small amount of background noise - during silences. This is to keep the user from becoming concerned that the connection has failed.

        While I don't know whether, or how, skype does this, it would be reasonable to either actually send the connection's real background nois

    • by icebike (68054)

      Exactly what I was thinking.

      You would think that a packet specifying X seconds of simulated silence could be packed into a few bits, so maybe two bytes should suffice.

      Clearly there is something else going on, or they would not have designed such a large packet to "represent silence".
      That one can distinguish the silence packets from the voice packets doesn't speak too well of the encryption that Skype has always claimed they use.

      • Re:Eloquent silence (Score:4, Interesting)

        by hawguy (1600213) on Monday January 07, 2013 @03:14PM (#42508965)

        Exactly what I was thinking.

        You would think that a packet specifying X seconds of simulated silence could be packed into a few bits, so maybe two bytes should suffice.

        Clearly there is something else going on, or they would not have designed such a large packet to "represent silence".
        That one can distinguish the silence packets from the voice packets doesn't speak too well of the encryption that Skype has always claimed they use.

        If the Skype client didn't send packets during 'silence', then the client on the receiving end of an extended silent session wouldn't know whether there was silence on the other end or a network problem. That's why the client keeps sending packets even during "silence" rather than just timing silent sections then sending out a packet at the end of the silence saying "It was silent for the past 10 seconds, so that's why you didn't receive any data from me".

        • by icebike (68054)

          First, I misspoke, and should have been mentioning milliseconds rather than seconds.
          But, still, a keep alive packet arriving once a second should be sufficient, wouldn't you think?

        • Re: (Score:2, Informative)

          by Anonymous Coward

          +1

          Skype is far from the first VoIP protocol to do this.

          http://en.wikipedia.org/wiki/Voice_activity_detection
          http://en.wikipedia.org/wiki/Comfort_noise

          • It is obvious that Skype uses voice activity detection, or else the silence packets would be as large as the voice packeage. The whole point is why they are still quite large (large enough to send a substantial amount of data).

            The second link is totally irrelevant because it doesn't concern the sender, but the receiver. The noise the receiver generates certainly does not depend on the size of the silence packages the sender sends.

        • Sending two bytes is not the same as sending nothing.
          The point is not that Skype sends packets for silence, but that it sends such big packets, despite obviously detecting the silence as such (otherwise the silence packages would be the same size as non-silence packages).

      • by Minwee (522556) <dcr@neverwhen.org> on Monday January 07, 2013 @03:17PM (#42509019) Homepage

        Exactly what I was thinking.

        You would think that a packet specifying X seconds of simulated silence could be packed into a few bits, so maybe two bytes should suffice.

        Were you planning on sending that "two seconds of silence" packet at the _start_ of the pause? If so I know a few theoretical physicists and at least one state lottery commission who would _love_ to see your algorithm.

        • by icebike (68054)

          Why not send them where the current 70 byte packets are sent?
          After all, this decision has already been made and implemented in the Skype protocol, as they are doing one or the other already.

        • by X0563511 (793323)

          One word that makes it possible: buffering.

          It wouldn't work with a realtime stream. TCP/UDP don't do realtime streams quite so well.

          • by makomk (752139)

            VOIP needs to be low latency, though, otherwise people get confused and try to talk over each other.

      • > You would think that a packet specifying X seconds of simulated silence could be packed into a few bits,
        > so maybe two bytes should suffice.

        You're confusing media-encoding with telephony. Media encoding occurs in non-realtime, so you can analyze a big chunk of data and plan ahead for both silence and bursts. Telephony is realtime. The more you delay the audio for analysis, the more annoying it becomes to the people having the conversation. With realtime telephony, you don't HAVE "X seconds" to buffe

        • by icebike (68054)

          You're confusing media-encoding with telephony. Media encoding occurs in non-realtime, so you can analyze a big chunk of data and plan ahead for both silence and bursts. Telephony is realtime. The more you delay the audio for analysis, the more annoying it becomes to the people having the conversation. With realtime telephony, you don't HAVE "X seconds" to buffer and delay transmission so you can analyze a chunk of audio that long.

          Wait, wait, wait,...

          Skype is already sending silence packets. Its ALREADY made the determination that it has silence, and packaged (something) differently.

          So that pretty much makes the rest of what you said either totally wrong, or non germane.

    • by tlhIngan (30335)

      I wonder why Skype needs 70 bytes to transmit essentially nothing. Maybe they already do use it for secret data transmission, just to their own servers?

      Encryption padding, I'd guess. Use something like AES which only works on 128/192/256 bit blocks (depending on key size)(16/24/32 bytes) and if you have a short packet of silence, it has to be padded in order to be encrypted. I'm guessing there might be a header and other stuff that pushes it to 70 bytes.

      • Since it doesn't contain any information, and it is identifiable as silence packet anyway, then why encrypt it?

        • by tlhIngan (30335)

          Since it doesn't contain any information, and it is identifiable as silence packet anyway, then why encrypt it?

          Because there may be other data besides the ones saying "this is silence". Perhaps some identifier, a size, etc. Maybe there's control information like mouse coordinates (for whiteboard mode), maybe some text chat, etc.

          As for not sending anything - well, Skype needs to send something in order to ensure the STUN is still active.

    • by gstoddart (321705)

      I wonder why Skype needs 70 bytes to transmit essentially nothing.

      My assumption was for a keepalive in the protocol.

      Otherwise, packets would stop coming if someone stops talking, and sooner or later the other side would have to assume you've hung up.

      Sending the packet for the silence would be the equivalent to "I'm still here".

      • You don't need 70 bytes for a simple keepalive. That's the point. Nobody argues that no packets should be sent. But why such large packets?

        Taking your analogy, it would be like holding a short monologue just to tell "I'm still here."

        • Maybe they found they were having trouble with traffic shaping/QOS type systems.

          Have to keep something decently sized flowing through the connection or it gets de-prioritized and then when real content starts flowing again, it lags? I don't know if this is true, but it sounds like a reasonable explanation considering how skype's design is so heavily focused on being able to punch through hostile networking environments and maintain a workable stream.

  • by Jeng (926980) on Monday January 07, 2013 @02:59PM (#42508741)

    If you are going to hide something, don't let everyone know where you put it.

    Now that the exploit has been discussed it will be watched out for.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      It's not an exploit.

      • by Jeng (926980)

        Wrong choice of words, but close enough.

        One would exploit the information

    • by Anonymous Coward

      If you are going to hide something, point everyone somewhere else. These guys are really using Youtube, but would prefer their Skype calls are monitored.

  • by etash (1907284)
    but now that they told us what they are going to do, the messages won't be a secret any more ?

    tl;dr: security by obscurity is a bad thing!
    • It really depends, you can still encrypt the hidden message, hence, it'd be almost impossible to tell if it's just plain old silence, or an encrypted message.

    • by Fnord666 (889225)

      tl;dr: security by obscurity is a bad thing!

      Maybe that's why this is an article about steganography rather than security?

  • the Chinese and Iranian governments are all over this already.
  • by Anonymous Coward

    So skype has 1kilobit/sec spare capacity when transmitting silence ? How much data does it actually sent then ? just for silence ?
    This protocol is either very inefficient, or there is reason for this 'waste' of bandwidth. So what does skype use it for ?

    • by hawguy (1600213)

      So skype has 1kilobit/sec spare capacity when transmitting silence ? How much data does it actually sent then ? just for silence ?
      This protocol is either very inefficient, or there is reason for this 'waste' of bandwidth. So what does skype use it for ?

      From TFA, it's 70 bytes per packet (560 bits, excluding packet overhead), so less than 2 packets/second gives 1kbit/second of data. That doesn't seem all that inefficient.

      • 70 bytes to transmit what could be transmitted in one byte (the status "no activity") seems very inefficient.

        • You aren't thinking of the protocol layers involved. At the top there is the "valid voip packet", which encapsulates everything. Next layer down you have an ID layer. Is it silence or is it waveform data? Silence, great. Next layer, for how long? 70 bytes isn't unreasonable.
        • by lamber45 (658956)

          Except that the packet already has at least an 8-byte UDP header, a 20-byte IPv4 (or 40-byte IPv6) header, and a link-layer header of some sort. There's probably some sort of checksum and block padding within those 70 bytes (which may in fact include the UDP or TCP header as well).

          Similarly, VNC tunneled over SSH doesn't use 1-byte and 2-byte packets. For a certain block-size for which I did calculations and watched some real-life traffic, actual packet payloads for the different relevant messages ar

  • Are real silence packets identical in payload? If so, a bitwise comparison of silence packets could be easily automated and would detect the altered packets, right? And if this is the case, how is this useful in a government-surveillance scenario? (I'm assuming that's what this is for.)
    • by vlm (69642)

      Each side has a very smart bridge.

      If bridge A sees an incoming 130 byte packet from the LAN side thats obviously skype, pass it.
      If bridge A sees an incoming 70 byte packet from the LAN side thats obviously skype, add a 60 byte encrypted / hashed / whateverd back channel of data.

      If bridge B sees an incoming 130 byte packet from the LAN side thats obviously skype, ram it thru the decrypt / dehash / whateverd thing and see if the last 60 bytes decodes to a valid back channel data packet. To a crude first appr

  • Move Along (Score:5, Funny)

    by Anonymous Coward on Monday January 07, 2013 @03:04PM (#42508829)

    Nothing to see hear.

  • There are a million ways to communicate in secret, and this ranks among the stupidest.
    • by hawguy (1600213)

      There are a million ways to communicate in secret, and this ranks among the stupidest.

      Which ways are less stupid than hiding your packets in a stream that's believed to be innocuous and even if the voice packets are monitored, your hidden data would presumably remain hidden?

  • Whitespace! (Score:5, Funny)

    by Vlad_the_Inhaler (32958) on Monday January 07, 2013 @03:19PM (#42509049) Homepage

    C may currently have overtaken Java as the most popular language but Whitespace [dur.ac.uk] is going to overtake them all!

  • by Anonymous Coward

    I've had a lot of chats with silences with hidden messages... mostly with women.

  • "A group of researchers from the Institute of Telecommunications of the Warsaw University of Technology have devised a way to send and receive messages hidden in the data packets

    Using Reverse Polish Encryption, no doubt.

  • by dutchwhizzman (817898) on Monday January 07, 2013 @04:18PM (#42510137)

    3

    2

    1

    Because MicroSoft will have none of this, obviously.

  • by PPH (736903) on Monday January 07, 2013 @04:30PM (#42510315)

    ... have the loudest minds.

  • by Frobnicator (565869) on Monday January 07, 2013 @04:31PM (#42510325) Journal

    Side channel attacks are old-school but any security researcher worth their title knows about them.

    This was a popular attack in the 60's and 70's for governments.

    Decades ago CS programs taught about how spies once leaked data from secret-privileged machines by emitting communications through CPU load, or through disk usage, or through various other timing attacks.

  • Since the Chinese government has access to wiretap all Skype calls [ycombinator.com], I wonder if they would be able to access the silent bits of information as well.
  • James Blish.

    'Nuff said.
  • Believe me, there are HUGE amounts of secret data transmitted in the silences in conversations... with your significant other, at least.

  • You can hear the song "Here's to My Sweet Satan."
  • Hidden shmidden. If they didn't encrypt it, Skype could simply inspect the silence packet and get everything they are transmitting. It's only secret to someone who has a microphone in your room

If God had a beard, he'd be a UNIX programmer.

Working...