Skype 2.5 Heuristic Stealth Mode Cracked

Skype 2.5 introduced strong stealth techniques in the software to make it harder to detect and block using ip filtering techniques. Unfortunately it has been cracked.

Skype 2.5’s call setup no longer conforms to a small number of predictable patterns, which could be identified and filtered at packet level. The company’s PRX Traffic Manager now use a heuristic model as the basis of its filtering.

The program has been randomised to make established pattern-matching techniques useless. Once the call connection is established Skype’s encryption makes it impossible to block from other packet traffic, hence any filtering needs to stop it before this point.

iPoque managed to find tell-tale pattern of packet lengths, timings, and small-scale packet consistencies which betrayed Skype’s presence.

However iPoque’s CEO Klaus Mochalski suggested that Skype could one day become impossible to detect if the program integrated more advanced encryption into its make-up.
via