We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Cambridge prof warns of Skype botnet threat

VoIP traffic can cover a multitude of sins

VoIP (voice over IP) apps could be used to cloak networks of zombies, used to launch DoS (denial-of-service) attacks, a Cambridge professor has warned.

Armies of ordinary PCs – 'botnets' – that have been infected by a virus and put under malicious control could be controlled and orchestrated by messages hidden in VoIP traffic generated by programs such as Skype, warned Jon Crowcroft, Marconi professor of communications systems at Cambridge University.

DoS attacks are usually shut down by tracing control messages, normally sent by chat and IM programs. "If someone were to use a VoIP overlay as a control tool for attacks, it would be much harder to find affected computers and almost impossible to trace the criminals behind the operation," said Crowcroft, who revealed the technique at CRN (the Communications Research Network), a networking think-tank funded by the Cambridge-MIT Institute.

"It would be irresponsible to build something that could go out and be used," said Crowcroft. Nevertheless, he built a demonstration system. "It was write-once, tear-up code," he said. "But it was very easy to do – unfortunately."

Although the attack has not been detected in actual use yet, Crowcroft warns it is only a matter of time. CRN's working group on internet security has raised the issue with VoIP providers, before making the issue public.

"There isn't a protocol you can't use as a covert signalling channel," responded Kurt Sauer, director of security operations at Skype. "Some large commercial groupware products have encrypted XML streams – they may not be quite as good at firewall traversal, but that's still an opaque data stream."

The attack will add to the unease enterprise IT staff already feel about applications, particularly the very popular Skype service. Some IT managers do not want uncontrolled traffic punching holes in their firewalls and using bandwidth, and security vendors have launched specific products to block Skype.

Crowcroft would like Skype to publish its routing specifications, so IT managers can work more effectively with the application, tracking it and checking its behaviour. "Skype's routing specification is proprietary," he said. "There are a whole bunch of reasons why obfuscation is not helpful in the long run."

Although Skype still wants its proprietary edge, the issue is up for discussion. "The people who own networks and systems have a right to manage as they see fit," said Sauer. "To the extent that we make it difficult to do that, we want to address that in our products."

This story first appeared on Techworld.com.

IDG UK Sites

Android M Developer Preview announced at Google I/O: Android M UK release date and new features. Wh?......

IDG UK Sites

Why I think the Apple Watch sucks and you'd be mad to buy it

IDG UK Sites

Ben & Holly's Game of Thrones titles spoof is delightfully silly

IDG UK Sites

Mac OS X 10.11 release date rumours: all the new features expected in Yosemite successor