{"id":748,"date":"2007-06-14T23:03:09","date_gmt":"2007-06-14T23:03:09","guid":{"rendered":"https:\/\/www.docbug.com\/blog\/archives\/748"},"modified":"2007-06-14T23:03:09","modified_gmt":"2007-06-14T23:03:09","slug":"russian-hacker-zine-analysis-of-skype-anti-reverse-engineering-measures","status":"publish","type":"post","link":"https:\/\/www.docbug.com\/blog\/archives\/748","title":{"rendered":"Russian hacker-zine analysis of Skype anti-reverse-engineering measures"},"content":{"rendered":"<p>Russian hacker magazine Xakep Online has posted an interesting analysis of all the measures Skype goes to to avoid reverse-engineering of their protocol and code. If you can&#8217;t read the <a href=\"http:\/\/www.xakep.ru\/post\/38543\/\"> original Russian<\/a> you can get the gist (as I did) from the <a href=\"http:\/\/translate.google.com\/translate?u=http%3A%2F%2Fwww.xakep.ru%2Fpost%2F38543%2F&#038;langpair=ru%7Cen&#038;hl=ru&#038;ie=UTF-8&#038;oe=UTF-8&#038;prev=%2Flanguage_tools\">Google translation<\/a>. A few highlighted techniques:<\/p>\n<ul>\n<li>Binary file is fully encrypted and dycrypted as it&#8217;s dynamically loaded into memory.<\/li>\n<li>Eliminated almost all static function calls, and critical procedures are called via a dynamically-obtained pointer determined via obfuscated code. That makes figuring out what&#8217;s going on in a debugger difficult.<\/li>\n<li>Recognizes the Windows kernel-mode debugger <a href=\"http:\/\/en.wikipedia.org\/wiki\/SoftICE\">SoftICE<\/a> and refuses to run when it sees it.<\/li>\n<li>Measure how long it takes to execute certain sections of code to try to detect whether it&#8217;s being run in emulation. (I&#8217;m not sure how this would work, given the range of CPUs it has to run on&#8230;)<\/li>\n<li>Do a checksum of the resulting decrypted code.<\/li>\n<\/ul>\n<p>The article also goes into all the ways Skype routes around firewalls by looking for open ports, and suggests that along with encrypted traffic and peer-to-peer distribution it&#8217;s the perfect tool to deliver a worm, trojan or virus payload under the radar of virus checkers and firewalls&#8230; if only you can find a way to get the target client to run your code. Essentially you&#8217;re left with just one level of protection, namely Skype itself. I&#8217;m not convinced this is any more problematic than the Swiss-cheese that is Windows security already, but it&#8217;s something to think about as we go forward.<\/p>\n<p>(Thanks to Sergey for the link and summary of the Russian!)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Russian hacker magazine Xakep Online has posted an interesting analysis of all the measures Skype goes to to avoid reverse-engineering of their protocol and code. If you can&#8217;t read the <a href=\"http:\/\/www.xakep.ru\/post\/38543\/\"> original Russian<\/a> you can get the gist (as I did) from the <a href=\"http:\/\/translate.google.com\/translate?u=http%3A%2F%2Fwww.xakep.ru%2Fpost%2F38543%2F&#038;langpair=ru%7Cen&#038;hl=ru&#038;ie=UTF-8&#038;oe=UTF-8&#038;prev=%2Flanguage_tools\">Google translation<\/a>. A few highlighted techniques:<\/p>\n<ul>\n<li>Binary file is fully encrypted and dycrypted as it&#8217;s dynamically loaded into memory.<\/li>\n<li>Eliminated almost all static function calls, and critical procedures are called via a dynamically-obtained pointer determined via obfuscated code. That makes figuring out what&#8217;s going on in a debugger difficult.<\/li>\n<li>Recognizes the Windows kernel-mode debugger <a href=\"http:\/\/en.wikipedia.org\/wiki\/SoftICE\">SoftICE<\/a> and refuses to run when it sees it.<\/li>\n<li>Measure how long it takes to execute certain sections of code to try to detect whether it&#8217;s being run in emulation. (I&#8217;m not sure how this would work, given the range of CPUs it has to run on&#8230;)<\/li>\n<li>Do a checksum of the resulting decrypted code.<\/li>\n<\/ul>\n<p>The article also goes into all the ways Skype routes around firewalls by looking for open ports, and suggests that along with encrypted traffic and peer-to-peer distribution it&#8217;s the perfect tool to deliver a worm, trojan or virus payload under the radar of virus checkers and firewalls&#8230; if only you can find a way to get the target client to run your code. Essentially you&#8217;re left with just one level of protection, namely Skype itself. I&#8217;m not convinced this is any more problematic than the Swiss-cheese that is Windows security already, but it&#8217;s something to think about as we go forward.<\/p>\n<p>(Thanks to Sergey for the link and summary of the Russian!)<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[15],"tags":[],"class_list":["post-748","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/www.docbug.com\/blog\/wp-json\/wp\/v2\/posts\/748","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.docbug.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.docbug.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.docbug.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.docbug.com\/blog\/wp-json\/wp\/v2\/comments?post=748"}],"version-history":[{"count":0,"href":"https:\/\/www.docbug.com\/blog\/wp-json\/wp\/v2\/posts\/748\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.docbug.com\/blog\/wp-json\/wp\/v2\/media?parent=748"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.docbug.com\/blog\/wp-json\/wp\/v2\/categories?post=748"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.docbug.com\/blog\/wp-json\/wp\/v2\/tags?post=748"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}