Full Disclosure mailing list archives
Re: [inbox] Re: [ Capture Skype trafic ]
From: "Exibar" <exibar () thelair com>
Date: Sun, 29 Oct 2006 21:21:45 -0500
I'm sorry, but that document outlines HOW Bluecoat can and does block Skype. A packet or protocol anaylizer Proxy will block anything that is NOT conforming HTTP to travel along on port 80. Skype does not conform to HTTP standards (for one it's encrypted) and BlueCoat will stop it. Yup, you can't be a moron and have every other port under the sun open on your network too.... "STEP 4: INSTALL SSL CONTROLS ON THE BLUE COAT SG The Blue Coat SG appliances managing application service ports for HTTP (80), RTSP (554), MMS (1755), etc. will drop client connections if the packets sent do not conform to the appropriate protocol. When Skype uses port 80, the protocol used is still Skypes proprietary protocol and does not conform to HTTP and so will be blocked. The Skype application finally attempts to use port 443, if the SSL controls are installed (part of SGOS v4.2) these packets will also be dropped as there is no SSL certificate exchanged between Skype nodes. Therefore, any attempt to establish a Super-node connection through these service ports will be unsuccessful, as the connection is nonconforming to standards."
-----Original Message----- From: Tyop? [mailto:tyoptyop () gmail com] Sent: Friday, October 27, 2006 2:19 PM To: Exibar; full-disclosure () lists grok org uk Subject: [inbox] Re: [Full-disclosure] [ Capture Skype trafic ] On 10/27/06, Exibar <exibar () thelair com> wrote:From: "Tyop?" <tyoptyop () gmail com>All is in the mail's subject. I need to match this crazy-encrypted-random trafic, to destroy it (I think I'm not alone to need informations on this product). I've found some work on the BlackHats slides, but skype updates..use a packet analyzer proxy.... bluecoat comes to mind as onethat worksquite well...http://www.bluecoat.com/downloads/whitepapers/BCS_controlling_skype_wp.pdf Bluecoat doesn't match the packets, sorry. quote: It is also recommended that enterprises block downloads of URLs ending with "skype.exe". This will prevent new Skype software from being downloaded to enterprise machines. This is very funny. ^-^ -- Tyop? "Please excuse my english."
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: [ Capture Skype trafic ], (continued)
- Re: [ Capture Skype trafic ] Nick FitzGerald (Oct 27)
- Re: [ Capture Skype trafic ] gabriel rosenkoetter (Oct 28)
- Re: [ Capture Skype trafic ] Nick FitzGerald (Oct 28)
- Re: [ Capture Skype trafic ] Peter Thoenen (Oct 28)
- Re: [ Capture Skype trafic ] Cedric Blancher (Oct 28)
- Re: [ Capture Skype trafic ] gabriel rosenkoetter (Oct 28)
- Re: [ Capture Skype trafic ] Cedric Blancher (Oct 28)
- Re: [ Capture Skype trafic ] Brian Eaton (Oct 28)
- Re: [ Capture Skype trafic ] Tyop? (Oct 29)
- Re: [ Capture Skype trafic ] Nick FitzGerald (Oct 29)
- Re: [inbox] Re: [ Capture Skype trafic ] Exibar (Oct 29)
- Re: [inbox] Re: [ Capture Skype trafic ] form guru (Oct 31)