Re: [Full-disclosure] [inbox] Re: [ Capture Skype trafic ]

I'm sorry, but that document outlines HOW Bluecoat can and does block Skype.
A packet or protocol anaylizer Proxy will block anything that is NOT
conforming HTTP to travel along on port 80. Skype does not conform to HTTP
standards (for one it's encrypted) and BlueCoat will stop it.
Yup, you can't be a moron and have every other port under the sun open on
your network too....



"STEP 4: INSTALL SSL CONTROLS ON THE BLUE COAT SG
The Blue Coat SG appliances managing application service ports for HTTP
(80), RTSP (554), MMS
(1755), etc. will drop client connections if the packets sent do not conform
to the appropriate
protocol. When Skype uses port 80, the protocol used is still Skype?s
proprietary protocol and does
not conform to HTTP and so will be blocked. The Skype application finally
attempts to use port
443, if the SSL controls are installed (part of SGOS v4.2) these packets
will also be dropped as
there is no SSL certificate exchanged between Skype nodes. Therefore, any
attempt to establish a
Super-node connection through these service ports will be unsuccessful, as
the connection is nonconforming to standards."



-----Original Message-----
From: Tyop? [mailto:tyoptyop@xxxxxxxxx]
Sent: Friday, October 27, 2006 2:19 PM
To: Exibar; full-disclosure@xxxxxxxxxxxxxxxxx
Subject: [inbox] Re: [Full-disclosure] [ Capture Skype trafic ]


On 10/27/06, Exibar <exibar@xxxxxxxxxxx> wrote:
From: "Tyop?" <tyoptyop@xxxxxxxxx>
All is in the mail's subject.
I need to match this crazy-encrypted-random trafic,
to destroy it (I think I'm not alone to need informations on this
product).
I've found some work on the BlackHats slides,
but skype updates..
use a packet analyzer proxy.... bluecoat comes to mind as one
that works
quite well...

http://www.bluecoat.com/downloads/whitepapers/BCS_controlling_skype_wp.pdf
Bluecoat doesn't match the packets, sorry.

quote:
It is also recommended that enterprises block downloads of URLs ending
with "skype.exe". This will prevent new Skype software from being
downloaded to enterprise machines.

This is very funny. ^-^

--
Tyop?
"Please excuse my english."




_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: Block Skype using ISA 2004
    ... close all not necessary outgoing ports ... blocking specific http traffic could be accomplished per http filtering ... Because Skype is programmed and even gets improved in bypassing nearly ...
    (microsoft.public.isa)
  • Re: [fw-wiz] IPS vs. Firewalls (why vs. ?)
    ... around 'default permit' or 'default deny'. ... discard anything that was not exactly plain HTTP. ... To truly understand what firewall administrators are up against, read the Skype firewall FAQ at http://www.skype.com/help/guides/firewall.html ... This option results in Skype working most reliably. ...
    (Firewall-Wizards)
  • Re: Not able to allow skype
    ... week ago I saw in the monitoring that it's trying to go over port 33033. ... Sometimes you are able to sign in to skype but not to call. ... will have trouble then connecting from home with a proxy filled in. ... Can it be something to do with the webproxy filter which is on for http ...
    (microsoft.public.isa)
  • RE: Blocking messengers like msn, skype etc
    ... setup a protocol rule to only allow http. ... then setup a destination set with the skype ip range/dns names. ... > I want to allow only normal http traffic on client pc's. ... > in the firewall client setting in ISA? ...
    (microsoft.public.isa.configuration)
  • Re: Allow Skype
    ... If I allow http and https to external, then I can use Skype no porblem at ... If I limited http and htpps to some sites, ... To make Skype communications work you should allow Skype client program to ... An Analysis of the Skype Peer-to-Peer Internet Telephony Protocol by Salman ...
    (microsoft.public.isa)