Researchers find a way to send secret “silent” messages through Skype

DIGITAL TRENDS [07/01/13]

By Francis Bea

Polish researchers discovered a secret way to send encrypted messages through Skype during the silent moments of your conversations.

Skype calls can be hijacked by third-party hackers — it’s not easy but it’s possible. Turns out Microsoft’s changes in July 2012 to its popular video VoIP app opened up the platform to snooping, at least by law enforcement. But there’s an intriguing secret method for sending hidden messages, researchers from the Institute of Telecommunications in Warsaw, Poland discovered.

With the way Skype works, the VoIP app sends 130-bit data packets that deliver information to and from the sender and recipient. If you’re talking on Skype, whatever you’ve said is sent in that packet and relayed as both voice and visual data. But in the silence between spoken words, when no information is sent, the team from Poland realized that they could interject 70-bit silence packets that are undetectable visually or sonically by the recipient (it mimics silence), and developed this into a program called SkypeHide. “The secret data is indistinguishable from silence-period traffic, so detection of SkypeHide is very difficult,” researcher Wojciech Mazurczyk told New Scientist. 

SkypeHide can send any type of surreptitious messages including voice, video, and text data at 1 kilobyte per second. Of course, it’s not a fail-safe: Someone with enough know-how could create a countermeasure for sniffing out these 70-bit packets, intercepting and then hacking the packets could be feasible.

Skype to Skype calls are encrypted with a 256-bit encryption to stymie any would-be hackers trying to eavesdrop on your conversation. Skype calls to cellphones and landlines on the other hand are not. With security and privacy important commodities these days, we can see a practical consumer-oriented application for a service like SkypeHide, although if you’re really worried about having your VoIP calls tapped, you might not want to be using this type of a service altogether.