From WikiLeaks

You can lead a trojan horse to a Bierzelt, but can you make it Skype?

DANIEL SCHMITT

January 24, 2008

The pdf file obtained by Wikileaks and also released by the german political party PiratenPartei, contains two scanned documents relating to activities of the Bavarian police, Ministry of Justice and the Prosecution office in intercepting encrypted data submitted via SSL or Skype via the internet. The first one, presenting a communication on splitting cost between Bavarian police and the prosecutors offices, the second one presenting the related offer for the software by a German company called Digitask.

The technology works via a local installation of malware on the clients computer. Digitask's offer gives a high-level explanation of this.

RELATED: Bavarian_trojan_for_non-germans - TRANSLATION FOR NON-GERMAN SPEAKERS

A n offer on interception technology

The offer, dated September 4th 2007, responds to an inquiry by Bavarian officials on the possibility of Skype interception. It introduces a basic description of the cryptographic workings of Skype, and concludes that new systems are needed to spy on Skype calls.

Next, it introduces the so-called Skype Capture Unit. In a nutshell: malware is installed onto a target machine, to intercept Skype Voice and Chat. Another feature introduced is a recording proxy, that is not part of the offer, yet would allow for anonymous proxying of recorded information to a target recording station. Access to the recording station is possible via a multimedia streaming client, supposedly offering real-time interception.

Another part of the offer is an interception method for SSL based communication, working on the same principle of establishing a man-in-the-middle attack on the key material on the client machine. According to the offer, this method works for Internet Explorer and Firefox web browsers. Digitask also recommends using overseas proxy servers, to cover the tracks of all activities.

T he eventuality of delivery

The document interestingly holds some information on future dependencies, time schedules and similar things, and it quickly becomes clear that the solution presented here eventually delivers something. While the recording server offered now might only be able to handle a small amount of new Skype client features like Video Chat, the first striking factor is a delivery time of 4-6 weeks for a single installation. Perhaps by then or at some other time the software will also be Windows Vista compatible. Interestingly, in 2008, software for Windows 2000 and Windows XP only is offered.

The delivery time also does not include installation on the target machine, but only provisioning of the software. Methods of delivery, which would be one of the more interesting features of such software, include personal delivery to the target machine, and sending it as an e-mail attachment. While other methods, not being further specified, can always be integrated, this will only happen at full development cost and the delivery is still fully up to the purchaser of the software.

Digitask will also not take on any responsibility for use of the software or damage caused by it.

T he high cost of governmental eavesdropping

The licensing model presented here relates to instances of installations per month for a minimum of three months. Each installation of the Skype Capture Unit will cost EUR 3500, SSL interception is priced at EUR 2500. A one-time installation fee of EUR 2500 is not further explained. The minimum cost for any installation on a suspect computer for a comprehensive interception of both SSL and Skype will be EUR 20500, if no more than one one-time installation fee are required.

S oftware versus bulletproof vests?

The letter gives a tabular overview of the cost. Interestingly, this includes the proxy server to disguise police officers' identity. After stating that no law currently clearly regulates these costs, and concentrating on various legal aspects of this statement, it is declared that all costs for hardware and software must be covered by local German police budgets, which are well known to be tight. According to a decision by the State Ministry of the Interior and the State Ministry of Justice, this includes all costs for acquisition and maintenance.