While Skype advocates try to make us believe that it is not only cheap and convenient but secure and well suited for business use, this article tells a slightly different story. But of course, this is China, this would never happen in Canada, USA, Europe or any other democratic country! Or??? So OK, we’ll have to be careful when we use Skype, but privacy is secured when we use VoIP or POTS! Right? Isn’t it???

China’s TOM-Skype Surveillance
Original story by Dustin D. Trammell posted here

According to a report published on October 1st by Citizen Lab, full chat text messages from TOM-Skype users were found on publicly-accessible web servers as well as the encryption key required to decrypt the data. Additional data such as millions of IP address, user names, and land-line phone numbers, and records of international users who regularly communicated with Chinese users were found alongside the chat logs.

From an Ars Technica article about the report:

Clearly, there are a number of problems with this discovery, starting with security. Villeneuve notes that the information contained on the servers could be used to exploit the TOM-Skype server network, and an attacker can access detailed user profiles. “In fact, evidence suggests that the servers used to store captured data have been compromised in the past and used to host pirated movies and torrents (for peer-to-peer file sharing),” reads the report. Clearly, crafty hackers already know where these servers are and how to get into them.

While troubling from an overall Skype security standpoint, it’s not much of a surprise that the Chinese government had a way to monitor their Skype users, especially with Skype being partnered with TOM Online, a Chinese company.

Since around September 2005, Chinese users attempting to download the Skype client were blocked from doing so, instead being redirected to a modified Chinese version hosted by TOM. Did anyone really think that this modified version wasn’t backdoored? Who wants to bet that they have keys to decrypt the voice channels as well?