[kaiteisbait]

All of us know that though Tor is an excellent cryptographically secured protocol that provides anonymity. However, we now know that relay nodes and relay bridges can be uniquely identified because of their peculiar characteristics. To over come these problems, awesome guys at the University of Waterloo came up with a proof-of-concept tool – SkypeMorph – that encapsulates TOR traffic inside of a benign Skype video stream. SkypeMorph is a pluggable transport for Tor that disguises client-to-bridge traffic as a Skype video conversation.

Skype adds an encrypted layer while making free video and audio calls, resulting in a rise of people using the application and it’s traffic. A Skype video call uses a significant amount of data in a short period of time. Hence, it may be overlooked some times.

SkypeMorph was named so, as the PoC tool uses a traffic morphing matrix to convert Tor packets into UDP packets. It allows you to encapsulate Tor traffic into a connection that resembles Skype video traffic. This effectively means that you can possibly pass through censorship and use TOR at the same time. In general, SkypeMorph aims to build a layer of protocol obfuscation for Tor bridges. It uses the SkypeKit Desktop API, that provides almost the same functionality as the Skype application, including making voice and video calls and sending files and text messages.

Goals of SkypeMorph:Hard to identify: SkypeMorph outputs encrypted traffic that resembles Skype video calls, trying to minimize the chances of being detected by the censor.
Hard to block: Since the outputs of SkypeMorph greatly resemble Skype video calls, in order to block SkypeMorph, the censor would need to block Skype calls altogether, which we assume it is unwilling to do.
Plausible deniability: The only way to prove that a node is actually using SkypeMorph software is to break into a user’s machine or to coerce him to divulge his information. Otherwise, communicating through SkypeMorph should look like a normal Skype video chat.

SkypeMorph implements smclient client and smserver server programs four Diffie-Hellman keys: two for outgoing and incoming message encryption, and another two keys for outgoing and incoming message authentication purposes. SkypeMorph in short implements two methods to morph Tor streams into traffic with indistinguishable packet sizes and timings to Skype video; the first method uses na¨?ve traffic shaping to emulate the target distribution, independent of the source distribution. The second method takes the source distribution into account, enhancing Wright et al.’s Traffic Morphing to also account for packet timings.

http://www.pentestit.com/skypemorph-obfu...deo-calls/

[The Protagonist]

Sounds like a brilliant setup. Could be used to make TOR browsing more secure from those rogue nodes.

[Anon_Error]

It looks pretty awesome. I'll check it out when I get home.

[KingFlashOut]

That is actually sick, protecting us even more

[w00t]

Sounds like a brilliant setup. Could be used to make TOR browsing more secure from those rogue nodes.

I don't think you understand what this does. It just forces Tor through UDP ports so it looks like skype.

[The Protagonist]

Sounds like a brilliant setup. Could be used to make TOR browsing more secure from those rogue nodes.

I don't think you understand what this does. It just forces Tor through UDP ports so it looks like skype.

But it says "SkypeMorph outputs encrypted traffic that resembles Skype video calls" so it seems to encrypt it the way Skype calls are encrypted.

[w00t]

Which would be accurate, because they both use SSL.

[LinkLance]

i gotta check this out and nice thread.

[kaiteisbait]

Kay, glad you people like it!

[Dyme]

Wow that's cool. Though Tor is very slow for some reason.