Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
RE: [Full-Disclosure] blocking SkyPE?
Date: Tue Jan 25 2005 - 02:04:45 CST
Full-Disclosure aspect: knowing the capabilities and limitations of the
various firewalls employed. How policies can be violated without detection.
Vendors and open-source community need to push to solve these real world
>...but the real question is: can they detect SkyPE specifically?
This is from a Fortigate with factory release NIDS, AV and IPS databases -
nothing custom - (someone with a checkpoint and others may pipe in here with
On Status page:
Recent Intrusion Detections
Time Src/Dst Service Attack Name
2005-01-24 22:35:16 10.0.0.12 126.96.36.199 http skype
Skype In Alert Log:
2005-01-24 22:35:16 log_id=1421051110 type=ips subtype=signature pri=alert
vd=root attack_id=109051909 src=10.0.0.12 dst=188.8.131.52 src_port=3743
dst_port=80 src_int=port1 dst_int=port2 status=detected proto=6 service=http
msg="p2p: skype,[Reference: http://www.fortinet.com/ids/ID109051909]"
I am not blocking skype traffic or the kazaa traffic that is detected, but
use this info to quantify the use of the network and to throttle bandwidth
if needed to maintain QOS for business-critical functions. Once you muck
with the priority of skype traffic, its utility as a usable telephone
disappears. I think that Virgin Mobile has a cool invention called the
cellular phone that most corporate skype users will find has better quality
BTW, I found this statement on the skype firewall info page to be laughable,
and since I like to laugh, I read it twice:
"Ideally, outgoing TCP connections to all ports (1..65535) should be opened.
This option results in Skype working most reliably. This is only necessary
for your Skype to be able to connect to the Skype network and will not make
your network any less secure."
...sure no egress limiting makes for a real secure network. I'll remember
that 2bits worth of advice for my next consulting gig. I just had to argue
this point with a user last week who quoted that exact line...he sounded
real convincing too, and said "TCP" as if he really understood what he was
- Bryan K. Watson
Full-Disclosure - We believe in it.