Just a few thoughts about Skype, Google Voice and the possibilities of Denial of Services and Distributed Denial of Service attack on a targeted telephone services.

Before we start, please check your local laws to ensure you are not breaking any laws before reading this article. This post is written for the purpose of academia.

Skype has the ability to call landline and cellphone numbers, which is a useful feature. What if we could automate this? the possibilities opened up by Skype is endless. Automated polling, automated meeting/task remainder, etc, which are in the realm of legal uses of Skype. But it also opens the door of possible grey activities such as voice blueprinting, mapping out used and unused numbers, spamming, and finally DoS and DDoS attack on targeting telephone systems.

Here is the biggest kicker, there is a python package that interfaces with Skype. Bring on the possibility of all the above mentioned applications of Skype. Using python and perl I was able to write a very simple program that can perform a simple Denial of Service on my cellphone.

Skype is cheap, for only $2.99/month you can create an account with unlimited calls to the USA and Canada. Virtually anyone, of any age could pick up a Visa gift card (they are horrible, but for illegal activities, oh well…) and sign up for a traceless Skype account.

The proof of concept is a short 30 line perl program, 40 line python program and Skype version 5.3.0.1093 (This also works with earlier version of Skype, actually, the python package was written for Skype 2.x, and has been deprecated for Skype 5.x) It works well, it is capable of generating a call every (5 seconds initiating time + 5 seconds timeout), 10 seconds, or 360 calls every hour, and 8640 calls everyday. Now scale this to a “distributed” attack, a single account is capable of generating 8640 calls everyday, now, suppose if we have a powerful computer, then multiple light weight FreeBSD (with xfce) virtual machines can be deployed, say 15, then we are capable of generating over 129,600 calls in a single day!

129,600 calls in a day is tiny compared to networked spam cells. So what do we do? We can write a malware package and deploy it on the internet. This script is tiny, it is simple, and think about this:

• How many people have Skype installed? Probably a lot
• How many of those are Mac users? (Probably enough, although other platforms will do as well, I’m just picking on Macs since I use a Mac)
• How many of those Mac users are actually “power users”? Not many, most probably are college students majoring in liberal arts. (Sorry arties)
• How many of those leave their Macs on overnight? Probably a lot.
• How many of those have a subscription of Skype? Probably a lot, since 30 dollars a year enables one to have unlimited phone call with people in USA and Canada.

So we sum this up, and we can see that there are a lot of users that have Skype with a subscription, say if we place that number at 100,000 vulnerable computers, that means we can generate over 432 million in a single day (taken in account that the malware only runs when the screen is locked or  during the night when the user is not using their computer.) The currently spam generated by email is at 200 billion a day, our method is only a fraction, but our method should be more “effective” since most spam are caught in spam filters.

Given that USA and Canadian numbers are 7 digits, that means, there is a total of 7^10 unique numbers, or 10,000,000,000 unique numbers. Our method, with 100,000 vulnerable computers could cover that range in 23 days. Of course, the number of vulnerable computers will be much higher, and the range of valid phone numbers will be much lower.

So that’s all for Skype. Next, Google voice, how many of you have a GMail account? Then you probably have seen this screen before:

Yes, we can make phone calls with GMail, (free for the remainder of this year.) Unfortunately, I haven’t found researched any methods/APIs that can be used with GMail to automate the process. However, at university, I took a User Interface class with Prof. Michael Terry. He demostrated to us a “programing language” that performs actions based on searching pixels on a screen. He demoed a script that was able to turn on his wireless network, and connect to the university wireless network, based on pixel searching and matching. So in essence, one could program a very inefficient program to automate this proces.

Kinda cool eh?