Ben Harwood's List: Videoconference

• If you want to make absolutely sure not to become a supernode, just run skype behind a symmetric NAT router.
• I run skype in parallel with SIP on my network, behind a symmetric router, and it has never caused any noticeable degradation for me in any networked application that I use, nor with my SIP/RTP communications on either end. YMMV however.
• Any computer hosted on a network that is behind a network address translation (NAT) device or restrictive firewall will disable supernode functionality.

1 more annotation...

• Many network and systems administrators take a dim view of Skype because experience with the software has shown that it can be a bandwidth hog. Other administrators fear that Skype's inherent ability to traverse firewalls is a security risk. And some administrators feel the combination of Skype's encryption and its binary-only, closed-source nature make it a black box, or complete unknown that has no place being on a well-maintained network. While these are all valid concerns, they should be considered in the context of local network policies and weighed against the benefits that Skype can provide. In many cases, running Skype in a well-managed environment can mitigate these risks.
• The purpose of this paper is to suggest best practices and recommendations when running Skype.
• Skype has the potential to be a bandwidth hog, but high bandwidth consumption while the user is not actively using Skype can be mitigated through changes in configuration or deployment. Provided that mitigating steps are taken, bandwidth consumption while the user is actively using Skype is not unreasonable.
• Although the core technologies used in Skype have not had a known security vulnerability in years, Skype still presents an attack vector for spam, phishing, or the transfer of malicious code by way of traditional social engineering. However, these attack vectors already exist on users' systems in e-mail clients, Web browsers, or other IM applications. Skype's functionality makes it no more or less inherently secure than other network communication applications. Skype may, however, be a more attractive target to phishers as some Skype users use paid services such as Skype-Out and Skype-In (the ability to dial out to a land line or to receive calls in from a landline, respectively). In this way, Skype accounts are actually tied to monetary value via PayPal.
• In less restrictive network environments, such as higher education networks, Skype is an attractive alternative to using traditional telephone service for costly long-distance calls, particularly when collaborating with colleagues in other countries.
• The use of relay hosts causes consternation among many network and systems administrators, as this functionality means that Skype is consuming network resources even when the end user is not using the Skype application. Although Skype has self-imposed limits on how much bandwidth it can consume, many administrators feel that this background bandwidth consumption is inappropriate and fear that unchecked use of Skype will lead to inordinate bandwidth use. This behavior can be mitigated (or stopped altogether) during deployment or subsequent configuration of Skype.
• Some institutions prohibit Skype specifically because of this clause. Some administrators and legal counselors will advise prohibiting Skype because this functionality means that a third-party, for-profit company is using university resources for the express purpose of furthering their commercial enterprise.
• It is the informal opinion of The University of Texas at Austin's legal counsel that this behavior is not fundamentally different from most other network applications that are developed and supported by commercial interests. For example, consider a user surfing the Web and being subject to advertisements on a Web site, or someone who uses Yahoo Mail and has an advertisement automatically appended to his or her e-mail. Many other IM applications (and indeed many other network applications) are supported by the use of in-line advertisements.
• For those wishing to eliminate the possibility of a Skype client becoming a super node or relay host, the simplest solution is to place the host behind a NAT firewall or otherwise restrict its ability to be publicly addressed. If other Skype users cannot see the host directly, the super node and relay host functions will simply not work and the host will remain a regular Skype client with no additional functionality.
• As of the 3.0 version, Skype can use Group Policies so administrators can make system management changes to sets of enterprise users. The Skype Administrative Template can be found at http://www.skype.com/security/Skype-v1.5.adm.
• Skype stands alone among VOIP applications due to its peer-to-peer network architecture and its extensive use of strong encryption of not only communications content but signaling traffic as well. The application itself and its network communications are extremely resistant to reverse engineering, making Skype activity difficult to detect and its communications impossible to decipher. For networks that are subject to strict legal or administrative regulations, Skype should be banned to prevent unauthorized communications. For more open networks, Skype can be a boon for end users who want to communicate with colleagues on another side of our rapidly shrinking world. Since Skype is a communication application, users will always be subject to unsolicited messages and end-user education is recommended to ensure that bogus links sent by unknown correspondents don't result in system compromises.

9 more annotations...

• Supernodes typically use little bandwidth even though they relay VoIP and file-transfer traffic in certain cases.

• • Any computer hosted on a network that is behind a network address translation (NAT) device or restrictive firewall will disable supernode functionality.
   
  • Skype clients behind an HTTP or SOCKS5 proxy will not serve as supernodes.

• The best way in my opinion to find out if Skype is acting as a Super-Node is to start it and let it run for a few hours without using it actively. Bandwidth consumption is obviously higher if you make calls or transfer data with Skype and it is more difficulty to find out if Skype is acting as a Super-Node if you have to analyze the traffic in direct and indirect traffic.

  • Has this ever been tested?
  Add Sticky Note
• The easiest way to prevent Skype from being a Super-Node is to block access to the ports 80 and 443 in Skype. You can do that under Tools > Options > Connections. Just uncheck the option “Use port 80 and 443 as alternatives for incoming connections”.

• There are several ways to prevent Skype from becoming a supernode:

   
   
  • Beginning with Skype 3.0, an explicit switch is provided in the registry settings to allow the disabling of supernode functionality.
   
  • Any computer hosted on a network that is behind a network address translation (NAT) device or restrictive firewall will disable supernode functionality.
   
  • Skype clients behind an HTTP or SOCKS5 proxy will not serve as supernodes.
• While the use of a SOCKS5 proxy still requires manual intervention by the user, the use of a proxy allows the economical "shaping" of Skype traffic. It has the additional positive side-effect of reducing supernodes on the network, reducing false-positive intrusion prevention system alarms and allowing for accurate measurement of Skype usage on the proxied network.