TOM-Skype Research

Jeffrey Knockel

See here for the relevant paper and slides.

* Update 3/1/2012: Added TOM-Skype 5.5.4.62 and TOM-Skype for Android 2.7 information.

* Update 6/19/2012: Reflect that TOM-Skype 5.8.4.64 and 5.9.4.12 use same lists as 5.5.4.62.

* Update 9/6/2012: Reflect that TOM-Skype 5.10.4.18 uses same lists as 5.5.4.62.

Censorship of the Day

These are recently retrieved, decrypted lists of the keywords that TOM-Skype downloads when starting up. These lists are used for both censorship and surveillance unless otherwise noted.

• TOM-Skype for Android 2.7 surveillance-only; TOM-Skype 3.6.4.316, 3.8.4.44 censorship and surveillance (retrieved 12/1/2012)
• TOM-Skype 4.0.4.226, 4.2.4.104 (retrieved 8/6/2012)
• TOM-Skype 5.0.4.14, 5.1.4.10 (retrieved 12/1/2012)
• TOM-Skype 5.1.4.10 surveillance-only (retrieved 12/1/2012)
• TOM-Skype 5.5.4.62, 5.8.4.64, 5.9.4.12, 5.10.4.18 (retrieved 12/1/2012)
• TOM-Skype 5.5.4.62, 5.8.4.64, 5.9.4.12, 5.10.4.18 surveillance-only (retrieved 12/1/2012)
• TOM-Skype for Android 2.7 (retrieved 12/1/2012)

Censorship Analysis

Most versions of TOM-Skype have built-in keyword lists in addition to keyword lists that they download. All lists are used for both censorship and surveillance unless otherwise noted.

TOM-Skype 3.6.4.316, 3.8.4.44, 4.0.4.226, 4.2.4.104

• Built-in keyfile:
  • Crypt
  • Plain
  • Plain with machine translation
• TOM-Skype 3.6.4.316, 3.8.4.44 clients download keyfile from http://skypetools.tom.com/agent/newkeyfile/keyfile (retrieved 4/20/2011):
  • Crypt
  • Plain
  • Plain with machine translation
• TOM-Skype 4.0.4.226, 4.2.4.104 clients download keyfile from http://a[1-8].skype.tom.com/installer/agent/keyfile (retrieved 4/20/2011):
  • Crypt
  • Plain
  • Plain with machine translation

TOM-Skype 5.0.4.14, 5.1.4.10

• Built-in keyfile:
  • Crypt
  • Plain
  • Plain without regular expression markup
  • Plain without regular expression markup, with machine translation
• TOM-Skype 5.0.4.14, 5.1.4.10 clients download keyfile from http://skypetools.tom.com/agent/keyfile (retrieved 4/20/2011):
  • Crypt
  • Plain
  • Plain with machine translation
  • See below for human translations
• TOM-Skype 5.1.4.10 additionally downloads a keyfile from http://skypetools.tom.com/agent/keyfile_u used only for surveillance but not for censorship (retrieved 4/20/2011):
  • Crypt
  • Plain
  • Plain with machine translation
  • See below for human translations

TOM-Skype 5.5.4.62, 5.8.4.64, 5.9.4.12, 5.10.4.18

• Downloads keyfile from http://a[1-8].skype.tom.com/installer/agent/keyfile5.5/keyfile (retrieved 12/18/2012):
  • Crypt
  • Plain
  • Plain with machine translation
• Additionally downloads keyfile from http://a[1-8].skype.tom.com/installer/agent/keyfile5.5/keyfile_u used only for surveillance but not for censorship (retrieved 12/18/2012):
  • Crypt
  • Plain
  • Plain with machine translation

TOM-Skype for Android 2.7

• Downloads keyfile from http://skypetools.tom.com/agent/newkeyfile/keyfile_a (retrieved 3/1/2012):
  • Crypt
  • Plain
  • Plain with machine translation
• Additionally downloads keyfile from http://skypetools.tom.com/agent/newkeyfile/keyfile used only for surveillance but not for censorship. This is just the same keyfile that both TOM-Skype 3.6.4.316 and 3.8.4.44 use for both censorship and surveillance.

Human Translations

We have human translations for the keyfiles above downloaded on 4/20/2011 by TOM-Skype 5.0.4.14 and 5.1.4.10:

• TOM-Skype 5.0.4.14, 5.1.4.10 human translations
• TOM-Skype 5.1.4.10 surveillance-only human translations

For questions or comments regarding the human translations, contact .

Decryption

These python programs decrypt TOM-Skype's encrypted keyfiles and surveillance traffic. All but the first require PyCrypto to run.

• decrypt1.py, for decrypting:
  • The built-in keyfiles for 3.6.4.316, 3.8.4.44, 4.0.4.226, and 4.2.4.104
  • http://skypetools.tom.com/agent/newkeyfile/keyfile_a (used in Android 2.7)
  • http://skypetools.tom.com/agent/newkeyfile/keyfile (used in Android 2.7 for only surveillance but used in 3.6.4.316, 3.8.4.44 for censorship and surveillance)
  • http://a[1-8].skype.tom.com/installer/agent/keyfile (used in 4.0.4.226, 4.2.4.104)
• decrypt2.py, for decrypting:
  • The built-in keyfiles for 5.0.4.14 and 5.1.4.10
  • http://skypetools.tom.com/agent/keyfile (used in 5.0.4.14, 5.1.4.10)
  • http://skypetools.tom.com/agent/keyfile_u (used in 5.1.4.10 for surveillance only)
• decrypt3.py, for decrypting surveillance traffic sent by TOM-Skype 3.6.4.316 and 3.8.4.44
• decrypt4.py, for decrypting surveillance traffic sent by TOM-Skype 4.0.4.226, 4.2.4.104, 5.1.4.10, 5.5.4.62, 5.8.4.64, 5.9.4.12, 5.10.4.18
• decrypt5.py, for decrypting:
  • http://a[1-8].skype.tom.com/installer/agent/keyfile5.5/keyfile (used in 5.5.4.62, 5.8.4.64, 5.9.4.12, 5.10.4.18)
  • http://a[1-8].skype.tom.com/installer/agent/keyfile5.5/keyfile_u (used in 5.5.4.62, 5.8.4.64, 5.9.4.12, 5.10.4.18 for surveillance only)
• decrypta.py, for decrypting surveillance traffic sent by TOM-Skype 2.7 for Android

This material is based upon work supported by the National Science Foundation under Grant No. 0844880. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.