Skype GPO

Hi all,

regularly we get requests from customers where the idea of using Skype as a VoIP solution in their corporate environment is brought up. There are a lot of eavesdropping and more conceptual concerns (e.g. refer to this or this, and of course the legendary “Silver Needle in the Skype” paper from Black Hat EU 2006), but those won’t be covered in this post (just to say this: at ERNW the use of Skype is strictly prohibited at by policy).

However, we worked on an interesting request that focused on Skype’s security impact on end devices, mainly concerning Windows clients. Skype has many features e.g. file sharing between users, the ability to set the port on which Skype listens, or clients becoming supernodes, which in turn can be relevant for the overall security impact on network or clients. The interesting part from a corporate perspective is the ability to configure those Skype settings via GPO, for which Skype even used to provide an ADM file. However, the settings in this file were quite outdated, which made us decide to put together a file for the settings of the most recent version of Skype. Relevant resources for this are the Skype IT Administrators Guide and a corresponding TechNet article on ADMX files (Managing Group Policy ADMX Files Step-by-Step Guide).

Our Skype ADMX files can be found here for download.

Besides the concerns of Skype usage in corporate environments in general (as mentioned above, this post does not discuss those), we want to outline some of the settings that can be relevant to protect clients and network:

• Disable File Transfer: Disable file transfer to achieve that any user can’t send any internal data trough Skype.
• Disable Contact Import: This setting prevents any user to import contacts trough the application itself, importing contacts can be realized over Skype-Manager tool.
• Disable Web Status: If you disable this setting any user can’t publish their online status.
• Disable API: Prevents usage of Skype API for third party applications.
• Disable Version Check: This setting prevents Skype to perform an initially version check.
• Memory Only: This setting makes it possible to run Skype without storing data on the local disk.
• Listen Port: Skype normally listens on a default Port, this setting restricts the port to your settings.
• Disable Supernode: This setting prevents a random user to become a supernode which makes it possible for this user to intercept traffic.
• Proxy Type: HTTPS or SOCKS5. This also enables the use of the proxy in general
• Proxy Address: “hostname:port” e.g. “socks5.mydomain.com:5050”.
• Proxy Username: “username” e.g. “socks5user”.
• Proxy Password: “password” e.g. “socks5pass”.

Despite our critical opinion on Skype, we hope that the files might help the secure operation of Skype in environments where it has to be used for some reasons.

Best,

Sebastian & Matthias

PS: We tested the files in our environment and did not experience any problems. We’re happy about bug reports, however it might take time to deploy changes and we cannot provide any support/warranty on the files.