6.11.
The Fingerprint Reader arrived finally. Now here's a curious disclaimer from MS: this should not be used as a security feature. Like buying a car and told it's no good for driving! Tried to find the reason- no luck yet... maybe I'll try looking into it tomorrow.

9.11.
Hey, just found out that Griaule makes an SDK that uses Microsoft's Fingerprint reader. You can also save _encrypted_ images to the disk with that. Maybe that's the same format as Microsoft uses...

Made a few tests, the encrypted images USE THE SAME BL***Y KEY every time! Scan two times, subtract, and lo and behold: out comes the original fingerprint! Greaaaat key management, guys...

Hmmm, to come to think of it, subtracting should produce a black image, but hey, biometric scans are never alike! And thanks to Digital Persona's good hardware, two scans are well rotated, scaled, moved and whatnot to the same position, so the differences are only the different grey-level values in the scan.

Also looks like the encryption mode is OFB: tried erasing the encrypted picture from places and exactly those places were decrypted to garbage. From encryption point of view, it would have been better if they used CFB/CBC, that at least would have given garbage out of the subtraction. Well, you can't have everything.

13.11.
Okay, I've just realized that USB-sniffers probably come in software, too, waaay cheaper it seems. Installed the one in today. It sure does generate a lot of cr... log files. From the looks of it, mostly zeroes are coming out from the reader. That CAN'T be encrypted data. Have to filter the good stuff out.

15.11.
Man, there are a lot of USB-specific stuff going in and out the reader. Building a good filter was a good idea, especially, when the SCANS BLURT OUT AS IS. No crypto at all, no siree. I wonder, prolly no keys either...

16.11.
Well that took a lot of matching. Damned image headers and type-messages... ok, but there's simply just not enough room or variety for the keys to be there. So checkmate, MS, no cipher, no key management, no nuttin'.

It is a piece of software with many layers of obfuscation, that can bypass firewalls, record your microphone, find your proxy credentials in your profiles, whose communications are encrypted and benefit from a peer to peer architecture, that can be found on many computers of governmental organisations or research laboratories. What is it? The latest backdoor? A spyware from an evil organisation?

No. It is used by your grandmother to call her sister. It's a VOIP program. It's Skype.

Many things have been said on Skype. The level of obfuscation suggests the existence of hidden dark secrets and has given birth to so many myths that we needed to go and see what was really was on. This presentation is about what we found in the belly of the beast.