Enterprise networks are already blocking messenger applications are actively engaged in monitoring P2P traffic and tweaking application firewalls to capture valid patterns of disruptive, noisy freeware applications such as Skype. I know some of the companies that uses Skype as an alternative medium for internal communication and some believe Skype traffic brings misery to their networks. Many people have done numerous testing to understand mysterious behavior of Skype traffic. Its encryption is indecipherable because it is a closed source, not shared for public, many argue this is vulnerable for Man-In-the-Middle (MITM) attacks although no one knows how the keys are exchanged. Skype traffic characteristics are dynamically changes and work through almost any NAT based firewall. UDP and TCP ports it uses differ randomly; even length of the packet and voice sample sizes vary in each time.
Some argue, neither Skype VoIP nor Skype IM poses any readily exploitable security threat, none of the black hat websites nor hacker forums so far mentioned a single incident of Skype being exploited for sinister security attacks. Bandwidth also not a huge concern (unless you become a SuperNode - explained later) A Skype voice session uses 32K to 46kbps of traffic in each direction and that is not a huge, but few dozen of internal users concurrently uses Skype calls could even fill up a T-1 worth of pipe.
Skype calls are routed through the Skype-network via other Skype running systems, these are called SuperNodes. Any PC running Skype risks becoming a SuperNode, why? Let's say you have fast internet connection (cable / ADSL2+) with a high end system with higher CPU/Memory with a direct IP connection to the internet, then my skype calls may end up routing through your PC! SuperNode can generate a considerable noise by opening a large number of concurrent connections for other systems, it doesn't matter you stop using Skype on your PC, it will still route calls. In order to stop this behavior you literally need to bounce your computer.
Irony is, before you install skype literally you have to agree upon being a SuperNode.
Quote from EULA:
4.1 Permission to utilize Your computer. In order to receive the benefits provided by the Skype Software, you hereby grant permission for the Skype Software to utilize the processor and bandwidth of Your computer for the limited purpose of facilitating the communication between You and other Skype Software users.
Countries like EU, US and Australia, there are very restrictive traffic caps, for 6GB monthly download, residential ADSL customers in Australia would pay around $50 per month. Excess traffic will cost far more. So cost of being a SuperNode is an expensive proposition! In an enterprise network it will be hugely disruptive and causes damn too much noise by disrupting legitimate applications.
So far there is no pragmatic way of blocking this undetectable, untraceable Skype traffic but very soon IPS vendors will work a way out. At this juncture, there is no such solution commercial or / open source solution that stops Skype calls permanently.
