Researchers ID Skype, BitTorrent Users

Scary by AcesHidden · 2011-10-21 05:49 · Score: 1

Privacy is but an illusion.

Re:Scary by ackthpt · 2011-10-21 06:07 · Score: 1

Privacy is but an illusion.
Yep. RIAA & MPAA dollars at work? If not, I bet they are keenly interested. Very keenly.
Still bugs me, 15+ years on that a lot of spam and other mischief on the internet hasn't been shut down. All the information is there.

--

A feeling of having made the same mistake before: Deja Foobar
Re:Scary by shoehornjob · 2011-10-21 07:09 · Score: 1

Maybe the so called "researchers" (MAFIAA research department) need to leave that sh!t alone and respect my privacy. I looked into using Skype for Video conferencing but their application was incredibly intrusive.

--
"We are just a war away from Amerikastan. When god vs god the undoing of man." Dave Mustaine
Re:Scary by __aavevi421 · 2011-10-22 03:37 · Score: 1

Political dissidents are child molesters now? Dick head.
Re:Scary by WorBlux · 2011-10-22 06:52 · Score: 1

So the U.S. navy is a bunch of child molesters? Tor is just a tool to increase privacy and security online. What people use it for is their own responsibility. Abusus non tollit usum. (Abuse is no argument against proper use)

Quick! by Anonymous Coward · 2011-10-21 05:50 · Score: 1

Unplug the internet!

Re:Quick! by taoareyou · 2011-10-21 07:40 · Score: 1

Imprison the user!
Re:Quick! by pakar · 2011-10-21 21:48 · Score: 1

Pickaxe?

Researchers? by HellYeahAutomaton · 2011-10-21 05:51 · Score: 1, Flamebait

C'mon!

Where do they get off calling these guys researchers, when they are clearly criminals attempting to invade the reasonably expected privacy of Skype users and BT users? These guys are peeping toms at best and identity thieves at worse.

Hold the organizations that employ these guys accountable.

Re:Researchers? by bigredradio · 2011-10-21 05:57 · Score: 2

I guess it will depend on who they are working for. If it is for the CIA, FBI or RIAA, then they are crime fighters. If they work for Anonymous, Wikileaks, or the Chinese government, then they are criminals.

--
Flexible bare-metal recovery for Linux/UNIX
Re:Researchers? by joebok · 2011-10-21 05:59 · Score: 5, Insightful

If they were criminals, wouldn't they keep their methods secret in order to blackmail or otherwise monetize it in some way? Research like this is the only way that security gets better.
Re:Researchers? by pclminion · 2011-10-21 06:01 · Score: 2

Are you some kind of dumbshit? You'd rather the government did this to you and you had no idea it was possible? Now we know this form of tracking is possible and we can develop a defense against it.
Re:Researchers? by Stalks · 2011-10-21 06:04 · Score: 4, Informative

If you use bittorrent, then you should expect no privacy at all as the protocol openly allows others to get the list of users.
Re:Researchers? by Nom+du+Keyboard · 2011-10-21 06:15 · Score: 1

C'mon!
Where do they get off calling these guys researchers, when they are clearly criminals attempting to invade the reasonably expected privacy of Skype users and BT users? These guys are peeping toms at best and identity thieves at worse.
Hold the organizations that employ these guys accountable.
I can only hope that my taxpayer money hasn't gone to fund this "research".

--
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Re:Researchers? by Lunix+Nutcase · 2011-10-21 06:17 · Score: 1

invade the reasonably expected privacy of Skype users and BT users?
For Skype users you might have a point but bittorrent works by publicly broadcasting your IP to the swarm. That's like standing outside shouting your name and social security number and claiming you had an expectation of privacy.
Re:Researchers? by jdavidb · 2011-10-21 06:29 · Score: 1

reasonably expected privacy
In other words, you'd like everyone to see this issue the way you do, so you call your expectations reasonable and anyone who disagrees with you is unreasonable.
Privacy costs. Not necessarily money, but it costs. Sure I avert my eyes if I run into someone's private moment, but if I really want to be private, I consider it my own responsibility to take precautions to achieve that.

--
Secession is the right of all sentient beings.
Re:Researchers? by postbigbang · 2011-10-21 06:30 · Score: 1

Like you have control over it. Whatchya going to do? And what good will it do ya?

--
---- Teach Peace. It's Cheaper Than War.
Re:Researchers? by Anonymous Coward · 2011-10-21 06:36 · Score: 1

What if they're professors from the Polytechnic Institute of New York University using a grant from the National Science Foundation? They only acknowledge the one grant for funding. They say it was "partially" funded through that but I have a hard time believing that a part of NYU would leave something as important out as getting funding from a party that had uncomfortable relations with the subject.
Besides, if you read the paper, they call it a "security threat" and the theoretical users of the method "attackers." Plus they throw the word "scheme" around a lot too. It might be used by the RIAA but it's not like the vulnerability didn't exist without this study.
Re:Researchers? by MrSmith0011000100110 · 2011-10-21 06:44 · Score: 1

Hasn't anyone learned from Aaron Barr? Don't fuck with people on the net you don't know. They can/will get you. That's obviously besides the legal implications of these "researchers". First, sniffing internet traffic is illegal...even google got in trouble for doing that "accidentally". Second, there is absolutely no way to correlate the data without stealing files or potentially protected IP from the "target" computer. So these "researchers" should be prosecuted to the fullest degree of the law...just like the people they're working for usually want to do to the rest of us.
Re:Researchers? by HellYeahAutomaton · 2011-10-21 06:49 · Score: 1

> In other words, you'd like everyone to see this issue the way you do, so you call your expectations reasonable and anyone who disagrees with you is
> unreasonable.
I can buy into Linus's law for the idea of making public problems that exist in security and software. However, this goes above and beyond and has directly subjected 100,000 users purposefully to unwarranted intrusion (an act of aggression) on their communications directly. It doesn't matter *who* does this.
It is wrong.
reasonable expectation of privacy: An objective, legitimate or reasonable expectation of privacy is an expectation of privacy generally recognized by society.
Is it a public service as a researcher to point out that if a person's home which appears to be secure is currently no longer secure while leaving the front door wide open? Perhaps.
Is it a public service for the researcher to walk inside and help themselves to your wife and your beer? Absolutely not.
Re:Researchers? by Joce640k · 2011-10-21 07:13 · Score: 1, Informative

If bittorrent data is arriving at your machine then somebody's got your IP address. Period. No way around it.

--
No sig today...
Re:Researchers? by postbigbang · 2011-10-21 07:32 · Score: 1

Feel free to suggest a legal procedure that has a chance of working. Failing that, dream on.

--
---- Teach Peace. It's Cheaper Than War.
Re:Researchers? by jdavidb · 2011-10-21 09:38 · Score: 1

Is it a public service for the researcher to walk inside and help themselves to your wife and your beer? Absolutely not.
Nothing of the sort has happened, unless I'm missing something.

--
Secession is the right of all sentient beings.
Re:Researchers? by jdavidb · 2011-10-21 09:41 · Score: 1

reasonable expectation of privacy: An objective, legitimate or reasonable expectation of privacy is an expectation of privacy generally recognized by society
You are repeating your beliefs instead of addressing my point.

--
Secession is the right of all sentient beings.
Re:Researchers? by E.I.A · 2011-10-21 10:58 · Score: 1

How does this comment get "flamebait" and the one saying essentially the same thing below gets 5 for "interesting". You guys need to lighten up a bit with the trigger-happy troll crap. I get branded a troll every time I make a joke. wtf?

--
Laws are like sausages. It's better not to see them being made. - Otto von Bismarck
Re:Researchers? by OeLeWaPpErKe · 2011-10-22 04:35 · Score: 1

Hi dear AC,
Google for these technologies : NAT, VPN, Tor, Proxy, Anomymizing proxies, Overlay networks, Distributed hashtables, ...
Re:Researchers? by HellYeahAutomaton · 2011-10-24 03:05 · Score: 1

http://en.wikipedia.org/wiki/Expectation_of_privacy
An objective, legitimate or reasonable expectation of privacy is an expectation of privacy generally recognized by society.
Re:Researchers? by jdavidb · 2011-10-26 06:05 · Score: 1

Once upon a time society also generally recognized that the earth was flat, that the world was created by God, and that homosexuals should be tortured and burned. Popularity contests are no way to decide morality.

--
Secession is the right of all sentient beings.
Re:Researchers? by HellYeahAutomaton · 2011-10-26 06:29 · Score: 1

You can't have it both ways -- first accusing of wanting to have the view as my way, and then against the general accepted view of the majority. Most people, liberty loving people see the view my way and in this case, since no one is harmed by this expectation it probably is morally correct.
You've only just proven yourself to be obstinate and disagreeable, citing irrelevant causes.

Privacy by Alunral · 2011-10-21 05:53 · Score: 1

So what's this old thing we used to call privacy? Is this even legal for them to be doing? Or will it, like everything else, fall into that gray area and be used against everyone?

Re:Privacy by Lunix+Nutcase · 2011-10-21 05:57 · Score: 1

What's illegal about it? What federal or state statute have they violated?
Re:Privacy by Nom+du+Keyboard · 2011-10-21 06:16 · Score: 1

What's illegal about it? What federal or state statute have they violated?
They have wiretapped your Skype calls for identifying information. Is that enough for you?

--
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Re:Privacy by znerk · 2011-10-21 06:16 · Score: 4, Interesting

What's illegal about it? What federal or state statute have they violated?
Wiretapping. Conspiracy to collect information assumed to be private, via technological means.
Robocalling (the Skype phone, duh). Wardialing (same thing).
They've violated a boatload of communications regulations... and the fact that they did it as part of a multi-researcher study means it was premeditated, and they conspired to do it. Conspiracy to commit a misdemeanor is a felony.
The problem here would be that anyone who tries to have them arrested and/or takes them to civil court will be presumed guilty of something, because why else would we care if someone can tie our online activities to our real-world identities?

--
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
Re:Privacy by nfc_Death · 2011-10-21 06:17 · Score: 1

Um collecting and storing personal data without an investigators license.
Re:Privacy by Lunix+Nutcase · 2011-10-21 06:18 · Score: 1

No they haven't. They've.only figured out the ip address. They aren't tapping the call.
Re:Privacy by Lunix+Nutcase · 2011-10-21 06:19 · Score: 2

An ip address you.publicly broadcast is personal information?
Re:Privacy by Lunix+Nutcase · 2011-10-21 06:22 · Score: 1

Since when is your ip address assumed to private when you are publicly broadcasting it all the time?
Re:Privacy by localman57 · 2011-10-21 06:43 · Score: 1

On top of that, it's not even like they're sniffing out packets on a public network. As I understand it, Skype uses YOUR computer to route / connect calls you may not be involved in. It seems to me that if someone sends an IP packet to your PC, you should be able to do anything with it you please. Sending malicious packets to another PC may be another story...
Re:Privacy by nfc_Death · 2011-10-21 06:51 · Score: 1

Personal information gathered without an investigators license is against the law. Correlation of a skype phone number with an IP address and data mining for that correlation is acting as a private investigator without a license.
Your argument is what? That an IP is semi-public info?
What does that have to do with the price of tea in china?
Re:Privacy by Jackie_Chan_Fan · 2011-10-21 06:53 · Score: 3, Insightful

It should be considering it is the path to the machine that holds all of your personal information.
When you get a key duplicated, a key maker can easily sell a copy of that key, and link it to your name. What if your name is Bill Gates? "This key here is for Bill Gate's personal safe, and this one is for his house, perhaps you would like a copy?"
Just because its available, doesnt mean its not private, or doesnt come with some expectation of privacy. I dont expect the key maker to sell a copy of my key to someone who intends to harm me.
Re:Privacy by znerk · 2011-10-21 07:36 · Score: 1

How many people do you know, other than us slashdotters, that realize they have an IP address when their equipment has a connection to the internet?
How many even know what an IP address is?

--
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
Re:Privacy by Khyber · 2011-10-21 10:52 · Score: 1

"Personal information gathered without an investigators license is against the law."
Only in certain states. There is no Federal ruling on this issue that I am aware of.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Re:Privacy by rocket+rancher · 2011-10-21 15:27 · Score: 1

Personal information gathered without an investigators license is against the law. Correlation of a skype phone number with an IP address and data mining for that correlation is acting as a private investigator without a license.
Your argument is what? That an IP is semi-public info?
What does that have to do with the price of tea in china?
Dude, don't be an idiot -- look up public domain at your nearest law library before you go trolling again.
Re:Privacy by rocket+rancher · 2011-10-21 15:45 · Score: 1

So what's this old thing we used to call privacy? Is this even legal for them to be doing? Or will it, like everything else, fall into that gray area and be used against everyone?
You don't put private information on computers that are connected to other computers that you don't control, because the information will not stay private. There is no expectation of privacy on the internet, any more than there is an expectation of privacy in a theater, or at a sporting event, or in a restaurant, or rolling down the street as a passenger on a public bus.
Tell me -- would you conduct confidential business at a restaurant, or store your private records under your seat at the theater, or go over your credit card bills at the ball game? Of course you wouldn't -- it is only fucking common sense, right? Why would the net be any different? Nobody is forcing you to put your private records on a publicly accessible device like an internet-connected computer, so be smart and don't do it voluntarily, either.
Re:Privacy by nfc_Death · 2011-10-21 17:55 · Score: 1

http://arstechnica.com/tech-policy/news/2008/02/mediasentry-role-in-riaa-lawsuit-comes-under-scrutiny.ars
Idiot huh? Nice response.
Re:Privacy by Alunral · 2011-10-21 20:03 · Score: 1

And it's thinking like that is what's getting us into this mess. The internet is not something like that anymore, it is a viable resource that should not be controlled like that. Banking, money transfers, private things, creditcard information all happens on the internet. It is not some toy anymore, it is just as much a part of business, and life, as anything else is. Are we not allowed to have privacy on it?

Packet sniffing by Anonymous Coward · 2011-10-21 05:58 · Score: 2, Interesting

Seeing as how this relies on packet sniffing of an unaware party's network traffic, I'm pretty sure any application of this without a warrant would constitute wiretapping. Correct me if I'm wrong, but that's my understanding of it.

Re:Packet sniffing by Lunix+Nutcase · 2011-10-21 06:08 · Score: 2

People are actually unaware that they are broadcasting their ip address when on the internet? Really? Especially those using bittorrent that works through broadcasting yourself to the swarm.
Re:Packet sniffing by mcavic · 2011-10-21 06:13 · Score: 1

Skype uses your computer to carry other people's traffic, and I assume BT is very similar. The question is whether you're entitled to sniff the data that's flowing through your own computer.

In other words, if you stand outside my window, talk on your cell phone, and I hear you, it's not eavesdropping.

That being said, Skype traffic is supposed to be encrypted.
Re:Packet sniffing by GameboyRMH · 2011-10-21 06:20 · Score: 1

Nope doesn't seem that it requires any kind of interception, just specialized local traffic analysis. It does require that you have accurate personal information in your Skype profile. Good luck finding me from that.

--
"When information is power, privacy is freedom" - Jah-Wren Ryel
Re:Packet sniffing by Bucky24 · 2011-10-21 06:39 · Score: 1

The Skype protocol should be easy enough to detect, and all they need to know is that Skype is in use, not the communication data.

--
All the world's a CPU, and all the men and women merely AI agents
Re:Packet sniffing by znerk · 2011-10-21 07:44 · Score: 2

A packet analyzer (also known as a network analyzer, protocol analyzer or sniffer, or for particular types of networks, an Ethernet sniffer or wireless sniffer) is a computer program or a piece of computer hardware that can intercept and log traffic passing over a digital network or part of a network.
http://en.wikipedia.org/wiki/Packet_analyzer
Sniffing doesn't necessarily require opening the packets. Think of it this way: if you want to know who someone is sending mail to, and who they're receiving mail from, then all you need to do is look at the fronts of the envelopes in their mailbox - sender and receiver address information is there for all to see. You don't actually care what's written inside, you just want to know who they're talking to.
Of course, it's still illegal to tamper with the mail, but if you didn't actually open the mail, then you might just get a slap on the wrist, instead of a few years in the federal penitentiary - assuming it was proven you touched the mail in the first place.

--
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
Re:Packet sniffing by Lunix+Nutcase · 2011-10-21 09:20 · Score: 2

So your complaining that they are doing nothing different than every bittorrent client does?
Re:Packet sniffing by Khyber · 2011-10-21 10:53 · Score: 1

"Example: satellite TV signals are being broadcast at you all the time, but it's illegal to receive and decrypt them without paying the provider."
Not according the the FCC which made rulings on OTA signals being intercepted. If it hits your property, you're free to intercept.
This is how police scanners are legal.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Re:Packet sniffing by WorBlux · 2011-10-22 07:03 · Score: 1

Look at the next sentence

As data streams flow across the network, the sniffer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications.
The actually verify the packet is a Skype one you have to pull it apart more that if you were merely going to route it.
Re:Packet sniffing by znerk · 2011-10-27 01:53 · Score: 1

[To] actually verify the packet is a Skype [packet] you have to pull it apart more [than] if you were merely going to route it.
... unless you happen to know that the destination IP belongs to a Skype service node, in which case all you need to know is where the packet is going - especially since you won't (in theory) be able to decode any information in the packet in the first place. Skype packets are encrypted, making packet disassembly a waste of time that could be used instead to correlate your internet traffic with individual components of a BitTorrent swarm and a known trafficker in Skype communications, without having to (or being able to) spy on what you were actually talking about on that Skype call.
This is an example of a side channel attack.
On the bright side, it's likely to be inadmissible as evidence in court, due to the fact that the information is obtained via methods that will probably be deemed illegal; wiretapping without a warrant is illegal in most jurisdictions. On the not-so-bright side, that's unlikely to deter anyone; it should be easy enough to use the illegal evidence to construct a legal fiction in order to obtain the information in other ways.

--
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
Re:Packet sniffing by znerk · 2011-10-27 02:43 · Score: 1

I know, bad form to reply to my own post, but I neglected to include some information that I felt was important enough to warrant the breach of netiquette.
Firstly, I wish to point out that my original intent was to show you that packet sniffing was indeed used in the attack (or information-gathering methodology, if you prefer).
Second, I would like to explain that it is not necessary to decode or decrypt the information in the packets, themselves, as the intent is to identify an individual, rather than to identify the content they are transmitting or receiving. The correlation is made between an individual BitTorrent user's traffic, and an (assumed to be the same) individual Skype user's traffic. The only information required for that inference is the source and destination of the packets.
That is to say, packet sniffing is involved. As you yourself quoted at me, the second paragraph of the wiki entry indicates (emphasis mine):

As data streams flow across the network, the sniffer captures each packet and, if needed, decodes the packet's raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications.
"Packet sniffing" does not necessarily indicate decryption/decoding. In this particular instance, the main concern is observing that packets are flowing, and sampling the sender and receiver information. The information indicating the packet's source and its destination are the only pertinent data, and are available with no more than a cursory glance at the packet to obtain the routing information. In other words, no more information is required than "if you were merely going to route it".
Being able to correlate the connection between the user and the BitTorrent swarm they are participating in, as well as correlating the user and the Skype node they are connected to, allows the observer (or attacker, depending on your viewpoint) to determine that a particular IP address that is communicating via the BitTorrent protocol is also communicating via the Skype protocol - if nothing else, the assumption that continued communication with IP addresses known to serve Skype and others that are known to serve BitTorrent seems to indicate that the required protocols are being observed.
IP Spoofing can not protect against this, as the communication is necessarily two-way, and without an accurate "return address" on the "envelope", the "package" will never be able to be successfully responded to - that is to say, the user would never receive the requested information because the address to send it to is false.
It is true that I have not read the article, and I am also not a Skype user. I am unaware of exactly how they are obtaining the identifying information from the Skype network.... but the fact remains that the "researchers" are able to obtain identifying information by correlating data from encrypted traffic - or more accurately, from the source and destination of that traffic.
As an aside, I am no longer quite so certain that this methodology will be deemed illegal, as the contents of the "conversation" are not necessarily discovered. Merely the fact of the conversation's existence seems to be enough to (accurately) point a finger.

--
This work is licensed under a Creative Commons Attribution 3.0 Unported License.

Skype incoming call... by Andrewkov · 2011-10-21 05:59 · Score: 4, Funny

Ring ring... incoming Skype call, it's the RIAA.

Re:Skype incoming call... by mcavic · 2011-10-21 06:15 · Score: 1

That's why I don't use Bit Torrent.
Re:Skype incoming call... by interval1066 · 2011-10-21 06:27 · Score: 1

Skype alone isn't worth the time developers seem to be spending on it, so I avoid it where possible. The quality is so bad, I can't understand anything the other party is saying. I'm not dropping my torrent streams though.

--
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
Re:Skype incoming call... by mcavic · 2011-10-21 06:32 · Score: 1

Skype is very good for me, as long as the network is reliable on both ends. Having the firewall port open on both ends (uPnp should do it) is helpful too.
Re:Skype incoming call... by Jackie_Chan_Fan · 2011-10-21 06:54 · Score: 1

What? Skype has incredible audio quality.
Re:Skype incoming call... by Gyorg_Lavode · 2011-10-21 07:45 · Score: 1

Skype quality is extremely dependent on hardware and room acoustics. If we can compress, stream, and decode MP3s in real time, the technology is likely not the problem. Instead, I think people simply are unwilling to pay real money for a simple microphone. However, a lot of nicer webcams seem to come with very nice Mics.

--
I do security
Re:Skype incoming call... by znerk · 2011-10-21 07:48 · Score: 1

Depends on your internet speed and what else is making traffic in your vicinity. I've had Skype calls so bad that I literally could not understand what information the caller was attempting to convey.

--
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
Re:Skype incoming call... by Khyber · 2011-10-21 10:55 · Score: 1

If you have bad quality on Skype, it's time to upgrade your box, or reinstall your OS.
I've had pretty much zero issues unless I'm on some bad wireless network.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Re:Skype incoming call... by fluffy99 · 2011-10-21 11:00 · Score: 1

Skype quality is extremely dependent on hardware and room acoustics. If we can compress, stream, and decode MP3s in real time, the technology is likely not the problem. Instead, I think people simply are unwilling to pay real money for a simple microphone. However, a lot of nicer webcams seem to come with very nice Mics.
Except we can buffer the MP3 stream to smooth out latency, jitter, packets arriving out of order, and retransmit dropped packets if need be. You can't do that with Voice over IP, as adding more than about 1/2-second.2 seconds latency is very noticeable.
http://www.voip-news.com/faq/voip-service-level-faq/
Re:Skype incoming call... by interval1066 · 2011-10-21 12:38 · Score: 1

Nope, I have a state of the art rig with an i7 quad core processor and plenty o ram + 1.5Mbs bandwidth connection. Its not me, its the protocol. Unless everyone I talk to has a shitty setup like your describing.

--
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
Re:Skype incoming call... by Khyber · 2011-10-22 03:35 · Score: 1

2.6 GHz AMD Athlon64 X2 5200+, 1.5 GB RAM, 30 mbit down 5 mbit up cable. I only tend to have issues when using wireless networking.
You don't mention your OS.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Re:Skype incoming call... by interval1066 · 2011-10-22 04:04 · Score: 1

On that rig its windows 7.

--
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
Re:Skype incoming call... by Khyber · 2011-10-22 10:00 · Score: 1

I've got Windows 7 Home Premium 64-bit. No issues.
Video is fine.
OTOH, G+ hangouts work better, and you get up to 10 people for free in a video conference.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.

This years hottest horror movie by Jumperalex · 2011-10-21 05:59 · Score: 2

ring ring ring
"Hello." ... ... ...
"Hello? Is there anyone there?" ... ... ...
"We know what you downloaded last summer!!!"

--
If you can't be good, be good at it!

Re:This years hottest horror movie by ackthpt · 2011-10-21 06:14 · Score: 1

ring ring ring
"Hello." ... ... ...
"Hello? Is there anyone there?" ... ... ...
"We know what you downloaded last summer!!!"
"Um. My house was burgled who curiously didn't break a window, lock or leave fingerprints anywhere. Prove me wrong!"

--

A feeling of having made the same mistake before: Deja Foobar
Re:This years hottest horror movie by mcavic · 2011-10-21 06:18 · Score: 1

Don't forget the sequel: We still know what you downloaded 3 years ago.
Re:This years hottest horror movie by Jumperalex · 2011-10-21 06:40 · Score: 1

"We have a recording of your voice eminating from your Skype call at the IP assigned to your modem ... muwahahahahaha"

--
If you can't be good, be good at it!

can't tell if you're serious by Chirs · 2011-10-21 06:00 · Score: 3, Insightful

If the researchers can do it, the bad guys may already be doing it.

Re:can't tell if you're serious by ackthpt · 2011-10-21 06:19 · Score: 1

If the researchers can do it, the bad guys may already be doing it.
If you mean RIAA or MPAA, they usually don't bother with this level of stuff, they just kick down your door, grab your stuff and up-end their Bucket o' Lawyers on your.

--

A feeling of having made the same mistake before: Deja Foobar
Re:can't tell if you're serious by ArhcAngel · 2011-10-21 07:01 · Score: 1

I don't think the sale of Skype is finalized yet but you can be sure as soon as it is this will be an invaluable tool of the Empire to combat piracy.

--
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K

This is not research. by spicyed · 2011-10-21 06:01 · Score: 5, Insightful

All it is is data mining packets from skype nodes and comparing them to open torrent peer lists. This is not really surprising or scary to me. There are other 'researchers' who can link alot more data to you then this.

Re:This is not research. by ackthpt · 2011-10-21 06:23 · Score: 1

All it is is data mining packets from skype nodes and comparing them to open torrent peer lists. This is not really surprising or scary to me. There are other 'researchers' who can link alot more data to you then this.
All the better reason to lock down your wireless network.

--

A feeling of having made the same mistake before: Deja Foobar
Re:This is not research. by znerk · 2011-10-21 08:32 · Score: 1

All it is is data mining packets from skype nodes and comparing them to open torrent peer lists. This is not really surprising or scary to me. There are other 'researchers' who can link alot more data to you then this.
All the better reason to lock down your wireless network.
... to make absolutely certain that the traffic they're sniffing couldn't possibly come from an outside agent?
Way to paint a target on your forehead.

--
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
Re:This is not research. by fluffy99 · 2011-10-21 11:03 · Score: 1

All it is is data mining packets from skype nodes and comparing them to open torrent peer lists. This is not really surprising or scary to me. There are other 'researchers' who can link alot more data to you then this.
All the better reason to lock down your wireless network.
I have mine unlocked thank you. I have a Netopia Wireless router which advertises two SSIDs. One is wide open for visitors and only has access to the internet. The other SSID can access both my internal network and the internet. This avoids my daughters friends having to ask what the password is every time they visit, and gives me some plausible deniability if I ever get questioned.

CLEARLY authoritative by Anonymous Coward · 2011-10-21 06:03 · Score: 4, Insightful

Because NAT and UPNP wouldn't make a random Skype user and a different BitTorrent user appear to be coming from the same IP address..

Re:CLEARLY authoritative by vux984 · 2011-10-21 06:15 · Score: 1

If the IP traces back to a verizon dsl modem, then its authoritative enough to know its either you or your mom. Just because there is some edge case out there doesn't change the fact that this CAN be used to sniff users out with high reliability a large percentage of the time.
Re:CLEARLY authoritative by Technician · 2011-10-21 06:38 · Score: 1

For us poor linux users with poor Skype performance and and such, I've used SIP instead. Just recently the SIP provider IPPI.fr has added a skype gateway that appears to work great.
I rarely use Bit Torrent as FTP is much faster for legal files, even if I was talking to someone on Skype while using BT, It would not show a connection. The Skype connection would be an IP in France.
I use SIP instead of Skype. i can connect it to a telephone with an old Vontage adapter or a Linksys PAP2T. With IPKall, I have unlimited free incoming minutes. Like Skype, SIP to SIP calls are free worldwide. With IPPI, I also get a free INUM number for incoming international calls. Most SIP accounts can call a INUM for free. The speed dialer included allows me to enter Skype numbers so they can be speed dialed with just the phone. No computer needed.

New: ippi lets you call Skype users for free!
If you follow ippi on Twitter and Facebook, you already know since late July that ippi can make calls to Skype users for free! Even better, ippi also allows Skype users free calls to users ippi !
Directions:
- To call from ippi to Skype, dial skype_id@skype.ippi.com and start the call
- To call from Skype to ippi, dial skype2ippi (add this contact for ease), then, when you get a chat message, send as a chat message the ippi login you wish to call (or ippi number)
For more information, our support is at your disposal.

--
The truth shall set you free!
Re:CLEARLY authoritative by znerk · 2011-10-21 07:25 · Score: 1

Because NAT and UPNP wouldn't make a random Skype user and a different BitTorrent user appear to be coming from the same IP address..
No, it wouldn't. "Random" implies that they wouldn't necessarily know each other, whereas "same ip" implies they have knowledge of one another, since they are operating from the same physical network address.

--
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
Re:CLEARLY authoritative by vux984 · 2011-10-21 10:20 · Score: 1

or a guest at your home
And if that torrent is up for 3 months? At what point does guest become "resident"?
or a neighbor using your unsecured wireless signal.
My wireless is not unsecured.
Only in America does an IP address equal a person.
Nobody said it equalled a person. But it gets you close enough to a person often enough that you can't shove your head in your ass and pretend that your safe or immune from being looked at.
If someone is shot with a gun registered to you, that doesn't prove you pulled the trigger ... maybe it was your house guest... or your neighbor borrowed it because you left the back porch door unlocked... so what? You can bet your ass they are going to take a good hard look at you anyway.

Re:Encryption? by Lunix+Nutcase · 2011-10-21 06:09 · Score: 1

You are still broadcasting your ip even when using encryption. How else do you think you create connections to others in the swarm?

Re:dump skype? by ToiletBomber · 2011-10-21 06:13 · Score: 1

People need to shift to decentralised distributing systems.

That's precisely what Bittorrent is...

And Why Are We Happy About This? by Nom+du+Keyboard · 2011-10-21 06:14 · Score: 1

And why are we happy that researchers seem to think that the more that they can do to strip away privacy as actually a Good Thing? Why not instead work out systems to make our computers more resistant to virus/trojan/rootkit infections. THAT would actually benefit the majority of us overall.

--
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."

Re:And Why Are We Happy About This? by znerk · 2011-10-21 08:22 · Score: 1

The problem, despite my other posts in this thread, is not privacy. It's a lack of sane legislation.
Copyright has become a joke, completely unenforceable for nearly any digital content. It has become more and more illegal to do things that would have been considered "fair use" just a few years ago. Adding to this is the fact that digital media can't be "loaned to a friend", which increases the feeling of being treated like a criminal, which causes the users to be less and less inclined to actually follow the rules in the first place.
It's an arms race, and the world already had one of these. It was called the Cold War, and it nearly resulted in world-wide destruction. Unfortunately, humanity doesn't seem to have learned that escalating both sides of a conflict leads only to violence.
What we need is a new media distribution system that has the consumers' rights built into the relationship between the consumer and the content producer. I don't have any idea what that system might be, but almost anything would be better than the system we have now, where pirating digital media results in a superior quality product (less intrusion to the content itself, with quality not far below the physical media in most cases).

--
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
Re:And Why Are We Happy About This? by Rhacman · 2011-10-21 08:23 · Score: 1

Are you arguing that we'd have more privacy if we ignored the vunerability than if the researchers had published it? Are you advocating privacy through obscurity... on Slashdot of all places?

--
Account -> Discussions -> Disable Sigs

Re:Encryption? by Anonymous Coward · 2011-10-21 06:17 · Score: 1

I don't know what you're talking about. My computer seeks out shady middlemen over dark fiber to ensure that all communications remain discreet.

Re:"Identity Thieves" by MobileTatsu-NJG · 2011-10-21 06:19 · Score: 1

In the situation you described, measurable damage is actually caused.

You get a D-. Go study chapters 3 and 4 again.

--

"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)

Re:Encryption? by Hadlock · 2011-10-21 06:21 · Score: 1

Well if all they're doing is matching up IP addresses between two databases, what does it matter what protocol they're using? For that matter, why is this even newsworthy? The encrypted payload, and how they're tracking encrypted BT (or perhaps, more imporantly how they know the encrypted packet is a BT packet) packets without violating the DMCA is what I'm curious about.

--
moox. for a new generation.

Re:dump skype? by icebraining · 2011-10-21 06:21 · Score: 2

Decentralizing doesn't really help, since it doesn't change the fact that Bittorrent works by advertising the IPs of the nodes and the torrents they're downloading/seeding.

What you'd need is something like onion routing, where it's hard to know who you're sharing with, even with centralized trackers.

Luckily, that exists in the form of Bittorrent over I2P.

--
Dilbert RSS feed

Moral of the story... by Lumpy · 2011-10-21 06:22 · Score: 1

Dont use Skype.

--
Do not look at laser with remaining good eye.

Re:Moral of the story... by HellYeahAutomaton · 2011-10-21 07:39 · Score: 2

SIP.
IAX.
XMPP
Re:Moral of the story... by i_b_don · 2011-10-21 10:31 · Score: 3, Interesting

I think this is the real issue here. It all has to be coming from problems with skype's security and nothing else. Skype should take this as a huge warning and encrypt their packet information NOW. I don't care what this is used for, people sniffing packets and being able to tell who someone is on a program like skype that is often left on 24/7 is a huge security risk for the person involved! This should NOT be happening and it's all skype's fault.
You guys are getting to hung up on the bit torrent aspect of this and should realize that it's really a major skype fuck up.
d

--
all language nazi's will burne in heil!
Re:Moral of the story... by Lumpy · 2011-10-24 01:39 · Score: 1

A telephone, cellphone, smoke signals, there are a lot more communication modes other than skype.

--
Do not look at laser with remaining good eye.

Re:Encryption? by GameboyRMH · 2011-10-21 06:23 · Score: 1

Most are set not to force encryption by default. That said I've forced outgoing encryption on my seedbox and the uplink stays pegged all day. I've been thinking of forcing incoming encryption to see how it goes, pretty much all BT clients do support encryption.

--
"When information is power, privacy is freedom" - Jah-Wren Ryel

From TFA by Dunbal · 2011-10-21 06:23 · Score: 1

to determine the current IP address of identified and targeted Skype user (if the user is currently active)

Moral of the story - make sure you are logged off from Skype before file sharing.

--
Seven puppies were harmed during the making of this post.

Re:From TFA by misterooga · 2011-10-21 07:22 · Score: 1

But what other apps, besides Skype, can be used for this type of tracking? I don't use BT or Skype but I'd like to know if there are any ways to prevent this, besides not using XXX or YYY. (at least at the same time.)
Re:From TFA by znerk · 2011-10-21 08:29 · Score: 2

If I am understanding the method properly, then anything that generates traffic can be used to correlate data, indicating that the BT user is also a user of (insert internet-using software here). Skype happens to be useful as an immediate indication of the identity of the user.
The question might then become, "What (legitimate) internet software might I be running, to cast doubt on whether I was using BT to acquire digital content illegally?"
For example, World of Warcraft uses BitTorrent to distribute patches, and can be configured to do so while you are logged in and playing. With the addition of the "Free to Play" aspect, your BitTorrent traffic might fly under the radar. I'm sure there are other pieces of software that can allow you to show good reason why your computer might have been servicing BitTorrent traffic...
Part of the problem, here, is that BitTorrent is coming under indirect attack by the media industry... most people will assume that "torrenting" is synonymous with "pirating".

--
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
Re:From TFA by znerk · 2011-10-21 08:31 · Score: 1

to determine the current IP address of identified and targeted Skype user (if the user is currently active)
Moral of the story - make sure you are logged off from Skype before file sharing.
... because there's no way they can acquire the Skype identification at "random time A", and then correlate that with the BitTorrent traffic at "random time B"...

--
This work is licensed under a Creative Commons Attribution 3.0 Unported License.

Re:Warning! by Anonymous Coward · 2011-10-21 06:24 · Score: 2, Funny

Fortunately I reconfigured my computer so that it doesn't broadcast an IP addr

[NO CARRIER]

Re:Encryption? by GameboyRMH · 2011-10-21 06:24 · Score: 1

True, encryption defeats wiretapping, but not swarm monitoring.

--
"When information is power, privacy is freedom" - Jah-Wren Ryel

Re:Encryption? by Lunix+Nutcase · 2011-10-21 06:24 · Score: 1

How is crawling a bittorrent swarm violating the dmca? You do realize that your IP address is publicly broadcasted, right?

Re:Encryption? by GameboyRMH · 2011-10-21 06:25 · Score: 2

Yes but you shouldn't run BT over Tor. It will be slow as shit for you and you'll be hogging the network. I encourage Tor node operators to block bittorrent over Tor (in fact I think it's blocked by default in recent releases).

--
"When information is power, privacy is freedom" - Jah-Wren Ryel

Re:First by taoareyou · 2011-10-21 06:45 · Score: 1

Fail.

Re:dump skype? by GameboyRMH · 2011-10-21 06:46 · Score: 2

I've looked at BT over I2P. It's completely incompatible with regular Bittorrent. It's a great idea but there just aren't enough users on there to make it a replacement for regular Bittorrent.

--
"When information is power, privacy is freedom" - Jah-Wren Ryel

Re:"Identity Thieves" by MobileTatsu-NJG · 2011-10-21 06:47 · Score: 1

Oh yeah? Tell us more about that.

--

"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)

Interesting but doesn't necessarily mean anything by FyberOptic · 2011-10-21 07:44 · Score: 1

But let's not confuse an IP address as being a person. Just because a Skype user is behind an IP doesn't mean the torrent user is the same person. Fortunately (and unfortunately for the media industry) the law, in America at least, is gradually beginning to make that distinction.

The bar is low with this one by Hentes · 2011-10-21 08:14 · Score: 1

So collecting IP addresses now qualifies as research? Will I become a security researcher if I post the IPs of my peers?

get a new IP address by KWTm · 2011-10-21 09:07 · Score: 1

"""Moral of the story - make sure you are logged off from Skype before file sharing."""
... because there's no way they can acquire the Skype identification at "random time A", and then correlate that with the BitTorrent traffic at "random time B"...

Right, at least for those users whose ISP gives them a dynamically reassigned IP address. Log off Skype, disconnect from the Internet and then reconnect, hopefully getting a new IP address (I remember one Slashdot user who kept getting reassigned the same "random" address), and then your IP addresses won't be correlatable.

I pity the guy who ends up with your recycled IP address, though.

--
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]

Re:get a new IP address by Dunbal · 2011-10-21 09:38 · Score: 1

I pity the guy who ends up with your recycled IP address, though.
Better yet, live in a country that recognizes that IP addresses do not correlate to specific people.

--
Seven puppies were harmed during the making of this post.

mmmmm by Chuby007 · 2011-10-21 10:16 · Score: 1

/me slowly closes skype... -.-

hmm by koan · 2011-10-21 10:30 · Score: 1

Guess who owns Skype, M$.

I smell something funny.

--
"If any question why we died, Tell them because our fathers lied."

Well DOH !!!! by microphage · 2011-10-21 14:17 · Score: 1

"Researchers have figured out a way to link online Skype users to their activity on peer-to-peer networks like BitTorrent. The team was able to sift out the nodes through which Skype calls are routed and determine the user's real IP address by sniffing the packets.

Re:TOR by lennier1 · 2011-10-21 19:32 · Score: 1

At least until the authorities come knocking because someone was downloading child pornography through the exit node you're running.

Hat on a hat... by Tyr07 · 2011-10-21 21:35 · Score: 1

It's just two NAT's? I know.. Genius right? That way, so while I'm using NAT, if I want to use NAT, I can!

Re:"Identity Thieves" by MobileTatsu-NJG · 2011-10-22 03:12 · Score: 1

When is the term 'Identity Theft' used before any damage is done?

--

"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)

Re:"Identity Thieves" by OeLeWaPpErKe · 2011-10-22 04:34 · Score: 1

Oh no the "victimless crime" thing applies to a lot of very not-ok crimes too :

credit card "theft" : usually involves duplicating credit cards, often by very impressive hacking feats
identity "theft": usually refers to stealing identification codes of other's credit cards online
breaking in your email, getting your passwords, exposing strange users at online fora ...

All of these crimes are "victimless". And if you ask hackers, all of the above should be perfectly legal, after all, you're pretty much bound to commit such crimes if you successfully break someone's security. They merely give the attacker the option of doing some damage ... just like piracy.

Re:dump skype? by WorBlux · 2011-10-22 07:09 · Score: 1

Except that all of a sudden each user needs to upload at least 3x what they download to make the system work instead of at least one times. And its still susceptible to timing attacks and supernodes.

Re:"Identity Thieves" by MobileTatsu-NJG · 2011-10-22 08:10 · Score: 1

If i ever get the chance, I will ask a hacker that. I've never heard 'victimless crime' when talking about Identity Theft. Learn something new every day.

--

"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)

Slashdot Mirror

Researchers ID Skype, BitTorrent Users

124 of 180 comments (clear)