Hacked Skype IP Address Search Shows Who's Speaking From Where

← Back to Stories (view on slashdot.org)

Hacked Skype IP Address Search Shows Who's Speaking From Where

Posted by timothy on Tuesday May 1, 2012 @04:52AM from the we-see-you-mr-appelbaum dept.

mask.of.sanity writes "An online search portal has been launched that reveals the IP addresses of any Skype user. The portal needs only a Skype username entered in a search bar for it to produce the IP address of a target user. It then uses IP addresses to geo-locate users on a map and reveal their ISP information."

56 of 84 comments (clear)

Min score:

Reason:

Sort:

Service temporary unavailable. by devilsdean · 2012-05-01 04:57 · Score: 1

That was quick
1. Re:Service temporary unavailable. by Eponymous+Hero · 2012-05-01 05:11 · Score: 2
  
  looking at the message history, quotes like "Service is down again: skype strikes back" imply that skype is doing something to protect their users' privacy. at the least it proves that Ivan thinks so.
  
  --
  insensitive clod overlords obligatory xkcd car analogy russian reversals whoosh pedant fanbois ftfy in 3...2...1..PROFIT
not surprising by v1 · 2012-05-01 04:59 · Score: 3, Insightful

Can be done very simply with a little bit of tcpdump. they're just sniffing network traffic from the machine to reveal information that skype doesn't normally display.
They make it sound like it's some awesome service hacking app when it's just displaying information the client app is just choosing not to show you.
Does this really surprise anyone? Skype directly connects you to another user. Their servers aren't a relay, they're just a meeting point to hook users together. Both users' computers simply have to have the IP address of the other person for their service to function. (though I could see them relaying just text traffic, but certainly not audio/video)

--
I work for the Department of Redundancy Department.
1. Re:not surprising by Anonymous Coward · 2012-05-01 05:22 · Score: 5, Informative
  
  Actually, the service works by sending the owner of the username a contact-info request (used for instance while searching for users to add to your contact list). The difference from what you mentions is that the target is not notified in any way (as opposed from when sending them a message or calling them), and also have no option to block the request.
2. Re:not surprising by Lumpy · 2012-05-01 05:31 · Score: 1
  
  Um. no.
  Skype DOES use relay servers when there is no ports open on the firewall that a user is behind. It's why skype works all the time and raw VoIP can not without opening ports.
  
  --
  Do not look at laser with remaining good eye.
3. Re:not surprising by Anonymous Coward · 2012-05-01 05:52 · Score: 5, Informative
  
  The servers are used to facilitate UDP Hole Punching. Once the NAT/Firewall has been bypassed the communicate is direct.
  http://en.wikipedia.org/wiki/UDP_hole_punching
4. Re:not surprising by w.hamra1987 · 2012-05-01 06:05 · Score: 1
  
  Actually, Skype DOES use relaying. I use skype from behind a NAT, and so do most of my contacts, we're all inaccessible through our external IP addresses, and sometimes, me and my contact are from the same ISP, and hence behind the same NAT, sharing same external IP address. why it works? because our communication goes through skype servers!
  
  --
  my sig pwns your sig
5. Re:not surprising by Talennor · 2012-05-01 06:17 · Score: 4, Insightful
  
  http://en.wikipedia.org/wiki/NAT_traversal
  Skype servers help make the connection, but aren't involved in the data stream.
  
  --
  
  //TODO: signature
6. Re:not surprising by Talennor · 2012-05-01 06:23 · Score: 1
  
  I'm sure you could run your skype traffic through TOR. Not sure the quality of service you'd get... (Ok, I'm sure, and it's not looking good.)
  
  --
  
  //TODO: signature
7. Re:not surprising by s_p_oneil · 2012-05-01 07:06 · Score: 4, Insightful
  
  "Can be done very simply with a little bit of tcpdump."
  Um, no. Not even close. This is a web site that can find any Skype user in the world by their Skype username. No one (not even the web server) needs to have Skype installed to use this, and no packet sniffing is being done. Since the encryption used for Skype's TCP connections starts with a Diffie-Hellman key exchange, a tcpdump would be pretty useless. Sure you could see your own Skype client talking to 100 different IP addresses, but you wouldn't have any idea who was at the other end of them, and you would have no way of sniffing the packets of every Skype user world-wide.
  I agree that this isn't surprising, though. Skype's protocol has been cracked (and those cracks have been published) so that anyone could write a program to talk to the Skype supernodes (any normal Skype client that allows incoming connections can be promoted to a supernode) and to perform this kind of search. The problem here lies in how much Skype supernodes trust any client that knows how to speak its language. The author considered that part of the Skype client to be sufficiently crack-proof, but he was wrong.
8. Re:not surprising by plover · 2012-05-01 07:41 · Score: 1
  
  Why? Anonymity is not a property they promise to deliver.
  
  --
  John
9. Re:not surprising by plover · 2012-05-01 07:46 · Score: 2
  
  What makes you think that Skype wants or needs to preserve anonymity? Consider that you are contacting Skype yourself and saying "This is Joe Sixpack. Please connect me to J. Random Hacker at +1-123-456-7890. And yes, I understand my information is on file so you can bill me for this call." You're already not anonymous.
  
  --
  John
10. Re:not surprising by Dan541 · 2012-05-01 13:11 · Score: 1
  
  Its a peer 2 peer network. Why would you expect any form of anonymity?
  Skype was never designed to be Tor
  
  --
  An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
11. Re:not surprising by garaged · 2012-05-01 13:29 · Score: 2
  
  And what it is so important about a skype call that needs that kind of security? I've been chatting on IRC for almos 2 decades and ip info has never been an issue
  
  --
  I'm positive, don't belive me look at my karma
12. Re:not surprising by lindi · 2012-05-01 23:35 · Score: 1
  
  It works easily. See e.g. http://www.usenix.org/event/usenix05/tech/general/full_papers/ford/ford_html/
13. Re:not surprising by Zaphod+The+42nd · 2012-05-02 03:44 · Score: 1
  
  this isn't surprising, though. Skype's protocol has been cracked (and those cracks have been published) so that anyone could write a program to talk to the Skype supernodes (any normal Skype client that allows incoming connections can be promoted to a supernode) and to perform this kind of search. The problem here lies in how much Skype supernodes trust any client that knows how to speak its language. The author considered that part of the Skype client to be sufficiently crack-proof, but he was wrong.
  QFT. I remember reading about the potential security exploits of skype some 5 years ago. If you speak skype to a node, it'll be happy to handle your requests with almost zero authentication, and it doesn't log it either. So you could extremely easily turn someone's skype box into a zombie to route your nefarious actions through. They'd have no clue you were doing it, no proof you did, and all evidence would show their IP was responsible. Perfect scapegoats.
  
  --
  GCS/MU/P d- s:- a-- C++++$ UL++ P+ L++ E+ W++ N o K- w--- O M+ V- PS+++ PE Y+ PGP t+ 5- X R++ tv+ b++ DI++ D++ G+ e++ h-
14. Re:not surprising by hobarrera · 2012-05-04 08:07 · Score: 1
  
  Because in this case, it means privacy (it divulges to third party my location), and in some cases, security (ir no-one knows your IP, I guess you're pretty safe from any sort of attack).
15. Re:not surprising by hobarrera · 2012-05-04 08:07 · Score: 1
  
  They certainly don't advertise it as a p2p network, rather as a "free internet phonecalls" service.
16. Re:not surprising by hobarrera · 2012-05-04 08:16 · Score: 1
  
  Not anonymous from them, but you'd expect third parties no to be able to trace you down through them.
17. Re:not surprising by Dan541 · 2012-05-05 15:46 · Score: 1
  
  Why would they need to, nobody outside of /. cares about any of the technical specifications.
  
  --
  An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
18. Re:not surprising by hobarrera · 2012-05-07 01:07 · Score: 1
  
  Its a peer 2 peer network. Why would you expect any form of anonymity?
  Let me rephrase:
  "People would not expect a lack of anonymity asociated with p2p networks because skype is not advertised as a p2p network, rather as a "free internet phonecalls" service."
19. Re:not surprising by Dan541 · 2012-05-07 01:14 · Score: 1
  
  So where is the expectation to privacy? People don't complain about their normal phone being traceable, why would this be an issue?
  
  --
  An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
20. Re:not surprising by Dan541 · 2012-05-07 01:14 · Score: 1
  
  Also skype has never been marketed as an Anonymous communications channel.
  
  --
  An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
21. Re:not surprising by hobarrera · 2012-05-07 03:36 · Score: 1
  
  You're just trolling, right?
  Users don't expect strangers to be able to track down sensitive data such as their IP address by using the service, it's generally implicit. Most IM/VoIP don't advertise this sort of feature; it's implicit.
22. Re:not surprising by Dan541 · 2012-05-07 03:53 · Score: 1
  
  Websites don't advertise that they can see your IP address either. Let alone other information such as you browser and Operating System. You IP isn't "sensitive data" it's used for routing data on the internet. If you don't want anyone to know it then don't connect to them or use a service that is designed for anonymity..
  
  --
  An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
23. Re:not surprising by hobarrera · 2012-05-07 04:15 · Score: 1
  
  So when you use any IM service, it's, in your opinion, normal for any random stranger to be able to deterine your IP address, even those totally unrelated to the service providers?
  I think it isn't. And skype is the only one (save for IRC) with a hole like this.
24. Re:not surprising by Dan541 · 2012-05-07 04:36 · Score: 1
  
  It's not a security hole. It's how the internet functions.
  Skype isn't intended to be anonymous, if you want total anonymoity you need to use a VPN. That's true for everything you do online don't assume its anonymous just because the client doesn't show that information.
  
  --
  An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
25. Re:not surprising by hobarrera · 2012-05-09 02:48 · Score: 1
  
  XMPP (by far, the most used IM client) doesn't expose you IP address to other users, unless you do a video/voice chat, in which case, it's inevitable.
  Why would I except less for a closed service which has payed features?
26. Re:not surprising by Dan541 · 2012-05-09 03:45 · Score: 1
  
  Because XMPP uses a client-server topology, whereas Skype is a Peer to Peer network and therefore clients make direct connections to one another.
  
  --
  An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
27. Re:not surprising by KhabaLox · 2012-05-11 08:24 · Score: 1
  
  Websites don't advertise that they can see your IP address either.
  Actually, I've had several websites warn me that my IP address was being broadcast*.
  *Not technically true, I know.
  
  --
  Ceci n'est pas un sig.
Re:I would say its trivial by mehrotra.akash · 2012-05-01 05:09 · Score: 1

* less than a minute
Article is ambiguous! by InvisibleClergy · 2012-05-01 05:14 · Score: 1

The article says you just need to enter their skype username - does this mean that it works for even people who are offline? I know that I have at least one or two pseudonyms I've used for voice-chat while playing vidya games. If it does work for offline people, that would mean Skype is keeping logs of most-recent IP addresses.
Service seems to be down right now, so there's no way for me to test it.
Yay by jmDev · 2012-05-01 05:16 · Score: 1

Now I can have even more people tell me that they have my IP address and they know someone that can hack me!
Re:I would say its trivial by olsmeister · 2012-05-01 05:24 · Score: 2

Not if the service worked the way it should. While actual calls should be done peer-to-peer, things like requests for information, call setup/teardown, etc should be handled by Skype's servers, not exposing the IP of another user until a call has been established.

Either that, or just dial *67 first...
Article summary author IP by Ziekheid · 2012-05-01 05:25 · Score: 4, Interesting

Is it me or did the person who wrote the summary of this article accidentally include his IP when linking to the portal page?
1. Re:Article summary author IP by slimjim8094 · 2012-05-01 05:29 · Score: 1
  
  Not just you. 216.34.181.45
  Wow.
  
  --
  I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
2. Re:Article summary author IP by cdrudge · 2012-05-01 05:43 · Score: 1
  
  According to my source, that IP traces back to a railroad track. Better call Steven Seagal to investigate.
3. Re:Article summary author IP by Anonymous Coward · 2012-05-01 07:07 · Score: 1
  
  Actually that IP points to slashdot.org, according to whois.
4. Re:Article summary author IP by Toad-san · 2012-05-02 02:49 · Score: 1
  
  And has anyone else noticed that the "portal" (well, the link anyway) is down?
  http://skype-ip-finder.tk/abused#66677:43676:216.34.181.45:/
  "Thank you for visiting
  SKYPE-IP-FINDER.TK
  This domain and website have been suspended because of abuse or copyright reasons."
ISP location is not your location by dwillden · 2012-05-01 05:35 · Score: 1

Wow so they think they can determine your location via your IP address and the ISP location. My ISP is HQ'd in or near Denver CO, I live in Utah, all the web-ads that try to target my location target me as being in Denver. So hack away, you'll still be hundreds of miles off, based solely on my IP.

--
I'm too lazy to compose a creative sig.
1. Re:ISP location is not your location by Anonymous Coward · 2012-05-01 05:45 · Score: 2, Funny
  
  Thank you sir for that info... We will be making adjustments to our database to compensate for the error.
2. Re:ISP location is not your location by laffer1 · 2012-05-01 05:46 · Score: 1
  
  This really depends on your ISP and package. As I have a business class package with static IPs and Comcast delegates them via ARIN, one can see my home address via my IP address.
  
  --
  MidnightBSD: The BSD for Everyone
Not New, But Pretty Cool by cryptizard · 2012-05-01 05:38 · Score: 5, Interesting

I saw this presented about a year ago at a security talk. If I recall correctly they were getting IP addresses by initiating a call but then terminating it before some threshold where the other party was actually notified, so it was invisible to the people they were tracking. The cooler part in my opinion was how they showed that something like 80% of people could be located on Skype (in the directory) based on information in their Facebook or LinkedIn profiles, allowing for targeted tracking of people. They also had some more advanced geo IP stuff to the point where they could get really good location results. The example they had was a woman in Florida where they could track her whole week's routine i.e. at work at 9:00, home by 5:00, where she goes to lunch, when she is visiting her grandmother in the next town. It is especially effective against people who are logged into Skype on their smart phones. Arguably the even cooler part was where they showed that they could track the entire population of a small country with something like $20,000 in computer hardware. As obvious as the nefarious applications of this are, it could also be pretty useful for tracking large scale movement for stuff like city planning.
Don't be hasty about trying this by 93+Escort+Wagon · 2012-05-01 05:41 · Score: 2

At least if you're a Skype user. It sounds like Skype is banning anyone who's logged in from the same IP address they're running this tool on.

--
#DeleteChrome
1. Re:Don't be hasty about trying this by ilsaloving · 2012-05-01 06:12 · Score: 2
  
  Really??
  Great! Now we just have to figure out how to convince all those stupid "I found you online and thought you looked cool!" Skype Bots to connect to that address!
2. Re:Don't be hasty about trying this by Anonymous Coward · 2012-05-01 06:49 · Score: 1
  
  That's precious. We have a potential privacy issue, and if the blackhats without skype accounts do it, well, nothing we can do about that. But if you dare research it yourself, we'll shitcan your account. Don't you know it's wrong to be curious!
Pretty easy to roll your own..... by trancemission · 2012-05-01 05:42 · Score: 1

Although not quite as easy as just firing up tcpdump (If it was - this would have been 'exploited' a long time ago)
http://pastebin.com/rBu4jDm8
Not sure if the version of skype client is relevant (Maybe you just need to enable debug mode)
You could replace looking at the logfile with sniffing packets if they are in plain text (Which they probably shouldn't be)
I haven't tried this.
Skype replaces P2P supernodes with Linux boxes by readandburn · 2012-05-01 06:09 · Score: 3, Informative

http://arstechnica.com/business/news/2012/05/skype-replaces-p2p-supernodes-with-linux-boxes-hosted-by-microsoft.ars
"LOL, Skype killed us." by sirdude · 2012-05-01 07:01 · Score: 2

"LOL, Skype killed us." is what I see when I visit the site. IP ban?
Re:Cookies error? Why does it use cookies? by Ohrion · 2012-05-01 08:08 · Score: 1

Some people LIKE to stay logged in.
Re:Cookies error? Why does it use cookies? by maxwell+demon · 2012-05-01 09:19 · Score: 1

Some people LIKE to stay logged in.
But for that you only need to send a cookie when logging in. Because if you are not logged in, you cannot stay logged in anyway.

--
The Tao of math: The numbers you can count are not the real numbers.
There is a solution by Technician · 2012-05-01 12:14 · Score: 4, Interesting

If you must hide your IP address, you can use one of many Skype/Sip gateways. SIP to SIP to the gateway then Skype to Skype from the gateway. Since Skype does not work well in Linus, I use SIP instead. SIP is P-P too, a SIP call will reveal my IP to a SIP caller. A Skype caller will only see the gateway.
There are several gateways. IPPI.fr is only a representative example.
You can Skype me in France anytime. I have never been to France.
http://www.ippi.com/
I don't use this to hide my IP address. I use it with an ATA so calls ring my phone, even when I'm not online. With their speed dialer, I can make Skype calls without turning on the computer.
I can be called by Google Voice, an INUM number, SIP, Skype, or IPKall number and any will ring my SIP phone, provide voice mail, caller ID, etc.
Analog Telephone Adapter (ATA) http://www.voip-info.org/wiki/view/Linksys+PAP2T

--
The truth shall set you free!
Hmmm. by BrokenHalo · 2012-05-01 12:53 · Score: 1

What strikes me as a bit sick (or at least sad) is that anyone might feel this project is a good use of their time. I can think of no reason why a skype user need be legitimately stalked in this way except for purposes of law enforcement, and those authorities already have resources at their disposal.
1. Re:Hmmm. by Anonymous Coward · 2012-05-01 13:27 · Score: 2
  
  Because without people like this guy, who is probing for weaknesses and making some noise about them, you rely on a security model of 'security through obscurity', and we all know that only idiots think that's real security.
2. Re:Hmmm. by hobarrera · 2012-05-02 16:30 · Score: 1
  
  Because this sort of project proves how flawed skype's so-called security model is in the first place.
  It's yet one more thing you can point at when listing skype's defects.
Shutdown by zerocool6900 · 2012-05-02 02:13 · Score: 1

Of course this site is no longer active as the US Government now follows /.
"This domain and website have been suspended because of abuse or copyright reasons."

--
Some people never learn...no matter how many times something happens to them.