Slashdot Mirror
Ask Slashdot: How To Track a Skype Account Hijacker?
An anonymous reader writes "My Skype account was hijacked, which I discovered after Skype suspended it for suspicious activity, including a number of paid calls and an attempt to debit my card. Now that I've secured the account again, I can see the call history — there are several numbers called in Senegal, Mali, Benin and Philippines. Obviously I could call them myself and create a bit of havoc in their lives, but ideally I'd like to trace the hijacker himself — perhaps with some kind of 'social engineering' approach. Or is it just a waste of time?" How would you do this, and would you bother?
Reddit seems to be fantastic at finding people on the internet given the flimsiest leads to their identity... sure they may get it wrong now and then, but hey... them's the breaks.
Set the password back to what they knew, wait for them to login and hijack it (another account friended) and use one of the sites that use the debug version of skype to obtain their ip. Then contact the ISP and say that either this illegally hijacking accounts or their IP/systems have been compromised. Don't forget to disassociate any cards prior.
1] Post the numbers dialed to 4chan
2] Wait for the onslaught of harassing calls
3] ???
4] Profit
Is it possible that the hijacker was selling calls to other people, possibly immigrants, maybe even illegals. If so, the numbers called may have no direct connection to the hijacker, rather each olne of them may know a different someone who knows the hijacker. So you could be looking for the common factor between the people who made the calls to the numbers that you have. I'm not sure that it will be easy to find that common factor. After all, you have Jim and Bill and Fred's numbers; Sue called Jim, Anne called Bill, Jenny called Fred; Sue, Anne and Jenny all know Henry .... so if you have Jim and Bill and Fred's numbers, and don't even know whether Henry exists or not, how do you find Henry?
The account was possibly being used for voip fraud. Voip fraud is typically the practice of hijacking a VOIP account (sip/skype) and then calling some foreign country exchange that has a stupid high per minute rate (that the called party gets a cut of). The called party is usually in on the scam but good luck getting any realistic amount of cooperation due to local corruption at the called party end (almost always third world countries).
Do you think someone broke into your Skype account to call 5 random countries? They're all toll numbers in Africa. The damage is done and you lost
-Bucky
Just let it go. It's not worth the time or the hassle.
You need to use the same kind logic as when buying a used car.
1. Do not assume you can outsmart them or that they have made glaring mistakes
2. Realize they do this professionally, that is, spend years eating and breathing this type of activity
3. Realize if there was some way to retaliate or gain an advantage, they wouldn't be doing this for a living.
4. Re-evaluate your position.
while(1) attack(People.Sandy);
Look at the places they called. Likely the hijacker is somewhere in a developing country. Unlikely to be the same country where the poster lives. The ISP will not care, as long as their bills are paid.
Enjoy life! This is not a dress rehearsal.
Won't Skype tell you the IP that was used by the thief?
No, they won't. In general companies tell you to contact the police, etc and go out of their way to be useless.
Some months ago I had someone purchase a plane ticket using my credit card. My bank sent me a SMS when the charge was made (usual alert system, they SMS each time there's a charge). I had the phone with me so I could do something instantly. This is what happened:
- The charge was made for a plane ticket on Airchile according to the SMS.
- I called the bank *inmediately* (as the SMS said) to notify them of the charge. Well, guess what, it was a Sunday at 23:00 or so and they were closed. So the bank couldn't help.
- I drove to the airport to talk to Airchile, which happened to be opened at the time because they was a flight leaving from Madrid to Santiago in a couple hours (I was hoping that the bastard was there). They couldn't help.
- I went to the police station in the airport and they couldn't help because I needed a bank statement before they could do anything. Really? I have to wait until the end of the month before I can file a report with the police?
You see - even if you are really willing to track things down and not demand your money back, the other parties involved rarely assist.
Eventually I got my statement, filed the report (useless at the time of course) and got my money. But I great chance to catch the guy was lost.
"I am a lawyer representing a senior banking official in Nigeria, who recently died leaving $10 million untraceable... and I am able to pay you to help me find the rightful heir..."
"Cock Up Your Beaver" does not mean what you think. This sig is intended to clog filters and annoy do-gooders
I had a similar experience - my account was emptied of its five GBP of credit.
I emailed Skype - "there have been fradudent calls, I've changed my password".
Their reply? (slightly paraphrased)
"You must have been responsible for the breach, as our security is perfect. We do not refund fraudulent calls due to customer error. We've locked your account, so you'll need to send us proof of ID (passport copy, etc) for it to be unlocked."
The key problem with this reply is that a *customer* asserting an event is a fraudulent call does not make it a fraudulent call.
What if they have bugs in their billing software?
Skype only cared about not issuing compensation. Needless to say, I've never told anyone my skype password and my laptop at the time of the calls was in for repair, where I had removed the SSD drive before sending the unit off. Also needless to say, I've never unlocked that account or spent another cent with Skype. Thankfully, GoogleTalk came out just at the right time. Thank God for choice.
They're most likely either (1) disconnected numbers, (2) toll numbers that will rack up massive charges, OR (3) Numbers that the thief sold innocent 3rd parties "cheap long distance minutes" to, through fraudulent schemes.
Don't engage yourself in placing international harassing phone calls to "create havoc" in random people's lives; that would be you committing a crime. ,
Or is it just a waste of time?
That, at best.
Old saying: There's always a sucker in a game of poker. Look around the table. If you don't see him, it's you.
Never play criminals on their home turf. They are doing this for a living, you don't. Guess who's better at the game?
Assorted stuff I do sometimes: Lemuria.org
If you knew enough to solve this problem you wouldn't have this problem. Since you don't any attempt is just going to give you more new problems you are unable to resolve until you find yourself clad in latex and wearing a ball gag. Give it up.
Help stamp out iliturcy.
Sadly there's no point in bothering.
In this instance, I might disagree. Given that those calls were (according to TFS) made to Senegal, Mali, Benin and Philippines, that in itself might be construed as suspicious. You could pass the information on to the FBI and tell them you are concerned your account could have been used for terrorist activity. Let them come down on the perps.
Your Bank/Credit card company has no 24h service number for such this ?
Time to change credit card company.
My cellphone was stolen from my car and then recovered (it was found in the middle of the street). I called the long-distance numbers, pretending that I found the phone and wanted to return it to the owner. The people called (teenagers) were surprisingly helpful and I got the name and local address of the teen that called them who was staying with his uncle. I turned the info over to the police who told me that the loss was actually incurred by the phone company (charges had been refunded) and I was not "harmed" so there were no charges to press, plus the kid could claim that he "found" the phone and did not break into my car. But the detective did talk to the uncle and told me he thought the uncle was going to beat the kid's ass and send him back to Louisiana since the kid had been a problem since he got here. Good enough for me whether true or not since it was all that could really be done.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert