Researchers have devised a stealthy and cheap way to track the IP addresses of tens of thousands of Skype users, and link the information to their online activities such as peer-to-peer sharing.
The method, which is explained in a recently published academic paper, works even when Skype users have reconfigured their accounts to accept calls only from people in their contact lists. It also works against Skype users who are not currently logged in, as long as they have used the VoIP client in the past three days. The system is able to link an individual Skype user to specific BitTorrent activity, even when they share the IP address with others over a local area network that uses network address translation (NAT).
“We have demonstrated that it is possible for a hacker, with modest resources, to determine the current IP address of identified and targeted Skype user (if the user is currently active),” the 14-page research paper noted. “In the case of Skype, even if the targeted user is behind a NAT, the hacker can determine the user's public IP address. Such an attack could be used for several malicious purposes, including tracking a person's mobility or linking the identity of a person to his internet usage.”
The researchers found that it was relatively easy to find the ID of most Skype users when their email address and birth name are known to the hacker. Additional information, such as the target's city of residence, sex, or age, brought greater accuracy to the attempt.
They then called the target's Skype account using a customized script that sent specially crafted packets. By examining the headers of the data that was returned, they had no trouble determining the person's IP address at all. Because the researchers prevented a TCP connection from being fully established during the probing, targets had no idea their Skype accounts were being scanned. They devised the script so that it could track 10,000 people for about US$500 per week.
After discovering the IP addresses of individuals, they tapped known BitTorrent sites to track the specific downloads of addresses in their database. Even when one of the IP addresses was shared among many p2p users on a single network, the method was able to single link a unique Skype user to a specific download by, among other things, collecting tags known as infohashes from BitTorrent networks.
The researchers added Google Talk, MSN Live and other real-time communication VoIP applications may also be susceptible to the technique, but they singled Skype out for containing what they called a huge privacy vulnerability.
In a media statement, Adrian Asher, chief information security officer in Microsoft's Skype division, exclaimed: “We extremely value the privacy of our VoIP users and are committed to making our products as secure as possible. Just as with typical internet communications software, Skype users who are connected may be able to determine each other's IP addresses. Through research and development, we will continue to make improvements in this area and to our software.”
The report also made several recommendations for improving Skype's ability to conceal the identity of its users.
“One probable solution that would go a long way is to design the VoIP protocol so that the callee's IP address is not revealed until the user accepts the incoming call,” it said. “With this property, Maria wouldn’t be able to inconspicuously call Joe. Moreover, if Maria is not on Joe's contact list, and Joe configures his client to not accept calls from strangers, then this technique would prevent any stranger from tracking him, conspicuously or otherwise.”