7 ms·

Hackers can get your IP through Skype by just sending a link, no click required

102 points by restrict-dark 3y ago

restrict-dark 3y ago
[flagged]
consoomer 3y ago
Isn't this the same crap that affects most messengers at one point? You send a link, the receiving client tries to do a link preview so a request is made to the link exposing the receiver's IP address?
- CharlieDigital 3y ago
  Yes, I was thinking the same thing. This seems like it would also hold true for Slack, Teams, Discord -- any app that would make another request to render the "card" for the URL unless those apps are proxying those requests.
  - consoomer 3y ago
    Most of those apps already had this issue raised/exposed and fixed. It seems to be a very common security measure that is overlooked.
  - orf 3y ago
    If you send a message to a channel with 5k people in it, would you expect 5k requests to go to the page in a short interval? How would that work with custom unfurl extensions? It’s all proxies and unfurled on the server, once. Anything else is madness.
    - numpad0 3y ago
      Does that madness help measuring CTR?
    - mh- 3y ago
      Agreed. And iMessage actually has the sender client generate the link preview and bundles that with the message. This sounds weird, but with end-to-end encrypted conversations, it's basically that or have it generated by the recipient. (or have one of the receiving client send it to a service out-of-band, but that "defeats" the end-to-end encryption.)
      - mikepurvis 3y ago
        Having the sender do it also makes sense from an auth point of view— thinking of like a private Github repo, or something like Jira running on your corporate VPN. Presumably the sender intended to share the contents with every recipient anyway and any that don't have access still of course won't be able to click through. But it would be pretty bad UX if the card was just blank in these cases because the messaging server didn't have access.
- shortrounddev2 3y ago
  Line previews the URL remotely. You can verify this because Line's servers are in Japan and the preview will show Japanese text for sites that offer a Japanese version
- waihtis 3y ago
  surely the request should'nt come from the client but a separate server? I presume the reason link checking exists is that the URL is reviewed for maliciousness, and that isn't likely to be done locally
  - thakoppno 3y ago
    > surely the request should'nt come from the client Maybe this problem is intractable logically? The preview needs to be accurate from the perspective of the client. The only way to guarantee that seems to me sending the request from client.
    - waihtis 3y ago
      I think most of the "malicious URL check" solutions literally compare the url string to a large, known bad address database
- betaby 3y ago
  Slack and Telegram use their respective infra to fetch the URL for the preview - not your local IP.
- zoomablemind 3y ago
  > ...receiving client tries to do a link preview I understood that the link in question was to some google.com, not a 'hacker' controlled URL. [ ...Yossi sent me a link via Skype text chat to google.com. The link was to the real Google site, and not an imposter. ] It may be something which is kept in the app's db following the generation of a preview. Would it make sense to restrict the chats to only 'address book' contacts, supposedly trusted?
99112000 3y ago
IIRC you can even spoof the URL, so the URL on screen is not what you will be directed to. It is a perfect ground for phishing attacks. PS: Skype and Teams share parts of the same XML message format, you can have some fun there too :)
- byteknight 3y ago
  Teams doesn't use an XML message spec [0] [0] https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/connectors-using?tabs=cURL#example-of-connector-message https://learn.microsoft.com/en-us/microsoftteams/platform/we...
Zelphyr 3y ago
It's amazing to me that, after all these years, people are surprised at how bad Microsoft is at security. I genuinely don't understand why companies use their products after decades of egregious security vulnerabilities.
paxys 3y ago
An IP address was never supposed to be personally identifiable info. If we treat it as such then no P2P service can ever work, and the internet will forever be under the control of a few large corps running data centers. The real solution here is to completely disconnect an IP address from a person or physical location. Broad adoption of IPv6 will be a big step towards that.
- jan_Sate 3y ago
  How could IPv6 help on that? They could just use the prefix to figure out which network you're coming from.
  - byteknight 3y ago
    I think they are referring the the shear number of IPs available and ease of switching. Not a solid argument, but it is the only thing I can think of though for their argument.
  - paxys 3y ago
    Yes, but "network" itself is an abstract concept. Because the addresses aren't scarce you can theoretically get a new one every day, or every time you log on, and throw it away right after. Each device you own can also have its own IP, without any NATs in the way and no way to tie them together.
    - Anon_Forever 3y ago
      >but "network" itself is an abstract concept. This is incorrect. IPv6 network routing prefixes are not an "abstract" concept. They are effectively the same PII as an IPv4 address. You can identify a user by their routing prefix, much like you can identify a user by their IPv4 address. All of their devices will have IPv6 addresses from their unique prefix much like all of their devices will have the same unique IPv4 address if they're using NAT.
  - ynik 3y ago
    IPv6 has the advantage that the ISP can give customers multiple prefixes at the same time, thus allowing rotation of the prefix without interrupting existing TCP connections. With IPv4, ISPs that want to rotate IP addresses have to forcibly disconnect their users (e.g. every 24h). This is a common practice, though probably mostly intended to allow charging business customers more if they need a stable IP. But the privacy side effect is also nice. But other than that minor point (which many ISPs are not taking advantage of), IPv4 addresses and IPv6 network prefixes are essentially the same privacy-wise: uniquely identifying an ISP customer, i.e. a family, not an individual.
don-code 3y ago
There are two alternative behaviors I can think of: 1. The service operator prerenders link previews on its own servers, then sends them to the client, which means that it needs to be privy to the contents of messages. I suspect this is already the case for Skype, but it's a feature that (say) Signal can't do this. 2. The message sender prerenders the link preview. Where link previews are interactive (I'm always impressed by linking Bandcamp in Slack, for instance), one could easily accomplish the same with some malicious JavaScript. I'm not sure any particular behavior is "better".
- dublinben 3y ago
  The link previews feature in Signal adds several layers to improve the privacy of option 2. https://signal.org/blog/i-link-therefore-i-am/ https://signal.org/blog/i-link-therefore-i-am/
- samtheprogram 3y ago
  The latter option (without interactivity) is how iMessage works.
daft_pink 3y ago
I'm really confused about whether Skype mobile includes Teams that used to be Skype and have just been renamed.
sacrosanct 3y ago
> Hackers can get your IP through Skype More like hackers can get your IP through you merely using The Internet. Also once a document or link is released onto the web, it will be looked at, mostly automatically. I crafted a PDF document that when opened, alerted me who opened it (a honey PDF). I uploaded it to both Google Drive and Dropbox, and it was some co-lo in Virginia that automatically scanned it, presumably to preview the doc in Dropbox/Drive, or (I suspect) maliciously opened it to have a nose.
- loa_in_ 3y ago
  I've heard from a reliable source that PDF and DOC sent through Messenger have all embedded links visited automatically
  - sacrosanct 3y ago
    No I mean a specially crafted PDF that beacons out who opened it up. Not links in the PDF.
gabereiser 3y ago
Funny because isn’t teams is based on that tech? Correct me if I’m wrong. I don’t work for Microsoft but my brother does. I recall him telling me this once, not sure if it’s true.
- betaby 3y ago
  It was at some degree. However Teams has no such problem as described in the article.
issafram 3y ago
"it is trivially easy to exploit and involves changing a certain parameter related to the link." what would that be?
tpmx 3y ago
So many words, so little information.
mattw2121 3y ago
In other news, hackers can get your IP address by sending you an email.
sbdaman 3y ago
Does anyone remember Skype resolvers? They were incredibly popular from like 2011-2014.
- Sayrus 3y ago
  I perfectly remember them also being embedded in DDOS as a Service offers. It's surprising seeing many persons saying an IP is not PII/private. While it may not allow you to "hack" a person, you can very certainly saturate his uplink. I also remember streamers being resolved and targeted repeatedly.
  - sbdaman 3y ago
    Yeah. If you were decently high ranked in any popular video game at the time, you had to make sure you didn't share a username between Skype/the game, or you'd be DDOSed endlessly.
IvanK_net 3y ago
[flagged]
- pb7 3y ago
  Given there's no way to easily verify that, you could be doxxing someone you want to be targeted.
uxp8u61q 3y ago
It's not like the "hackers" are going to be able to do much with the IP address.
- mschuster91 3y ago
  An attacker can simply DDoS someone, a common nuisance in online games.
- kube-system 3y ago
  Depends on a person’s threat model. If someone is a dissident under a repressive dictatorship, and the “hackers” work for the regime, someone could be killed with this information.
  - notif1 3y ago
    Anyone in that position knows not to use Skype. Anyone in that position that was using Skype was likely picked up ages ago because their threat modeling is clearly trash.
    - kube-system 3y ago
      That's not a reason to discount this as a real vulnerability. Most hacks in the real world are due to mistakes in security hygiene. Because most people aren't security experts, and even those who are, are human. They make mistakes, do things in a hurry sometimes, and don't know everything. Novel, high-skilled attacks are uncommon.
      - notif1 3y ago
        It's certainly a real vulnerability just not a particularly impactful one. Claiming that it's going to get people killed is unnecessarily inflammatory rhetoric that makes you look like you don't know what you're talking about. Claiming that novel, high-skilled attacks are uncommon when they're inherently challenging to have visibility of confirms that you don't know what you're talking about.
nosmokewhereiam 3y ago
People in 2013 were performing this, or something quite similar, to DDoS players like a bully. I can only imagine the implications for livestreamers, or other public facing folks.
435h45hnb45 3y ago
[flagged]
mandeepj 3y ago
> An IP address was never supposed to be personally identifiable info. I'm not sure if law enforcement would like that. They want to identify and catch bad actors like blackmailers, hackers, terrorists and a bunch like that.
kelnos 3y ago
Certainly Microsoft should patch this, but as for the specific issue... so what? I don't consider my IP address to be sensitive information, regardless of whether or not various regulations may consider an IP address to be PII. Sure, there are some classes of people for whom this might be a big risk (journalist or dissident in an oppressive dictatorship, for example), but those people should not be using Skype in the first place.
Anon_Forever 3y ago
I haven't used Skype in close to a decade. No one that I know uses Skype. All the former Skype users have moved over to WhatsApp, Discord, etc. Who is using Skype in 2023? How many users are still using Skype?
- JCharante 3y ago
  It gets used on platforms like italki (by users, not as a white labeled thing). People share skype names and you can use it with people behind the great firewall.
- kwoff 3y ago
  I used Skype until 2019 when I moved back to the US. It was nice to have a local US number for my family to call. (Maybe there's a better way to do that, though.)
AtNightWeCode 3y ago
Most chat programs have solved this by using a proxy. The downside of this is that the proxy may be blocked. There should be a more generic and safe way to deal with link previews.
tryithard 3y ago
jokes on them, it's been years since I used skype!
Alifatisk 3y ago
Reminds me of the days when people used Skype Resolvers, good ol' days.
uni_baconcat 3y ago
> The attack could pose a serious risk to activists, political dissidents, journalists, those targeted by cybercriminals, and many more people. Since Skype is infamous for lacking E2EE and other security methods, I wonder if these groups of people, who are sensitive to privacy, will still use Skype in 2023.

102 points by restrict-dark 3y ago

[flagged]

Isn't this the same crap that affects most messengers at one point? You send a link, the receiving client tries to do a link preview so a request is made to the link exposing the receiver's IP address?

CharlieDigital 3y ago
Yes, I was thinking the same thing. This seems like it would also hold true for Slack, Teams, Discord -- any app that would make another request to render the "card" for the URL unless those apps are proxying those requests.
- consoomer 3y ago
  Most of those apps already had this issue raised/exposed and fixed. It seems to be a very common security measure that is overlooked.
- orf 3y ago
  If you send a message to a channel with 5k people in it, would you expect 5k requests to go to the page in a short interval? How would that work with custom unfurl extensions? It’s all proxies and unfurled on the server, once. Anything else is madness.
  - numpad0 3y ago
    Does that madness help measuring CTR?
  - mh- 3y ago
    Agreed. And iMessage actually has the sender client generate the link preview and bundles that with the message. This sounds weird, but with end-to-end encrypted conversations, it's basically that or have it generated by the recipient. (or have one of the receiving client send it to a service out-of-band, but that "defeats" the end-to-end encryption.)
    - mikepurvis 3y ago
      Having the sender do it also makes sense from an auth point of view— thinking of like a private Github repo, or something like Jira running on your corporate VPN. Presumably the sender intended to share the contents with every recipient anyway and any that don't have access still of course won't be able to click through. But it would be pretty bad UX if the card was just blank in these cases because the messaging server didn't have access.
shortrounddev2 3y ago
Line previews the URL remotely. You can verify this because Line's servers are in Japan and the preview will show Japanese text for sites that offer a Japanese version
waihtis 3y ago
surely the request should'nt come from the client but a separate server? I presume the reason link checking exists is that the URL is reviewed for maliciousness, and that isn't likely to be done locally
- thakoppno 3y ago
  > surely the request should'nt come from the client Maybe this problem is intractable logically? The preview needs to be accurate from the perspective of the client. The only way to guarantee that seems to me sending the request from client.
  - waihtis 3y ago
    I think most of the "malicious URL check" solutions literally compare the url string to a large, known bad address database
betaby 3y ago
Slack and Telegram use their respective infra to fetch the URL for the preview - not your local IP.
zoomablemind 3y ago
> ...receiving client tries to do a link preview I understood that the link in question was to some google.com, not a 'hacker' controlled URL. [ ...Yossi sent me a link via Skype text chat to google.com. The link was to the real Google site, and not an imposter. ] It may be something which is kept in the app's db following the generation of a preview. Would it make sense to restrict the chats to only 'address book' contacts, supposedly trusted?

99112000 3y ago

IIRC you can even spoof the URL, so the URL on screen is not what you will be directed to. It is a perfect ground for phishing attacks. PS: Skype and Teams share parts of the same XML message format, you can have some fun there too :)

byteknight 3y ago
Teams doesn't use an XML message spec [0] [0] https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/connectors-using?tabs=cURL#example-of-connector-message https://learn.microsoft.com/en-us/microsoftteams/platform/we...

Zelphyr 3y ago

It's amazing to me that, after all these years, people are surprised at how bad Microsoft is at security. I genuinely don't understand why companies use their products after decades of egregious security vulnerabilities.

paxys 3y ago

An IP address was never supposed to be personally identifiable info. If we treat it as such then no P2P service can ever work, and the internet will forever be under the control of a few large corps running data centers. The real solution here is to completely disconnect an IP address from a person or physical location. Broad adoption of IPv6 will be a big step towards that.

jan_Sate 3y ago
How could IPv6 help on that? They could just use the prefix to figure out which network you're coming from.
- byteknight 3y ago
  I think they are referring the the shear number of IPs available and ease of switching. Not a solid argument, but it is the only thing I can think of though for their argument.
- paxys 3y ago
  Yes, but "network" itself is an abstract concept. Because the addresses aren't scarce you can theoretically get a new one every day, or every time you log on, and throw it away right after. Each device you own can also have its own IP, without any NATs in the way and no way to tie them together.
  - Anon_Forever 3y ago
    >but "network" itself is an abstract concept. This is incorrect. IPv6 network routing prefixes are not an "abstract" concept. They are effectively the same PII as an IPv4 address. You can identify a user by their routing prefix, much like you can identify a user by their IPv4 address. All of their devices will have IPv6 addresses from their unique prefix much like all of their devices will have the same unique IPv4 address if they're using NAT.
- ynik 3y ago
  IPv6 has the advantage that the ISP can give customers multiple prefixes at the same time, thus allowing rotation of the prefix without interrupting existing TCP connections. With IPv4, ISPs that want to rotate IP addresses have to forcibly disconnect their users (e.g. every 24h). This is a common practice, though probably mostly intended to allow charging business customers more if they need a stable IP. But the privacy side effect is also nice. But other than that minor point (which many ISPs are not taking advantage of), IPv4 addresses and IPv6 network prefixes are essentially the same privacy-wise: uniquely identifying an ISP customer, i.e. a family, not an individual.

don-code 3y ago

There are two alternative behaviors I can think of: 1. The service operator prerenders link previews on its own servers, then sends them to the client, which means that it needs to be privy to the contents of messages. I suspect this is already the case for Skype, but it's a feature that (say) Signal can't do this. 2. The message sender prerenders the link preview. Where link previews are interactive (I'm always impressed by linking Bandcamp in Slack, for instance), one could easily accomplish the same with some malicious JavaScript. I'm not sure any particular behavior is "better".

dublinben 3y ago
The link previews feature in Signal adds several layers to improve the privacy of option 2. https://signal.org/blog/i-link-therefore-i-am/ https://signal.org/blog/i-link-therefore-i-am/
samtheprogram 3y ago
The latter option (without interactivity) is how iMessage works.

daft_pink 3y ago

I'm really confused about whether Skype mobile includes Teams that used to be Skype and have just been renamed.

sacrosanct 3y ago

> Hackers can get your IP through Skype More like hackers can get your IP through you merely using The Internet. Also once a document or link is released onto the web, it will be looked at, mostly automatically. I crafted a PDF document that when opened, alerted me who opened it (a honey PDF). I uploaded it to both Google Drive and Dropbox, and it was some co-lo in Virginia that automatically scanned it, presumably to preview the doc in Dropbox/Drive, or (I suspect) maliciously opened it to have a nose.

loa_in_ 3y ago
I've heard from a reliable source that PDF and DOC sent through Messenger have all embedded links visited automatically
- sacrosanct 3y ago
  No I mean a specially crafted PDF that beacons out who opened it up. Not links in the PDF.

gabereiser 3y ago

Funny because isn’t teams is based on that tech? Correct me if I’m wrong. I don’t work for Microsoft but my brother does. I recall him telling me this once, not sure if it’s true.

betaby 3y ago
It was at some degree. However Teams has no such problem as described in the article.

issafram 3y ago

"it is trivially easy to exploit and involves changing a certain parameter related to the link." what would that be?

tpmx 3y ago

So many words, so little information.

mattw2121 3y ago

In other news, hackers can get your IP address by sending you an email.

sbdaman 3y ago

Does anyone remember Skype resolvers? They were incredibly popular from like 2011-2014.

Sayrus 3y ago
I perfectly remember them also being embedded in DDOS as a Service offers. It's surprising seeing many persons saying an IP is not PII/private. While it may not allow you to "hack" a person, you can very certainly saturate his uplink. I also remember streamers being resolved and targeted repeatedly.
- sbdaman 3y ago
  Yeah. If you were decently high ranked in any popular video game at the time, you had to make sure you didn't share a username between Skype/the game, or you'd be DDOSed endlessly.

IvanK_net 3y ago

[flagged]

pb7 3y ago
Given there's no way to easily verify that, you could be doxxing someone you want to be targeted.

uxp8u61q 3y ago

It's not like the "hackers" are going to be able to do much with the IP address.

mschuster91 3y ago
An attacker can simply DDoS someone, a common nuisance in online games.
kube-system 3y ago
Depends on a person’s threat model. If someone is a dissident under a repressive dictatorship, and the “hackers” work for the regime, someone could be killed with this information.
- notif1 3y ago
  Anyone in that position knows not to use Skype. Anyone in that position that was using Skype was likely picked up ages ago because their threat modeling is clearly trash.
  - kube-system 3y ago
    That's not a reason to discount this as a real vulnerability. Most hacks in the real world are due to mistakes in security hygiene. Because most people aren't security experts, and even those who are, are human. They make mistakes, do things in a hurry sometimes, and don't know everything. Novel, high-skilled attacks are uncommon.
    - notif1 3y ago
      It's certainly a real vulnerability just not a particularly impactful one. Claiming that it's going to get people killed is unnecessarily inflammatory rhetoric that makes you look like you don't know what you're talking about. Claiming that novel, high-skilled attacks are uncommon when they're inherently challenging to have visibility of confirms that you don't know what you're talking about.

nosmokewhereiam 3y ago

People in 2013 were performing this, or something quite similar, to DDoS players like a bully. I can only imagine the implications for livestreamers, or other public facing folks.

435h45hnb45 3y ago

[flagged]

mandeepj 3y ago

> An IP address was never supposed to be personally identifiable info. I'm not sure if law enforcement would like that. They want to identify and catch bad actors like blackmailers, hackers, terrorists and a bunch like that.

kelnos 3y ago

Certainly Microsoft should patch this, but as for the specific issue... so what? I don't consider my IP address to be sensitive information, regardless of whether or not various regulations may consider an IP address to be PII. Sure, there are some classes of people for whom this might be a big risk (journalist or dissident in an oppressive dictatorship, for example), but those people should not be using Skype in the first place.

Anon_Forever 3y ago

I haven't used Skype in close to a decade. No one that I know uses Skype. All the former Skype users have moved over to WhatsApp, Discord, etc. Who is using Skype in 2023? How many users are still using Skype?

JCharante 3y ago
It gets used on platforms like italki (by users, not as a white labeled thing). People share skype names and you can use it with people behind the great firewall.
kwoff 3y ago
I used Skype until 2019 when I moved back to the US. It was nice to have a local US number for my family to call. (Maybe there's a better way to do that, though.)

AtNightWeCode 3y ago

Most chat programs have solved this by using a proxy. The downside of this is that the proxy may be blocked. There should be a more generic and safe way to deal with link previews.

tryithard 3y ago

jokes on them, it's been years since I used skype!

Alifatisk 3y ago

Reminds me of the days when people used Skype Resolvers, good ol' days.

uni_baconcat 3y ago

> The attack could pose a serious risk to activists, political dissidents, journalists, those targeted by cybercriminals, and many more people. Since Skype is infamous for lacking E2EE and other security methods, I wonder if these groups of people, who are sensitive to privacy, will still use Skype in 2023.