3 ms·

It's not like the "hackers" are going to be able to do much with the IP address.

mschuster91 3y ago
An attacker can simply DDoS someone, a common nuisance in online games.
kube-system 3y ago
Depends on a person’s threat model. If someone is a dissident under a repressive dictatorship, and the “hackers” work for the regime, someone could be killed with this information.
- notif1 3y ago
  Anyone in that position knows not to use Skype. Anyone in that position that was using Skype was likely picked up ages ago because their threat modeling is clearly trash.
  - kube-system 3y ago
    That's not a reason to discount this as a real vulnerability. Most hacks in the real world are due to mistakes in security hygiene. Because most people aren't security experts, and even those who are, are human. They make mistakes, do things in a hurry sometimes, and don't know everything. Novel, high-skilled attacks are uncommon.
    - notif1 3y ago
      It's certainly a real vulnerability just not a particularly impactful one. Claiming that it's going to get people killed is unnecessarily inflammatory rhetoric that makes you look like you don't know what you're talking about. Claiming that novel, high-skilled attacks are uncommon when they're inherently challenging to have visibility of confirms that you don't know what you're talking about.
      - kube-system 3y ago
        I'm not saying (and didn't say) that's a likely outcome of this particular bug. I'm posing the example as something that could be done with an IP address, because I'm pushing back at the assertion that IP addresses aren't useful for anything. They aren't useful for criminal hackers looking for a random untargeted machine to compromise. But they're useful for targeted scenarios like the example I gave.
- uxp8u61q 3y ago
  Uh, what? What scenario are you trying to conjure here? The regime knows the person's Skype handle, but not his/her IP; and the knowledge of the IP someone enables the regime to kill the person?! How does that work, exactly? Can you elaborate?
  - kube-system 3y ago
    Yes, and in places like these, ISPs are compelled to provide address assignment logs, if the ISPs are not government entities already. With that info, they can show up to their physical address.
    - uxp8u61q 3y ago
      Maybe I didn't express myself well enough. Do you really find it plausible that the government would know the person's Skype username but not their name? If they can compell the isp, why not Microsoft? They will obviously comply too.
      - kube-system 3y ago
        > Do you really find it plausible that the government would know the person's Skype username but not their name? Yes, people communicate under pseudonyms on the internet all of the time. Remember that not all governments have the same technological power as the major global powers... especially the most repressive ones. > If they can compell the isp, why not Microsoft? They will obviously comply too. MS has a limited physical footprint where they can be legally compelled to do anything. They don't operate in the world's most repressive regimes. And they do deny information requests all of the time. 25% of criminal requests were rejected by MS last year for not meeting requirements. And many of the world's most repressive regimes don't even appear on the list. Probably because they also say (emphasis mine): > Microsoft produces data in response to valid legal requests from governmental entities in countries where Microsoft Corporation is located. https://www.microsoft.com/en-us/corporate-responsibility/law-enforcement-requests-report https://www.microsoft.com/en-us/corporate-responsibility/law...

An attacker can simply DDoS someone, a common nuisance in online games.

Depends on a person’s threat model. If someone is a dissident under a repressive dictatorship, and the “hackers” work for the regime, someone could be killed with this information.

notif1 3y ago
Anyone in that position knows not to use Skype. Anyone in that position that was using Skype was likely picked up ages ago because their threat modeling is clearly trash.
- kube-system 3y ago
  That's not a reason to discount this as a real vulnerability. Most hacks in the real world are due to mistakes in security hygiene. Because most people aren't security experts, and even those who are, are human. They make mistakes, do things in a hurry sometimes, and don't know everything. Novel, high-skilled attacks are uncommon.
  - notif1 3y ago
    It's certainly a real vulnerability just not a particularly impactful one. Claiming that it's going to get people killed is unnecessarily inflammatory rhetoric that makes you look like you don't know what you're talking about. Claiming that novel, high-skilled attacks are uncommon when they're inherently challenging to have visibility of confirms that you don't know what you're talking about.
    - kube-system 3y ago
      I'm not saying (and didn't say) that's a likely outcome of this particular bug. I'm posing the example as something that could be done with an IP address, because I'm pushing back at the assertion that IP addresses aren't useful for anything. They aren't useful for criminal hackers looking for a random untargeted machine to compromise. But they're useful for targeted scenarios like the example I gave.
uxp8u61q 3y ago
Uh, what? What scenario are you trying to conjure here? The regime knows the person's Skype handle, but not his/her IP; and the knowledge of the IP someone enables the regime to kill the person?! How does that work, exactly? Can you elaborate?
- kube-system 3y ago
  Yes, and in places like these, ISPs are compelled to provide address assignment logs, if the ISPs are not government entities already. With that info, they can show up to their physical address.
  - uxp8u61q 3y ago
    Maybe I didn't express myself well enough. Do you really find it plausible that the government would know the person's Skype username but not their name? If they can compell the isp, why not Microsoft? They will obviously comply too.
    - kube-system 3y ago
      > Do you really find it plausible that the government would know the person's Skype username but not their name? Yes, people communicate under pseudonyms on the internet all of the time. Remember that not all governments have the same technological power as the major global powers... especially the most repressive ones. > If they can compell the isp, why not Microsoft? They will obviously comply too. MS has a limited physical footprint where they can be legally compelled to do anything. They don't operate in the world's most repressive regimes. And they do deny information requests all of the time. 25% of criminal requests were rejected by MS last year for not meeting requirements. And many of the world's most repressive regimes don't even appear on the list. Probably because they also say (emphasis mine): > Microsoft produces data in response to valid legal requests from governmental entities in countries where Microsoft Corporation is located. https://www.microsoft.com/en-us/corporate-responsibility/law-enforcement-requests-report https://www.microsoft.com/en-us/corporate-responsibility/law...