this post was submitted on 28 Aug 2023
304 points (92.7% liked)

Technology

59314 readers
4817 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

A security researcher has found it’s possible to reveal a Skype app user’s IP address without the target needing to even click a link. Microsoft said the vulnerability does not need immediate attention.

top 50 comments
sorted by: hot top controversial new old
[–] Lettuceeatlettuce@lemmy.ml 99 points 1 year ago (2 children)
[–] eager_eagle@lemmy.world 55 points 1 year ago (1 children)

You just hurt the feelings of 5 internet users

[–] ChapolinColoradoNZ@lemmy.world 3 points 1 year ago (1 children)
[–] Zorque@kbin.social 18 points 1 year ago (1 children)
load more comments (1 replies)
[–] partial_accumen@lemmy.world 17 points 1 year ago (3 children)
[–] PipedLinkBot@feddit.rocks 4 points 1 year ago

Here is an alternative Piped link(s): https://piped.video/watch?v=ZI0w_pwZY3E

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source, check me out at GitHub.

[–] Blizzard@lemmy.zip 2 points 1 year ago (1 children)

How have I missed that 🤣

[–] TurnItOff_OnAgain@lemmy.world 2 points 1 year ago

Look at all of his other Message from the CEO of ____ videos. They are amazing.

load more comments (1 replies)
[–] RedditWanderer@lemmy.world 66 points 1 year ago (3 children)

The attack could pose a serious risk to activists, political dissidents, journalists, those targeted by cybercriminals, and many more people.

Lmao like they're using Skype when trying to hide

[–] Potatos_are_not_friends@lemmy.world 24 points 1 year ago (1 children)

Hello. I am evil hacker cyber criminal.

If you want to discuss terms, find me on Skype at EvilHackerCyberCriminalGuy69.

Do not be fooled by the 69, as while it can be seen as a joke, it is my birth year as the original name was taken.

Thank you.

[–] TurnItOff_OnAgain@lemmy.world 5 points 1 year ago

I use 88 in stuff as well. I didn't realize until way to late that 88 is a nazi thing.

[–] Edgelord_Of_Tomorrow@lemmy.world 17 points 1 year ago (3 children)

Have to be honest, I thought Skype was discontinued years ago.

[–] RedditWanderer@lemmy.world 8 points 1 year ago

It was but we forgot to tell our grandparents, and Microsoft

[–] TonyTonyChopper@mander.xyz 5 points 1 year ago

somehow Emperor Skype returned

no matter how many times you say no it keeps coming back, same with Edge

[–] affiliate@lemmy.world 3 points 1 year ago (1 children)

i did too. i’m genuinely not sure why it exists. microsoft is making teams into its favorite productivity app, and i can’t think of anything skype has that teams doesn’t. why does skype still exist?

[–] lemmyvore@feddit.nl 3 points 1 year ago (3 children)

Because it sucks quite a bit less than Teams. I know I'll be sad to see it go when companies eventually switch to Teams. They're already running side by side in most places now while companies are migrating so it's only a matter of time. Microsoft will probably announce end of life sometime this year.

Skype basically bridged the time it took Microsoft to come up with their own conferencing solution so now that Teams is here to stay they can take Skype out back and shoot it.

load more comments (3 replies)
[–] rar@discuss.online 13 points 1 year ago* (last edited 1 year ago)

On a serious note, most of those people (activists, journalists, etc.) aren't exactly the computer savvy types, nor have the time or resource to spend learning about matters they seldom know about, and yet they are the ones that desperately need this knowledge. They might have an important message to be sent. What would you use to spread the message in their shoes?

Sure, we the tech guys, especially subscribed to privacy related communities, can talk about Tor browser or threat modeling all day. But have you tried bring that up in social circles, if any?

Non tech minded activists will simply use the tools at their disposal: messaging apps? sure; social media apps, if looking for message amplification, whatever it runs on their cheap android phone. Metadata? IP? Profiling? Browser fingerprinting? Some are aware of it, as they also had to endure internet censorship growing up. It's a trade they make knowingly or unknowingly between the cause and their physical and mental health.

We can laugh at their ignorance all we want, but this is how we become the Ivory tower that fuels resentment.

[–] BradleyUffner@lemmy.world 53 points 1 year ago (2 children)

Ohh no, someone on the Internet might have my IP address! The horror! What if they try to ping me?!

[–] RheingoldRiver@kbin.social 11 points 1 year ago* (last edited 1 year ago)

People used to use this attack in League of Legends a decade ago. If they're losing, they guess someone might have Skype open; and moreover, that their Skype is the same as their summoner name. Then they get an ip address and ddos the entire lobby, causing the game to crash (I think it happened in one of my games maybe once, but I didn't really play ranked other than team ranked).

Also, since all pro & semipro players had each other added, this was possible to do at any time during online tournaments (which was most tournaments - TSM invitational etc). So there were always rules that ddossing was disallowed. But it did happen.

Known ddossers were more hated in the community than known flamers, but a few people who did it "reformed" and went on to be pro players anyway.

[–] sugartits@lemmy.world 6 points 1 year ago (1 children)

What if they leave an anonymous tip that you're distributing CSAM?

[–] SkyeStarfall@lemmy.blahaj.zone 27 points 1 year ago* (last edited 1 year ago) (1 children)

With just an IP? Then the system is broken. Because an IP is often easy to get, and everything that directly connects to you needs your IP, unless you use a VPN I guess.

Every website knows your IP. Every internet application knows your IP. Everyone in a peer-to-to-peer network knows your IP. It's not a secret, it's just your internet address. It is designed to be known.

[–] Sethayy@sh.itjust.works 7 points 1 year ago

Yk I was on the others side of this til this comment, like I was gonna say there's a difference between corporations and malicious individual actors, but nowadays I'd trust some random individual 1000x before a company.

God I hope veilied becomes popular

[–] havokdj@lemmy.world 48 points 1 year ago (2 children)

Is this even news? Literally an exploit as old as time.

[–] Bearigator@ttrpg.network 9 points 1 year ago

I remember my friends and I doing this in 2008. This really is super old

load more comments (1 replies)
[–] jrest18n@lemm.ee 35 points 1 year ago

When Skype was still in common use, this was a very known issue. I’m in lots of gaming communities, and you had to be careful about who knew your username because you could have your IP exposed then get DDoS.

Possibly they patched it and this is a new instance of this, but it was like this for years and years before.

[–] Filipdaflippa@lemmy.ml 29 points 1 year ago (1 children)

Wait you can still do this? I was booting people off games when they would use the same user as their Skype over 10 years as a script kiddie, how is it not patched by now

load more comments (1 replies)
[–] howrar@lemmy.ca 25 points 1 year ago (2 children)

If you connect to anything on the internet, you're giving out your IP address. Why would this be any more of a concern?

[–] TORFdot0@lemmy.world 17 points 1 year ago

Users may consent to giving Microsoft their IP address but not to everyone who sends them a link

[–] brianorca@lemmy.world 4 points 1 year ago (1 children)

Because this can happen without you connecting to any suspicious server.

load more comments (1 replies)
[–] Cheems@lemmy.world 23 points 1 year ago

Now, that's a name I've not heard in a long time.

[–] dyc3@lemmy.world 19 points 1 year ago (1 children)

This is not new. It's literally always been like this.

[–] Redditiscancer789@lemmy.world 2 points 1 year ago* (last edited 1 year ago)

Lol I love how behind the times academics can be. This literally was a big thing used to ddos streamers back in the day like 2010s-2015s. All that needed to happen was they accepted a call and since Skypes peer to peer the hacker instantly got their IP. I remember Destiny being targeted for a while by it.

[–] Franzia@lemmy.blahaj.zone 17 points 1 year ago (1 children)

What the fuck. What percentage of people uses skype? I'd really rather see coverage of the exploits found in discord, zoom, slack, etc.

[–] marmo7ade@lemmy.world 5 points 1 year ago

I’d really rather see coverage of the exploits found in discord, zoom, slack, etc.

You intentionally clicked on this link.

[–] Swim@lemmy.ca 16 points 1 year ago

This is soo old that's how they would ddos clan leaders and shot callers back in the acheage days

[–] GustavoM@lemmy.world 12 points 1 year ago

Man, Justin Bieber is such a fa-- wait. We aren't in the 00's anymore?

[–] artvabas@lemmy.world 10 points 1 year ago (2 children)

Who is using Skype these days!

[–] LinusSexTips@lemmy.world 4 points 1 year ago

Was common practice in procurement for me and my team, still have contacts at ASRock / Keychron / Logitech / SteelSeries / Beacn / HYTE / Maxsun and many more.

Was a platform that was used early on and has carried through. Factories in China will commonly use WeChat but many of the more mainstream western brands will default to Skype.

[–] Redderthanmisty@lemmygrad.ml 3 points 1 year ago

Still a thing for some enterprise users... and the elderly.

[–] Raptor_007@lemmy.world 10 points 1 year ago

Silently? They don’t even tell you they’re doing it? 😕

[–] HawlSera@lemm.ee 9 points 1 year ago

There ia Very Probably No solution to this

[–] jet@hackertalks.com 8 points 1 year ago

Always on VPN is a good idea, or a VPN just for apps you don't trust (like skype). https://github.com/Safing/portmaster is a nice visual firewall configurator that can do things like, this app, must use the firewall. (easy to configure split firewall)

Me who hasn’t used Skype in like 15 years: Oh no

[–] stillwater@lemm.ee 4 points 1 year ago

Security research on Skype seems like durability testing a wet paper bag.

[–] canis_majoris@lemmy.ca 4 points 1 year ago

Huh, the time machine must be off. This was news from a decade ago.

It's actually one of the main reasons we switched off Skype to Discord for most gaming socialization.

[–] AnonTwo@kbin.social 3 points 1 year ago

Pretty sure this was already known. Just even back when Skype was relevant it wasn't fixed.

[–] ShittyRedditWasBetter@lemmy.world 3 points 1 year ago (1 children)

Because nobody cares. At all. The only people who might are streamers and over zealous nerds.

[–] Kolanaki@yiffit.net 3 points 1 year ago (1 children)

Even an overzealous nerd would understand knowing an IP address is pretty much worthless.

load more comments (1 replies)
[–] silvercove@lemdro.id 2 points 1 year ago

Is anyone still using Skype? Or is this a danger just to the last 10 people using it?

load more comments
view more: next ›