Hot answers tagged

45

Given the information you have provided I'd say that it's google shortener visiting the url to check it for security purposes: "Our spam detection algorithms are automated, and routinely disable suspicious goo.gl short URLs" see here. Back in 2013 it came out that Microsoft monitors skype conversations for HTTPS urls. It then visits these urls purportedly ...


33

Today, Skype do not route communication through other users machines. This is done by Microsoft servers in datacenters. But back in the days, in the early versions of the Skype protocol, every user with strong-enough bandwidth and not behind a NAT (with routable IP address), can become a supernode and route the traffic of other users that are behind NAT. ...


25

As others have already answered: Yes, Skype originally did sometimes use other Skype users to route some calls. BUT!!! What the other replies didn't say was: This was actually A GOOD THING! Because Skype was initially Peer-2-Peer based not server based (as Microsoft made it) and all traffic was encrypted from end-to-end it gave Skype two big advantages ...


17

My understanding is that Superfish installs the exact same certificate and private key into every computer, so once you obtain the hard-coded private key you can use it to man-in-the-middle anyone who has superfish installed. Avast does not do this; it dynamically generates a unique certificate and private key for every install. This is what the Avast ...


13

When you use Google's goo.gl service for link shortening, the URL becomes known to Google. This gives Goolge the opportunity to index the content for their search engine. Remember Google's privacy policy which basically states "we will data-mine every single bit of information you make available to us". Apparently it then appeared as a search result for a ...


11

Yes, be alarmed. It looks like something injected into Skype is trying to communicate with an untrusted server in Ukraine. There's no reason for Skype to be doing this normally. A bit of investigation on the domain returns this information: domain: pakko.ua admin-c: PC226-UANIC tech-c: IMENA-UANIC status: OK-UNTIL 20131123175521 dom-public: ...


11

It's exceedingly difficult to block Skype file transfers at the network level. They've designed it to use common ports (80 / 443) and proprietary encryption (albeit an extension to SSL) along with UPnP NAT holepunching to ensure absolutely minimal conflicts and setup issues. Remote file transfers go through supernodes as part of a P2P architecture, so it's ...


8

This might simply be a Skype Supernode (I no longer think so), that said, I think there are some red flags: The server is in Ukraine and it belongs to a company that doesn't seem to have business with Microsoft/Skype, and they don't seem to be in a position to host a Skype Supernode. Server is running ProFTPD 1.2.10 behind an open port 21. I don't see why ...


8

Currently there is a small breach in the Skype for Web. Any HTML code is escaped on the client side before it is posted to the Skype server. But you can send unescaped HTML by writing some JavaScript code. The steps follows: Go to Skype for Web via Chrome Open JavaScript console and execute: // replace standard XHR.send() with our custom implementation ...


7

They may be able to gather some details about your connection since I believe that Skype at least used to go direct from one user to the other when in a voice call, so they could potentially identify your IP address, however they would be limited to what Skype allows them to do or any bugs in Skype allow for. If Skype is bug free, they shouldn't be able to ...


7

There have been several suggestions that skype is indeed backdoored and evesdroppable. If your concerned about it because Microsoft is now the owner, there are plenty of other alternatives to Skype which I would suggest as the easiest and cleanest solution (besides, if MS is your competitor, why would you buy their services). Some of the alternatives like ...


6

According to Vanilla Skype Part 2 [page 67], when you ask Skype to save your password, it takes a hash md5(username\nskyper\npassword) then it encrypts it using AES-256 and it stores it /home/USER/.Skype/SKYPE_USER/config.xml (config->Lib->Account->Credentials3). I have just tried to copy config->Lib->Account->Credentials3 to a config.xml ...


5

I have Skype running on a computer, and I can see that the Skype client is periodically exchanging packets with my contacts on Skype. So it is possible to figure out the IP address of your contacts simply by looking on network traffic on your own computer. I am not aware of any jurisdiction in which it is illegal to look at what is happening on your own ...


5

Payload encryption means they can't know what the communication content is, but in some cases they can still know what protocol you're using (In this case Skype). This is how countries block Tor, for example. Methods to detect the protocol being used even if it's encrypted: IP-based: TCP is not encrypted even if the payload is encrypted (So that computers ...


5

That Skype might be backdoored has long been a concern. See link below. https://ultraparanoid.wordpress.com/2007/06/19/why-skype-is-evil/ I also noted in a past review I did that the official, independent crypto review and the description gained by a reverse engineering team differed significantly. The latter had design flaws and working exploits. Also, ...


5

Down at the bottom-right corner of the Gmail inbox is a "last account activity" line with a "details" link. You can click on that link to get a list of IP addresses that the account has been accessed from.


5

I believe they already have if this article is correct: http://community.skype.com/t5/Security-Privacy-Trust-and/How-to-protect-your-IP-from-skype-resolvers/td-p/3874291 Skype uses peer-to-peer instead of traditional client/server connections to make the calls happen though. Since there's no sole middleman the data needs to know where it's going between ...


4

As for the other part of the question: why are users sticking with it while there are better solutions? Two words: market penetration. Average John Doe doesn't care about security or abusing (in the olden days) other network users. He just wants to make calls, this just works and he's not going to persuade all his friends to use something else when ...


4

While I would not count out malware/spyware, there is distinct possibility this is hardware malfunction. From the description I could say the touchscreen is defective (it or the ribbon cable). Do you have cracked glass/screen protection? In that case it is entirely possible for the phone to dial "on it's own". I've seen it on one phone already. It may be ...


4

Skype apparently had some known vulnerabilities, but most are old: http://www.cvedetails.com/product/18729/Skype-Skype.html?vendor_id=8920 https://www.cvedetails.com/vulnerability-list/vendor_id-2302/product_id-4023/Skype-Technologies-Skype.html You might also be interested in reading Skype's security page http://www.skype.com/en/security/ Without going ...


3

It seems strange that odd behavior only occurs when using Skype. If there was a RAT (remote administration Trojan), which can include key logging functions, your computer would be compromised across the board. The loading/processing cursor icon might not be signalling malware at all, its strange that you would suddenly think this is a sign of a virus. If ...


3

Although Skype uses robust mechanism and cryptography to authenticate a user, a password can be compromised in many ways from many different points. For example: From your endpoint, e.g. malware stealing your password, using a keylogger, etc. From external parties, e.g. password reused on another system/application which has been hacked, password manager ...


3

No, there isn't any plugin for Skype that would plug into its transport layer and custom encrypt calls peer-to-peer, and there likely won't be any as: Skype uses a closed proprietary protocol, which they do not publish. Skype intentionally does not interoperate with the rest of the VoIP industry, which is built on open standards. [1] Skype is now ...


3

If you like to chat in a secure way: Use any XMPP service (e.g. jabber) and overlay them with OTR. A List of supported programs can also be found on the wikipedia. Videochatting is not supported...


3

First off, I'd consider calling support: https://support.skype.com/en/faq/FA109/i-ve-forgotten-my-password Secondly, a recovery process has been outlined here: http://insecurety.net/?p=427 It is NOT as simple as running JTR on the conf.xml file ....


3

Chat history and contacts are saved in a windows directory : C:\Documents and Settings\\Application Data\Skype\ . Network admin has access to those files and can access them. So basically, Yes. Network admin can view your chat history or even export them without you noticing.


3

Here's the answer to the technical part of the question. As for the legal bit, well... here's the technical bit: All three services are encrypted, but there's some concern about the scope of that encryption: Client-only encryption: Me Provider You +-------+ +----------+ +-------+ | Plain |========| Plain ...


3

Skype uses a Peer to Peer model to route "calls" through the internet which means that part of the lookup function is being routed through unknown third parties. Microsoft (when they bought Skype) changed the model earlier this year so that it mainly routes through semi-trusted nodes (i.e. not some guys home broadband!) which they call "Supernodes" - ...


3

Recently I too noticed strange hits to a private page link sent via skype. Sometimes 10-15 at a time. On checking web server logs, I found its skype's spider bot. Any link you post in skype chats, the spider bot tries to fetch preview of website ( not sure why, may be spying links or storing website snapshots) If you check web server log (since i had ...


2

PGP/GPG is the defacto standard, getting a non-technical user started can be done. Take into consideration that there are applications that can hemp the non-technical user, but the user must become more security aware if he does not one to leak his private key. There is a tool called Silent Circle which was created by Phill Zimmerman, the man behind PGP, ...



Only top voted, non community-wiki answers of a minimum length are eligible