4

I'm posting this three weeks after a malware and keylogger scare that happened through Skype, and my own negligence, which resulted in a fresh install of Windows 7.

Everything's running and clean, but after a couple of weeks of using Skype again and monitoring activity with TCPview, I noticed there were two IPs that were slowly but surely sending and receiving packets from Skype, while Skype was idle.

Closing one of the connections closed the other at nearly the same time, and they haven't shown up since. Looking up the two IP's (while ignoring the extensions) showed they were possibly coming from home networks with AT&T U-verse and CableOne from the DFW area and Southeast Arizona, respectively.

Should I be worried or suspicious about this? At first I wasn't, but then I remembered that Skype ditched the p2p setup back in July, so I have no clue why there'd be a connection like this.

Screenshot of logs

  • Skype listens to 0.0.0.0/0 on <insert port here>, which means if your computer is directly exposed to the internet, anyone can connect and use Skype functions on your system. Whether or not that includes a vulnerability remains to be seen. The answer about a "very small number of bytes" is horribly wrong, especially without enough details. – Mark Buffalo Nov 14 '17 at 17:41
  • I should clarify the above: this is only true when you have it enabled. I think it's enabled by default. See this answer. Different versions may use different ports as well. – Mark Buffalo Nov 14 '17 at 23:34
-2

It seems that these kinds of issues continue to plague Skype.

Best guesses seem to indicate bot scans or poor hygiene on Skype Adverts.

I would certainly suggest installing ad blocking on all of your browsers. I also install it on my router too.

If you haven't changed passwords on your Microsoft account recently, that couldn't hurt and you should certainly turn on two-factor authentication for the account.

  • Well it is a very small # of bytes so maybe not a lot to worry about. This should almost never be part of an answer when it comes to security. An established shell may use only a few bytes to start... – Mark Buffalo Nov 14 '17 at 23:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.