Skype lapses allows hacker to track your BitTorrent downloads

Scientists have devised a stealthy and low-cost way to track the internet protocol addresses of tens of thousands of Skype users, and link the information to their online activities such as the sharing of specific files over BitTorrent.

The method, which is laid out in a recently published academic paper, works even when Skype users have configured their accounts to accept calls only from people in their contact lists. It also works against Skype users who aren't currently logged in, as long as they've used the VoIP program in the past three days. The system is able to link an individual Skype user to specific BitTorrent activity, even when they share the IP address with others over a local area network that uses NAT, or network address translation.

“We have shown that it is possible for an attacker, with modest resources, to determine the current IP address of identified and targeted Skype user[s] (if the user is currently active),” the 14-page paper stated. “In the case of Skype, even if the targeted user is behind a NAT, the attacker can determine the user's public IP address. Such an attack could be used for many malicious purposes, including observing a person's mobility or linking the identity of a person to his internet usage.”

The scientists found that it was relatively easy to find the ID of most Skype users when their email address and birth name are known to the attacker. Additional information, such as the target's city of residence, sex, or age, brought greater accuracy to the task.

They then called the target's Skype account using a customized system that sent specially crafted packets. By examining the headers of the data that was returned, they had no trouble determining the person's IP address. Because the scientists prevented a TCP, or transmission control protocol, connection from being fully established during the probing, targets had no idea their Skype accounts were being tracked. The scientists devised the system so that it could track 10,000 people for about $500 per week.

After learning the IP addresses of individuals, the scientists tapped BitTorrent sites to track the specific downloads of addresses in their database. Even when one of the IP addresses was shared among many users on a single network, the method was able to single link a unique Skype user to a specific download by, among other things, collecting identifiers known as infohashes from BitTorrent networks.

The scientists said Google Talk, MSN Live and other real-time communication applications may also be susceptible to the technique, but they singled Skype out for containing what they called “a major privacy vulnerability.”

In a statement, Adrian Asher, chief information security officer in Microsoft's Skype division, said: “We value the privacy of our users and are committed to making our products as secure as possible. Just as with typical internet communications software, Skype users who are connected may be able to determine each other's IP address. Through research and development, we will continue to make advances in this area and improvements to our software.”

The research paper, which is titled I Know Where You are and What You are Sharing, made several recommendations for improving Skype's ability to conceal the identity of its users.

“One solution that would go a long way is to design the VoIP system so that the callee's IP address is not revealed until the user accepts the call,” it stated. “With this property, Alice would not be able to inconspicuously call Bob. Moreover, if Alice is a stranger (that is, not on Bob's contact list), and Bob configures his client to not accept calls from strangers, then this design would prevent any stranger from tracking him, conspicuously or otherwise.”

A PDF of the paper is here.

Bittorent Site Compromised, Serves Malware to Downloaders

Attackers hijacked two popular Bittorrent websites and tampered with their download mechanisms, causing visitors trying to obtain file-sharing software to instead receive malware.

The hacks on bittorrent.com and utorrent.com replaced the sites' standard software downloads with a piece of fake antivirus software known as Security Shield, an advisory warned. Anyone who downloaded and installed software from those sites between 4:20 a.m. California time and 6:10 a.m. should scan their systems immediately for infections.

Once installed, Security Shield delivers false reports that a computer is infected with multiple pieces of malware and prompts the user for payment before claiming to disinfect the machine. The attack affected only users who downloaded and installed software from bittorrent.com and utorrent.com during the hour-and-fifty-minute window that the sites were compromised. Those who installed software previously are unaffected.

"We take the security of our systems and the safety of our users very seriously," the Bittorrent advisory stated. "We sincerely apologize to any users who were affected."

Bittorrent Client Released uTorrent 3 Final

After what felt like an eternity, the final version of the popular lightweight Bittorrent client uTorrent 3 has been released today. The final version is build 25406 and existing users should see update notifications when they start their client on their system, or by manually checking for updates by selecting Help > Check for Updates. Users of uTorrent 2.x can download the latest version of the program from the official website, where it is available as a 32-bit and 64-bit application for the Microsoft Windows operating system.

The release notes are as usually available on the official forum. Version 3 of uTorrent adds features such as a portable mode, streaming, torrent ratings or drag and drop sending of files. The complete list of changes and fixes is available in the forum.

The drop files to send feature is incredibly easy to use. Just drop a file that you want to share on the drop area, and uTorrent will create the torrent for you. The program displays a tiny url link that the recipients of the file need to open. The torrent is then added to their uTorrent version. If they do not have uTorrent it is installed on their system.

Streaming needs to be activated in the uTorrent options before it becomes available. All suitable media players are automatically available for selection in the options.

The Stream button becomes then available in the torrent listing. A click on the button loads the stream url in the selected media player. It is then possible to play the media in the player directly, even if it has not been downloaded completely yet.

Depending on your previous version, you may see a different looking client with additional features that you had not had access to before. This includes uTorrent apps which more often than not provide access to media and file releases of companies and organizations. You find some apps among the available ones that add features to uTorrent, a chat for instance.

The getting started guide in the client seems to be new as well. It offers a step by step guide, a beginners guide and links to faqs and information about the program (correct me if I’m wrong here).

The developers have fixed a boat load full of issues, from crashes and stability issues over freezes and hangs to cpu optimizations.

Users should take a look at known issues before they update, if they want to make sure that the program works on their system without difficulties. The list displays confirmed problems and issues that are not fixed in the uTorrent 3.0 stable release.

Most of the bugs listed seem to be limited to display issues, only a few indicate stability issues.

On a personal note. I’m running uTorrent 3.0 since the first alpha and did not have a single problem ever since. The update to version 3.0 went without difficulties. Some users in the release thread are on the other hand reporting problems with the version.

Have you made the update to uTorrent 3.0 yet? What is your impression of the new version.