Mobile Study: 2012/04/29

2012年5月2日水曜日

Skype user IP-address disclosure

1. Downloading this patched version of Skype 5.5:
http://skype-open-source.blogspot.com/2012/03/skype55-deobfuscated-released.html
2. Turn on debug-log file creation via adding a few registry keys.
https://github.com/skypeopensource/skypeopensource/wiki/skype-3.x-4.x-5.x-enable-logging
3. Make "add a Skype contact" action, but not send add request, just click on user, to view his vcard(general info about user). This will be enough.
4. Take look in the log of the desired skypename.
The record will be like this for real user ip: -r195.100.213.25:31101
And like this for user internal network card ip: -l172.10.5.17
21:16:45.818 T # 3668 PresenceManager: a?? noticing skypetestuser1 0x3e54a539a91a19fc-s-s65.55.223.23 :40013-r195 .100.213.25:31101-l172 .10.5.17:22960 23d23109 82f328ff
5. Catch user via whois service.
http://nic.ru/whois/?query=195.100.213.25
This is help you to get info about skype user: City, Country, Internet provider and internal user ip-address.
Now you can troll him about CIA and Mossad, he-he.
---
Perl script to automate the search in the debug log.
---
#!perl
$LOGFILE="debug-20120420-2257.log";
$SKYPENAME="skypetestuser1";
open(RD,$LOGFILE);
open(WR,">_ip_logger.txt");
while(<RD>){ chomp;
$line=$_;
if( ($line=~ /PresenceManager:/) and ($line=~ /noticing/) ){
$line=~ /-r(\d+.\d+.\d+.\d+)/;
$ip=$1;
print WR $line."\n";
print WR "IP: $ip\n";
if ($line=~ /$SKYPENAME/){
print $line."\n";
print "${SKYPENAME} IP: $ip\n";
};
};
};
close(RD);
close(WR);
---

Hacked Skype IP Address Search Shows Who's Speaking From Where

"An online search portal has been launched that reveals the IP addresses of any Skype user. The portal needs only a Skype username entered in a search bar for it to produce the IP address of a target user. It then uses IP addresses to geo-locate users on a map and reveal their ISP information."

An online search portal has been launched that reveals the IP addresses of any Skype user.

The portal requires a Skype username to be entered for it to produce local and remote IP addresses of users.

It then refers to a third party site to geo-locate users on a map and reveal further information.

The portal builds on a published flaw within Skype first detailed by an anonymous user on Pastebin who wrote that a hacked 'deofuscated' version of Skype would reveal the IP addresses of users, even those who had not been added to contact books.

But the operator of the Skype-IP-Finder portal claimed in a tweet that Skype would de-register any user who activated the hacked Skype version and logged in under their profile.

The search portal would avoid that risk.

Skype was investigating but noted the hack was an "ongoing, industry-wide issue faced by all peer-to-peer software companies".

"We are committed to the safety and security of our customers and we are takings measures to help protect them," the company said.

The hacked Skype application would capture IP addresses within the programs' logs when a user's contact card was opened – part of the process to send contact requests.

However the request need not be sent: Skype's debug logging function, activated using registry keys on github, would record IP addresses.

The Pastebin entry also included a Perl script to automate searching the logs for IP addresses.

Last year, researchers had exploited a Skype vulnerability to match IP addresses of Skype users to data gleaned from BitTorrent to discover file sharing information (pdf).

Android Ported To C#

https://github.com/xamarin/XobotOS

"Xamarin has just announced that they got the Java part of Android ported to C# via machine translation. The resulting OS, called XobotOS, is available on Github. They claim some serious performance gains over Dalvik. For them, this is an experiment that they are not planning to focus on, but they will be using some of the technologies in Mono for Android."