Ask Slashdot: How To Track a Skype Account Hijacker? 152
An anonymous reader writes "My Skype account was hijacked, which I discovered after Skype suspended it for suspicious activity, including a number of paid calls and an attempt to debit my card. Now that I've secured the account again, I can see the call history — there are several numbers called in Senegal, Mali, Benin and Philippines. Obviously I could call them myself and create a bit of havoc in their lives, but ideally I'd like to trace the hijacker himself — perhaps with some kind of 'social engineering' approach. Or is it just a waste of time?" How would you do this, and would you bother?
No point (Score:2, Interesting)
Sadly there's no point in bothering. It could be that the numbers they called are 'premium' numbers and its possible that your account is gonna get charged a whole ton of money from those 'services' that were set up specifically for this kind of thing.
Re:No point (Score:5, Interesting)
Sadly there's no point in bothering.
In this instance, I might disagree. Given that those calls were (according to TFS) made to Senegal, Mali, Benin and Philippines, that in itself might be construed as suspicious. You could pass the information on to the FBI and tell them you are concerned your account could have been used for terrorist activity. Let them come down on the perps.
Re: (Score:2)
Sadly there's no point in bothering.
In this instance, I might disagree. Given that those calls were (according to TFS) made to Senegal, Mali, Benin and Philippines, that in itself might be construed as suspicious. You could pass the information on to the FBI and tell them you are concerned your account could have been used for terrorist activity. Let them come down on the perps.
well, sure, call those numbers them. give them more money.
Re: (Score:2)
Now there's a good sense answer that requires little to do on the part of the violated. You can still make it out to be a huge thing , down at the bar, with you in the middle of an international incident.
Someone mod this guy up and get him a beer.
Re: (Score:1)
Sadly there's no point in bothering.
In this instance, I might disagree. Given that those calls were (according to TFS) made to Senegal, Mali, Benin and Philippines, that in itself might be construed as suspicious. You could pass the information on to the FBI and tell them you are concerned your account could have been used for terrorist activity. Let them come down on the perps.
Lol, not likely. This is a common scam lately, not just by getting into Skype accounts but also by breaking into PBX systems, SIP phones, etc. They place calls to those numbers which are toll services, this generates a charge to the person's account. The scammer is somehow related to the people who get paid when those numbers get called, either directly involved or at least another branch of a criminal enterprise.
They've been up to this for years, so while I'm sure the FBI would be happy to add the OP's spe
Re: (Score:1)
Do you seriously live in such a paranoid delusion that you believe that crap?
Ask Reddit... (Score:5, Funny)
Reddit seems to be fantastic at finding people on the internet given the flimsiest leads to their identity... sure they may get it wrong now and then, but hey... them's the breaks.
Re: (Score:2)
I'll save the poster some time: if you ask Reddit, they'll tell you it was Sunil Tripathi. Case closed.
get their ip (Score:3, Informative)
Their ISP won't care (Score:4, Insightful)
Look at the places they called. Likely the hijacker is somewhere in a developing country. Unlikely to be the same country where the poster lives. The ISP will not care, as long as their bills are paid.
Re: (Score:1)
Look at the places they called. Likely the hijacker is somewhere in a developing country. Unlikely to be the same country where the poster lives. The ISP will not care, as long as their bills are paid.
Call and harass the people they contact. You know, passively at first, pretending to be other guy, then lay in.
Re:Their ISP won't care (Score:5, Funny)
First become fluent at harassing people in African-French and Filipino.
Re: (Score:2)
For a simple DoS you needn't even speak their language.
Re: (Score:2)
Be aware that many in West African countries don't have home phones or home internet. They may be someone renting a chair at an Internet Cafe.
http://nigeriamasterweb.com/Etc4/InternetSurfersCyberCafeNairobiKenya.jpg [nigeriamasterweb.com]
Post numbers (Score:5, Interesting)
1] Post the numbers dialed to 4chan
2] Wait for the onslaught of harassing calls
3] ???
4] Profit
Re: (Score:3, Insightful)
Neither is my cat. It still catches the mice though.
Re: (Score:1)
Actually your cat IS your personal army.
Re:Post numbers (Score:5, Funny)
Actually your cat IS your personal army.
It may seem like the cat belongs to you, but if it really was your personal army then it would actually have to obey your orders.
In reality, you are more like a squire to your cat; you attend to the cat's personal needs when it isn't off doing heroic battle against a mouse or bug.
Re:Post numbers (Score:5, Insightful)
Re: (Score:1)
Re: (Score:1)
I am not saying that he has a good personal army.
Cats Are Assholes (Score:1)
Want some food? I'm your best friend.
Play time? I'm your best friend.
Any other time? FU, GTFO
I love 'em :-)
Re: (Score:2)
What makes you think this isn't part of it...?
What about the IP (Score:2)
Won't Skype tell you the IP that was used by the thief?
Re:What about the IP (Score:5, Interesting)
Won't Skype tell you the IP that was used by the thief?
No, they won't. In general companies tell you to contact the police, etc and go out of their way to be useless.
Some months ago I had someone purchase a plane ticket using my credit card. My bank sent me a SMS when the charge was made (usual alert system, they SMS each time there's a charge). I had the phone with me so I could do something instantly. This is what happened:
- The charge was made for a plane ticket on Airchile according to the SMS.
- I called the bank *inmediately* (as the SMS said) to notify them of the charge. Well, guess what, it was a Sunday at 23:00 or so and they were closed. So the bank couldn't help.
- I drove to the airport to talk to Airchile, which happened to be opened at the time because they was a flight leaving from Madrid to Santiago in a couple hours (I was hoping that the bastard was there). They couldn't help.
- I went to the police station in the airport and they couldn't help because I needed a bank statement before they could do anything. Really? I have to wait until the end of the month before I can file a report with the police?
You see - even if you are really willing to track things down and not demand your money back, the other parties involved rarely assist.
Eventually I got my statement, filed the report (useless at the time of course) and got my money. But I great chance to catch the guy was lost.
Re: (Score:2)
"I'd like to know my IP, the one I used on Tuesday to call Somalia."
"No, we aren't allowed to tell you your own IP address for privacy reasons."
How exactly does that work? You are who you were last week, as far as they are concerned, right?
Re: (Score:2)
Congrats, and welcome to the queue. If you'd like to dispute this society, please press star, and an operator will be with you
Re: (Score:1)
The funny part is that's by design. Our American society cares more about protecting the right to make mistakes and the belief in second chances than it does in any right to privacy or integrity.
Actually this is the implementation of "What if it's someone rich?" clause.
Re: (Score:2)
It does? Gee, the prison and justice system in general would have suggested otherwise.
Re: (Score:2)
Our American society cares more about protecting the right to make mistakes and the belief in second chances than it does in any right to privacy or integrity.
So that's why there's more Americans in prison than any other society in history. Got it.
What airline was that again? (Score:2)
airchile doesnt exist.
Re:What about the IP (Score:5, Insightful)
Your Bank/Credit card company has no 24h service number for such this ?
Time to change credit card company.
Re: (Score:2)
What sort of dodgy bank are you with that doesn't have a 24-hour line for reporting card loss/theft?
A couple years ago, my wife's check card number was stolen and run for about $300 at a Wal-Mart in Dallas - at about 10 PM local time on a Sunday, I was able to call and report the theft on a 24-hour number, get the number blocked, and even managed to get the store manager at the Wal-Mart to pull video from the checkout line of the thief. The next morning I faxed in the appropriate form, and the money was bac
Re: (Score:1)
I wouldn't start that journey from here (Score:5, Insightful)
Re: (Score:3, Funny)
The answer is clear: The hijacker is Kevin Bacon.
Re:I wouldn't start that journey from here (Score:5, Insightful)
Sue called Jim, Anne called Bill, Jenny called Fred; Sue, Anne and Jenny all know Henry .... so if you have Jim and Bill and Fred's numbers, and don't even know whether Henry exists or not, how do you find Henry?
It's pretty much impossible; not mathematically but practically. First, Jim, Bill and Fred live in different foreign countries. They have no obligation to tell you anything, even if you are a police officer in your own country. But if for some reason they choose to endanger their relatives, they may not know where Sue, Anne and Jenny live. But if you manage to find them, those three are not required to tell you anything (if they are in the USA, at least.) But if you manage to make them talk and they point at Henry, Henry can always say that he used his own Skype account, but the OP "hacked" it to "frame him" because he is "raysis." (Well, that story is being tried by the Boston bomber's mother.) The OP may find himself on the receiving end of a counter-suit, if not of a criminal complaint (doesn't matter if it has merit or not - justice is not based on such trivial things.)
The OP should pick better passwords, write the loss off, and take this experience as a valuable lesson.
Re: (Score:2)
They have no obligation to tell you anything, even if you are a police officer in your own country.
You must be new here. =)
Hello, I'm looking for my long lost brother. I'm 80 years old and we were together in Auschwitz. Have you heard about Auschwitz? No? Could you do me a favour and look it up? I'll call you back. By the way we only barely survived and have been separated ever since...
OP is probably right asking for help with this stuff. Social Engineering is fun, profitable and perfectly legal, but it certainly isn't easy for the uninitiated.
Re: (Score:2)
Most ISPs, even in poor foreign sites, are trained for social engineering. Hell, they may reverse your tactic and have you crying about their 7 starving children by the time you hang up the phone.
Re: (Score:1)
Hello, I'm looking for my long lost brother. I'm 80 years old and we were together in Auschwitz
Language of what tribe will you use? Are you good with it? What would *you* do if someone calls you, purportedly from China, and in broken English starts asking you who in China you talked to on Skype a week ago and what is her address, using an excuse that is an obvious lie. Most people would respond in just two simple English words (that are pretty well understood worldwide) and block the contact forever.
Yo
Re: (Score:2)
It's not even that. I bet the numbers called were all premium-rate telephone numbers and that is how the hijacker makes his money. By calling them you will give them more of your money.
voip fraud (Score:3, Informative)
The account was possibly being used for voip fraud. Voip fraud is typically the practice of hijacking a VOIP account (sip/skype) and then calling some foreign country exchange that has a stupid high per minute rate (that the called party gets a cut of). The called party is usually in on the scam but good luck getting any realistic amount of cooperation due to local corruption at the called party end (almost always third world countries).
You're a fucking idiot (Score:4, Insightful)
Do you think someone broke into your Skype account to call 5 random countries? They're all toll numbers in Africa. The damage is done and you lost
Re:You're a fucking idiot (Score:5, Informative)
The last time I checked the Philippines was an island chain, not a territory in Africa. Don't you just sound credible?
Let it go. (Score:5, Insightful)
Just let it go. It's not worth the time or the hassle.
Use better logic (Score:5, Insightful)
1. Do not assume you can outsmart them or that they have made glaring mistakes
2. Realize they do this professionally, that is, spend years eating and breathing this type of activity
3. Realize if there was some way to retaliate or gain an advantage, they wouldn't be doing this for a living.
4. Re-evaluate your position.
Re:Use better logic (Score:5, Funny)
3. Realize if there was some way to retaliate or gain an advantage, they wouldn't be doing this for a living.
I'm waiting for SIFPTP (Simple Internet Face-Punch Transfer Protocol) to be implemented.
Re:Use better logic (Score:5, Informative)
This might be the same digital effort - an account with 'cash' is passed/sold around until it fails.
Re: (Score:2)
What? This is put out there like it's common knowledge in Australia but "Informative" to others.
What do you even mean by "Bell" public phone? It's obviously not Ma Bell, is that why the air quotes?
Re: (Score:2)
Putting "Bell" allows US centric readers a reference to a time in their past, the use of pay phones and international calling cost structures at that time.
vs the long Australian telco history http://en.wikipedia.org/wiki/Australian_Telecommunications_Commission [wikipedia.org] that would not be so clear to a non Australian reader on average.
Re: (Score:2)
Fair enough, "pay phone" would be the US-ism though.
Still, I read a good bit about phreaking as a kid, don't recall any widespread international call efforts in Australia. I blame Wargames for making that popular.
Re: (Score:1)
Only revenge (Score:3)
You need professional help (Score:3)
If you have a problem, if no one else can help, and if you can find them, maybe you can hire the A-Team.
Re: (Score:3)
Call the numbers in Africa and say... (Score:5, Funny)
Customer defined fraud (Score:3, Interesting)
I had a similar experience - my account was emptied of its five GBP of credit.
I emailed Skype - "there have been fradudent calls, I've changed my password".
Their reply? (slightly paraphrased)
"You must have been responsible for the breach, as our security is perfect. We do not refund fraudulent calls due to customer error. We've locked your account, so you'll need to send us proof of ID (passport copy, etc) for it to be unlocked."
The key problem with this reply is that a *customer* asserting an event is a fraudulent call does not make it a fraudulent call.
What if they have bugs in their billing software?
Skype only cared about not issuing compensation. Needless to say, I've never told anyone my skype password and my laptop at the time of the calls was in for repair, where I had removed the SSD drive before sending the unit off. Also needless to say, I've never unlocked that account or spent another cent with Skype. Thankfully, GoogleTalk came out just at the right time. Thank God for choice.
Re: (Score:2)
They key thing to learn is to make sure Skype doesn't auto-recharge and delete your credit card details from your profile. It's a damage limitation exercise.
Re:Customer defined fraud: maybe not so redundant (Score:1)
Dont get involved. (Score:2, Informative)
The hacker may have been involved in drug smuggling or terrorism or what not. Do not get involved. Be happy you got your Skype account back and move on.
Re: (Score:3, Insightful)
Don't call the numbers (Score:5, Insightful)
They're most likely either (1) disconnected numbers, (2) toll numbers that will rack up massive charges, OR (3) Numbers that the thief sold innocent 3rd parties "cheap long distance minutes" to, through fraudulent schemes.
Don't engage yourself in placing international harassing phone calls to "create havoc" in random people's lives; that would be you committing a crime. ,
Re: (Score:2)
You can check the phone rates to call many phone numbers that are not a 900 type number. Most likely the account was used to call friends and associates.
The fees are based on the termination charges of the destination phone number. Use this link to see charges for a typical VOIP provider (Skype carges considerably more than most other VOIP providers)
http://www.viatalk.com/tools/intrates/ [viatalk.com]
VIATALK rates given for example. Other providers are similar.
For rate comparisons, you can compare Diamondcard, VIATALK,
Re:Philippines ~ US 27 cents / minute. (Score:2)
A quick check of VIATALK rates to Philippines $0.2693
Nigeria $0.1905
Nigeria Cell typical, varies.. $0.1966 - $0.2505
Re: (Score:2)
You can check the phone rates to call many phone numbers that are not a 900 type number. Most likely the account was used to call friends and associates.
Not all country codes are listed. 8816, for example. And if you don't do your research, you may arrive at an equivalent to 900 number, or destination with ludicrous termination charges.
The international rate sheets only show you the standard rates for dialing certain countries, but there are destinations that can be $10 to $25 per minute, and it's
Re: (Score:2)
(4) Numbers owns by a Telco to create traffic. Many Telcos in third world countries uses this scheme. They create random numbrers, when you call there it's playing music or a thanks message or something like that. They then pay people to call those phone number from overseas Telcos.
That's a very interesting scary concept... although, when you consider, there will be international termination charges paid to those providers, generated by their own calls.
Well, that is also a form of fraud.
Similar to th
scamming a scammer (Score:5, Insightful)
Or is it just a waste of time?
That, at best.
Old saying: There's always a sucker in a game of poker. Look around the table. If you don't see him, it's you.
Never play criminals on their home turf. They are doing this for a living, you don't. Guess who's better at the game?
Re: (Score:3)
You can tie up scammers on their home turf. It is called scam baiting. The scammer gets to spend time and money playing games with your bait instead of victims. I regularly write scammers back. I am most interested in my inheritance of 10.5 million.
I question my eligibility, write with a fake first name, no last name, and a bait email account with a free US DID phone number. They can email me, text me, call me, etc, while I continue to find out the name of the deceased before I fill out their form to f
Re: (Score:3)
Re: (Score:2)
You can tie up scammers on their home turf.
You also tie yourself up. Unless you have nothing else to do with your time, it's still a net loss for you.
Re: (Score:2)
You can tie up scammers on their home turf.
You also tie yourself up. Unless you have nothing else to do with your time, it's still a net loss for you.
Unless you can derive entertainment from it. Then it can pay for itself.
Dan Aris
Agree with everybody who said "give it up." (Score:4, Interesting)
Waste of time (Score:1)
Look on this as hard earned experience to use better passwords in the future.
The tubes are the wild wild west, and anyone who thinks otherwise is delusional.
Just move on, and don't waste your time.
I recall many years ago being hacked by someone. Reformat, learn from the experience, and move on.
Easy Solution (Score:3)
Re: (Score:2)
my advice was similar, go to the shady part of town at night dressed as batwoman. enough interesting things will then ensue you'll forget all about your hijacked account
Re: (Score:2)
Re: (Score:2)
see?, interesting things are happening to you just imagining it
Done (Score:1)
> "I can see the call history — there are several numbers called in Senegal, Mali, Benin and Philippines."
Don't bother -- you'll just be hassling some expat's grandma or sister. The account was probably hacked and immediately rented out on the black market. Now, the expat certainly realizes it was hacked, and would deserve it, but the hacker is long gone, probably hundreds of victims down the road already.
(ring ring)
"It's Queef calling from America!"
(answers)
"Hello?"
"You asshole hacked my Skype!"
I did this (Score:4, Informative)
My cellphone was stolen from my car and then recovered (it was found in the middle of the street). I called the long-distance numbers, pretending that I found the phone and wanted to return it to the owner. The people called (teenagers) were surprisingly helpful and I got the name and local address of the teen that called them who was staying with his uncle. I turned the info over to the police who told me that the loss was actually incurred by the phone company (charges had been refunded) and I was not "harmed" so there were no charges to press, plus the kid could claim that he "found" the phone and did not break into my car. But the detective did talk to the uncle and told me he thought the uncle was going to beat the kid's ass and send him back to Louisiana since the kid had been a problem since he got here. Good enough for me whether true or not since it was all that could really be done.
Comment removed (Score:3)
Re: (Score:1)
happened to me (Score:1)
Someone brought a subscription to call Jordan, burned through it (you don't get many minutes to jordan) brought $10 credit, used that, then that was the end of it. Both were debited from my paypal account.
Skype were horrendously unhelpful, insisting my account hadn't been hacked, but I needed to reset my password multiple times on their insistence anyway, and refused to entertain the idea of a refund because I had allready "used" the credit. Thankfully paypal stumped up the refund, I got some BS boilerplat
You wanna fuck with criminals? (Score:1)
take a bounty hunter course or something.
Creepy. (Score:2)
Re: (Score:2)
How would he be breaking the law? And where is he suggesting hacking?
I think the thought was he could somehow use the numbers the thief called (ie people the thief knew), but it sounds like those were scam toll numbers or something else that wouldn't be helpful.
Re: (Score:1)
OP's plan is exactly what the long distance companies did when phreakers would use found phone numbers to call friends around the country. You needed to have forgetful friends because the company would call them up and ask who called. Phreakers would usually use payphones, which were plentiful back then.
Wrong priorities (Score:3)
The original poster has not stated that he knows how his account was hijacked.
His first priority should be to understand the how the hijack happened and take measures to makes usre that it won't happen again. Regaining control of the accoount again is not sufficient.
Re: (Score:2)
First up: IANAL.
I think in Australia what you state above is not a crime.
To my knowledge, conspiracy to commit a crime requires 2 or more people.
Re: (Score:2)
I think he insinuated that random /. posters would be conspirators, in his sexually excited state.
Re: (Score:2)
Replying to an AC seems like pissing into the wind... but anyway.
I think your definition needs work, otherwise every murder mystery author would be guilty.
Re: (Score:2)
They don't give drunks, mod points, you sot!
Re: (Score:2, Insightful)
Seriously
Surely you have better things to do in your life than troll around here and issue such nonsense. On that note, I'm going to get back to my life and go to sleep. You may continue to troll along as you choose.
Re: (Score:2)
Seems like a lot of people agree with this "troll" if he's already gotten Score:5.
Re: (Score:2)
Myself included. There's almost certainly nothing to be gained from embarking on some CSI inspired e-detective work.
If AC is a troll, fair enough but by such a broad definition the same is true of Mendax. The only difference I see is that the AC opted for humour over Mendax's calling card for why he/she probably doesn't get invited to many parties - at least not a second time.
Re: (Score:1)
You've have to be pretty short-sighted to believe that telling someone to "get a life" means that the accuser is a bitter person. Some people need to be put in their place, even the nicest people know when to put their foot down and tell it like it is.
Re: (Score:2)
I'm still waiting to hear activities that you consider to be a life. Whatever you say is going to either sound silly or ridiculously lofty, and we'll make fun of you and ask you why if you have such a "life" you are prowling around slashdot, but you won't tell us will you, you bitter loser.
Oh noes! AC, with his Wikipedia-provisioned psychology degree and at least one foot on the floor is well on truly on to us. Help ma boab - better scarper!
Re: (Score:2)
game theory, tit for tat
But I thought tit for tat with forgiveness beats pure tit for tat.
Re: (Score:2)
Re: (Score:2)
Regardless of additional modifiers: tits always beat tats.
Man boobs.
Re: (Score:2)
I'm sure it's possible, but he also uses skype to chat with his friends and it wouldn't be easy to get all of them to use a different solution.
So, he uses multiple clients, or we all just use skype - unless we can find someting worth the hassle of converting to, which would have to work on Linux, Android