11

This morning, I found out that I received a call from "skype-resolver" in the middle of the night on my phone. When I went to Skype, the call was nowhere to be found, presumably because the account had already been deleted. iOS however, kept a record of the call listing the name as "Group%20Maker" and username "8:guest:abab0b31-f32b-...".

This was surprising, because I've never been called by a scam contact in my decade of Skype usage. The furthest it would extend to is a contact request.

I have experience with Skype resolvers, having experimented with them many years ago. I tested it on myself, and it would spit back my IP. Only it would never call you in the process. Ever since these were apparently patched, the websites would never work, and few people speak of them any longer.

That's why I thought it was so strange to get a call like this. I searched the Skype directory for similar contacts and found dozens of active "Skype Resolver" accounts, all with the "guest:xxxxxxxx-xxx..." usernames. But that's as much as I've been able to find out about my caller. Is this just some new scam, or was someone actually trying to get my IP in 2021?

Update: Notification cache on my phone says the caller was actually named "skype-resolver.net". This website just leads to a "Coming soon" screen. A whois lookup says this website was created yesterday.

Update 2: Received a second call from them about 18 hours later, with a different username. Wanted to answer but did not do so out of security for my IP. Thoughts?

tphilli
  • 263
  • 2
  • 7
  • It says right in that article that the "default" setting is to not use P2P. I'm assuming from that wording that it's possible to set it back to P2P, so presumably that resolver is trying to get your IP if you're one of the few users who manually set it back to P2P. – user Feb 11 '21 at 15:11
  • I never changed the P2P settings on my account, and I wouldn't even know how. My new guess is that someone is trying to advertise a new "Skype resolver" website. If this is a person who previously owned one, they might have had records of all the users who were entered in the past (potential customers). Only thing is, the website would be a scam because Skype works differently now. – tphilli Feb 11 '21 at 15:51
  • Note that we are getting quite a lot of questions and comments from other people seeing the same thing recently. It might simply be a change in how Skype operates. – schroeder Feb 12 '21 at 17:05
  • 1
    Your IP was probably already exposed, even if you didn't accept the call. I have received the same call few days ago, didn't accept it, but when I checked the skype-resolver.net web, my account name was discoverable by my IP. Shame on these internet data collectors, but more shame on Microsoft allowing this. Deleted Skype for good. Did not find any setting in current app to chose between P2P and centralized connection and I am sure I have never been tinkering with this. Also it's not possible to delete skype account without deleting Microsoft account. What a shame. – user10099 Feb 16 '21 at 17:15
  • @user10099 I can't believe it, you're right. The website is up now, and it works. When you put yourself in, it calls you, and then spits back your IP regardless of whether you pick up. – tphilli Feb 17 '21 at 00:51
  • this actually happens to me on desktop app (macos) too – chachan Feb 25 '21 at 18:21

2 Answers2

5

There is now a working Skype resolver in 2021. It is skype-resolver.net, and it will call you if you try to look yourself up. Either the old security flaw has not been fully patched, or a new one has been found. It is not clear whether the site calls you automatically, or only when someone is trying to look you up. It doesn't matter whether you answer--if you try, the call will instantly end.

There seems to be a simple fix for this. On each of your active Skype devices, go to your settings, and enable the option "Only allow Skype calls from contacts to ring on this device". While you will still see a missed call notification from the guest usernames, the site itself will output "Could not resolve user", and there will be no current IP listed. That being said, past IPs you've had may still be visible.

tphilli
  • 263
  • 2
  • 7
5

To answer this question - yes, you should be concerned and I'd recommend to uninstall skype on all devices where you don't need it.

If you are using Outlook's web app, the following filter for uBlock Origin will completely disable Skype's integration and prevent your IP from being resolved:

||*.skype.com^$third-party

How it works

  • The call is made using a guest account
  • That guest account has blocked you before calling
  • You don't need to accept the call in order to have your IP leaked.
  • I haven't seen any P2P connection

I believe the reason that it doesn't show up in the call log is because skype isn't expecting a guest account to call someone that they blocked.

It looks like Skype somehow spits out your IP when you receive a call.

Data from Skype's API

Here's some data from Skype's services that happens when you receive a call from them:

Caller data:

[
   {
      "about":null,
      "avatarUrl":null,
      "birthday":null,
      "city":null,
      "country":null,
      "displayname":"skype-resolver.net",
      "emails":[
         
      ],
      "firstname":"skype-resolver.net",
      "gender":"0",
      "homepage":null,
      "jobtitle":null,
      "language":null,
      "lastname":null,
      "mood":null,
      "namespace":"guest",
      "phoneHome":null,
      "phoneMobile":null,
      "phoneOffice":null,
      "province":null,
      "richMood":null,
      "username":"guest:a93b3f62-010a-49ce-817a-b2b1f953aeaa"
   }
]

Conversation data:

{
   "targetLink":"https://azeus1-client-s.gateway.messenger.live.com/v1/users/ME/contacts/8:guest:a93b3f62-010a-49ce-817a-b2b1f953aeaa",
   "id":"8:guest:a93b3f62-010a-49ce-817a-b2b1f953aeaa",
   "type":"Conversation",
   "version":1613596332633,
   "properties":{
      "isemptyconversation":"False",
      "conversationblocked":"True"
   },
   "lastMessage":{
      "from":"https://azeus1-client-s.gateway.messenger.live.com/v1/users/ME/contacts/8:guest:a93b3f62-010a-49ce-817a-b2b1f953aeaa",
      "type":"Message",
      "conversationLink":"https://azeus1-client-s.gateway.messenger.live.com/v1/users/ME/conversations/8:guest:a93b3f62-010a-49ce-817a-b2b1f953aeaa"
   },
   "messages":"https://azeus1-client-s.gateway.messenger.live.com/v1/users/ME/conversations/8:guest:a93b3f62-010a-49ce-817a-b2b1f953aeaa/messages",
   "lastUpdatedMessageId":0,
   "lastUpdatedMessageVersion":0
}

Skype will try to fetch the conversation messages, but since the conversation is blocked, it will return a "400 Bad Request" error with the following JSON:

{"errorCode":201,"message":"conversation blocked"}

Call data:

{
   "participants":{
      "from":{
         "id":"8:guest:a93b3f62-010a-49ce-817a-b2b1f953aeaa",
         "displayName":"skype-resolver.net",
         "endpointId":"removedf-ffff-ffff-ffff-ffffffffffff",
         "languageId":"en-GB",
         "participantId":"8c34d346-59ba-49dc-96f2-295f92b45d31",
         "hidden":false
      },
      "to":{
         "id":"8:[REMOVED]",
         "displayName":null,
         "endpointId":"00000000-0000-0000-0000-000000000000",
         "languageId":null,
         "participantId":"removedf-ffff-ffff-ffff-ffffffffffff",
         "hidden":false
      }
   },
   "callInvitation":{
      "callModalities":[
         "audio"
      ],
      "links":{
         "progress":"https://cc-euwe-08.cc.skype.com:443/cc/v1/incoming/[REMOVED]/24/t/369/progress?i=215",
         "newOffer":"https://cc-euwe-08.cc.skype.com:443/cc/v1/incoming/[REMOVED]/24/t/369/mediaOfferRequest?i=215",
         "mediaAnswer":"https://cc-euwe-08.cc.skype.com:443/cc/v1/incoming/[REMOVED]/24/t/369/mediaAnswer?i=215",
         "acceptance":"https://cc-euwe-08.cc.skype.com:443/cc/v1/incoming/[REMOVED]/24/t/369/accept?i=215",
         "redirection":"https://cc-euwe-08.cc.skype.com:443/cc/v1/incoming/[REMOVED]/24/t/369/redirect?i=215",
         "callController":"http://callcontroller.invalid",
         "callLeg":"https://cc-euwe-08.cc.skype.com:443/cc/v1/incoming/[REMOVED]/24/t/369/reject?i=215",
         "subscribe":"https://broker-euno-07.broker.skype.com/api/v1/subscribe/d19d9eb1-6f54-4980-bdda-4729e82f0a4b/0?i=13",
         "brokerHttpTransport":"http://52.114.77.179/enc"
      },
      "mediaContent":null,
      "replaces":null
   },
   "additionalActionResponses":[
      {
         "url":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]?i=219&e=[REMOVED]",
         "output":{
            "roster":{
               "participants":{
                  "8:guest:a93b3f62-010a-49ce-817a-b2b1f953aeaa":{
                     "details":{
                        "id":"8:guest:a93b3f62-010a-49ce-817a-b2b1f953aeaa",
                        "displayName":"skype-resolver.net",
                        "endpointId":"00000000-0000-0000-0000-000000000000",
                        "participantId":null,
                        "languageId":null,
                        "hidden":false
                     },
                     "endpoints":{
                        "removedf-ffff-ffff-ffff-ffffffffffff":{
                           "call":{
                              "serverMuteVersion":0
                           },
                           "capabilities":{
                              "cloudAudioVideoConference":"enabled",
                              "cloudScreenSharing":"disabled",
                              "hostlessConference":"disabled",
                              "cloudMerge":"disabled",
                              "additionalModalityOperationLinks":"disabled",
                              "implicitCallback":"disabled",
                              "autoJoinOnConflict":"disabled",
                              "supportsCompressedServicePayload":"disabled",
                              "serverMuteUnmute":"disabled",
                              "supportNgcMediaControl":"disabled"
                           },
                           "participantId":"removedf-ffff-ffff-ffff-ffffffffffff"
                        }
                     },
                     "role":"guest"
                  }
               },
               "type":"MultiPartyEndpoint",
               "sequenceNumber":0,
               "participantCounts":{
                  "totalParticipants":1,
                  "preheatedParticipants":0,
                  "lobbyParticipants":0,
                  "totalPresenters":0,
                  "requestingAttentionPresenters":0,
                  "totalAttendees":0,
                  "requestingAttentionAttendees":0,
                  "overflowAttendeeCount":0
               }
            },
            "conversationController":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]?i=219&e=[REMOVED]",
            "sequenceNumber":1,
            "subject":"",
            "activeModalities":{
               "call":null
            },
            "state":{
               "isMultiParty":false,
               "groupCallInitiator":null,
               "isBroadcast":false,
               "isVoiceDataCollectionOn":false
            },
            "links":{
               "leave":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/leave?i=219&e=[REMOVED]",
               "addParticipant":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/addParticipant?i=219&e=[REMOVED]",
               "removeParticipant":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/removeParticipant?i=219&e=[REMOVED]",
               "addModality":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/addModality?i=219&e=[REMOVED]",
               "addParticipantAndModality":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/add?i=219&e=[REMOVED]",
               "removeModality":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/removeModality?i=219&e=[REMOVED]",
               "mute":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/mute?i=219&e=[REMOVED]",
               "unmute":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/unmute?i=219&e=[REMOVED]",
               "notificationLinks":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/notificationLinks?i=219&e=[REMOVED]",
               "merge":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/merge?i=219&e=[REMOVED]",
               "updateEndpointMetadata":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/updateEndpointMetadata?i=219&e=[REMOVED]",
               "updateEndpointState":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/updateEndpointState?i=219&e=[REMOVED]",
               "admit":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/admit?i=219&e=[REMOVED]",
               "conversationHttpTransport":"http://52.114.74.144/enc",
               "publishState":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/publishState?i=219&e=[REMOVED]",
               "removeState":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/removeState?i=219&e=[REMOVED]",
               "updateMeetingSettings":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/updateMeetingSettings?i=219&e=[REMOVED]",
               "searchParticipants":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/searchParticipants?i=219&e=[REMOVED]",
               "getAllParticipants":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/getAllParticipants?i=219&e=[REMOVED]",
               "admitAll":"https://conv-euwe-10.conv.skype.com:443/conv/[REMOVED - CONVERSATION ID]/admitAll?i=219&e=[REMOVED]"
            },
            "capabilities":{
               "cloudAudioVideoConference":"enabled",
               "cloudScreenSharing":"disabled",
               "hostlessConference":"disabled",
               "cloudMerge":"disabled",
               "additionalModalityOperationLinks":"disabled",
               "implicitCallback":"disabled",
               "autoJoinOnConflict":"disabled",
               "supportsCompressedServicePayload":"disabled",
               "serverMuteUnmute":"disabled",
               "supportNgcMediaControl":"disabled"
            },
            "subscriptionDetails":{
               "selfParticipant":{
                  "version":0,
                  "state":"active",
                  "details":{
                     "id":"8:[REMOVED]",
                     "displayName":"[REMOVED]",
                     "endpointId":"00000000-0000-0000-0000-000000000000",
                     "participantId":null,
                     "languageId":null,
                     "hidden":false
                  },
                  "endpoints":null,
                  "role":"admin"
               }
            }
         }
      }
   ],
   "debugContent":{
      "callId":"removedf-ffff-ffff-ffff-ffffffffffff",
      "participantId":"removedf-ffff-ffff-ffff-ffffffffffff"
   }
}

Outlook's web app also appears to reject the call even though it doesn't seem to reject it with the following request:

{callEnd: {code: 410, subCode: 3111, phrase: "CallEndReasonMediaOfferProcessingError"}}
ARandomUser
  • 66
  • 5