Interesting research, but I doubt it would hold up in a court. You just can't prove ownership of a Skype profile by an individual unless you subpoena Skype, and if you're going to subpoena someone, you should just subpoena the ISP of the IP directly.

Still, this kind of service could be used by background check agencies, private detectives, etc where the burden of proof is whatever the client decides to accept (though I can think of much easier ways of getting someone's IP address than this).

This was posted about a couple of days ago (https://torrentfreak.com/security-flaw-links-bittorrent-user...), and the Register makes the same (incorrect) assumption as TorrentFreak that IPs can be traced to a single person.

This attack vector links Skype accounts to IP addresses, and then tries to find those IP addresses in BitTorrent swarms. But IP addresses are not people: an IP assigned to an account I owned is not necessarily being used by me, and the person who has a Skype account using a given IP is not necessarily the same person who is using BitTorrent to join a swarm from that IP.

The major issue here is that anyone can find out the IP address of any Skype user just by knowing their username, which can be found in the Skype global directory. Even worse, the user isn't able to block this (or even be notified about this) and the attack can be done by someone not in your contact list.

I am always against bittorrent being associated with everything illegal. If anyone ever gets to the legal phase, wont ISP's disclose the IP number details rather than relying on skype ?

The actual arxiv pdf was submitted about a month ago. http://arxiv.org/abs/1109.4039 The main thing here is that the attack is one of several ways to distinguish that a machine running Skype is the same machine running the bittorrent client; they're not separate machines hidden behind the same IP.

Shouldn't this just be: 'Researchers exploit Skype to gain IP address information'.

Wouldn't these be researchers rather than scientists?