Turning the Tables On "Phone Tech Support" Scammers

mask.of.sanity writes A security pro has released a Metasploit module that can take over computers running the Ammyy Admin remote control software popular among "Hi this is Microsoft, there's a problem with your computer" tech support scammers. The hack detailed in Matthew Weeks' technical post works from the end-user, meaning victims can send scammers the hijacking exploit when they request access to their machines. Victims should provide scammers with their external IP addresses rather than their Ammyy identity numbers as the exploit was not yet built to run over the Ammyy cloud, according to the exploit readme. This is much more efficient than just playing along but "accidentally" being unable to follow their instructions.

Comments

External IP

[tomhath]

Providing your own IP address to a criminal so you can trash their computer just doesn't sound like a good plan to me.

Re:External IP

[Noryungi]

... Depends if your IP address is dynamic or not. In my case, all I have to do is reset the DSL modem/router and, presto ! New IP!

I am more concerned about the legality of it. Running a live exploit on their network may make some ISPs fidgety. Also not sure about the position of law enforcement agencies...

Re:External IP

[thegarbz]

Why not? What can you do with one IP address? On the flip side why do you think this is any worse than giving someone access via a cloud service after which they can look at your IP anyway?
216.34.181.45

Come at me bro!

Re:External IP

[Anonymous Coward]

Yeeaaah ... that's the IP to slashdot.org :)

Re:External IP

[BarbaraHudson]

I am more concerned about the legality of it. Running a live exploit on their network may make some ISPs fidgety. Also not sure about the position of law enforcement agencies...

The cops won't like the competition ... in Soviet Russia, law enforcement exploits YOU ... oh, wait ...

Re:External IP

[benjfowler]

Don't use your own machine, use a honeypot/goat machine.

Presumably, a bit of work is required to hit back at the scammers in the first instance; a little extra effort couldn't hurt.

Re:External IP

[DarkOx]

Yea but its a metasploit module so you run metasploit on some very disposable vm you have out on Amazons aws in the free tier.

Either have your revershell go back to that IP and forward it on your own system or just bank on tact these losers don't have the skills it would take recover your ip from your shell code in memory or see the outbond connection on their firewall and have it call your back directly.

These guys are following a script. Most of the actors probably don't know how to deal with things much outside that. They are using an off the self remote access tool and social engineering. If they could pwn your box without your help they'd skips the steps where they setup the bogus call center, train employees, pay to make a bunch of often long international phone calls, etc and move strait to the profit step.

If they can't get you to fall for the scam they probably are not very dangerous.

Re:External IP

[Luthair]

I'm not advocating for it, but one assumes it would be pretty unlikely they'd complain to anyone. They probably aren't in the same country and they are engaged in a variety of illegal activities.

How about

[BringsApples]

THEM: Hi this is Microsoft and...
US: hang up

Done. Fuck this war.

Re:How about

[i.r.id10t]

I got called by one last Friday night. Kept him on the phone for almost an hour, playing along. Even gave him clues I wasn't on windows (ie, when he asked me to run eventviewer I described the output of top, including clueless worrying about zombie processes).

Finally told him I had to go pick up my daughter and that I'd been screwing with him. He called me a "miserable son of a bitch" and hung up.

Kinda felt that it was my duty to keep him occupied, after all each minute I was screwing with him was a minute he wasn't scamming some truly helpless user "out there" somewhere.

Re:How about

[Wycliffe]

THEM: Hi this is Microsoft and...
US: hang up
  Done. Fuck this war.

That's exactly what they want. It's the same reason that scammers say they are from nigeria even when they aren't.
They don't want to talk to you. They want the non-gullible to hang up as quickly as possible so they can quickly find
the little old lady who they can steal from. They called my mom and luckily she had 2 things going for her. First,
she doesn't know enough to actually follow their instructions and second, she called me. Otherwise she would
probably be out some money and I would be left cleaning up the mess. So sure, it's easier to hang up on them but
you are actually doing them a favor and helping them out by doing so.

Re:How about

[TheCarp]

These people call my mother incessently. Every other day or so I hear her yelling at her phone "you are not really with windows, windows doesn't call" (yes they say they are calling "from windows" lol).

I just saw this and ran down to show her, not so much for the exploit but the idea of playing mickey the dunce and keeping them on the phone for as long as possible. Lol she has a true talent for annoying tech support. Hell I once got a call from a guy at the help desk "I just got off the phone with your mother" "really?" "yah down in radiology right? I was on the phone for 45 minutes and had to send a technition out because I couldn't get her to plug the ethernet cable back into the wall" "now, she told you she is blind right?" "No she....what the fuck!"

Seriously.... I think I just punished them good suggesting she keep a log of how long she can keep them on the phone for.

Re:How about

[Anonymous Coward]

I managed over an hour and a half the other day. I had to look up the different messages from Windows XP from online help pages. Basically imagine you are really really clueless but you have an IT expert son who has set up your Windows computer so you don't have the administrative privilages to do yourself any damage and all running of hacking software is blocked by some obscure anti-malware software that you don't understand yourself. It also helps if you are too clueless to use your mobile phone at the same time as typing on the computer.

You should manage to do at least 10 minutes of mindless work between each time you talk to them.

Never admit you are scamming them; the aim is to teach them to hang up on truely clueless people themselves depriving them of some of their most important audience.

Re:How about

[gstoddart]

Finally told him I had to go pick up my daughter and that I'd been screwing with him. He called me a "miserable son of a bitch" and hung up.

You know, the amazing thing is they feel they have a right to be angry.

Dude, you called me with the express intent of scamming me ... you seriously expect me to treat you like a human being?

I don't think so.

Re:How about

[gstoddart]

You're using a western mindset.

He's some impoverished guy in India desperate to make a few rupees from someone who, in his eyes, is very wealthy.

Well, that's NMFP ... he knows damned well that what he's doing is illegal, and would have no sympathy for me if I fell victim. He is certainly aware of the fact that he's not offering me a useful service. You couldn't possibly train someone to do that scam without explaining it to them.

So, he may well have convinced himself that there's no harm if he scams us a little.

But, I don't actually give a crap about his feelings.

If what he's doing is so noble and justified, call someone in India, see if they are interested.

From me, he gets a big "fuck off".

If he's expecting me to say "oh, gee, the poor cute little Indian is just trying to make a buck", he's sadly mistaken, and should expect the kind of animosity he gets.

Re:How about

[Swave An deBwoner]

You want this:

http://itslenny.com/

Re:Rife in the UK

[stealth_finger]

"Hi, we've detected a virus on your machine etc etc"

"Yes, that's mine, I've been testing it. Can you tell me how and when it was detected please?"

".....[click]beeeeeeeeeeeeeeee"

Re:Love reading about it

[stealth_finger]

I will love reading about anyone who managed to destroy a call centre of these scammers and get them out of business. Myself, I would fear bad legal consequences if I did it, because hacking into their computers isn't going to be legal just because they are scammers. Now telling them that you just hacked into their computers and asking them to open log files to show evidence, that would be fun.

There's not really anything they can do apart from try to get revenge on your machine. "Hi international police, well we we're trying to scam this guy and he somehow managed to switch the flip and gutted our entire organisation........please stop laughing"

Re:What spam calls?

[Scutter]

Scammers, by definition, do not follow the law. What makes you think they'd concern themselves with something as petty as a Do No call law?

And yes, you should consider yourself lucky. These kinds of calls are becoming more frequent and MUCH more aggressive. I had one scammer call me back over a hundred times in one day when I hung up on him. I eventually just routed all incoming calls to my fax machine.

What Microsoft could do

[Jesrad]

One thing Microsoft could do easily and cheaply, which would eventually end this "Calling you from Windows and you have a virus" scam, is to have a short mention about this being a scam on the front page of their website. A single sentence would suffice.

When you get called by the indian call center employee, who for most of them believe they are working for a legitimate business, mention how the caller is NOT really affiliated with Microsoft because their website say it's a scam. "See for yourself !" and hang up.

The actual pirates can probably not do the mass phone call themselves and still rack up enough money, which is why they hire call centres to do it for them, and why they also take precautions to show them some pretense of legitimacy. If the call centres stop working with them they'll go away.

Re:Rife in the UK

[DocSavage64109]

If it's anything like how they pronounce lieutenant, then I don't know how British pronounce Brighton either.

Re:What is wrong with people?

[Bowlich]

Reading over your comment it just occurred to me that a lot of novice users could very well potentially have an argument for why they would believe that Microsoft "knows" of their problems -- every time Windows XP had some process crash it would pop up a modal asking if you wanted to send a crash report to Microsoft. Pretty much every OS I've worked on does this, Ubuntu will even ask if you want to report a problem.

If I never used, or rarely used a computer and didn't come across these messages often it would not be a large jump of logic to presume that clicking "yes" on that modal would open a ticket on some help desk at Microsoft and some lowly tech-support would call you up some time in the future to fix the issue for you.

Start Button ?

[OneSmartFellow]

Them: Hello, this is Microsoft. We have detected a problem with your computer.
Me: Really?
Them: Yes of course. Do you see your "start" button?
Me: No
Them: It's in the lower left corner.
Me:The lower left corner of what ?
Them: The lower left corner of your computer.
Me: The lower left corner?...........when viewed from where ?
Them: From the front.
Me: OK, let me see.....All I see is a little sticker that says Intel Inside on the lower left corner.
Them: I don't understand.
Me: The computer has a little sticker on the lower left corner. but no start button.
Them: No, I mean the lower left corner of your monitor.
Me: Wait I'll have a look..........I don't have a start button on the lower left corner of my monitor either. I do see a little sticker that says "Infant Optics" (it's a baby monitor) Them: click

Re:Start Button ?

[SQLGuru]

Next time you get the call, you could try this approach:

You: Wait, you know I have a computer? Are you my parole officer? I've been banned from using electronic devices due to my recent conviction. If you're accessing my computer, that makes you an accomplice. Per the plea agreement, we both going get 20 years in a federal prison. The NSA is probably now tracking us both.

TeamViewer

[bhlowe]

I had a "Microsoft" guy walk me through installing TeamViewer. After twenty minutes of goofing with him, I said it was installed (which it already was).. When he asked for my team viewer ID, I asked for him to give me his ID first. They didn't and were mad I wasted their time. But.. it makes me think that the TeamViewer company might be able help track down these jerks.

Windows is updating

[jmv]

I like to get these scammers on the line for as long as possible, but without wasting my time. So far, what I've seen to work well was "Oh, my computer just crashed, I need to reboot" and "Now windows is applying updates". This means they'll wait without me having to think of stuff to tell them. Any other effective tricks?

Re:one did ring back and shout abuse

[DocSavage64109]

I never have these guys calling me, but several of the stories here mention these guys shouting profanity and abuse. I wonder if it is some sort of defense mechanism to keep themselves from realizing how low they are to be using these fraudulent tactics on innocent people.

I just give them access

[Khyber]

I keep an old XP laptop loaded with furry porn, pictures of cows and pigs being slaughtered, BDSM porn, transsexual midget porn, stuff from rotten.com/ogrish like beheadings, gential mutilation, etc., set on random rotate every second for the desktop with a nice fading transition, everything locked except the remote assistance tool, and when they call I put that machine live and let them in.

The extortion begins, and then they see something that invariably offends the piss out of them while they're forced to watch a constantly-changing desktop wallpaper they can't stop, and the extortion ends with me laughing in their ears.

Endless entertainment. I even got a "You're the sickest thing existing on this planet." from some chick that was playing the scam.

I lol'd hard at that one.

India: Scammer country

[ub3r n3u7r4l1st]

ugh, this is a real disgrace on India. I think this scamming here is frequent from India because there is little to no regulation, law or enforcement of it if there were one about scamming 'foreigners'.

This is how most of the Indian GDP were composed of.

It is part of their culture. In the university that I went to, 90% of the Indians are cheating. This is in a electrical engineering master's program.

That's why our organization will not hire any H1Bs.