Slashdot Mirror
Listen To a Microsoft Support Scam As It Happened
itwbennett writes You know full well that Microsoft will never call you and ask to "access your computer" to help fix a problem. Yet this is a ruse that many unsuspecting computer users fall for and wind up with their machine hacked. CSO writer Steve Ragan, turns the tables during a phone call with a scammer — and he records it all for us to hear. Do yourself a favor and play it for your parents.
And here's a written transcript of all actions taken by the Indian government to stop this scam:
I've told my parents so many times not to click on links in an email.....now you're telling me to send them a link and have them click on it?
Had one of these (and only one)... told them I only had Mac's at home, and the guy got belligerent and said I was lying, then finally after telling him that over and over for a good minute he basically said FU and hung up. Can't imagine what they'd say if I said I only ran Linux, or something really obscure ("Sorry, I only run OpenVMS"). =D So yeah... guess their scheme falls over pretty quickly if you don't have a Windows box...
"Internet expl..Internet Exploiter?..Internet Explorer?"
Brilliant.
Do not click this link. You have been warned.
There are ninety (90) scripts trying to run on that page.
fake support calls are eerily similar to 419 scams in confidence artistry but it bears remembering why and when these scandals have taken place. In nigerias case oil discovery led to british and american interests propping up a series of dictators favourable to their interests yet despotic to their own people. After a few violent uprisings, oil export dropped to 40%, and largely has never returned. nationalized exports, systemic corruption, and a dearth of unemployment with a sizeable population of educated adults led to the 419 artistry and arguably an increase in piracy.
in Indias case, rampant corruption and high unemployment combined with a tech industry that favours low worker pay and aggressively combats everything from workplace safety to union organization and benefits has led to the tech support scam, born from the confidence and trust of americans and europeans accustomed to the dulcet tones of the south asian tech support worker.
Good people go to bed earlier.
... and depending on my mood I have several strategies;
1. Just tell them you only have Linux, they'll hang up immediately. ... So can I speak to your manager. (So far I've never got a manager.)
2. Musical hold, put the phone next to a speaker and go on with your life.
3. Tell them you have several computers running various Windows versions, which one did you mean... do you have a hostname or IP address so I can narrow it down? You don't? So how do you know it was my machine again? Really?
4. Pretend to follow along with their instructions, honestly the most time consuming and least satisfying.
But the problem is not with us, it's with Joe User who for some reason is unaware that Microsoft isn't phoning everybody. Never underestimate the power of human stupidity.
XML is a known as a key material required to create SMD: Software of Mass Destruction
I received one of these calls a few weeks ago. After the scammer informed me that my computer was compromised but he was going to help me solve the problem I thanked him for his help and asked him which of my computers was infected. He seemed surprised by the question and said, "You have more than one computer?" I replied that I have several and surely he must be aware of that because he had just described the extensive monitoring Microsoft was doing. He said it didn't matter which one; just go to one of them and follow his instructions to get rid of the infection. I said that surely I need to go to the one that is infected to clean it, but he again claimed it didn't matter which one I went to. I pushed the point that if his monitoring was able to detect an infection then surely it must be able to identify which of my computers was infected. He started becoming beligerent, almost shouting that it didn't matter which computer had the infection but that I needed to go to one of them immediately so he could help me clean it. At this point I called him a liar and asked how he felt about lying to and stealing from people. He really started yelling at that point, and I just hung up. I haven't heard back yet.
http://youtu.be/GVQoAlQrnSg
The problem is, we support & enable "stupid" now, instead of letting them succumb to natural selection like they would have in the past.
If you could reason with religious people, there would be no religious people
depending on his locality, that might be illegal speech.
(and yes, there IS such a thing in the US too.)
Better story:
dont tell them that you are onto them. Instead, monitor the honeypot and see what they install later, what they use the compromised VM for, and build an actual case against them.
It's one thing to say "these people are taking over computers". it's entirely another to clearly show what they do with the computer afterwards, and build a profile that can be used to detect compromised systems based on activity patterns, then publish.
Crap, i clicked on it.
I've forwarded that e-mail hundreds of times!
/the world will always build a bigger idiot
In the future, I would want to not be isolated from my friends in the Space Station.
Your (obvious troll and off topic) post falls flat because it omits one thing. "Two consenting adults".
If you could reason with religious people, there would be no religious people
My father used to run ubuntu now hes on fedora. My mother has been on a mac for the past 5 years. There is no windows in their house. When he gets the scam call about problems with his "windows" he tells them he doesn't have windows, only doors. It takes them a second to figure it out and then they hang up. Its pretty comical, and if more grandma's grandpa's had linux desktops this wouldn't be a problem. All they ever use the computer for is checking email and surfing the web anyway, if you guys haven't moved your parents off of windows by now, shame on you!
No, I don't believe, a threat to curse somebody can be prosecuted in the US. Not even if you are cursing the President.
Yes, that would be more responsible. But it requires much more involvement — with you having fun only for the first few minutes of it.
I used to do this to spammers: pretending to be interested, collecting responses from their real e-mail addresses, identifying their real web-sites, &c., then trying to get them shut down for good based on all the evidence I collected. It only worked in about 10% of cases (in late 90ies) and now I just post the spam to SpamCop and feed it to my own Bayesian filter...
In Soviet Washington the swamp drains you.
Does your operating system's included video player support synchronizing a timed transcript to an audio file or a set of subtitles to a video file? And in which timed text format? And does your operating system support the concept of a playlist, where an audio or video presentation is made of several chapters each with its own URL?
These guys alway call with spoofed caller ID info. Why? Because its easy. I really can't believe that it not possible to create a REAL caller ID system. But the TELCO's will *itch about regulatory interference in their business. I say make them LIABLE for passing on bogus ID info and they will find a way to make caller id work. Calls from overseas? Just ID them as OVERSEAS calls. Co that sell spoofing services, well if the TELCO is liable, they wont allow spoofed ID on outbound trunks. They would rather profit from a BROKEN feature than actually create a working one.
one day I shall invent a tool that allows you to kill and mangle people via telephone, and then I can enjoy life again.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
No I don't.
See, these scammers are just like a typical Hollywood Sci-Fi movie, the aliens always speak English and land in the USA.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
That (your?) post was an obvious anti-gay post, trying to make a parallel with pedophilia. I was pointing out the failing in the logic. Politicians weren't relevant to my post.
If you could reason with religious people, there would be no religious people
Even more epic fail, I've worked on the MS campus a lot, and in fact installed much of the security hardware. I take them on a mental tour of the campus, trying to get them to tell me what building they're supposedly working in, ask them whether the Ms Pacman machine is still in that stairwell, etc. It can be fun.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
The one I got (well the only one I actually bothered listening to) wanted a credit card number before they'd connect and "fix" my machine..
I hadn't given them my IP so I'm not entirely sure how they were planning to do that, but as I don't have fake CC numbers laying around I pretty much terminated the call at that point so I never got to find out what their next step was..
My guess is that they would have just kept me on the line for another few minutes claiming to do something they weren't actually doing while they verified and charged whatever to my card. There are much more efficient attack vectors than manually calling people if your only goal is to install a back door into the home PC of someone who doesn't know how to protect themselves.
My grandmother did them one better....
> "Hello, I'm [her name] from Microsoft Support Service..."
GM: "Sorry, but I don't have a computer"
I'm starting to think GNU is the problem with "GNU/Linux" these days.
The best way to fight them is to waste their time....
Because your portrayal of "helpless user" was pretty narrow.
What makes you so sure? I swore at one in Hindi while I was following their instructions and they asked me if I was from Pakistan. The real shock is that TeamViewer hasn't pulled that old download.
If they're calling from India, their local laws are meaningless to me. There's no point in building a case, there will be no prosecution.
"It looks like you're behind a router; I can't tell which computer on your internal network is the culprit. Let's hit them all just to make sure, ok? If we leave even one, the whole thing could get reinfected!"
Maybe 3 years ago I played along with such a caller. I run Ubuntu, but didn't say anything to them about what o/s I was using. When he asked me to visit a web site and download a Windows file from a web page, I laughed inside, thinking nothing would happen. I downloaded the .exe from a throw-away Ubuntu VM I had. Unexpectedly, Ubuntu downloaded Wine, installed it, then ran the .exe file. I was both impressed and scared that Ubuntu had done this automatically to run the .exe file. This resulted in a completely empty Windows (Wine) desktop, to which they of course quickly tried to connect. I kept "accidentally" disabling their control, so they could only look. When I finally gave them access, they were very confused that it had none of the usual Windows applications and menus they were expecting to see, nor did their usual password changing and locking work. More and more people on their end of the call were talking on the phone, trying to figure out what was going on.
After nearly an hour on the phone, I had enough and told them I was a software developer, and they hadn't scammed me. They swore at me and hung up. Immediately, I got a phone call from someone else saying he was calling to help me unlock my computer for a fee. Obviously as soon as they lock a desktop, they must trigger something in their call system so someone else calls back to earn some money.
Is to educate ourselves on the nature of the scam first hand. We can hang-up whenever we like so it's not like any commitment. First hand experience of this sort of thing is valuable and gives confidence when it's not so clear cut. Perhaps IT pros won't be clicking on attachments any time soon but the people we support do and we need to find out how far they've been scammed etc. which is a bit weird as WE are trying to do telephone support EXACTLY as the bogus supporters. To the end user what's the difference?
Not only that, but the dude said his name was John. That's not a very India sounding name to me.
Fact is it takes quite a lot of time to string one of these people along. Last time I did more or less what is on this tape, and stopped it just shy of downloading anything. I asked the guy, "What does your mother think about this?" He seemed confused, so I said, "Is your mother proud of what you are doing, trying to trick old people into hacking their little computer?" Then I yelled at him a little bit more.
So yeah, you can do it, but as someone else said here, your time is more valuable than theirs.
How about a moderation of -1 pedantic.
Curses? nCurses, maybe?
If I'm going to that level, I'll be more straightforward. She's been identified - and we have an office in her city. She can expect a couple of our agents to be visiting her home, as well as the children's school. If/when she says she doesn't HAVE any children, remind her that her sister/mother/cousin does. Better than a curse, IMHO - even if she believes in curse, I don't, and I'll not make a convincing threat with it. I DO believe in tough men with guns carrying a grudge though. We see them in any city of the world, every day.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
You know, I meant it as a joke, but at least two moderators have been sufficiently offended by it to downmod the suggestion. And that's on /., which should be higher in rationality, than average.
So, I think, it would work on an average script-reading third-world woman hired by a scammer.
Yes, this may be a problem. But, as long as you don't use smily-faces, I don't care :-)
In Soviet Washington the swamp drains you.
Last time (and only time) i loaded up a VM with a bunch of graphic images on the desktop and had them change every minute or so. kept the guy in my vm for about 15 images until he couldnt take it anymore. I told him i was a photographer
have you seen my sig? there are many others like it but none that are the same
That site is trying to con me into installing Flash. What kind of low down, dirty scam is that?
Have gnu, will travel.
You must be new here.
Would it be acceptable to offer JavaScript streaming without charge and require a subscription for "a simple link to the file", like The Escapist does?
The best thing to do to these people (assuming you are bored/have the time to mess with them) is to let them connect to a Virtualbox VM and WASTE THEIR TIME, and then not tell them that you are wasting their time, and most importantly, NOT TELL THEM THE MISTAKES THEY MADE. One time I saw a video of someone from Malwarebytes doing just this. They connected the person to a Virtualbox VM and wasted a bunch of their time, but at the end of the video they explained to the person what they did wrong and practically gave them instructions on things they could've done to make the scam more convincing. I facepalmed at that. You do not give them instructions, or tell them what they're doing wrong. You just waste as much of their time as you possibly can.
I received the same call, but with a guy's voice, far eastern accent. he had me for a second with the "your IP address is sending out bad traffic" & they were getting warning errors on their end.. I was at work on the company's windows 7 box, but was wondering why *I* was getting the call instead of IT.. I decided to play along, I screw him up at the *superkey +r* imagining if I were working on my openbox debian machine; me: "ok, it opened my home folder, what next?" he, seeing that wasn't working, tried to navigate through the c:/ drive; him: ..slight pause .. "ok ok, close that out, I need you to click the windows icon in lower left, then computer, then c:/ drive"..
me: "I don't have a windows icon, I using openbox & a home folder"
him: "wait you're at home right?"
me: "no I'm at work, IT should be dealing with this"
phone line: ::CLICK::
LOL @ the moderations - everyone who moderates has seen the request to raise people up, rather than to tear people down. Funny, some people just don't see the point in that.
Me? I mistake sarcasm and jokes sometimes - obviously - but I would never mod you down because I disagree with you.
Some people, eh?
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
I haven't had any of these calls to date, and it's pretty rare for me to get any kind of phone spam. Since I've worked in tech support years ago, I'm curious how long I could string one of them along. "I only use it to log into my bank, I've got all the money from my accident settlement in there. Haven't noticed any trouble, are you sure I need this? "
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
My parents just about fell for this exact same scam. After speaking with the scammers directly and Googling around, the process goes something like this: --Caller (usually Indian) calls from a number listed as "out of area" --Caller informs you that they are with Microsoft Tech Support --Caller informs you that they have detected your Windows computer sending out virus reports --Caller asks you to download a remote desktop tool --Caller gets access to your desktop, pulls up task manager to show you some perfectly normal, though suspicious sounding, processes --Caller then tries to sell you a $300 service and asks for credit card information. --Various reports on the internet document the caller performing malicious acts (deleting files etc) on the host computer if you are uncooperative. The sad thing is that this scam works! My parents have been contacted multiple times and they are just one of many households contacted. That kind of call volume requires a lot of man hours and that means it is generating serious revenue. Damn leeches.
Every time I get this stupid scam call on my parent's phone (we are living with them temporarily) I tell the guy on the other end that I don't have a computer but would love one to be delivered overnight. I don't give out my address or anything though... just hang up usually after that.
I've got a ReactOS VM sitting on my home machine waiting for the scammers to call me. It looks like Windows. It behaves like Windows (this makes it easy to follow their script). However every remote access application I've tried crashes with all manner of creative error messages.