Slashdot Mirror
Listen To a Microsoft Support Scam As It Happened
itwbennett writes You know full well that Microsoft will never call you and ask to "access your computer" to help fix a problem. Yet this is a ruse that many unsuspecting computer users fall for and wind up with their machine hacked. CSO writer Steve Ragan, turns the tables during a phone call with a scammer — and he records it all for us to hear. Do yourself a favor and play it for your parents.
And here's a written transcript of all actions taken by the Indian government to stop this scam:
I've told my parents so many times not to click on links in an email.....now you're telling me to send them a link and have them click on it?
Had one of these (and only one)... told them I only had Mac's at home, and the guy got belligerent and said I was lying, then finally after telling him that over and over for a good minute he basically said FU and hung up. Can't imagine what they'd say if I said I only ran Linux, or something really obscure ("Sorry, I only run OpenVMS"). =D So yeah... guess their scheme falls over pretty quickly if you don't have a Windows box...
Do not click this link. You have been warned.
There are ninety (90) scripts trying to run on that page.
fake support calls are eerily similar to 419 scams in confidence artistry but it bears remembering why and when these scandals have taken place. In nigerias case oil discovery led to british and american interests propping up a series of dictators favourable to their interests yet despotic to their own people. After a few violent uprisings, oil export dropped to 40%, and largely has never returned. nationalized exports, systemic corruption, and a dearth of unemployment with a sizeable population of educated adults led to the 419 artistry and arguably an increase in piracy.
in Indias case, rampant corruption and high unemployment combined with a tech industry that favours low worker pay and aggressively combats everything from workplace safety to union organization and benefits has led to the tech support scam, born from the confidence and trust of americans and europeans accustomed to the dulcet tones of the south asian tech support worker.
Good people go to bed earlier.
... and depending on my mood I have several strategies;
1. Just tell them you only have Linux, they'll hang up immediately. ... So can I speak to your manager. (So far I've never got a manager.)
2. Musical hold, put the phone next to a speaker and go on with your life.
3. Tell them you have several computers running various Windows versions, which one did you mean... do you have a hostname or IP address so I can narrow it down? You don't? So how do you know it was my machine again? Really?
4. Pretend to follow along with their instructions, honestly the most time consuming and least satisfying.
But the problem is not with us, it's with Joe User who for some reason is unaware that Microsoft isn't phoning everybody. Never underestimate the power of human stupidity.
XML is a known as a key material required to create SMD: Software of Mass Destruction
I received one of these calls a few weeks ago. After the scammer informed me that my computer was compromised but he was going to help me solve the problem I thanked him for his help and asked him which of my computers was infected. He seemed surprised by the question and said, "You have more than one computer?" I replied that I have several and surely he must be aware of that because he had just described the extensive monitoring Microsoft was doing. He said it didn't matter which one; just go to one of them and follow his instructions to get rid of the infection. I said that surely I need to go to the one that is infected to clean it, but he again claimed it didn't matter which one I went to. I pushed the point that if his monitoring was able to detect an infection then surely it must be able to identify which of my computers was infected. He started becoming beligerent, almost shouting that it didn't matter which computer had the infection but that I needed to go to one of them immediately so he could help me clean it. At this point I called him a liar and asked how he felt about lying to and stealing from people. He really started yelling at that point, and I just hung up. I haven't heard back yet.
http://youtu.be/GVQoAlQrnSg
depending on his locality, that might be illegal speech.
(and yes, there IS such a thing in the US too.)
Better story:
dont tell them that you are onto them. Instead, monitor the honeypot and see what they install later, what they use the compromised VM for, and build an actual case against them.
It's one thing to say "these people are taking over computers". it's entirely another to clearly show what they do with the computer afterwards, and build a profile that can be used to detect compromised systems based on activity patterns, then publish.
Crap, i clicked on it.
Even more epic fail, I've worked on the MS campus a lot, and in fact installed much of the security hardware. I take them on a mental tour of the campus, trying to get them to tell me what building they're supposedly working in, ask them whether the Ms Pacman machine is still in that stairwell, etc. It can be fun.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
Define "stupid." Would you be able to tell when an auto mechanic is BSing you? When your contractor does a half-assed job building your home but still charges you full price? Any of 1000 other scams that are out there attacking areas of knowledge you haven't studied?
Just because a person can't tell a mouse from a memory stick doesn't mean they're stupid -- it means they don't know about computers. And that's still a large portion of the population, even among the younger crowd ("can use Facebook" does not indicate "knowing about computers" in any useful sense.)
Because most people have no need to know. Just like you don't need to know how to design and build the car you drive or the house you live in, most people don't need to know every detail about computers in order to use them.
There is (or at least should be) an argument that because computers (/phone/tablets/etc) are increasingly storing large chunks of our critical information that we should be training everyone in at least basic security.
Of course that's easier said than done. Its hard to make a full-term course out of that to push in public education (where they don't have the funding to support existing courses anyway.) Doing it as one of those three-day seminar type courses would be great except how do you convince more than a handful of people to attend? And nobody wants to see registration and licensing for basic computer usage (enforcing a minimal amount of training in order to obtain the license) -- even those who think programmers should be licensed generally wouldn't go that far.
So until someone figures out how to educate the entire country (/planet!), just calling people "stupid" and shutting down the conversation isn't helping anything. Or you know, since you're apparently perfect at everything (otherwise you'd be "stupid" too) maybe you can be the one to figure out how to solve the problem!
Maybe 3 years ago I played along with such a caller. I run Ubuntu, but didn't say anything to them about what o/s I was using. When he asked me to visit a web site and download a Windows file from a web page, I laughed inside, thinking nothing would happen. I downloaded the .exe from a throw-away Ubuntu VM I had. Unexpectedly, Ubuntu downloaded Wine, installed it, then ran the .exe file. I was both impressed and scared that Ubuntu had done this automatically to run the .exe file. This resulted in a completely empty Windows (Wine) desktop, to which they of course quickly tried to connect. I kept "accidentally" disabling their control, so they could only look. When I finally gave them access, they were very confused that it had none of the usual Windows applications and menus they were expecting to see, nor did their usual password changing and locking work. More and more people on their end of the call were talking on the phone, trying to figure out what was going on.
After nearly an hour on the phone, I had enough and told them I was a software developer, and they hadn't scammed me. They swore at me and hung up. Immediately, I got a phone call from someone else saying he was calling to help me unlock my computer for a fee. Obviously as soon as they lock a desktop, they must trigger something in their call system so someone else calls back to earn some money.
Define "stupid." Would you be able to tell when an auto mechanic is BSing you? When your contractor does a half-assed job building your home but still charges you full price?
Generally yes. I know enough about these things that I already have a pretty good idea what is going on with a car that I can take it to a mechanic and not get ripped. For example, does your car make a funny noise? Well you can do simple tests to try and narrow down what makes the noise change, and this gives you a good idea of what the problem might be. I just don't have the time, the tools, or the shop space to do a lot of these jobs myself, so I pay someone to actually do what I need them to do.
Same on the house. Simple jobs I do myself, other ones I will hire someone to finish things out. In many cases I might not know exactly how a tradesman would do a particular job, so I will watch for a bit so I can learn something.