Slashdot Mirror
Researchers Find 25,000 Domains Used In Tech Support Scams (onthewire.io)
An anonymous reader writes:
Three doctoral students at Stony Brook University spent eight months analyzing internet scammers who pose as remote tech support workers (usually pretending to be from Microsoft of Apple). Their research revealed more than 25,000 scam domains and thousands of different scam phone numbers. "Although victims of these scams can be anywhere, the researchers found that 85.4% of the IP addresses in these scams were located across different regions of India," reports On The Wire, "with 9.7% located in the United States and 4.9% in Costa Rica. Scammers typically asked users for an average of $291, with prices ranging from $70 to $1,000."
The researchers even called 60 of the con artists to study their technique, and concluded most were working in large, organized call centers. They use remote access tools, and in fact two popular tools were used in 81% of the scams, according to the paper. "We found that, on average, a scammer takes 17 minutes, using multiple social engineering techniques mostly based on misrepresenting OS messages, to convince users of their infections..."
The researchers even called 60 of the con artists to study their technique, and concluded most were working in large, organized call centers. They use remote access tools, and in fact two popular tools were used in 81% of the scams, according to the paper. "We found that, on average, a scammer takes 17 minutes, using multiple social engineering techniques mostly based on misrepresenting OS messages, to convince users of their infections..."
My bet: TeamViewer and LogMeIn.
This is part of why I don't understand why this continues to be a big problem. They're not some fly-by-night flighty twitchy boiler room working in a different hotel room every week to try to keep one step ahead of a door kick. These are established, stable, organized, stationary, predictable groups that ought to be easy targets for law enforcement. Seeing as this also coincides with only a few geographical locations (india and costa rica) I can only presume local law enforcement is either very lax, is complacent ("hey it brings money into our local economy, that's good right?"), or is on the take.
I work for the Department of Redundancy Department.
when they give a 'phone number for the mark to call ??? With all the resources that the NSA, GCHQ, FBI, ... have finding where that number goes to is going to be well within their abilities. That they are not finding and nailing these crooks demonstrates that they are not interested in protecting the public. It is not as if the cost to the public is small, the BBC claims £10.9bn a year (just in the UK). So: one has to ask what are those clowns doing with all they money that they soak up ? Who's interests are they protecting? It does not seem to be you or me!
First thing coming to my mind was how can tech support for big companies be scammed? If my OS gets broken and I chose (not too likely to happen) to call their support, how are they intercepting my call? After skimming through the article, I understood what the terrible problem was: these pop-ups telling you that there is a virus on your computer! There are people actually believing the popup, reading the nonsense on it, calling to the given number and paying what people there tell them to pay!!
This seems a pretty crappy approach which is likely to be performed just by a few "companies", that's why the fact that most of scammers are in the same country makes lot of sense. Also why analysing the software used by the scammer to trick the victim? How can this be relevant here? Logically, if you want to access a computer in a different location you have to rely on certain software, exactly the same than using the phone to talk to someone.
Are people seriously so stupid to believe everything that pops-up in front of them? To even pay up to $1000 because basically a pop-up in a random (and most probably crappy and/or illegal) site told them to do so? How could these people not deserve to lose their money? How could anyone waste their time on analysing such a sad nonsense other than from the there-are-lots-of-stupids perspective?
Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
This is the one thing that would unite Americans, as declaring war on overseas scammers would be incredibly popular. Everybody hates them AND they're foreign, so it's a win-win for you.
Seriously, it's a better use of bombs than a bunch of so-called terrorists and dictators, it'll guarantee re-election.
Way to miss the point.
Only 9.7% were in the USA, versus 85.4% in India. That's a huge difference in risk.
And you're also ignoring the fact that IP associated with the USA host a huge number of globally-useful web sites and other online services, while that just isn't true for India.
For most Internet users, blocking Indian IP addresses would be a net gain in security and convenience.
But for most users, blocking USA IP addresses would result in almost no security gain, while losing a lot of convenience.
You're trying to make it sound like IP addresses associated with the USA and those associated with India make equal contributions, both good and bad, to the Internet at large. That is not true at all.
USA IP addresses, as a whole, make a large positive contribution, with very little negative contribution. Indian IP addresses, on the other hand, make a small or nonexistent positive contribution, with a huge negative contribution.
because they have covered it time and time again during slow news cycles.
> but alas the list of domains isn't included in the appendix.
Try blocking "*.in" for starters. https://registry.in/
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
The State Department should lodge a formal complaint at the Indian embassy to call for action. The governmanet in India should take steps to rid the Internet of these criminals.
Up until March or April last year, I was taking 3-5 scam calls per week, to an un-listed UK land line number.
Most of the time I just did my best to keep the caller busy for as long as possible, purely to stop them spending time on the next victim. However, one day, as part of my challenging the caller to "prove their identity", the person I was speaking to actually managed to disclose my personal account number that I have with my UK telco/ISP. This number is printed on invoices but otherwise not used; it has no relation to my phone number, email address, or anything else.
The only way the caller could have known that detail - and correctly identified me from it - was if they were either an employee of my telco, or had stolen data from them.
I did some more digging, let the caller go, then got in touch with the anti-fraud team for my telco. Obviously telephone fraud is a big deal, with lots of un-paid bills and some large sums of money involved. So: this is a serious team with skilled people, people who can take scams seriously. I eventually got put through to an investigator and managed to convince them that they had either a leak from, or crooks operating out of, one of their India call centres.
I have not had a fraudulent call since then.
Let's just repeat the salient bit of that: an average of 4 fraudulent calls per week; one call to my telco anti-fraud team; no more calls for almost exactly one year.
I could not in truth write that my telco had a criminal gang operating out of one of their India call centres; but the evidence from my side suggests that is a likely explanation. The use of fraudulent email domains is only part of the problem, however, because without the calls we would not be prompted to visit them. [ OK, spam notwithstanding].
You would think that ISPs would be a bit more vigilant when it comes to signing up new customers; you would also expect that telcos with India-based call centres were more careful in watching their employees... Sadly, both of these activities would eat into profits. The truth is that the big telcos don't care if we are impacted by fraud, as long as they are not directly losing out in the process.
Until that changes, the calls will continue.