Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Crime Windows

Listen To a Microsoft Support Scam As It Happened 229

Posted by samzenpus from the can-I-trust-you? dept.
itwbennett writes You know full well that Microsoft will never call you and ask to "access your computer" to help fix a problem. Yet this is a ruse that many unsuspecting computer users fall for and wind up with their machine hacked. CSO writer Steve Ragan, turns the tables during a phone call with a scammer — and he records it all for us to hear. Do yourself a favor and play it for your parents.
This discussion has been archived. No new comments can be posted.

Listen To a Microsoft Support Scam As It Happened More

Listen To a Microsoft Support Scam As It Happened

Comments Filter:

  • the real problem (Score:5, Insightful)

    by slashmydots ( 2189826 ) on Monday March 09, 2015 @12:10PM (#49216169)
    And here's a written transcript of all actions taken by the Indian government to stop this scam:

  • sending to partents (Score:5, Funny)

    by Anonymous Coward on Monday March 09, 2015 @12:13PM (#49216183)

    I've told my parents so many times not to click on links in an email.....now you're telling me to send them a link and have them click on it?

  • Funny thing... (Score:5, Interesting)

    by stazeii ( 1148459 ) on Monday March 09, 2015 @12:13PM (#49216187) Homepage
    Had one of these (and only one)... told them I only had Mac's at home, and the guy got belligerent and said I was lying, then finally after telling him that over and over for a good minute he basically said FU and hung up. Can't imagine what they'd say if I said I only ran Linux, or something really obscure ("Sorry, I only run OpenVMS"). =D So yeah... guess their scheme falls over pretty quickly if you don't have a Windows box...

    • Re:Funny thing... (Score:5, Insightful)

      by Anonymous Coward on Monday March 09, 2015 @12:17PM (#49216217)
      LOL If you have only Mac's at home, you've already been scammed.

    • Re: (Score:3)

      by mlts ( 1038732 )

      I've had that happen, and I did warn the guy that the computer I was using really couldn't use MSI files, because they were not in AIX's installp or 64 bit coff format.

      I've always thought it would be humorous to allow them into a VM on an isolated network, just so I can snapshot it and see what type of ugly RAT-ware they are using... but if they started hacking from there, I'd be responsible, so ixnay on that happening.

    • Re:Funny thing... (Score:5, Interesting)

      by fermion ( 181285 ) on Monday March 09, 2015 @12:25PM (#49216303) Homepage Journal
      It is for stuff like this I wish that phones could record calls. We really need a change of laws. When a business calls and intimidates people, we really need a record.

      • Re:Funny thing... (Score:5, Interesting)

        by BUL2294 ( 1081735 ) on Monday March 09, 2015 @12:32PM (#49216369)
        (IANAL) In Illinois, and likely most other states, if you believe that a crime will take place during the recording of a phone call (and this does likely count as a felony), you can record it without permission of the other party. In addition, you are shielded from prosecution for breaking wiretapping laws & your surreptitiously recorded evidence can be used for prosecution.

        • Re: (Score:2)

          by Greyfox ( 87712 )
          Typically if you open with "This call may be recorded (or *WILL* be recorded)" that's enough to shield you from the wiretapping laws. Essentially you just need to inform the other party of your intent to record the call in advance. (Not a lawyer in any state, much less all 50, check with your local authoritah yadda yadda)

          There's got to be some android software that lets you accomplish this. It's also easy to do with asterisk if you have landlines or voip. You can just set up a voice menu system that info

        • (IANAL) In Illinois, and likely most other states, if you believe that a crime will take place during the recording of a phone call (and this does likely count as a felony), you can record it without permission of the other party. In addition, you are shielded from prosecution for breaking wiretapping laws & your surreptitiously recorded evidence can be used for prosecution.

          In some US states only one party consent is needed to you can record to your heart's content since you consent. No need to do get the other party's consent.

          • Re: (Score:2)

            by sribe ( 304414 )

            In some US states only one party consent is needed...

            Most US states, actually ;-)

        • Didn't we just pass some laws to protect cops from recording (cause they'd never break the law - umm Homan Square [google.com]), so I'm not sure if this is still the case.

    • a friend of mine and his folks have been recently plagued by this.

      He actually did say he ran linux (he doesnt, but that's beside the point) and just hung up. They called again later though.

      He lives next door to his folks (not the basement. next door) so the next time his folks answered. His folks dont know anything about computers but can recognize a scam when they hear one. His mom just blurted into the phone "I dont even use a computer!" and hung up.

      they got quite a few more calls in the week after.

      some

      • Re:Funny thing... (Score:5, Insightful)

        by Altrag ( 195300 ) on Monday March 09, 2015 @01:15PM (#49216877)

        Trouble with trolling them is that they don't really care. The worst you'll accomplish is getting some low-paid (probably illegally low since you know, illegal business anyway) phone drone fired and replaced with the next one.

        Your time is more valuable than theirs..

      • Re: (Score:2)

        by Steve B ( 42864 )

        Last time I got one of these calls, it went something like this:

        "I need you to open your Windows."
        "Can you call me back later when it's not raining?"
        *click*

    • Re: (Score:2, Interesting)

      by Anonymous Coward

      The best thing you can do is to talk to these people and swear at them... for every minute that you have them on the line, they're not scamming some's Gramma.

      • Re: (Score:2)

        by Anrego ( 830717 ) *

        I've tried to keep them on the line and waste their time, but they figure it out pretty fast and just hang up (although once I did get a bit of profanity, so I was kinda proud of that).

        • Re:Funny thing... (Score:4, Interesting)

          by HappyHead ( 11389 ) on Monday March 09, 2015 @12:49PM (#49216559)
          Another good trick to use is to pretend you're trying to follow their instructions, and that it's just not working.

          Tell them your virus scanner is giving you alerts, they'll think you're a really good target. If your phone has a 'mute' option, ask them to hold on for a second because you've got another call. Come back within a minute or two, and if they're still there, lead them on again. Never let on that you aren't actually following their instructions, never let on that you know it's a scam. As long as they think they've got you hooked, they'll keep trying. As soon as you reveal that you're not buying into their lines, they'll cut bait and look for someone else to scam.

          That's the big difference between the major scammers like this, and the ordinary telemarketers who just want to sell you things you don't need while you're trying to eat dinner - the scammers are allowed to hang up. The regular telemarketers aren't, and you can spend an hour telling them all about the coffee cup sitting on your desk.

        • Re: (Score:2)

          by cusco ( 717999 )

          One would think that when I tell them that I've done server and desktop support for close to two decades it should scare them off, but it doesn't seem to. The ones that I've gotten have a script, and they'll follow it off the edge of the Earth. I've kept them on the line for up to 23 minutes, and even then I only hung up because it was time to throw things in the wok and I needed both hands.

    • Had one of these (and only one)... told them I only had Mac's at home, and the guy got belligerent and said I was lying, then finally after telling him that over and over for a good minute he basically said FU and hung up.

      That's the wrong way to do it -- instead, pretend to be old and incompetent (and with a similarly old computer). It takes you two minutes to get to your computer, another minute to figure out which button turns it on, another 10 minutes for your computer to boot up (with occasional progress reports so they don't lose heart). In between, you set the phone down and do whatever you were doing before. Like with real tech support, fake tech support requires near-infinite patience and the target demographic is cl

      • Re: (Score:2)

        by moeinvt ( 851793 )

        I agree with the "waste their time" strategy. We should have a regular competition to see who can keep one of these people on the line the longest.

    • Had one of these (and only one)... told them I only had Mac's at home, and the guy got belligerent and said I was lying, then finally after telling him that over and over for a good minute he basically said FU and hung up. Can't imagine what they'd say if I said I only ran Linux, or something really obscure ("Sorry, I only run OpenVMS"). =D So yeah... guess their scheme falls over pretty quickly if you don't have a Windows box...

      Only if yo let it. I've gotten those calls and kept them on for quite some time and listen to them get more and more frustrated when they can't seem to get me to give them access but am only seconds away from giving them a credit card number. Frankly, after a while I give up and offer to pay and here is my credit...click...dial tone...

    • Re: (Score:2)

      by SeaFox ( 739806 )

      Had one of these (and only one)... told them I only had Mac's at home, and the guy got belligerent and said I was lying, then finally after telling him that over and over for a good minute he basically said FU and hung up

      My mom got called once while I was home and didn't give up even when she told him she was using Linux Mint -- I got on the phone and asked the "Microsoft employee" to confirm our Windows Product Key code -- he should be able to see that if he is monitoring my computer after all, I said.

      After a repeated requests for this the scammer actually tried to give a fake one -- that didn't follow the correct format (number of characters or pattern of letters/numbers).
      I pointed this out laughed in his face before hang

    • Re: (Score:3)

      by nobuddy ( 952985 )

      I have a few VM images of crappy insecure Windows installs I use for training. I have one that has every virus I can find on it. I moved a copy of every infected payload file to a folder on the desktop labelled "Financial Records" in the hopes that someday they will call me. So far they have not cooperated on this.

  • "Internet expl..Internet Exploiter?..Internet Explorer?"

    Brilliant.

  • NoScript (Score:5, Informative)

    by DrunkenTerror ( 561616 ) on Monday March 09, 2015 @12:18PM (#49216221) Homepage Journal

    There are ninety (90) scripts trying to run on that page.

    • Re: (Score:2)

      by tepples ( 727027 )

      How many scripts are acceptable on such a page? If zero, then without script, what would provide controls for the audio playback?

      • Re:NoScript (Score:5, Informative)

        by Anonymous Coward on Monday March 09, 2015 @12:37PM (#49216449)

        This always seems to come as a complete surprise to many people, but you can just link directly to an audio or video file. You don't actually need any javascript "playback controls". My OS will take care of that just fine, thank you, and play the file when I click on the link to it. That's what it's for. And it's far more trustworthy than some random site's pile of javascript doing who knows what.

        So yes, zero script is the preferred answer. Like the GP, I disable them locally, so only sites I wish to allow to run scripts can run scripts.

        • Does your operating system's included video player support synchronizing a timed transcript to an audio file or a set of subtitles to a video file? And in which timed text format? And does your operating system support the concept of a playlist, where an audio or video presentation is made of several chapters each with its own URL?

          • VLC routinely synchronizes audio and video files - I suppose that it could also syncrhonize a "timed transcript" with an audio file. Better yet - why not just make a video of the transcript scrolling down the page as the audio plays? There are a whole bunch of people on Youtube who have figured out how to do that.

            • Re: (Score:2)

              by tepples ( 727027 )

              True, VLC supports the LRC and SRT formats for timed text and has supported WebVTT since this commit in September 2013 [gitorious.org]. So that's fine as long as you can ensure that all of your viewers have (or have permission to install) VLC.

      • How many scripts are acceptable on such a page? If zero, then without script, what would provide controls for the audio playback?

        Seems to me the standard <embed> has worked just fine for decades. Browsers shouldn't be handling this shit.

        • Re: (Score:3)

          by tepples ( 727027 )

          The <embed> element is not a standard but a Netscape extension. It has been superseded by <audio> and <video>.

      • The thing is, they don't need controls on the page for audio playback. Just hang the damned file up there, and let me point VLC or something at it. All the controls necessary reside right here, in my box.

  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Monday March 09, 2015 @12:25PM (#49216293)
    Comment removed based on user account deletion

    • in Indias case, rampant corruption and high unemployment combined with a tech industry that favours low worker pay and aggressively combats everything from workplace safety to union organization and benefits has led to the tech support scam, born from the confidence and trust of americans and europeans accustomed to the dulcet tones of the south asian tech support worker.

      Americans and Britons (what about Canadians?). I doubt you'd find many
      Indians fluent enough in French, Italian, Spanish, German, Polish, ...
      who'd be available for this kind of scam.

  • These guys call me every few months... (Score:5, Interesting)

    by H0p313ss ( 811249 ) on Monday March 09, 2015 @12:29PM (#49216333)

    ... and depending on my mood I have several strategies;

    1. Just tell them you only have Linux, they'll hang up immediately.
    2. Musical hold, put the phone next to a speaker and go on with your life.
    3. Tell them you have several computers running various Windows versions, which one did you mean... do you have a hostname or IP address so I can narrow it down? You don't? So how do you know it was my machine again? Really? ... So can I speak to your manager. (So far I've never got a manager.)
    4. Pretend to follow along with their instructions, honestly the most time consuming and least satisfying.

    But the problem is not with us, it's with Joe User who for some reason is unaware that Microsoft isn't phoning everybody. Never underestimate the power of human stupidity.

    • Re:These guys call me every few months... (Score:5, Funny)

      by I4ko ( 695382 ) on Monday March 09, 2015 @12:35PM (#49216417)
      Last time I got one of these I was in a playful mood and pretended to be an illiterate, however I answered their questions like I was using a VAX via a green screen VT-100 terminal. Took them 15 minutes to say - "aaah, we are sorry, we don't support that". Especially when they asked me what is the key on the left of Alt and I told them I don't have an "Alt" but a "line feed".

    • Re:These guys call me every few months... (Score:5, Funny)

      by Anonymous Coward on Monday March 09, 2015 @12:45PM (#49216527)

      Recently discussing this with friends we came to the conclusion that the best approach would be:
      State that your girlfriend/wife is the main user of that computer.
      Get increasingly angry that "she" has broken it
      Say she's just come home and you'll be back in 2 minutes - you need to talk to her
      Go into another room, shout, make some loud banging noises then go silent.
      On the phone say "oh god what have I done" repeatedly. Maybe cry.

      Once they hang up, carry on as normal.

      • Re: (Score:2)

        by moeinvt ( 851793 )

        That's an excellent idea.

        Reminds me of a Jerky Boys call. He was telling his imaginary wife to STFU while he was on the phone and then, after he had supposedly knocked her unconscious he wanted the guy on the other end to be a witness for him and tell the cops that his wife had been interrupting their conversation and he therefore had no choice but to hit her.
        I think I'm going to add an additional piece to your plan where I step outside and light off a firecracker before getting remorseful and telling the

      • Recently discussing this with friends we came to the conclusion that the best approach would be:
        State that your girlfriend/wife is the main user of that computer.
        Get increasingly angry that "she" has broken it
        Say she's just come home and you'll be back in 2 minutes - you need to talk to her
        Go into another room, shout, make some loud banging noises then go silent.
        On the phone say "oh god what have I done" repeatedly. Maybe cry.

        Once they hang up, carry on as normal.

        But they're in India... so yeah...

    • 1. Just tell them you only have Linux, they'll hang up immediately.

      I tried that when they called me many years ago (back when windows XP was new... and they had the same recorded opening message back then) and the guy on the phone told me that no I didn't, my computer was a Microsoft Windows Computer, because that is what everyone has. He literally would not believe me that I wasn't using Windows. He actually got angry with me. It was kinda funny really.

    • I have had that call before I took the guy for a ride.

      Can you go to the start menu?

      Do you mean the "K"?
      I don't see control panel but it says system tools.
      when i search for cmd it doesn't find anything but there is a command prompt symbol. It says xterm.
      Yeah it says invalid command.
      I downloaded it but It say it doesn't know how to open the file.
      he finally just hung up.

    • Re: (Score:3)

      by dwywit ( 1109409 )

      1. I get told that I am lying, and that they KNOW I'm running Windows.
      2. I get more laffs out of leading them astray, "reading" the errors in my event logs.
      3. Tried that. "I have several computers. Which one is it?" "All of them, sir" "But which one do you want me to turn on?" "Any of them, sir" "But which one are you getting the error messages from?" "All of them, sir" and so ad nauseam.
      4. See #2

      I've been handed off to "an expert on your computer", who I promptly told I knew he was a scammer. His reaction

  • Which computer? (Score:4, Informative)

    by bradvoy ( 686502 ) on Monday March 09, 2015 @12:32PM (#49216379)
    I received one of these calls a few weeks ago. After the scammer informed me that my computer was compromised but he was going to help me solve the problem I thanked him for his help and asked him which of my computers was infected. He seemed surprised by the question and said, "You have more than one computer?" I replied that I have several and surely he must be aware of that because he had just described the extensive monitoring Microsoft was doing. He said it didn't matter which one; just go to one of them and follow his instructions to get rid of the infection. I said that surely I need to go to the one that is infected to clean it, but he again claimed it didn't matter which one I went to. I pushed the point that if his monitoring was able to detect an infection then surely it must be able to identify which of my computers was infected. He started becoming beligerent, almost shouting that it didn't matter which computer had the infection but that I needed to go to one of them immediately so he could help me clean it. At this point I called him a liar and asked how he felt about lying to and stealing from people. He really started yelling at that point, and I just hung up. I haven't heard back yet.

    • Re:Which computer? (Score:5, Interesting)

      by Opportunist ( 166417 ) on Monday March 09, 2015 @01:24PM (#49217013)

      It saddens me to see what kind of amateurs and dazzlers muscle into the ancient trade, if not art, of grifting. A professional would have said something akin to "Hmm... sadly I only have one set of data here and it doesn't say exactly what it is but from what's installed that would be a ... laptop?" Chances are that you have a laptop and maybe only one.

      Ah well, heavy sigh... But then again, everyone who perfected the art of sweet talking, telling people what they want to hear and at the same time making them fear the world as they know it comes to an end if they don't listen to him and pay him for it has long since moved on into consulting. More profitable and even legal!

      • "It looks like you're behind a router; I can't tell which computer on your internal network is the culprit. Let's hit them all just to make sure, ok? If we leave even one, the whole thing could get reinfected!"

  • Here is an detailed video (of another scam) (Score:3, Informative)

    by mtbrandao ( 3735361 ) on Monday March 09, 2015 @12:33PM (#49216393)
    http://youtu.be/GVQoAlQrnSg

  • You can't fix stupid (Score:3)

    by Brad1138 ( 590148 ) <brad1138@yahoo.com> on Monday March 09, 2015 @12:34PM (#49216397)
    The problem is, we support & enable "stupid" now, instead of letting them succumb to natural selection like they would have in the past.

    • Re:You can't fix stupid (Score:4, Insightful)

      by Altrag ( 195300 ) on Monday March 09, 2015 @01:54PM (#49217323)

      Define "stupid." Would you be able to tell when an auto mechanic is BSing you? When your contractor does a half-assed job building your home but still charges you full price? Any of 1000 other scams that are out there attacking areas of knowledge you haven't studied?

      Just because a person can't tell a mouse from a memory stick doesn't mean they're stupid -- it means they don't know about computers. And that's still a large portion of the population, even among the younger crowd ("can use Facebook" does not indicate "knowing about computers" in any useful sense.)

      Because most people have no need to know. Just like you don't need to know how to design and build the car you drive or the house you live in, most people don't need to know every detail about computers in order to use them.

      There is (or at least should be) an argument that because computers (/phone/tablets/etc) are increasingly storing large chunks of our critical information that we should be training everyone in at least basic security.

      Of course that's easier said than done. Its hard to make a full-term course out of that to push in public education (where they don't have the funding to support existing courses anyway.) Doing it as one of those three-day seminar type courses would be great except how do you convince more than a handful of people to attend? And nobody wants to see registration and licensing for basic computer usage (enforcing a minimal amount of training in order to obtain the license) -- even those who think programmers should be licensed generally wouldn't go that far.

      So until someone figures out how to educate the entire country (/planet!), just calling people "stupid" and shutting down the conversation isn't helping anything. Or you know, since you're apparently perfect at everything (otherwise you'd be "stupid" too) maybe you can be the one to figure out how to solve the problem!

      • Re:You can't fix stupid (Score:5, Insightful)

        by toonces33 ( 841696 ) on Monday March 09, 2015 @04:20PM (#49219173)

        Define "stupid." Would you be able to tell when an auto mechanic is BSing you? When your contractor does a half-assed job building your home but still charges you full price?

        Generally yes. I know enough about these things that I already have a pretty good idea what is going on with a car that I can take it to a mechanic and not get ripped. For example, does your car make a funny noise? Well you can do simple tests to try and narrow down what makes the noise change, and this gives you a good idea of what the problem might be. I just don't have the time, the tools, or the shop space to do a lot of these jobs myself, so I pay someone to actually do what I need them to do.

        Same on the house. Simple jobs I do myself, other ones I will hire someone to finish things out. In many cases I might not know exactly how a tradesman would do a particular job, so I will watch for a bit so I can learn something.

  • I've forwarded that e-mail hundreds of times!

    /the world will always build a bigger idiot

  • My parents laugh when they get this call (Score:2, Interesting)

    by Anonymous Coward

    My father used to run ubuntu now hes on fedora. My mother has been on a mac for the past 5 years. There is no windows in their house. When he gets the scam call about problems with his "windows" he tells them he doesn't have windows, only doors. It takes them a second to figure it out and then they hang up. Its pretty comical, and if more grandma's grandpa's had linux desktops this wouldn't be a problem. All they ever use the computer for is checking email and surfing the web anyway, if you guys have

    • There is no windows in their house.

      so your parents house is a giant basement???

      My father used to run ubuntu now hes on fedora.

      yup

  • These guys alway call with spoofed caller ID info. Why? Because its easy. I really can't believe that it not possible to create a REAL caller ID system. But the TELCO's will *itch about regulatory interference in their business. I say make them LIABLE for passing on bogus ID info and they will find a way to make caller id work. Calls from overseas? Just ID them as OVERSEAS calls. Co that sell spoofing services, well if the TELCO is liable, they wont allow spoofed ID on outbound trunks. They would r

  • One day, one awesome day ... (Score:3)

    by Opportunist ( 166417 ) on Monday March 09, 2015 @01:05PM (#49216771)

    one day I shall invent a tool that allows you to kill and mangle people via telephone, and then I can enjoy life again.

  • Because your portrayal of "helpless user" was pretty narrow.

  • works in linux too (Score:5, Interesting)

    by mejustme ( 900516 ) on Monday March 09, 2015 @02:00PM (#49217387)

    Maybe 3 years ago I played along with such a caller. I run Ubuntu, but didn't say anything to them about what o/s I was using. When he asked me to visit a web site and download a Windows file from a web page, I laughed inside, thinking nothing would happen. I downloaded the .exe from a throw-away Ubuntu VM I had. Unexpectedly, Ubuntu downloaded Wine, installed it, then ran the .exe file. I was both impressed and scared that Ubuntu had done this automatically to run the .exe file. This resulted in a completely empty Windows (Wine) desktop, to which they of course quickly tried to connect. I kept "accidentally" disabling their control, so they could only look. When I finally gave them access, they were very confused that it had none of the usual Windows applications and menus they were expecting to see, nor did their usual password changing and locking work. More and more people on their end of the call were talking on the phone, trying to figure out what was going on.

    After nearly an hour on the phone, I had enough and told them I was a software developer, and they hadn't scammed me. They swore at me and hung up. Immediately, I got a phone call from someone else saying he was calling to help me unlock my computer for a fee. Obviously as soon as they lock a desktop, they must trigger something in their call system so someone else calls back to earn some money.

  • Fact is it takes quite a lot of time to string one of these people along. Last time I did more or less what is on this tape, and stopped it just shy of downloading anything. I asked the guy, "What does your mother think about this?" He seemed confused, so I said, "Is your mother proud of what you are doing, trying to trick old people into hacking their little computer?" Then I yelled at him a little bit more.

    So yeah, you can do it, but as someone else said here, your time is more valuable than theirs.

    • That's ultimately it - how much is your own time worth. If you could construct some sort of Siri-like thing that just acted dumb, asked inane questions, and generally ran them in circles, it could be quite funny.

      I suppose you could just tell them you need to let the dog out, set down the phone and not pick it up again until they give up.

  • That site is trying to con me into installing Flash. What kind of low down, dirty scam is that?

Slashdot Top Deals

"...a most excellent barbarian ... Genghis Kahn!" -- _Bill And Ted's Excellent Adventure_

Close