Jump to content

Technical support scam: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
Line 24: Line 24:
*The scammer may also claim that the system's "problems" are a result of "expired" [[warranty|warranties]] on its hardware or software, and coax the victim into paying for a "renewal".<ref name=troyhunt/><ref name=wired/>
*The scammer may also claim that the system's "problems" are a result of "expired" [[warranty|warranties]] on its hardware or software, and coax the victim into paying for a "renewal".<ref name=troyhunt/><ref name=wired/>
*The scammer may run the obscure [[Syskey]] utility and configure a startup password known only to them, thereby locking the victim out of their own system after the computer is rebooted.<ref>[http://www.woodchipcomputers.co.uk/index.php?PageID=msscam Woodchip computers:Have you been caught by the "I am Windows Support" scam?]</ref><ref name="kerbsonsecurity">{{cite news |last1=Holzman|first1=Carey|title='Microsoft Partner' Claims Fuel Support Scams|url=http://krebsonsecurity.com/2014/11/microsoft-partner-claims-fuel-support-scams/|accessdate=26 July 2016|agency=Kerbs on Security|date=14 November 2014}}</ref>
*The scammer may run the obscure [[Syskey]] utility and configure a startup password known only to them, thereby locking the victim out of their own system after the computer is rebooted.<ref>[http://www.woodchipcomputers.co.uk/index.php?PageID=msscam Woodchip computers:Have you been caught by the "I am Windows Support" scam?]</ref><ref name="kerbsonsecurity">{{cite news |last1=Holzman|first1=Carey|title='Microsoft Partner' Claims Fuel Support Scams|url=http://krebsonsecurity.com/2014/11/microsoft-partner-claims-fuel-support-scams/|accessdate=26 July 2016|agency=Kerbs on Security|date=14 November 2014}}</ref>
*The scammer may boot your computer into [[safe mode]] and/or delete files from your [[operating system]].


===Objectives===
===Objectives===

Revision as of 17:33, 12 July 2017

A technical support scam refers to a class of telephone fraud activities, in which a scammer claims to offer a legitimate technical support service, often via cold calls to unsuspecting users. Such cold calls are mostly targeted at Microsoft Windows users, with the caller often claiming to represent a Microsoft technical support department.

In English-speaking countries such as the United States, United Kingdom, and Australia, such cold call scams have occurred as early as 2008 and primarily originate from call centers in India.

The scammer will typically attempt to get the victim to allow remote access to their computer. After remote access is gained, the scammer relies on confidence tricks typically involving utilities built into Windows and other software in order to gain the victim's trust to pay for the supposed "support" services, when the scammer actually steals the victim's credit card account information, or to persuade the victim to login to Internet banking—lying that a secure server is connected and that they cannot see the details—to receive a promised refund.

Operation

Technical support scams typically rely on social engineering. Scammers use a variety of confidence tricks to get the victim to install remote desktop software, with which they take control of the victim's computer, and then use various Windows components and utilities (such as the Event Viewer), third-party utilities (such as rogue security software), and other tasks to make the victim believe that the computer has issues that need to be fixed, before proceeding for the victim to pay for "support".[1][2]

Initiation

Technical support scams can begin in a variety of different ways.[2][3] It most commonly begins with a cold call, usually claiming to be associated with a legitimate-sounding third-party, with a name like "Microsoft" or "Windows Technical Support",[4] or via advertising on popular search engines such as Bing or Google, cybersquatting keywords related to commercial products and services that an unsuspecting user may search for (such as "Microsoft live chat", "Facebook support", or "Outlook login help"), and leading to web pages containing a number to be called.[5][6] Some scams have been initiated via pop-up ads on infected websites instructing the potential victim to call a number. These pop-ups often resemble error messages such as the Blue Screen of Death.[7][8]

Remote access

The scammer instructs the victim to download and install a remote access program, such as TeamViewer, LogMeIn, GoToAssist, ConnectWise Control (known also as ScreenConnect), etc., and provide them with the details required to remote-control their computer using that program.[1][9]

Confidence tricks

After gaining access, the scammer attempts to convince the victim that their computer is suffering from problems that must be repaired. A number of common methods are used during many technical support scams—most of which involve misrepresenting the content and output of various Windows tools and system directories as evidence of malicious activity, such as viruses and other malware. Normally the elderly and the vulnerable will be targeted for technical support scams, or for people who aren't familiar with computers.

  • The scammer may direct users to Windows' Event Viewer, which displays a log of various events for use by system administrators and expert users to troubleshoot problems. Although many of the log entries are relatively harmless notifications, the scammer may fraudulently claim that log entries labelled as warnings and errors are evidence of malware activity or that the computer is becoming corrupted, and that the errors must be "fixed".[2][3][10]
  • The scammer may present system folders that contain unusually named files, such as Windows' Prefetch and Temp folders, and claim that the files are evidence of malware on the system.[10]
  • The scammer may misuse Command Prompt tools to generate suspicious-looking output, for instance, the tree command, which displays a listing of files and directories. The scammer may claim the innocuous program to be a malware scanner, and manually enter text purporting to be an error message (such as "security breach ... trojans found") after the conclusion of the output.[11]
  • The scammer may misrepresent values and keys stored in the Windows Registry as being malicious, such as innocuous keys whose values are listed as not being set.[2]
  • The "Send To" function on Windows is associated with a globally unique identifier. The output of the command assoc, which lists all file associations on the system, displays this association with the line ZFSendToTarget=CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}; this GUID is the same on all versions of Windows. The scammer may claim that this is a unique ID used to identify the user's computer, or claim that the "CLSID" listed is actually a "Computer Licence Security ID" that must be renewed.[12][13]
  • The scammer may also claim that the system's "problems" are a result of "expired" warranties on its hardware or software, and coax the victim into paying for a "renewal".[3][10]
  • The scammer may run the obscure Syskey utility and configure a startup password known only to them, thereby locking the victim out of their own system after the computer is rebooted.[14][15]
  • The scammer may boot your computer into safe mode and/or delete files from your operating system.

Objectives

These tricks are meant to target victims who may be unfamiliar with the actual uses of these tools, such as inexperienced users and senior citizens—especially when the scam is initiated by a cold call.[1][4][16] They then coax the victim into paying for their services or software which they claim is designed to "repair" their computer, which actually is malware that infects it or software that causes other damage.[17] The scammers in turn, gain access to the victim's credit card information, which can be used to make additional fraudulent charges. Afterwards, the scammer may also claim that the victim is eligible for a refund, and request the user's bank account information—which is instead used to steal more money from the victim, rather than providing the promised refund.[2][3][4][10][18][19]

In an investigation conducted by Symantec employee Orla Cox, it was revealed that after Cox paid for the fee for the scammer to remove the nonexistent "malware" infections, the scammers would then merely clear the log in the Event Viewer and disable Windows' event logging feature. This merely means that errors would no longer appear in the Event Viewer, i.e. had malware actually existed on Cox's computer, it would remain intact.[20]

Unethical and fake "support" companies

The great majority of the complaints and discussion about companies that cold-call and offer "technical support"[21] report them as being not merely incompetent or ineffective, but actively dishonest, doggedly trying to convince the victim of non-existent problems by trickery, and when possible damaging a computer they gain access to.[2][22][23] Computer support companies advertise on search engines like Google and Bing,[21][24] but some are heavily criticised, sometimes for practices similar to the cold callers. One example is the India-based company iYogi, which has been reported by InfoWorld to use scare tactics and install undesirable software.[25][26] In December 2015, the state of Washington sued iYogi's US operations for scamming consumers and making false claims in order to scare the users into buying their diagnostic software.[27] iYogi, which was required to respond formally by the end of March 2016,[28] said before its response that the lawsuit filed was without merit.[29] In September 2011, Microsoft dropped Comantra, a Gold Partner, from their Microsoft Partner Network because of accusations of being involved in cold-call technical support scams.[30]

In December 2014, Microsoft filed a lawsuit against a California-based company operating such scams for "misusing Microsoft's name and trademarks" and "creating security issues for victims by gaining access to their computers and installing malicious software, including a password grabber that could provide access to personal and financial information."[31] In an effort to protect consumers, Microsoft-owned advertising network Bing Ads (which services ad sales on Bing and Yahoo! Search engines)[32][33] amended its terms of service in May 2016 to prohibit the advertising of third-party technical support services or ads claiming to "provide a service that can only be provided by the actual owner of the products or service advertised".[5][34]

See also

References

  1. ^ a b c Arthur, Charles (18 July 2012). "Virus phone scam being run from call centres in India". Guardian. Retrieved 31 March 2014.
  2. ^ a b c d e f Segura, Jérôme. "Tech Support Scams - Help & Resource Page | Malwarebytes Unpacked". Malwarebytes Corporation. Retrieved 28 March 2014.
  3. ^ a b c d Hunt, Troy (February 21, 2012). "Scamming the scammers – catching the virus call centre scammers red-handed". Retrieved 1 April 2014.
  4. ^ a b c "Hello, I'm definitely not calling from India. Can I take control of your PC?". Ars Technica. Retrieved 16 November 2014.
  5. ^ a b "Microsoft to Bing users: No more shady third-party ads for tech support, password recovery". ZDNet. Retrieved 13 May 2016.
  6. ^ "Despite Crackdowns, Tech Support Ads In Search Are Still Cause For Consumer Confusion". Search Engine Land, Ginny Marvin on August 5, 2014
  7. ^ Harley, David (7 October 2015). "Tech Support Scams: Top of the Pop-Ups". We Live Security. Retrieved 28 July 2016.
  8. ^ "Do not respond to scam pop-up messages in your web browser". www.communications.gov.au. Department of Communications and the Arts. Retrieved 2016-04-19.
  9. ^ Technical support scammers (8 July 2017). "Fake ConnectWise Control login purporting to be British Telecom technical department (note name of site)". bttechnicaldepartment.screenconnect.com. Archived from the original on 8 July 2017. {{cite web}}: Unknown parameter |deadurl= ignored (|url-status= suggested) (help)
  10. ^ a b c d Solon, Olivia (11 April 2013). "What happens if you play along with a Microsoft 'tech support' scam?". Wired.co.uk. Retrieved 10 November 2014.
  11. ^ Lodhi, Nauman. "Beware of Microsoft Tech Support Scammers". Business 2 Community. Retrieved 18 April 2014.
  12. ^ "Support desk scams: CLSID not unique". We Live Security. ESET. Retrieved 15 November 2014.
  13. ^ "Support-Scammer Tricks". We Live Security. ESET. Retrieved 15 November 2014.
  14. ^ Woodchip computers:Have you been caught by the "I am Windows Support" scam?
  15. ^ Holzman, Carey (14 November 2014). "'Microsoft Partner' Claims Fuel Support Scams". Kerbs on Security. Retrieved 26 July 2016.
  16. ^ "Microsoft Phone Scams". www.which.co.uk/. Which?.
  17. ^ Scott, Gini. Scammed: Learn from the Biggest Consumer and Money Frauds How Not to Be a Victim. Skyhorse Publishing, Inc. ISBN 9781621535041.
  18. ^ "Tech Support Scams". Federal Trade Commission. Retrieved 16 November 2014.
  19. ^ Winterford, Brett (May 18, 2011). "How the Microsoft/LogMeIn support scam works". ITnews.com.au. Retrieved 1 April 2014.
  20. ^ Cox, Orla (22 June 2010). "Technical Support Phone Scams". Symantec. Retrieved 3 August 2016.
  21. ^ a b Hunt, Troy. "Interview with the man behind Comantra, the "cold call virus scammers"". Retrieved 18 April 2014.
  22. ^ Baker, Steve. "What Seniors (And Their Children) Need To Know About Tech Support Scams". Forbes. Retrieved 19 April 2017.
  23. ^ "Reputation of guruaid.com". WOT.
  24. ^ "How iYogi & Guruaid running tech support campaigns?". AdWords Community. Retrieved 2 May 2014.
  25. ^ Cringley, Robert (28 March 2012). "The downward (dog) spiral: iYogi exposed". InfoWorld. Retrieved 3 April 2014.
  26. ^ Cringley, Robert (21 March 2012). "Tech support or extortion? You be the judge". InfoWorld. Retrieved 9 June 2015.
  27. ^ Washington state sues firm, alleges tech support scam, Associated Press, 16 December 2015
  28. ^ Joe Panettieri (18 March 2016). "iYogi IT Services Lawsuit: State of Washington Awaits Response - ChannelE2E". ChannelE2E. Retrieved 24 March 2016.
  29. ^ Lawsuits Cloud iYogi Remote Tech Support Reputation, 11 Jan 2016
  30. ^ Microsoft Drops partner accused of Cold-Call Scams, 22 February 2016
  31. ^ Whitney, Lance (19 December 2014). "Microsoft combats tech support scammers with lawsuit". CNET. Retrieved 21 December 2014.
  32. ^ "Microsoft loses exclusivity in shaken up Yahoo search deal". Ars Technica. Retrieved 30 June 2015.
  33. ^ "Ad Tech And Mobile In Focus In Microsoft And Yahoo's Renewed Search Deal". TechCrunch. Retrieved 30 June 2015.
  34. ^ "Bing bans tech support ads—because they're mostly scams". Ars Technica. Retrieved 13 May 2016.
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Technical_support_scam&oldid=790273105"