18 ms·

Dell Computers Has Been Hacked

537 points by MilnerRoute 11y ago

EwanToo 11y ago
Far more likely it's call centre staff who work for dell customer support abusing their system access than an external hack, this seems quite common across almost all brands and industries
cm2187 11y ago
I don't know if it's related but I found something deeply worrying a couple of months ago. I purchased a laptop on Dell's website at my home address using a personal email and my personal paypal account. No reference anywhere to my job or employer. A couple of weeks later I receive a call from India on the mobile number provided to Dell, from a guy pretending to be from Dell (and he might have been) who wanted to discuss how he could do business with my employer which he mentioned by name (a large corporation). At that time I thought that Dell's commercials were unacceptably pushy, googling their private clients to find a way in their employer. It didn't occur to me that this might have been a scam using Dell's database.
- deleted 11y ago
  [deleted]
- nthitz 11y ago
  Axciom, Epsilon and similar companies track your credit card purchases and correlate them with a profile of who they think you are. If you work for a large corporation that is probably easier to identify than a small one. http://www.acxiom.com/ http://www.acxiom.com/ http://www.epsilon.com/ http://www.epsilon.com/
  - samstave 11y ago
    These companies need to burn to the fucking ground.
  - imbellish 11y ago
    It's the isolating arm of capitalism drilling its elbow grease directly into your personal life.
    - beedogs 11y ago
      We can't be too far off from a China-style 'citizen credit rating' kind of system.
      - rms_returns 11y ago
        It already happens unofficially. How do you think banks assess your lending/borrowing habits when you apply for a loan? There are detective agencies who track credit cards and other things (like a few examples someone gave in this very thread).
        pdkl95 11y ago
        There is a huge difference between a "private" rating system and a public rating that uses your friends against you as manipulation. See Extra Credit's description[1] of how this works. We aren't there yet, but consider that Facebook wants to use your social network associations in your credit score[2]. [1] https://www.youtube.com/watch?v=lHcTKWiZ8sI https://www.youtube.com/watch?v=lHcTKWiZ8sI [2] http://www.theatlantic.com/technology/archive/2015/09/facebooks-new-patent-and-digital-redlining/407287/ http://www.theatlantic.com/technology/archive/2015/09/facebo...
        krick 11y ago
        Jesus. If that first video is true, then that's what should be top-upvoted submission on HN. Why isn't it better known? I mean, at least I personally never heard about it and I might be not the most informed person on the Internet, but certainly I'm not the least. And this is much more important thing to know than… well, everything I usually hear on the news. I don't get often surprised by all that dystopian stuff, because I assume we already are quite fucked, but this one did surprise me. That's just crazy.
  - cm2187 11y ago
    But in my defense I have a very common name, in fact the same name of a major politician. The email address I provided Dell was a single use disposable email address. So I have no idea of how they managed to correlate me to my employer.
  - pbhjpbhj 11y ago
    It would surely be really easy if you purchase things at a company shop or cafeteria? But the banks already know where your paycheck comes from ...
  - dcposch 11y ago
    I assumed that when I buy something on a card, it's more or less private. The transaction should be known only to: me, the merchant, our respective banks, Visa, and I guess the IRS if they come and ask for it. If I understand correctly, youre saying my entire purchase history is shared with random third party marketing companies. Full transaction data, PII included, no anonymization. How is that even remotely OK?
    - sbarre 11y ago
      That is correct. Banks and credit card companies merchandise this information to their partners, which leads to this kind of thing. Check your cards' terms of services if you want to be somewhat horrified.
      - branchless 11y ago
        Banks are disgusting. They get a cut already from the purchase which ought to be more than enough to deliver this and make a profit. But no it's not enough. I don't use facebook but do use a credit card. Hard to opt out of that in the modern world. God these people are filth.
        krick 11y ago
        Well, I don't know how hard is it in the USA, but I use cash most of the time and know several people who do the same. Sure, sometimes you need to make wire transfer, or pay with credit card, or paypal for that matter. But at least shopping in the supermarket is possible with cash.
        wuschel 11y ago
        Then I do hope that you do not own a cashback etc bonus card, or your can be quite sure that your personal consumption related high resolution data will end up in some buyers pocket. And all that for a cheaper (and cheap) bread-knife.
        11y ago
- yock 11y ago
  I recently experienced this with a software vendor after trialing some of their software. It's one of those forms where you have to enter some personal info before downloading the installer, and while I provided them with my email address I deliberately dodged entering my employer information. Imagine my surprise when I get a phone call from them at work asking how that software was working out for me. To be fair, I hated the software and wasn't going to buy it. That phone call certainly didn't nudge me in their direction though.
- nfoz 11y ago
  I ordered a laptop from Dell, providing no information about my small employer. I ordered it from my own laptop but it was on my work's WiFi when I ordered it. They called to confirm some BS about the order, and mentioned my employer's name. I was pretty stunned. I'm thinking they correlate IP address of your purchase on Dell.com with employer, I've heard such databases are available, but it's pretty surprising to me... not sure what else they do, except yeah, maybe googling their customers.
acomjean 11y ago
Am I the only one thinking that we've lost total control over the machines and data we've created. It seems like nothing is safe and or verifiable anymore. Add to this the backdrop of governments wanting backdoors. People calling you in the US pretending to be from the "IRS" and yet nothing is/ can be done about it? Maybe its really high time for C and its buffer overflows to go... And SQL injection. We're tech savy here, yet sometime even we fall for these things. Its starting to get actually expensive. I hate to be all conspiracy theory about this, but if/when the banks fall down like this....
- marklgr 11y ago
  From one of the comments in the article, it's probably more like we've lost control of how businesses work. Many people don't like the phrase "race to the bottom", but that's what comes to mind when you get to see how personal data is handled to third parties and/or cheap, expendable workforce.
  - keithpeter 11y ago
    At that point, one would expect to see increasing regulation kick in. It did historically for other kinds of service, e.g. financial services, insurance, public transport &c.
- such_a_casual 11y ago
  While I know very little about 'computer security', I have never been under the impression that Dell is aware such a term exists. "another dangerous dell root cert dicovered" http://www.pcworld.com/article/3008478/security/and-then-there-were-two-another-dangerous-dell-root-certificate-discovered.html http://www.pcworld.com/article/3008478/security/and-then-the... "dell attacks on scada doubled" http://securityaffairs.co/wordpress/35967/hacking/dell-attacks-on-scada-doubled.html http://securityaffairs.co/wordpress/35967/hacking/dell-attac... "in what some experts are calling the biggest data theft in US history." http://www.abc.net.au/news/stories/2011/04/07/3185296.htm http://www.abc.net.au/news/stories/2011/04/07/3185296.htm
- bonestamp2 11y ago
ossreality 11y ago
Yeah, I'll bet every penny I own that the author sucks at InfoSec compared to what they think. I'm just shocked that this has never affected me, as a Linux user, on my number of Dell devices.
roflaway 11y ago
Throwaway account because I just shared this story with a buddy of mine: I, too, have received these "Dell" tech support calls and angrily yell at them as I hang up within 15seconds. Lately though, I received a bombardment of calls (15 to be exact) in the past 3 days from the same number. I answered the one of them, and it had the same 1minute 10s message saying to call the number back regarding a computer threat they found on my computer (the voicemails are all 1min 10s). These calls woke my kids and I up every..damn..day. The calls kept coming on my work and personal line. Without dialing back the number, I'll never know how this crap even started. I feel bad for others out there who may actually fall for these kind of tactics
- such_a_casual 11y ago
  If you do decide to call back, make sure you check the number online first. There are some phone scams that involve getting people to call back pay-to-talk (I don't know what the proper term is) numbers.
  - kileywm 11y ago
    You're probably thinking of Premium-rate telephone numbers. https://en.wikipedia.org/wiki/Premium-rate_telephone_number https://en.wikipedia.org/wiki/Premium-rate_telephone_number
- Natsu 11y ago
  I prefer not to hang up right away. Instead, I try to waste a bit of their time. For automated calls, I just put down the phone and wait a while to hang up. But for people? I try other means of time wasting, so they can't call someone else to scam them. Last time they called, I told them that it was good that they called, because my computer had detected a virus on their computer and that I wanted them to download an install malware.exe to remove it. Next time they claim to call from Microsoft, I think I'll tell them I'm glad they've called, because I really need to speak to Bill Gates. Or if he's not available, Steve Ballmer. I guess Bill might not answer his own phone any more, but I have to admit that I wonder what Bill does if he gets a call from them? Maybe next time I should say that I'm Bill Gates and they're all fired? At least this is more amusing than simply hanging up in disgust. And it helps slow down the rate at which they scam new people, even more so the more people who do this.
stevebmark 11y ago
Sincerely, thank you for reporting this and helping bring it to the spotlight. It's too easy for things like this to fall under the radar of any major acknowledgement, letting corporations get away with major scandals without any accountability.
et1337 11y ago
Has Dell made any sort of announcement about this? Getting hacked is one thing. Failure to promptly notify the public is another.
josh_carterPDX 11y ago
Time to take my Optima 8200 offline. Sigh.
ommunist 11y ago
I'd rather bet that real Dell outsourced tech support to some company in India, where very often business ethics towards customer records is virtually non-existent. But what else can you expect? If you are not paying decent money, be prepared that your data woll be sold, unless you are ReallY able to enforce control over it. I seriously doubt that Dell tech support is ISO 27000 compliant.
- ketralnis 11y ago
  What do I expect? I expect the people that I send sensitive data to to be able to protect it. Blaming their overseas offices and partners doesn't make it better or relieve them of responsibility. And Dell isn't some too-cheap-to-be-true, fly-by-night operation. Saying that their customers were basically asking for it is bollocks as well.
  - jodrellblank 11y ago
    What do I expect? I expect the people that I send sensitive data to to be able to protect it. Desire, maybe, but expect? That's so far from reality are there any grounds for expecting that these days? Has any company successfully kept /all/ sensitive data from hackers?
- tzs 11y ago
  > If you are not paying decent money, be prepared that your data woll be sold, unless you are ReallY able to enforce control over it From what I can see from a bit of Googling, Dell does pay their tech support people decent money. If Glassdoor is to be believed [1] [2], Dell tech support people in India make about 340k rupees a year, or about 28k per month. That appears to be a middle class income for an Indian city dweller [3] [4]. [1] https://www.glassdoor.com/Salary/Dell-Technical-Support-Associate-India-Salaries-EJI_IE1327.0,4_KO5,32_IL.33,38_IN115.htm https://www.glassdoor.com/Salary/Dell-Technical-Support-Asso... [2] If the above link does not work without you being logged into a Glassdoor account, try Googling for "how much does dell pay tech support people in india" and clicking the Glassdoor result. [3] http://qr.ae/RgYML2 http://qr.ae/RgYML2 [4] http://www.pewresearch.org/fact-tank/2015/07/16/are-you-in-the-global-middle-class-find-out-with-our-income-calculator/ http://www.pewresearch.org/fact-tank/2015/07/16/are-you-in-t...
z3t4 11y ago
I don't know about you, but where I live (Sweden) there are strict rules on how you can store personal data and who has access to it. It's also against the law to put people in "databases". I guess we still remember WW2 and how the Nazi used such registers ...
- 27182818284 11y ago
  There are rules in the United States too, but a lot of places get it wrong. There is HIPPA, FERPA, PII, etc. More often than not a company thinks they're compliant but then after a break-in is found to be lacking something big like hashing passwords.
- ZanyProgrammer 11y ago
  Wasn't Sweden a lukewarm half assed ally of Germany in World War 2, at least for the first few years?
- greggyb 11y ago
  > It's also against the law to put people in "databases". I find this very hard to believe. At face value I interpret this as saying that no company doing business in Sweden has any sort of customer database. Is this correct? What about a CRM system?
  - z3t4 11y ago
    You need the customer's consent. So if they opt-in it's alright in most cases. But you can only store their personal data if you absolutely need to, and in a secure way. For example only store post address if you intend to send them snail male. You can for example only have someone in your CRM if they are a customer. And if they ask you to remove their data, you must remove all information about them. You do not have to worry if your company and all your equipment is located outside Sweden though. But as for example Facebook have a data-center in Sweden, you can actually request them to remove all your data. Example of illegal database is a database for direct marketing. Or a register of race, religion or preferences.
dogma1138 11y ago
I actually wonder if Dell was hacked or this is some 3rd party info sharing that got leaked the old fashion way. The problem with these types of cold call scams is that they do not scale, it seems a bit odd that a group could target a company the the likes of Dell would resort to such tactics (And yes I am fully aware that they could've breached Dell and sold the data but then I'm not sure that phone scammers would be in their price range). My bet would be on a 3rd party losing some data or getting hit, or even just employees doing it the really old fashion way print out couple of 1000's of profiles and go to work your operation most likely wont scale much beyond that anyhow. But in general allot of that info could've been fished even the Dell support tag. Dell's own support website has an auto detect feature that scans for it on your machine it supports .NET HTTP distro app, ActiveX and a few other plugin methods and if you have the Dell Support bloat ware installed I think even JavaScript could potentially work. (Don't remember if Dell was affected but over the years multiple laptop vendors were found to leak support info over LAN/Ethernet as they run various services both during boot and later through the bloatware they ship the machines with) If you have the support tag you usually can access old tickets opened on that tag either online or by social engineering their support team (With IBM support in the UK if you have the S/N you'll see all past tickets in their system) the rest of the data like name and phone numbers can be found out quite easily. So if you want to scam people by pretending to be Dell support you should be able to do it without actually needing access to their customer DB.
geocar 11y ago
It doesn't sound like Dell has been very effective here: likely attackers downloaded the database raw or it's one of their many contractors who log in remotely. Last time I saw that interface it was a web form that someone could access from any machine! This is serious. If you have customer data, you need to log access to that data, and you need to audit access to that data, and (very important!) you need to have a zero-tolerance policy. This isn't trivial to set up, but it's necessary; The CTO is responsible here, not some "website hackers".
- rms_returns 11y ago
  Second this. In fact, I would rather argue that its better to stop forcing online registration of computers until the privacy of those who register is guaranteed. Its not as if registration is even needed, they already have a tag attached to each device, so they can track sales using that. On the other hand, this problem is not specific to only Dell. Take the online web-forms of any other major Tech seller like Asus, Samsung, Motorola or HTC and their website sucks. Almost every one of them looks poorly designed and unprofessional which is more worrying.
  - geocar 11y ago
    It's not just tracking sales though, it's CRM, so every time they speak to someone about replacement/warrantee they need to know who they spoke to and audit frequent complaints either as abuse or something systemic that needs to be chased with a supplier. I know why Dell needs to do this, but the C-suite is responsible for dieselgate and this kind of thing needs to be developed smartly, with taste, and with a consideration about what can fail (and how bad it can get). Bread and butter: Encrypt everything, long audit trail; Sysadmins don't need to read the databases (and can log need for keys), engineering doesn't need to read personal data, helpdesk don't need to log into servers, and no service needs unauthenticated and unlogged read (even internally; e.g. for automated reporting); Get audited by someone competent. I handled 1bn daily records with 100% uptime, and max 6hr delay reporting using a single server, so there is no excuse except an incompetent CTO.
- dogma1138 11y ago
joshchaney 11y ago
The title should really be changed, there is no confirmation they were hacked. I have an equally plausible theory -- You used the same username and password somewhere else that got hacked, or your credentials were stolen through some infostealing malware. Account takeover is a huge problem these days, it wouldn't surprise me if there is a tool out there written specifically to validate combo lists against Dell's website.
- Bhullnatik 11y ago
  He mentions using two-step verification though. That doesn't mean it's not possible, but that makes a lot harder to get into his account.
  - joshchaney 11y ago
    He said his email account has 2FA (convincing us his email was not hacked), I don't think he meant his account on Dell.
biot 11y ago
Years ago at work, I noticed Dell's emails had an unsubscribe link that went to a "manage account" kind of interface. The idea was you enter your email address, go to some kind of "Manage Subscriptions" page, and you could opt out. Unfortunately, you could also see a bunch of Personally Identifiable Information including your first and last names, possibly your mailing address, and other information. I reported this to Dell and got back a very dismissive, abrasive email saying something to the effect of "Well how else are we going to let people unsubscribe?", claiming that they had no other legal option. I just changed all my info to junk and left it at that; eventually they closed that hole, but it wouldn't surprise me if some site exists that still allows people to harvest anybody's information from Dell using nothing but their email address.
Already__Taken 11y ago
Back in February of 2013 I bought an XPS 13" convertible (nice btw, shocked it doesn't ship with Pro) and whilst it was on the way I got 2 very convincing looking shipping tracking scam emails that ask to run some executable and enter some details. They had the correct model of laptop and very specific timing. I've never had any other spam like in before it since. Sadly gmail has removed the spam from so long ago and the initial Dell contact email must have been sent from a form as I only have the service desk reply with my correct shipping number to track myself. This might be even more serious than it looks.
txutxu 11y ago
14:43 UTC+1, site not loading, DNS error (domain not resolved). It seems DNS this was hosted on godaddy, but can't see the content now. It was pointing to shared hosting on dreamhost. The domain will expire in August, so that is not the problem. The domain is in status clientUpdateProhibited, clientTransferProhibited, clientRenewProhibited, clientDeleteProhibited... the whois has been updated today. Maybe this site was put down?
- kenbellows 11y ago
  Looks up to me, 08:55 UTC-5. If it's still not working for you try the archive: https://web.archive.org/web/20160105091436/http://www.10zenmonkeys.com/2016/01/04/dell-computers-has-been-hacked/ https://web.archive.org/web/20160105091436/http://www.10zenm...
  - txutxu 11y ago
    Still does not resolve here... maybe the problem is just in my network. I can see it now using translate.google.com as a proxy and it works. Thanks !!
davismwfl 11y ago
I posted about this about 7 months ago on HN, https://news.ycombinator.com/item?id=9881674 https://news.ycombinator.com/item?id=9881674, I also tweeted it out. Dell responded to my tweet saying there has been no breach and our data was secure. Obviously I didn't and don't believe them, and their main response was report it to the FTC. That is crap, admit it, fix it and deal with the issue. What totally pissed me off is that it was my sons laptop they called on and they called him directly since his number was listed when he called in for real Dell support about 3 months prior to the scam call. They had convinced him they were Dell until I walked into his room and heard 30 seconds of the call and asked why he called them, soon as he said he didn't I told him to hang up. They were persistent, calling him back many times over the next 2 months. I had to block the number to finally get it to stop and my son says he got a new call just a few weeks ago, new number same scam but at least he is smarter about it now.
- prplhaz4 11y ago
  I had the same problem last April, and had a surprisingly difficult time finding any more info about it. All Dell forum threads say that they know nothing about it and refer you to the FTC site. The really disturbing part was they used my mobile number, which had been spam-free until the Dell issue. I posted about my experience here, with the hopes that others in my cohort would benefit from it, but the thread is still quiet: http://forum.notebookreview.com/threads/scam-calls-from-dell-reps.773149/#post-9988974 http://forum.notebookreview.com/threads/scam-calls-from-dell... Summary of my battle: Keept them on the phone as long as possible, asked stupid questions, and tried to piss them off as much as humanly possible - I managed to get a "find a pen, remove the cap and stick it up your ass" after 2 hours on the phone with them. I kept them on the phone while my 4mb download took 45mins.
  - davismwfl 11y ago
    Just read your description, it is nearly identical to what they were trying to get my son to do. They wanted remote access and telling him that his computer was attacking other people and their "monitoring" caught it. Really was an elaborate explanation when I heard it, but so insane to anyone that knows how this all works. But to a 17 yr old it seemed reasonable, even plausible especially with the quick talking, pushy nature of these guys. That was until I got my son to stop and think about it for a minute, then he saw the stupidity in what they were saying. It was a great lesson for him, and while I had sworn off Dell quite a long time ago, this made him now say no thanks to Dell. His new laptop is a Toshiba, not that they or any company is immune, but the fact Dell won't even publicly address it and help to protect their customers to me is really the sign of a bad corporation. He even convinced 3 of the kids in his high school that were buying new laptops to avoid Dell, so hopefully people keep spreading the word and it starts affecting Dell in the only place they will apparently listen.
revscat 11y ago
I'm not seeing any direct evidence of a hack. It seems just as likely that Dell could have simply sold customer data to interested parties.
- fabulist 11y ago
  Superphish showed us that Dell is clearly willing to do something of that nature, but the data the hackers are alleged to possess (shared secrets, support histories, ...) isn't the kind of thing you'd sell. There is no proof, but there the author certainly presents plenty of evidence. Unless you have access to information outside this article, the most likely hypothesis is that their database was compromised.
mmaunder 11y ago
Suggestion: if you are affected by this, get your attorney to reach out to Dell and get a response on record. You might be surprised. Their legal team will understand the risks of sweeping under the carpet or denying something they know about.
mergy 11y ago
Same here back in mid-2015. We got a call from scammers with valid service ids of some of our equipment from Dell. I hope Dell comes clean on all of this.
ferongr 11y ago
It's been some time (10 years or so) since I've last bought a prepackaged computer (I build my desktops from parts) but do you really have to register your personal information with the manufacturer when you buy a prebuilt computer? Why would there be a need to do that anyway, wouldn't the serial number of the machine be enough for warranty purposes?
- discreditable 11y ago
  You technically don't have to, but the Out of Box Experience pushes you towards it.
- nandhp 11y ago
  Well, generally speaking, if you order a computer online (as most people probably do) you give them your name, address, and phone number so they can ship it to you.
  - ferongr 11y ago
    Thanks for pointing that out. Here in Greece (and most of Europe AFAIK) manufacturers don't sell directly to consumers, hence my confusion.
victorantos 11y ago
it's blocked for me, I get We've blocked this page O2 Wifi takes public wifi seriousl..
hackuser 11y ago
Something doesn't make sense: How can it be worthwhile for the attackers to invest that much time in gaining access to one computer? Given wrong numbers and that many people won't answer the phone, be near the computer, have time at that moment, or be willing to cooperate, and then add the time it takes to talk an end user through such a process, will they gain access to even one computer every 2 hours? How can that pay off? There are many, many more efficient attacks. How about good old-fashioned spam?
- spoondan 11y ago
  The purpose of the scam is not to gain access to computers. The purpose of the scam is to fleece unsuspecting Dell customers. The scammers gain the trust of their victim by using misappropriated Dell customer data. They charge exorbitant fees for unnecessary services to the less technically competent. My assumption is that the scammers are based in India or somewhere else where dollars go quite a bit farther than the US. Even apart from the potential for fraudulent charges, spending a few days to earn a few hundred dollars is definitely worth it in a country where the average income for a year is around $1300.
FredWills 11y ago
This is just so appalling! Hackers are just so dangerous! I find it add to trust the works of any other hacker aside my personal hacker,Andy Stover! He is the best hacker i currently know...you can get hold of him via (913) 583-0019 JUST INQUIRE!

537 points by MilnerRoute 11y ago

Far more likely it's call centre staff who work for dell customer support abusing their system access than an external hack, this seems quite common across almost all brands and industries

cm2187 11y ago

I don't know if it's related but I found something deeply worrying a couple of months ago. I purchased a laptop on Dell's website at my home address using a personal email and my personal paypal account. No reference anywhere to my job or employer. A couple of weeks later I receive a call from India on the mobile number provided to Dell, from a guy pretending to be from Dell (and he might have been) who wanted to discuss how he could do business with my employer which he mentioned by name (a large corporation). At that time I thought that Dell's commercials were unacceptably pushy, googling their private clients to find a way in their employer. It didn't occur to me that this might have been a scam using Dell's database.

deleted 11y ago
[deleted]
nthitz 11y ago
Axciom, Epsilon and similar companies track your credit card purchases and correlate them with a profile of who they think you are. If you work for a large corporation that is probably easier to identify than a small one. http://www.acxiom.com/ http://www.acxiom.com/ http://www.epsilon.com/ http://www.epsilon.com/
- samstave 11y ago
  These companies need to burn to the fucking ground.
- imbellish 11y ago
  It's the isolating arm of capitalism drilling its elbow grease directly into your personal life.
  - beedogs 11y ago
    We can't be too far off from a China-style 'citizen credit rating' kind of system.
    - rms_returns 11y ago
      It already happens unofficially. How do you think banks assess your lending/borrowing habits when you apply for a loan? There are detective agencies who track credit cards and other things (like a few examples someone gave in this very thread).
      - pdkl95 11y ago
        There is a huge difference between a "private" rating system and a public rating that uses your friends against you as manipulation. See Extra Credit's description[1] of how this works. We aren't there yet, but consider that Facebook wants to use your social network associations in your credit score[2]. [1] https://www.youtube.com/watch?v=lHcTKWiZ8sI https://www.youtube.com/watch?v=lHcTKWiZ8sI [2] http://www.theatlantic.com/technology/archive/2015/09/facebooks-new-patent-and-digital-redlining/407287/ http://www.theatlantic.com/technology/archive/2015/09/facebo...
        krick 11y ago
        Jesus. If that first video is true, then that's what should be top-upvoted submission on HN. Why isn't it better known? I mean, at least I personally never heard about it and I might be not the most informed person on the Internet, but certainly I'm not the least. And this is much more important thing to know than… well, everything I usually hear on the news. I don't get often surprised by all that dystopian stuff, because I assume we already are quite fucked, but this one did surprise me. That's just crazy.
- cm2187 11y ago
  But in my defense I have a very common name, in fact the same name of a major politician. The email address I provided Dell was a single use disposable email address. So I have no idea of how they managed to correlate me to my employer.
- pbhjpbhj 11y ago
  It would surely be really easy if you purchase things at a company shop or cafeteria? But the banks already know where your paycheck comes from ...
- dcposch 11y ago
  I assumed that when I buy something on a card, it's more or less private. The transaction should be known only to: me, the merchant, our respective banks, Visa, and I guess the IRS if they come and ask for it. If I understand correctly, youre saying my entire purchase history is shared with random third party marketing companies. Full transaction data, PII included, no anonymization. How is that even remotely OK?
  - sbarre 11y ago
    That is correct. Banks and credit card companies merchandise this information to their partners, which leads to this kind of thing. Check your cards' terms of services if you want to be somewhat horrified.
    - branchless 11y ago
      Banks are disgusting. They get a cut already from the purchase which ought to be more than enough to deliver this and make a profit. But no it's not enough. I don't use facebook but do use a credit card. Hard to opt out of that in the modern world. God these people are filth.
      - krick 11y ago
        Well, I don't know how hard is it in the USA, but I use cash most of the time and know several people who do the same. Sure, sometimes you need to make wire transfer, or pay with credit card, or paypal for that matter. But at least shopping in the supermarket is possible with cash.
        wuschel 11y ago
        Then I do hope that you do not own a cashback etc bonus card, or your can be quite sure that your personal consumption related high resolution data will end up in some buyers pocket. And all that for a cheaper (and cheap) bread-knife.
        11y ago
yock 11y ago
I recently experienced this with a software vendor after trialing some of their software. It's one of those forms where you have to enter some personal info before downloading the installer, and while I provided them with my email address I deliberately dodged entering my employer information. Imagine my surprise when I get a phone call from them at work asking how that software was working out for me. To be fair, I hated the software and wasn't going to buy it. That phone call certainly didn't nudge me in their direction though.
nfoz 11y ago
I ordered a laptop from Dell, providing no information about my small employer. I ordered it from my own laptop but it was on my work's WiFi when I ordered it. They called to confirm some BS about the order, and mentioned my employer's name. I was pretty stunned. I'm thinking they correlate IP address of your purchase on Dell.com with employer, I've heard such databases are available, but it's pretty surprising to me... not sure what else they do, except yeah, maybe googling their customers.

acomjean 11y ago

Am I the only one thinking that we've lost total control over the machines and data we've created. It seems like nothing is safe and or verifiable anymore. Add to this the backdrop of governments wanting backdoors. People calling you in the US pretending to be from the "IRS" and yet nothing is/ can be done about it? Maybe its really high time for C and its buffer overflows to go... And SQL injection. We're tech savy here, yet sometime even we fall for these things. Its starting to get actually expensive. I hate to be all conspiracy theory about this, but if/when the banks fall down like this....

marklgr 11y ago
From one of the comments in the article, it's probably more like we've lost control of how businesses work. Many people don't like the phrase "race to the bottom", but that's what comes to mind when you get to see how personal data is handled to third parties and/or cheap, expendable workforce.
- keithpeter 11y ago
  At that point, one would expect to see increasing regulation kick in. It did historically for other kinds of service, e.g. financial services, insurance, public transport &c.
such_a_casual 11y ago
While I know very little about 'computer security', I have never been under the impression that Dell is aware such a term exists. "another dangerous dell root cert dicovered" http://www.pcworld.com/article/3008478/security/and-then-there-were-two-another-dangerous-dell-root-certificate-discovered.html http://www.pcworld.com/article/3008478/security/and-then-the... "dell attacks on scada doubled" http://securityaffairs.co/wordpress/35967/hacking/dell-attacks-on-scada-doubled.html http://securityaffairs.co/wordpress/35967/hacking/dell-attac... "in what some experts are calling the biggest data theft in US history." http://www.abc.net.au/news/stories/2011/04/07/3185296.htm http://www.abc.net.au/news/stories/2011/04/07/3185296.htm
bonestamp2 11y ago

ossreality 11y ago

Yeah, I'll bet every penny I own that the author sucks at InfoSec compared to what they think. I'm just shocked that this has never affected me, as a Linux user, on my number of Dell devices.

roflaway 11y ago

Throwaway account because I just shared this story with a buddy of mine: I, too, have received these "Dell" tech support calls and angrily yell at them as I hang up within 15seconds. Lately though, I received a bombardment of calls (15 to be exact) in the past 3 days from the same number. I answered the one of them, and it had the same 1minute 10s message saying to call the number back regarding a computer threat they found on my computer (the voicemails are all 1min 10s). These calls woke my kids and I up every..damn..day. The calls kept coming on my work and personal line. Without dialing back the number, I'll never know how this crap even started. I feel bad for others out there who may actually fall for these kind of tactics

such_a_casual 11y ago
If you do decide to call back, make sure you check the number online first. There are some phone scams that involve getting people to call back pay-to-talk (I don't know what the proper term is) numbers.
- kileywm 11y ago
  You're probably thinking of Premium-rate telephone numbers. https://en.wikipedia.org/wiki/Premium-rate_telephone_number https://en.wikipedia.org/wiki/Premium-rate_telephone_number
Natsu 11y ago
I prefer not to hang up right away. Instead, I try to waste a bit of their time. For automated calls, I just put down the phone and wait a while to hang up. But for people? I try other means of time wasting, so they can't call someone else to scam them. Last time they called, I told them that it was good that they called, because my computer had detected a virus on their computer and that I wanted them to download an install malware.exe to remove it. Next time they claim to call from Microsoft, I think I'll tell them I'm glad they've called, because I really need to speak to Bill Gates. Or if he's not available, Steve Ballmer. I guess Bill might not answer his own phone any more, but I have to admit that I wonder what Bill does if he gets a call from them? Maybe next time I should say that I'm Bill Gates and they're all fired? At least this is more amusing than simply hanging up in disgust. And it helps slow down the rate at which they scam new people, even more so the more people who do this.

stevebmark 11y ago

Sincerely, thank you for reporting this and helping bring it to the spotlight. It's too easy for things like this to fall under the radar of any major acknowledgement, letting corporations get away with major scandals without any accountability.

et1337 11y ago

Has Dell made any sort of announcement about this? Getting hacked is one thing. Failure to promptly notify the public is another.

josh_carterPDX 11y ago

Time to take my Optima 8200 offline. Sigh.

ommunist 11y ago

I'd rather bet that real Dell outsourced tech support to some company in India, where very often business ethics towards customer records is virtually non-existent. But what else can you expect? If you are not paying decent money, be prepared that your data woll be sold, unless you are ReallY able to enforce control over it. I seriously doubt that Dell tech support is ISO 27000 compliant.

ketralnis 11y ago
What do I expect? I expect the people that I send sensitive data to to be able to protect it. Blaming their overseas offices and partners doesn't make it better or relieve them of responsibility. And Dell isn't some too-cheap-to-be-true, fly-by-night operation. Saying that their customers were basically asking for it is bollocks as well.
- jodrellblank 11y ago
  What do I expect? I expect the people that I send sensitive data to to be able to protect it. Desire, maybe, but expect? That's so far from reality are there any grounds for expecting that these days? Has any company successfully kept /all/ sensitive data from hackers?
tzs 11y ago
> If you are not paying decent money, be prepared that your data woll be sold, unless you are ReallY able to enforce control over it From what I can see from a bit of Googling, Dell does pay their tech support people decent money. If Glassdoor is to be believed [1] [2], Dell tech support people in India make about 340k rupees a year, or about 28k per month. That appears to be a middle class income for an Indian city dweller [3] [4]. [1] https://www.glassdoor.com/Salary/Dell-Technical-Support-Associate-India-Salaries-EJI_IE1327.0,4_KO5,32_IL.33,38_IN115.htm https://www.glassdoor.com/Salary/Dell-Technical-Support-Asso... [2] If the above link does not work without you being logged into a Glassdoor account, try Googling for "how much does dell pay tech support people in india" and clicking the Glassdoor result. [3] http://qr.ae/RgYML2 http://qr.ae/RgYML2 [4] http://www.pewresearch.org/fact-tank/2015/07/16/are-you-in-the-global-middle-class-find-out-with-our-income-calculator/ http://www.pewresearch.org/fact-tank/2015/07/16/are-you-in-t...

z3t4 11y ago

I don't know about you, but where I live (Sweden) there are strict rules on how you can store personal data and who has access to it. It's also against the law to put people in "databases". I guess we still remember WW2 and how the Nazi used such registers ...

27182818284 11y ago
There are rules in the United States too, but a lot of places get it wrong. There is HIPPA, FERPA, PII, etc. More often than not a company thinks they're compliant but then after a break-in is found to be lacking something big like hashing passwords.
ZanyProgrammer 11y ago
Wasn't Sweden a lukewarm half assed ally of Germany in World War 2, at least for the first few years?
greggyb 11y ago
> It's also against the law to put people in "databases". I find this very hard to believe. At face value I interpret this as saying that no company doing business in Sweden has any sort of customer database. Is this correct? What about a CRM system?
- z3t4 11y ago
  You need the customer's consent. So if they opt-in it's alright in most cases. But you can only store their personal data if you absolutely need to, and in a secure way. For example only store post address if you intend to send them snail male. You can for example only have someone in your CRM if they are a customer. And if they ask you to remove their data, you must remove all information about them. You do not have to worry if your company and all your equipment is located outside Sweden though. But as for example Facebook have a data-center in Sweden, you can actually request them to remove all your data. Example of illegal database is a database for direct marketing. Or a register of race, religion or preferences.

dogma1138 11y ago

I actually wonder if Dell was hacked or this is some 3rd party info sharing that got leaked the old fashion way. The problem with these types of cold call scams is that they do not scale, it seems a bit odd that a group could target a company the the likes of Dell would resort to such tactics (And yes I am fully aware that they could've breached Dell and sold the data but then I'm not sure that phone scammers would be in their price range). My bet would be on a 3rd party losing some data or getting hit, or even just employees doing it the really old fashion way print out couple of 1000's of profiles and go to work your operation most likely wont scale much beyond that anyhow. But in general allot of that info could've been fished even the Dell support tag. Dell's own support website has an auto detect feature that scans for it on your machine it supports .NET HTTP distro app, ActiveX and a few other plugin methods and if you have the Dell Support bloat ware installed I think even JavaScript could potentially work. (Don't remember if Dell was affected but over the years multiple laptop vendors were found to leak support info over LAN/Ethernet as they run various services both during boot and later through the bloatware they ship the machines with) If you have the support tag you usually can access old tickets opened on that tag either online or by social engineering their support team (With IBM support in the UK if you have the S/N you'll see all past tickets in their system) the rest of the data like name and phone numbers can be found out quite easily. So if you want to scam people by pretending to be Dell support you should be able to do it without actually needing access to their customer DB.

geocar 11y ago

It doesn't sound like Dell has been very effective here: likely attackers downloaded the database raw or it's one of their many contractors who log in remotely. Last time I saw that interface it was a web form that someone could access from any machine! This is serious. If you have customer data, you need to log access to that data, and you need to audit access to that data, and (very important!) you need to have a zero-tolerance policy. This isn't trivial to set up, but it's necessary; The CTO is responsible here, not some "website hackers".

rms_returns 11y ago
Second this. In fact, I would rather argue that its better to stop forcing online registration of computers until the privacy of those who register is guaranteed. Its not as if registration is even needed, they already have a tag attached to each device, so they can track sales using that. On the other hand, this problem is not specific to only Dell. Take the online web-forms of any other major Tech seller like Asus, Samsung, Motorola or HTC and their website sucks. Almost every one of them looks poorly designed and unprofessional which is more worrying.
- geocar 11y ago
  It's not just tracking sales though, it's CRM, so every time they speak to someone about replacement/warrantee they need to know who they spoke to and audit frequent complaints either as abuse or something systemic that needs to be chased with a supplier. I know why Dell needs to do this, but the C-suite is responsible for dieselgate and this kind of thing needs to be developed smartly, with taste, and with a consideration about what can fail (and how bad it can get). Bread and butter: Encrypt everything, long audit trail; Sysadmins don't need to read the databases (and can log need for keys), engineering doesn't need to read personal data, helpdesk don't need to log into servers, and no service needs unauthenticated and unlogged read (even internally; e.g. for automated reporting); Get audited by someone competent. I handled 1bn daily records with 100% uptime, and max 6hr delay reporting using a single server, so there is no excuse except an incompetent CTO.
dogma1138 11y ago

joshchaney 11y ago

The title should really be changed, there is no confirmation they were hacked. I have an equally plausible theory -- You used the same username and password somewhere else that got hacked, or your credentials were stolen through some infostealing malware. Account takeover is a huge problem these days, it wouldn't surprise me if there is a tool out there written specifically to validate combo lists against Dell's website.

Bhullnatik 11y ago
He mentions using two-step verification though. That doesn't mean it's not possible, but that makes a lot harder to get into his account.
- joshchaney 11y ago
  He said his email account has 2FA (convincing us his email was not hacked), I don't think he meant his account on Dell.

biot 11y ago

Years ago at work, I noticed Dell's emails had an unsubscribe link that went to a "manage account" kind of interface. The idea was you enter your email address, go to some kind of "Manage Subscriptions" page, and you could opt out. Unfortunately, you could also see a bunch of Personally Identifiable Information including your first and last names, possibly your mailing address, and other information. I reported this to Dell and got back a very dismissive, abrasive email saying something to the effect of "Well how else are we going to let people unsubscribe?", claiming that they had no other legal option. I just changed all my info to junk and left it at that; eventually they closed that hole, but it wouldn't surprise me if some site exists that still allows people to harvest anybody's information from Dell using nothing but their email address.

Already__Taken 11y ago

Back in February of 2013 I bought an XPS 13" convertible (nice btw, shocked it doesn't ship with Pro) and whilst it was on the way I got 2 very convincing looking shipping tracking scam emails that ask to run some executable and enter some details. They had the correct model of laptop and very specific timing. I've never had any other spam like in before it since. Sadly gmail has removed the spam from so long ago and the initial Dell contact email must have been sent from a form as I only have the service desk reply with my correct shipping number to track myself. This might be even more serious than it looks.

txutxu 11y ago

14:43 UTC+1, site not loading, DNS error (domain not resolved). It seems DNS this was hosted on godaddy, but can't see the content now. It was pointing to shared hosting on dreamhost. The domain will expire in August, so that is not the problem. The domain is in status clientUpdateProhibited, clientTransferProhibited, clientRenewProhibited, clientDeleteProhibited... the whois has been updated today. Maybe this site was put down?

kenbellows 11y ago
Looks up to me, 08:55 UTC-5. If it's still not working for you try the archive: https://web.archive.org/web/20160105091436/http://www.10zenmonkeys.com/2016/01/04/dell-computers-has-been-hacked/ https://web.archive.org/web/20160105091436/http://www.10zenm...
- txutxu 11y ago
  Still does not resolve here... maybe the problem is just in my network. I can see it now using translate.google.com as a proxy and it works. Thanks !!

davismwfl 11y ago

I posted about this about 7 months ago on HN, https://news.ycombinator.com/item?id=9881674 https://news.ycombinator.com/item?id=9881674, I also tweeted it out. Dell responded to my tweet saying there has been no breach and our data was secure. Obviously I didn't and don't believe them, and their main response was report it to the FTC. That is crap, admit it, fix it and deal with the issue. What totally pissed me off is that it was my sons laptop they called on and they called him directly since his number was listed when he called in for real Dell support about 3 months prior to the scam call. They had convinced him they were Dell until I walked into his room and heard 30 seconds of the call and asked why he called them, soon as he said he didn't I told him to hang up. They were persistent, calling him back many times over the next 2 months. I had to block the number to finally get it to stop and my son says he got a new call just a few weeks ago, new number same scam but at least he is smarter about it now.

prplhaz4 11y ago
I had the same problem last April, and had a surprisingly difficult time finding any more info about it. All Dell forum threads say that they know nothing about it and refer you to the FTC site. The really disturbing part was they used my mobile number, which had been spam-free until the Dell issue. I posted about my experience here, with the hopes that others in my cohort would benefit from it, but the thread is still quiet: http://forum.notebookreview.com/threads/scam-calls-from-dell-reps.773149/#post-9988974 http://forum.notebookreview.com/threads/scam-calls-from-dell... Summary of my battle: Keept them on the phone as long as possible, asked stupid questions, and tried to piss them off as much as humanly possible - I managed to get a "find a pen, remove the cap and stick it up your ass" after 2 hours on the phone with them. I kept them on the phone while my 4mb download took 45mins.
- davismwfl 11y ago
  Just read your description, it is nearly identical to what they were trying to get my son to do. They wanted remote access and telling him that his computer was attacking other people and their "monitoring" caught it. Really was an elaborate explanation when I heard it, but so insane to anyone that knows how this all works. But to a 17 yr old it seemed reasonable, even plausible especially with the quick talking, pushy nature of these guys. That was until I got my son to stop and think about it for a minute, then he saw the stupidity in what they were saying. It was a great lesson for him, and while I had sworn off Dell quite a long time ago, this made him now say no thanks to Dell. His new laptop is a Toshiba, not that they or any company is immune, but the fact Dell won't even publicly address it and help to protect their customers to me is really the sign of a bad corporation. He even convinced 3 of the kids in his high school that were buying new laptops to avoid Dell, so hopefully people keep spreading the word and it starts affecting Dell in the only place they will apparently listen.

revscat 11y ago

I'm not seeing any direct evidence of a hack. It seems just as likely that Dell could have simply sold customer data to interested parties.

fabulist 11y ago
Superphish showed us that Dell is clearly willing to do something of that nature, but the data the hackers are alleged to possess (shared secrets, support histories, ...) isn't the kind of thing you'd sell. There is no proof, but there the author certainly presents plenty of evidence. Unless you have access to information outside this article, the most likely hypothesis is that their database was compromised.

mmaunder 11y ago

Suggestion: if you are affected by this, get your attorney to reach out to Dell and get a response on record. You might be surprised. Their legal team will understand the risks of sweeping under the carpet or denying something they know about.

mergy 11y ago

Same here back in mid-2015. We got a call from scammers with valid service ids of some of our equipment from Dell. I hope Dell comes clean on all of this.

ferongr 11y ago

It's been some time (10 years or so) since I've last bought a prepackaged computer (I build my desktops from parts) but do you really have to register your personal information with the manufacturer when you buy a prebuilt computer? Why would there be a need to do that anyway, wouldn't the serial number of the machine be enough for warranty purposes?

discreditable 11y ago
You technically don't have to, but the Out of Box Experience pushes you towards it.
nandhp 11y ago
Well, generally speaking, if you order a computer online (as most people probably do) you give them your name, address, and phone number so they can ship it to you.
- ferongr 11y ago
  Thanks for pointing that out. Here in Greece (and most of Europe AFAIK) manufacturers don't sell directly to consumers, hence my confusion.

victorantos 11y ago

it's blocked for me, I get We've blocked this page O2 Wifi takes public wifi seriousl..

hackuser 11y ago

Something doesn't make sense: How can it be worthwhile for the attackers to invest that much time in gaining access to one computer? Given wrong numbers and that many people won't answer the phone, be near the computer, have time at that moment, or be willing to cooperate, and then add the time it takes to talk an end user through such a process, will they gain access to even one computer every 2 hours? How can that pay off? There are many, many more efficient attacks. How about good old-fashioned spam?

spoondan 11y ago
The purpose of the scam is not to gain access to computers. The purpose of the scam is to fleece unsuspecting Dell customers. The scammers gain the trust of their victim by using misappropriated Dell customer data. They charge exorbitant fees for unnecessary services to the less technically competent. My assumption is that the scammers are based in India or somewhere else where dollars go quite a bit farther than the US. Even apart from the potential for fraudulent charges, spending a few days to earn a few hundred dollars is definitely worth it in a country where the average income for a year is around $1300.

FredWills 11y ago

This is just so appalling! Hackers are just so dangerous! I find it add to trust the works of any other hacker aside my personal hacker,Andy Stover! He is the best hacker i currently know...you can get hold of him via (913) 583-0019 JUST INQUIRE!