4 ms·

I posted about this about 7 months ago on HN, https://news.ycombinator.com/item?id=9881674 https://news.ycombinator.com/item?id=9881674, I also tweeted it out.

I posted about this about 7 months ago on HN, https://news.ycombinator.com/item?id=9881674 https://news.ycombinator.com/item?id=9881674, I also tweeted it out. Dell responded to my tweet saying there has been no breach and our data was secure. Obviously I didn't and don't believe them, and their main response was report it to the FTC. That is crap, admit it, fix it and deal with the issue. What totally pissed me off is that it was my sons laptop they called on and they called him directly since his number was listed when he called in for real Dell support about 3 months prior to the scam call. They had convinced him they were Dell until I walked into his room and heard 30 seconds of the call and asked why he called them, soon as he said he didn't I told him to hang up. They were persistent, calling him back many times over the next 2 months. I had to block the number to finally get it to stop and my son says he got a new call just a few weeks ago, new number same scam but at least he is smarter about it now.

prplhaz4 11y ago
I had the same problem last April, and had a surprisingly difficult time finding any more info about it. All Dell forum threads say that they know nothing about it and refer you to the FTC site. The really disturbing part was they used my mobile number, which had been spam-free until the Dell issue. I posted about my experience here, with the hopes that others in my cohort would benefit from it, but the thread is still quiet: http://forum.notebookreview.com/threads/scam-calls-from-dell-reps.773149/#post-9988974 http://forum.notebookreview.com/threads/scam-calls-from-dell... Summary of my battle: Keept them on the phone as long as possible, asked stupid questions, and tried to piss them off as much as humanly possible - I managed to get a "find a pen, remove the cap and stick it up your ass" after 2 hours on the phone with them. I kept them on the phone while my 4mb download took 45mins.
- davismwfl 11y ago
  Just read your description, it is nearly identical to what they were trying to get my son to do. They wanted remote access and telling him that his computer was attacking other people and their "monitoring" caught it. Really was an elaborate explanation when I heard it, but so insane to anyone that knows how this all works. But to a 17 yr old it seemed reasonable, even plausible especially with the quick talking, pushy nature of these guys. That was until I got my son to stop and think about it for a minute, then he saw the stupidity in what they were saying. It was a great lesson for him, and while I had sworn off Dell quite a long time ago, this made him now say no thanks to Dell. His new laptop is a Toshiba, not that they or any company is immune, but the fact Dell won't even publicly address it and help to protect their customers to me is really the sign of a bad corporation. He even convinced 3 of the kids in his high school that were buying new laptops to avoid Dell, so hopefully people keep spreading the word and it starts affecting Dell in the only place they will apparently listen.
  - prplhaz4 11y ago
    It's good that you managed to intervene - I know a lot of Dell owners that are not well equipped to handle these sorts of calls. Hopefully the worst that comes of it is a small fee. At least it is good to see word getting out - that is likely the first step to any reasonable resolution.
drzaiusapelord 11y ago
I've accepted that we live in an age where no one can secure data that is coveted by determined attackers. Even companies with the best infosec are often taken down by the simplest social engineering or clumsy spear-phisihng attempts that work well enough. I hope this changes as we migrate away from passwords and passphrases to mandatory two factor login with physical keyfob tokens, from C to Rust, and from putting things directly onto the internet to putting everything behind a IPS/IDS that updates itself via signatures, honepots, etc. Especially in the home where no one runs IPS, the same way early consumer OS's didn't bother to ship with firewalls. Phones need something like this too, especially with blocking known spammer numbers/providers. Everyday I get an Indian call center impersonating either state farm or blue cross. I have no way to stop this as they randomize the phone number each time, often in mocking ways like starting with a movie 555 prefix or having a prefix starting with 1. I also don't want a relationship with companies like Dell where they store all my info. Why can't I buy something via a private OpenID/Persona-like system that has a tokenized version of my credit card and Dell just ships the product? I must have hundreds of accounts spread out with various sites, vendors, etc. Each of them ripe for the taking by scammers and hackers with my real name, stored card, etc. I hope this stuff is what breaks the camel's back. IT security right now is a nightmare. I suspect it will get much worse before it gets better. Cryptolocker didn't suddenly fix corporate IT security. From what I can tell, its just as bad as its ever been.
- prplhaz4 11y ago
  Because retailers figured out a while ago that having a personal relationship with their customers (knowing everything about them) is EXTREMELY valuable. Think of the merchant wars with MC/Visa/ApplePay...etc as well as how much they sink into loyalty programs. Knowing your customer pays off in spades (until you have a security breach and get sued into oblivion). Would be nice to be able to opt-in to a "forget everything you know about me" program - Newegg would probably get tons of business from paranoid nerds with an option like that in place.
  - chris_wot 11y ago
    I have to warn you that you just triggered a liars paradox.
EGreg 11y ago
Guess the PCI Compliance thing works at least. Otherwise why do they need to ask his credit card authorization?

prplhaz4 11y ago

I had the same problem last April, and had a surprisingly difficult time finding any more info about it. All Dell forum threads say that they know nothing about it and refer you to the FTC site. The really disturbing part was they used my mobile number, which had been spam-free until the Dell issue. I posted about my experience here, with the hopes that others in my cohort would benefit from it, but the thread is still quiet: http://forum.notebookreview.com/threads/scam-calls-from-dell-reps.773149/#post-9988974 http://forum.notebookreview.com/threads/scam-calls-from-dell... Summary of my battle: Keept them on the phone as long as possible, asked stupid questions, and tried to piss them off as much as humanly possible - I managed to get a "find a pen, remove the cap and stick it up your ass" after 2 hours on the phone with them. I kept them on the phone while my 4mb download took 45mins.

davismwfl 11y ago
Just read your description, it is nearly identical to what they were trying to get my son to do. They wanted remote access and telling him that his computer was attacking other people and their "monitoring" caught it. Really was an elaborate explanation when I heard it, but so insane to anyone that knows how this all works. But to a 17 yr old it seemed reasonable, even plausible especially with the quick talking, pushy nature of these guys. That was until I got my son to stop and think about it for a minute, then he saw the stupidity in what they were saying. It was a great lesson for him, and while I had sworn off Dell quite a long time ago, this made him now say no thanks to Dell. His new laptop is a Toshiba, not that they or any company is immune, but the fact Dell won't even publicly address it and help to protect their customers to me is really the sign of a bad corporation. He even convinced 3 of the kids in his high school that were buying new laptops to avoid Dell, so hopefully people keep spreading the word and it starts affecting Dell in the only place they will apparently listen.
- prplhaz4 11y ago
  It's good that you managed to intervene - I know a lot of Dell owners that are not well equipped to handle these sorts of calls. Hopefully the worst that comes of it is a small fee. At least it is good to see word getting out - that is likely the first step to any reasonable resolution.

drzaiusapelord 11y ago

I've accepted that we live in an age where no one can secure data that is coveted by determined attackers. Even companies with the best infosec are often taken down by the simplest social engineering or clumsy spear-phisihng attempts that work well enough. I hope this changes as we migrate away from passwords and passphrases to mandatory two factor login with physical keyfob tokens, from C to Rust, and from putting things directly onto the internet to putting everything behind a IPS/IDS that updates itself via signatures, honepots, etc. Especially in the home where no one runs IPS, the same way early consumer OS's didn't bother to ship with firewalls. Phones need something like this too, especially with blocking known spammer numbers/providers. Everyday I get an Indian call center impersonating either state farm or blue cross. I have no way to stop this as they randomize the phone number each time, often in mocking ways like starting with a movie 555 prefix or having a prefix starting with 1. I also don't want a relationship with companies like Dell where they store all my info. Why can't I buy something via a private OpenID/Persona-like system that has a tokenized version of my credit card and Dell just ships the product? I must have hundreds of accounts spread out with various sites, vendors, etc. Each of them ripe for the taking by scammers and hackers with my real name, stored card, etc. I hope this stuff is what breaks the camel's back. IT security right now is a nightmare. I suspect it will get much worse before it gets better. Cryptolocker didn't suddenly fix corporate IT security. From what I can tell, its just as bad as its ever been.

prplhaz4 11y ago
Because retailers figured out a while ago that having a personal relationship with their customers (knowing everything about them) is EXTREMELY valuable. Think of the merchant wars with MC/Visa/ApplePay...etc as well as how much they sink into loyalty programs. Knowing your customer pays off in spades (until you have a security breach and get sued into oblivion). Would be nice to be able to opt-in to a "forget everything you know about me" program - Newegg would probably get tons of business from paranoid nerds with an option like that in place.
- chris_wot 11y ago
  I have to warn you that you just triggered a liars paradox.

EGreg 11y ago

Guess the PCI Compliance thing works at least. Otherwise why do they need to ask his credit card authorization?