4 ms·

How is this thing intercepting all his Facebook and bank traffic?

ghaff 8y ago
I don't think it is. Here's another thread which may be for the same thing or something similar. https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyouraccountdotcom/?st=jmilt3ow&sh=592d9a78 https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour... It's apparently a "rent a Facebook account" scam. (The roommate apparently also provided his Facebook credentials.)
- tedunangst 8y ago
  That is 10x more informative.
  - astronautjones 8y ago
    It's also three (!) years old, which is crazy to think someone has been mailing these out and running the same scam on FB without getting caught, particularly from 2016 on, with the scrutiny placed on FB's illegitimate political ads
    - SmellyGeekBoy 8y ago
      Surely it would be fairly easy for FB to fingerprint the "browser" running on these device and see that it isn't a regular user? At the very least get them to jump through some hoops or enter a CAPTCHA or something?
- tgsovlerkhgsel 8y ago
  I expected click fraud, but if the description is accurate (and I don't have much of a reason to believe it isn't, since it describes pretty shady activity if you read between the lines), they're using the accounts to post shady ads that Facebook doesn't allow (and bans accounts for) until the account gets banned. Also, the participant is supposed to get paid after they send the Raspberry Pi back after the account got banned, i.e. once the user has absolutely zero value for the scammer... I don't see why the scammer would pay... (although it may be chump change compared to the money they make from getting a percentage of the ad spend, so maybe it's worth paying that to get a better reputation).
- mortenjorck 8y ago
  Ok, so it looks from that like the Pi is there to act as a VPN endpoint of sorts to allow the operators to use the recruit’s Facebook account undetected by FB’s geolocation security. From which it would appear they then run some sort of high-volume affiliate marketing scam.
Filligree 8y ago
It probably isn't. But if it is, the most likely way would be by using ARP spoofing. Of course, that in itself doesn't let you bypass TLS.
ummonk 8y ago
Yeah, I don't get how this is going to intercept traffic to any website that is HSTS-protected.

I don't think it is. Here's another thread which may be for the same thing or something similar. https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyouraccountdotcom/?st=jmilt3ow&sh=592d9a78 https://www.reddit.com/r/Scams/comments/2vd1g8/scam_rentyour... It's apparently a "rent a Facebook account" scam. (The roommate apparently also provided his Facebook credentials.)

tedunangst 8y ago
That is 10x more informative.
- astronautjones 8y ago
  It's also three (!) years old, which is crazy to think someone has been mailing these out and running the same scam on FB without getting caught, particularly from 2016 on, with the scrutiny placed on FB's illegitimate political ads
  - SmellyGeekBoy 8y ago
    Surely it would be fairly easy for FB to fingerprint the "browser" running on these device and see that it isn't a regular user? At the very least get them to jump through some hoops or enter a CAPTCHA or something?
tgsovlerkhgsel 8y ago
I expected click fraud, but if the description is accurate (and I don't have much of a reason to believe it isn't, since it describes pretty shady activity if you read between the lines), they're using the accounts to post shady ads that Facebook doesn't allow (and bans accounts for) until the account gets banned. Also, the participant is supposed to get paid after they send the Raspberry Pi back after the account got banned, i.e. once the user has absolutely zero value for the scammer... I don't see why the scammer would pay... (although it may be chump change compared to the money they make from getting a percentage of the ad spend, so maybe it's worth paying that to get a better reputation).
mortenjorck 8y ago
Ok, so it looks from that like the Pi is there to act as a VPN endpoint of sorts to allow the operators to use the recruit’s Facebook account undetected by FB’s geolocation security. From which it would appear they then run some sort of high-volume affiliate marketing scam.

Filligree 8y ago

It probably isn't. But if it is, the most likely way would be by using ARP spoofing. Of course, that in itself doesn't let you bypass TLS.

ummonk 8y ago

Yeah, I don't get how this is going to intercept traffic to any website that is HSTS-protected.