5 ms·

Wow. I expected that it would install a keylogger or something, but this is so low tech that I'm both impressed and disappointed. Impressed because it's (a) so

Wow. I expected that it would install a keylogger or something, but this is so low tech that I'm both impressed and disappointed. Impressed because it's (a) so elaborate for what it is, (b) it's cheaper than procuring an actual virus, and (c) it is supported by existing scam infrastructure. Disappointed because I expected some exciting new attack vector.

iforgotpassword 4y ago
Yeah like, I see that it's cheap to run those scam ads on fishy websites and just wait until someone is tricked into calling, or run a robocaller and wait until someone presses 1. But having all this designed, ordered, packaged and shipped, just so maybe the receiver calls seems way too much effort. How does this scale? I'd see this make sense for targeted attacks, but like this? Wow.
- sigmoid10 4y ago
  I don't really see the design or packaging as an issue, after all that can be done for cents apiece in high volume productions. But the USB drives are definitely interesting. Even when ordered in large batches from cheap chinese manufacturers, they will probably cost a dollar per drive. So if you send that to 10k people, you have to expect a very high payout. The approach is certainly more effective than a spam mail, but then again sending an email costs several orders of magnitude less. So I wonder if this is really orders of magnitude more likely to capture people. Perhaps with strong pre-selection.
  - surfpel 4y ago
    $1 per drive for how much storage? I’m sure these don’t even need a single Gig. Probably could get lots of super cheap ones during liquidation events or salvage operations and what not.
    - sigmoid10 4y ago
      I just looked it up: Even if you accept less than 1 GB you'll have a hard time finding drives below $3. The USB controller chip alone is about $1 and you need some actual storage and a casing as well. Even if you're really proficient at acquisition and manage to get them for 10% of that price, it's still orders of magnitude more expensive than email based spam.
      - surfpel 4y ago
        > ...USB controller chip alone is about $1... That's for official parts and at lower quantities I presume. Knock off chips are often pennies, especially at scale. When I buy chips for side projects, I often just source them from ebay/alibaba where you can get them for ridiculously cheap prices. [1][2] > ...it's still orders of magnitude more expensive than email based spam. Relative to how much they drain from elderly folks retirement accounts, I think it's a logical investment for them given that existing scammer tactics are being made obsolete. In any case, I just checked Alibaba and found several listings [3][4] that claim ≤50¢ at scale. They look rather professional and you could even brand a logo on them. 1 - https://www.ebay.com/itm/392526892417 https://www.ebay.com/itm/392526892417 (USB - Serial converter, NOT a USB drive IC) 2 - https://www.ebay.com/itm/392540419491 https://www.ebay.com/itm/392540419491 (power bank chip) 3 - https://www.alibaba.com/product-detail/Usb-Drive-Usb-Drive-Low-Price_62014581781.html https://www.alibaba.com/product-detail/Usb-Drive-Usb-Drive-L... 4 - https://www.alibaba.com/product-detail/Cheap-customized-Logo-Usb-Stick-2_1600384094970.html https://www.alibaba.com/product-detail/Cheap-customized-Logo...
        sigmoid10 4y ago
        Half a dollar is still orders of magnitude more expensive.

iforgotpassword 4y ago

Yeah like, I see that it's cheap to run those scam ads on fishy websites and just wait until someone is tricked into calling, or run a robocaller and wait until someone presses 1. But having all this designed, ordered, packaged and shipped, just so maybe the receiver calls seems way too much effort. How does this scale? I'd see this make sense for targeted attacks, but like this? Wow.

sigmoid10 4y ago
I don't really see the design or packaging as an issue, after all that can be done for cents apiece in high volume productions. But the USB drives are definitely interesting. Even when ordered in large batches from cheap chinese manufacturers, they will probably cost a dollar per drive. So if you send that to 10k people, you have to expect a very high payout. The approach is certainly more effective than a spam mail, but then again sending an email costs several orders of magnitude less. So I wonder if this is really orders of magnitude more likely to capture people. Perhaps with strong pre-selection.
- surfpel 4y ago
  $1 per drive for how much storage? I’m sure these don’t even need a single Gig. Probably could get lots of super cheap ones during liquidation events or salvage operations and what not.
  - sigmoid10 4y ago
    I just looked it up: Even if you accept less than 1 GB you'll have a hard time finding drives below $3. The USB controller chip alone is about $1 and you need some actual storage and a casing as well. Even if you're really proficient at acquisition and manage to get them for 10% of that price, it's still orders of magnitude more expensive than email based spam.
    - surfpel 4y ago
      > ...USB controller chip alone is about $1... That's for official parts and at lower quantities I presume. Knock off chips are often pennies, especially at scale. When I buy chips for side projects, I often just source them from ebay/alibaba where you can get them for ridiculously cheap prices. [1][2] > ...it's still orders of magnitude more expensive than email based spam. Relative to how much they drain from elderly folks retirement accounts, I think it's a logical investment for them given that existing scammer tactics are being made obsolete. In any case, I just checked Alibaba and found several listings [3][4] that claim ≤50¢ at scale. They look rather professional and you could even brand a logo on them. 1 - https://www.ebay.com/itm/392526892417 https://www.ebay.com/itm/392526892417 (USB - Serial converter, NOT a USB drive IC) 2 - https://www.ebay.com/itm/392540419491 https://www.ebay.com/itm/392540419491 (power bank chip) 3 - https://www.alibaba.com/product-detail/Usb-Drive-Usb-Drive-Low-Price_62014581781.html https://www.alibaba.com/product-detail/Usb-Drive-Usb-Drive-L... 4 - https://www.alibaba.com/product-detail/Cheap-customized-Logo-Usb-Stick-2_1600384094970.html https://www.alibaba.com/product-detail/Cheap-customized-Logo...
      - sigmoid10 4y ago
        Half a dollar is still orders of magnitude more expensive.