5 ms·

I've had these calls too, now and again but never had the patience to keep them on the line. So , they want to install some kind of remote admin software on yo

by jiggy2011 14y ago

I've had these calls too, now and again but never had the patience to keep them on the line. So , they want to install some kind of remote admin software on your PC? I'm going to assume it is something based on VNC or RDP. In that case if you really wanted to troll them it might be fun to figure out which protocol it was using and implement a custom server that you can run when they call you. Any fun ideas as to what that could do?

furyg3 14y ago
It seems to me that the best idea would be for credit card companies to issue "Fraud" cc numbers to certain groups of people. Once a few these are processed, that merchant account can be shut down... it's a fraud.
- jiggy2011 14y ago
  Good idea, but I assume whatever merchant they are using is getting charge backs all the time so they probably know who they are. That's assuming they are even using a legit merchant account as opposed to just stealing numbers which are exploited in some other way.
  - ConstantineXVI 14y ago
    Just yesterday I ran into someone's computer hit with a variant on this scam[0], which was demanding you buy them a prepaid debit card to pay off the ransom. Seems nearly impossible to trace back to the extortionist if they're careful about spending them. [0] http://www.fbi.gov/news/stories/2012/august/new-internet-scam http://www.fbi.gov/news/stories/2012/august/new-internet-sca...
- bradleyland 14y ago
  You needn't issue any special CC numbers. "Follow the money" is standard fraud investigation practice, and a defrauded consumer's CC will do just fine. Tracing the transactions back to the processor and merchant account is doable, but it's often a temporary solution. How do you stop them from simply opening another? When someone establishes a merchant account, they often do so as a corporation. Corporation blacklisted? Start another one. The requirements for opening a merchant account are similar to a standard credit check. If you have no credit history, your terms will be worse, and the bank will probably hold funds for a longer period of time than if you had good credit, but ultimately, that's just a cost of doing business. If there's inbound cash flow to be had, the exercise of managing costs is standard business practice. To stop them, you have to find the people behind the operation and put them in jail. Given that they're not US-based, that takes time. Most foreign governments have more pressing matters than taking down the scammer that is stealing money from non-constituents.
  - dangrossman 14y ago
    That's what MATCH (Member Alert to Control High-Risk Merchants) and TMF (Terminated Merchant File) are for. When someone establishes a merchant account, they must provide the tax IDs (SSNs) of the principals of the business, not just the business itself. If the account is terminated for an egregious offense, like fraud, all those principals get added to MATCH and TMF, which all acquiring banks have access to when reviewing new applications. In theory, it should be impossible to open multiple Visa/MasterCard merchant accounts for fraudulent purposes without having a new human being signing up each time, not just a new shell corporation.
    - bradleyland 14y ago
      It has been years since I worked in the industry, but once upon a time, I worked for some online pharmacy guys. Yeah, I know. Yeah, I'm ashamed to admit it, but I never spammed anyone, and we never did anything nefarious (technologically speaking). Anyway, things might have changed theses days, but the guy who ran that business was always fighting to keep merchant accounts online. He kept the dev team out of the business side, but I overheard plenty of conversations involving fake identities and shell companies. I have little doubt that its harder than it used to be, but still, it remains a "cost of doing business" issue.
bradleyland 14y ago
> I'm going to assume it is something based on VNC or RDP. It's not at all. Very few end user support tools are VNC or RDP based. Most of them use services like LogMeIn or GoToAssist. I've received a few of these calls where I strung them along and they were all using one of the two listed above (most used LogMeIn). I did encounter one that was using an off-brand tool, but it was commercial and not VNC or RDP based. Even if they were using something like VNC, you couldn't run a custom server to troll them, because the connection is initiated in the inverse of what you're used to when controlling a remote computer. They don't connect to your machine, you run an executable, which initiates a connection from your computer to their server.
- jiggy2011 14y ago
  You could still build an application to troll them, it would just involve reverse engineering the custom protocol and having your program connect out to the proxy. I guess you would have to be a much more determined troll though with plenty of time on your hands. If they are using a legit service like logmein I'm surprised they aren't taking more action on this.
  - bradleyland 14y ago
    >You could still build an application to troll them, it would just involve reverse engineering the custom protocol and having your program connect out to the proxy. And do what? Say you reverse engineer the protocol. Then what? What proxy? Who said anything about a proxy? >If they are using a legit service like logmein I'm surprised they aren't taking more action on this. If they're using LogMeIn, good luck reverse engineering. LogMeIn's security is really fantastic. The protocol is encrypted with strong algorithms and has a lot of spoof detection measures in place. I'd love to hear an explanation of what you think you'd do with this theoretical troll server. I've messed with these guys a lot. They wan't control of your machine so they can install their software, then extort you for money. End of story. If they don't feel like they're moving in that direction, they hang up and move on. I drag them along using social engineering, then let them log in to a VM with nothing on it. I let them install their software, then I find a way to terminate the call and trash the VM.

furyg3 14y ago

It seems to me that the best idea would be for credit card companies to issue "Fraud" cc numbers to certain groups of people. Once a few these are processed, that merchant account can be shut down... it's a fraud.

jiggy2011 14y ago
Good idea, but I assume whatever merchant they are using is getting charge backs all the time so they probably know who they are. That's assuming they are even using a legit merchant account as opposed to just stealing numbers which are exploited in some other way.
- ConstantineXVI 14y ago
  Just yesterday I ran into someone's computer hit with a variant on this scam[0], which was demanding you buy them a prepaid debit card to pay off the ransom. Seems nearly impossible to trace back to the extortionist if they're careful about spending them. [0] http://www.fbi.gov/news/stories/2012/august/new-internet-scam http://www.fbi.gov/news/stories/2012/august/new-internet-sca...
bradleyland 14y ago
You needn't issue any special CC numbers. "Follow the money" is standard fraud investigation practice, and a defrauded consumer's CC will do just fine. Tracing the transactions back to the processor and merchant account is doable, but it's often a temporary solution. How do you stop them from simply opening another? When someone establishes a merchant account, they often do so as a corporation. Corporation blacklisted? Start another one. The requirements for opening a merchant account are similar to a standard credit check. If you have no credit history, your terms will be worse, and the bank will probably hold funds for a longer period of time than if you had good credit, but ultimately, that's just a cost of doing business. If there's inbound cash flow to be had, the exercise of managing costs is standard business practice. To stop them, you have to find the people behind the operation and put them in jail. Given that they're not US-based, that takes time. Most foreign governments have more pressing matters than taking down the scammer that is stealing money from non-constituents.
- dangrossman 14y ago
  That's what MATCH (Member Alert to Control High-Risk Merchants) and TMF (Terminated Merchant File) are for. When someone establishes a merchant account, they must provide the tax IDs (SSNs) of the principals of the business, not just the business itself. If the account is terminated for an egregious offense, like fraud, all those principals get added to MATCH and TMF, which all acquiring banks have access to when reviewing new applications. In theory, it should be impossible to open multiple Visa/MasterCard merchant accounts for fraudulent purposes without having a new human being signing up each time, not just a new shell corporation.
  - bradleyland 14y ago
    It has been years since I worked in the industry, but once upon a time, I worked for some online pharmacy guys. Yeah, I know. Yeah, I'm ashamed to admit it, but I never spammed anyone, and we never did anything nefarious (technologically speaking). Anyway, things might have changed theses days, but the guy who ran that business was always fighting to keep merchant accounts online. He kept the dev team out of the business side, but I overheard plenty of conversations involving fake identities and shell companies. I have little doubt that its harder than it used to be, but still, it remains a "cost of doing business" issue.

bradleyland 14y ago

> I'm going to assume it is something based on VNC or RDP. It's not at all. Very few end user support tools are VNC or RDP based. Most of them use services like LogMeIn or GoToAssist. I've received a few of these calls where I strung them along and they were all using one of the two listed above (most used LogMeIn). I did encounter one that was using an off-brand tool, but it was commercial and not VNC or RDP based. Even if they were using something like VNC, you couldn't run a custom server to troll them, because the connection is initiated in the inverse of what you're used to when controlling a remote computer. They don't connect to your machine, you run an executable, which initiates a connection from your computer to their server.

jiggy2011 14y ago
You could still build an application to troll them, it would just involve reverse engineering the custom protocol and having your program connect out to the proxy. I guess you would have to be a much more determined troll though with plenty of time on your hands. If they are using a legit service like logmein I'm surprised they aren't taking more action on this.
- bradleyland 14y ago
  >You could still build an application to troll them, it would just involve reverse engineering the custom protocol and having your program connect out to the proxy. And do what? Say you reverse engineer the protocol. Then what? What proxy? Who said anything about a proxy? >If they are using a legit service like logmein I'm surprised they aren't taking more action on this. If they're using LogMeIn, good luck reverse engineering. LogMeIn's security is really fantastic. The protocol is encrypted with strong algorithms and has a lot of spoof detection measures in place. I'd love to hear an explanation of what you think you'd do with this theoretical troll server. I've messed with these guys a lot. They wan't control of your machine so they can install their software, then extort you for money. End of story. If they don't feel like they're moving in that direction, they hang up and move on. I drag them along using social engineering, then let them log in to a VM with nothing on it. I let them install their software, then I find a way to terminate the call and trash the VM.