3 ms·

> I'm going to assume it is something based on VNC or RDP. It's not at all. Very few end user support tools are VNC or RDP based. Most of them use services lik

> I'm going to assume it is something based on VNC or RDP. It's not at all. Very few end user support tools are VNC or RDP based. Most of them use services like LogMeIn or GoToAssist. I've received a few of these calls where I strung them along and they were all using one of the two listed above (most used LogMeIn). I did encounter one that was using an off-brand tool, but it was commercial and not VNC or RDP based. Even if they were using something like VNC, you couldn't run a custom server to troll them, because the connection is initiated in the inverse of what you're used to when controlling a remote computer. They don't connect to your machine, you run an executable, which initiates a connection from your computer to their server.

jiggy2011 14y ago
You could still build an application to troll them, it would just involve reverse engineering the custom protocol and having your program connect out to the proxy. I guess you would have to be a much more determined troll though with plenty of time on your hands. If they are using a legit service like logmein I'm surprised they aren't taking more action on this.
- bradleyland 14y ago
  >You could still build an application to troll them, it would just involve reverse engineering the custom protocol and having your program connect out to the proxy. And do what? Say you reverse engineer the protocol. Then what? What proxy? Who said anything about a proxy? >If they are using a legit service like logmein I'm surprised they aren't taking more action on this. If they're using LogMeIn, good luck reverse engineering. LogMeIn's security is really fantastic. The protocol is encrypted with strong algorithms and has a lot of spoof detection measures in place. I'd love to hear an explanation of what you think you'd do with this theoretical troll server. I've messed with these guys a lot. They wan't control of your machine so they can install their software, then extort you for money. End of story. If they don't feel like they're moving in that direction, they hang up and move on. I drag them along using social engineering, then let them log in to a VM with nothing on it. I let them install their software, then I find a way to terminate the call and trash the VM.
  - jiggy2011 14y ago
    There will be something in the middle proxying between the attacker and your computer, to get through NAT. Regards reverse engineering, you would have to grab packet information from your memory before it hits SSL. Not sure how the spoof detection works. I'm sure these protocols have been reverse engineered before. Regards what I'd do with it, really not sure. I've never had these guys on the line for long enough to know much about how their scam works. In practice it would probably be easier to just construct a VM in such a way that it makes whatever they are trying to do difficult in some amusing way, depends on how much patience they have I guess.
    - brk 14y ago
      A tainted VM would be a lot more fun and easier to execute. One thing I've seen from using various TeamViewer and LMI apps is that poor quality connections can cause frustrating issues. A few things like a mouse driver that sporadically moves the mouse exactly opposite of the way they are trying to move it ("Not sure why it does that, maybe because I bought this PC in Australia and everything is upside down there"). Icons and a desktop background that look like the artifacts you get from poor connections (wrong colors, smearing, etc.). Random popups on the screen with things like "Fraudulent Windows Support Department detected. IP trace from FBI in progress!!".
      - jiggy2011 14y ago
        That last one would certainly be a lot of fun. Though thinking about it , I'm not sure it's wise to piss these people off too much since in order to contact you they must have your telephone number which will probably have a 1:1 relationship with your physical address.
    - bradleyland 14y ago
      I see. I was thinking you were headed more in the direction of reverse tunneling to screw with their systems. You never really stated any goal; e.g., to make the target machine difficult to control. Simply making things difficult for them would be much easier to achieve on the client. Hell, probably the most fun thing to do would be to load the system up with malware so badly that the system was practically useless, then watch as they try to navigate around all the bullshit in order to install their scamware.

jiggy2011 14y ago

You could still build an application to troll them, it would just involve reverse engineering the custom protocol and having your program connect out to the proxy. I guess you would have to be a much more determined troll though with plenty of time on your hands. If they are using a legit service like logmein I'm surprised they aren't taking more action on this.

bradleyland 14y ago
>You could still build an application to troll them, it would just involve reverse engineering the custom protocol and having your program connect out to the proxy. And do what? Say you reverse engineer the protocol. Then what? What proxy? Who said anything about a proxy? >If they are using a legit service like logmein I'm surprised they aren't taking more action on this. If they're using LogMeIn, good luck reverse engineering. LogMeIn's security is really fantastic. The protocol is encrypted with strong algorithms and has a lot of spoof detection measures in place. I'd love to hear an explanation of what you think you'd do with this theoretical troll server. I've messed with these guys a lot. They wan't control of your machine so they can install their software, then extort you for money. End of story. If they don't feel like they're moving in that direction, they hang up and move on. I drag them along using social engineering, then let them log in to a VM with nothing on it. I let them install their software, then I find a way to terminate the call and trash the VM.
- jiggy2011 14y ago
  There will be something in the middle proxying between the attacker and your computer, to get through NAT. Regards reverse engineering, you would have to grab packet information from your memory before it hits SSL. Not sure how the spoof detection works. I'm sure these protocols have been reverse engineered before. Regards what I'd do with it, really not sure. I've never had these guys on the line for long enough to know much about how their scam works. In practice it would probably be easier to just construct a VM in such a way that it makes whatever they are trying to do difficult in some amusing way, depends on how much patience they have I guess.
  - brk 14y ago
    A tainted VM would be a lot more fun and easier to execute. One thing I've seen from using various TeamViewer and LMI apps is that poor quality connections can cause frustrating issues. A few things like a mouse driver that sporadically moves the mouse exactly opposite of the way they are trying to move it ("Not sure why it does that, maybe because I bought this PC in Australia and everything is upside down there"). Icons and a desktop background that look like the artifacts you get from poor connections (wrong colors, smearing, etc.). Random popups on the screen with things like "Fraudulent Windows Support Department detected. IP trace from FBI in progress!!".
    - jiggy2011 14y ago
      That last one would certainly be a lot of fun. Though thinking about it , I'm not sure it's wise to piss these people off too much since in order to contact you they must have your telephone number which will probably have a 1:1 relationship with your physical address.
  - bradleyland 14y ago
    I see. I was thinking you were headed more in the direction of reverse tunneling to screw with their systems. You never really stated any goal; e.g., to make the target machine difficult to control. Simply making things difficult for them would be much easier to achieve on the client. Hell, probably the most fun thing to do would be to load the system up with malware so badly that the system was practically useless, then watch as they try to navigate around all the bullshit in order to install their scamware.