5 ms·

>You could still build an application to troll them, it would just involve reverse engineering the custom protocol and having your program connect out to the pr

>You could still build an application to troll them, it would just involve reverse engineering the custom protocol and having your program connect out to the proxy. And do what? Say you reverse engineer the protocol. Then what? What proxy? Who said anything about a proxy? >If they are using a legit service like logmein I'm surprised they aren't taking more action on this. If they're using LogMeIn, good luck reverse engineering. LogMeIn's security is really fantastic. The protocol is encrypted with strong algorithms and has a lot of spoof detection measures in place. I'd love to hear an explanation of what you think you'd do with this theoretical troll server. I've messed with these guys a lot. They wan't control of your machine so they can install their software, then extort you for money. End of story. If they don't feel like they're moving in that direction, they hang up and move on. I drag them along using social engineering, then let them log in to a VM with nothing on it. I let them install their software, then I find a way to terminate the call and trash the VM.

jiggy2011 14y ago
There will be something in the middle proxying between the attacker and your computer, to get through NAT. Regards reverse engineering, you would have to grab packet information from your memory before it hits SSL. Not sure how the spoof detection works. I'm sure these protocols have been reverse engineered before. Regards what I'd do with it, really not sure. I've never had these guys on the line for long enough to know much about how their scam works. In practice it would probably be easier to just construct a VM in such a way that it makes whatever they are trying to do difficult in some amusing way, depends on how much patience they have I guess.
- brk 14y ago
  A tainted VM would be a lot more fun and easier to execute. One thing I've seen from using various TeamViewer and LMI apps is that poor quality connections can cause frustrating issues. A few things like a mouse driver that sporadically moves the mouse exactly opposite of the way they are trying to move it ("Not sure why it does that, maybe because I bought this PC in Australia and everything is upside down there"). Icons and a desktop background that look like the artifacts you get from poor connections (wrong colors, smearing, etc.). Random popups on the screen with things like "Fraudulent Windows Support Department detected. IP trace from FBI in progress!!".
  - jiggy2011 14y ago
    That last one would certainly be a lot of fun. Though thinking about it , I'm not sure it's wise to piss these people off too much since in order to contact you they must have your telephone number which will probably have a 1:1 relationship with your physical address.
- bradleyland 14y ago
  I see. I was thinking you were headed more in the direction of reverse tunneling to screw with their systems. You never really stated any goal; e.g., to make the target machine difficult to control. Simply making things difficult for them would be much easier to achieve on the client. Hell, probably the most fun thing to do would be to load the system up with malware so badly that the system was practically useless, then watch as they try to navigate around all the bullshit in order to install their scamware.

jiggy2011 14y ago

There will be something in the middle proxying between the attacker and your computer, to get through NAT. Regards reverse engineering, you would have to grab packet information from your memory before it hits SSL. Not sure how the spoof detection works. I'm sure these protocols have been reverse engineered before. Regards what I'd do with it, really not sure. I've never had these guys on the line for long enough to know much about how their scam works. In practice it would probably be easier to just construct a VM in such a way that it makes whatever they are trying to do difficult in some amusing way, depends on how much patience they have I guess.

brk 14y ago
A tainted VM would be a lot more fun and easier to execute. One thing I've seen from using various TeamViewer and LMI apps is that poor quality connections can cause frustrating issues. A few things like a mouse driver that sporadically moves the mouse exactly opposite of the way they are trying to move it ("Not sure why it does that, maybe because I bought this PC in Australia and everything is upside down there"). Icons and a desktop background that look like the artifacts you get from poor connections (wrong colors, smearing, etc.). Random popups on the screen with things like "Fraudulent Windows Support Department detected. IP trace from FBI in progress!!".
- jiggy2011 14y ago
  That last one would certainly be a lot of fun. Though thinking about it , I'm not sure it's wise to piss these people off too much since in order to contact you they must have your telephone number which will probably have a 1:1 relationship with your physical address.
bradleyland 14y ago
I see. I was thinking you were headed more in the direction of reverse tunneling to screw with their systems. You never really stated any goal; e.g., to make the target machine difficult to control. Simply making things difficult for them would be much easier to achieve on the client. Hell, probably the most fun thing to do would be to load the system up with malware so badly that the system was practically useless, then watch as they try to navigate around all the bullshit in order to install their scamware.