I’ve had some minor adventures with them in the past. Sometimes they claimed to be calling from Microsoft, telling me they’d detected a fault on my computer. One one occasion I pretended to have a Mac (living the dream, eh) and tried to do what they were telling me, complaining that my screen didn’t have on it what they were asking me to click on. I wasn’t at the computer - I’d made it up. When I said I didn’t have Internet Explorer, but could use Safari, they asked “Don’t you have Windows” and I said “Well, you told me you’d found a problem with MY computer; don’t YOU know?”. They hung up.
One guy claiming to be from Microsoft told me he was called Martin Short, so I launched into a tirade around how much I loved his movies, especially The Three Amigos (great film). He hung up.
The other day a woman claiming to be from BT spouted nonsense at me about hackers and servers and when she paused I said “Look, you don’t have to do this. You don’t have to ring people up to try to exploit them. You could get a better job that’s not so dishonest.” Without missing a beat she told me to go fuck myself and hung up on me. Seriously, it’s hard to give careers advice in IT these days.
I’ve always wanted to explore these scams deeper. I say always, I mean I’ve kind of wanted for some time... so after my careers advice call was so rudely terminated, I went onto my Mac: yes I have a real Mac now, not a pretend one - don’t worry it also dual boots to Windows, so I’ve not entirely sold my soul to Apple: also Microsoft... I went onto my Mac and I installed a fresh Windows within VirtualBox. In short, this simulation of a computer is running a Windows with nothing installed on it except a web browser. It knows nothing about me other than my name and has no access to any of my private files... but it lives in a sandbox on my computer.
Having created the pretend computer, I took a clone of it and called that the honeypot. I fear I may have misnamed it - it should really be called honey trap. Honeypot sounds like a euphemism for something naughty, but I’m not going to google that in a hurry to check.
The honeypot can be compromised as many times as you like and it can be wiped in 20 seconds and rebuilt from the original in 5 minutes. In other words it’s a playground where I can watch hackers trying to fool me, knowing that they’re wasting all of our time. Similarly, as it’s not real and has never been used in the real world, there’s zero chance of it having caught any viruses or having been compromised in any other way.
On Tuesday another hacker called. I ran up the stairs giddy with excitement and quickly started up the honeypot computer on my real computer and turn on screen recording with my phone on speakerphone.
What occurred is a play in three acts.
In act 1, there is the ridiculous attempt by the scammers to blind me with science and take control of my computer, the situation and my confidence. We’ll come to try techniques they use in a bit. In act 2, at around 36:46 in the above video, I reach a point where I no longer want to play, partly because it was taking so long, and partly because the request they made would have genuinely compromised my security, so I reveal that I’m an IT specialist and that they’ve been trapped in a virtual computer all along and that I can see through their lies and bullshit.... it took a lot of pushing from me for the fellow on the other end to accept that the game was up. In act 3, the human behind behind the scam - someone who has a shitty job in a criminal call centre in a deprived country - spoke to me as a human, with no script, with his own feelings and fears, and I shut up and listened... or at least backed off enough for him to be heard. He may even give up this game one day as a result.
Before I explain the con (briefly - watch it to see more) I should say that I came into this aware that some people go for jobs in what they think is genuine IT support, then learn during induction that they’ll be exploiting people for criminal gain... some walk away, some have no option but to stay and probably some feel entitled to skim money off whom they imagine are wealthy foreigners.
The con seems to be tiered. The first person you speak to is a robot asking you to press 1 for support. The idea being to filter out people who don’t answer, or who don’t think they might have a computer problem that needs support.
The next person is there to ask you to do stuff. When it’s clear that you’re pliable and will follow instruction, you’re passed onto the next person who walks you through setting up some software that gives them control of your computer. Bizarrely they use two tools at the same time. Any Desk and Team Viewer. One of the things they try to minimise is your perception of what these are and what access you’re handing over to the people on the other end.
Finally you are handed over to a hacker. This is the person who will ramp up the social engineering claims, suggesting how important it is to catch hackers, and who will also be driving the control of your computer while, and this is the clever bit trying to convince you that you’re doing it. My hacker “Mark Robinson” probably not his real name, was getting me to do all manner of silly things including typing the command “I want to know how many hackers are activate on my server” into a command prompt... and when I hit return, he pasted in a command to make my machine actually appear to do stuff. Luckily he pulled the trick twice so I saw what he was doing as it flashed past the second time.
So you think there’s a problem (they have you look in spurious error logs to start the process), you think BT are fixing the problem for you by telling you what to do, and you’ve forgotten that they’re watching and controlling your computer during the call.
After they earn your trust they will eventually hold your computer to ransom unless you pay them.
People fall for this.
I hope the above video, in which I deliberately slow them down and waste their time will be useful to show people about the dangers of being scammed/hacked. Similarly I hope people will look at the victim on the other end of the phone - he deserves a better life than this, but has fallen into something quite wrong.
The best defence against this is everyone being wise to it. Then they will stop as there’ll be no market for it.