In August 2019 there will be a Rammstein concert here in Oslo, and of course the tickets were sold out in no time at all… so in short no tickets for me But a couple of days ago a friend of mine told me that someone on Facebook is selling four tickets to that exact concert. So, my wife and I contacted someone that claimed to be a student called Magnus Lie with the email address firstname.lastname@example.org.
Magnus turned out to be really friendly kind of guy, offering to help us set up an account with skrill.com for secure money transfer, and he claimed using skrill.com would keep both parties happy and safe from fraud (and other evil things) He was even asking some control questions about our skrill.com setup, just to keep us safe and secure (very nice of him to ensure that we don’t get tricked).
So, when we were setup and ready to go he told us to just go ahead and transfer the money to email@example.com and he would make the necessary arrangements on his side. Paranoid as we both are we did a quick google search on “firstname.lastname@example.org” , a search that gave no relevant hits. I also decided to do a quick test transfer on http://www.skrill.com to see what happened. Well it turned out that Mr Lie seemed to have an alias a Mr Uday Daas. So, when we asked Magnus (or Uday) who Uday Daas was he went silent for some minutes (suspect that the number of minutes reflects the time needed to setup a new Gmail and Skrill account..” – Oh, he said. did you use the correct email address? did you use email@example.com? And that was the end of that trade.
It seems to be a common trade/weakness with fraudsters that they are just way to helpfull, and since I’m a Norwegian, my spider sense starts tingling when people are service minded… its just not right 🙂
And Magnus\Uday please don’t spend the 0.12 USD, you got from me, on candy. Make sure you put it your piggy bank so you can save it for someting nice….
After spending over 90 minutes on the phone with our “Friends” at “Windows support” I’m not at all surprised that people get tricked into giving them full control of their PC’s and giving them their credit card details. They are actually extremely service minded (much more the a real service desk usually is…) Never thought I would be able to keep them on the call for 90 minutes before they called my bluff and I had to cave in.
As usual It started with a call from Windows Support, and this time around I thought… well I’m sitting at home, I have a VM to spare, let’s see where this takes me. On the other end of the line was this nice girl speaking with an Indian accent, she could inform me that someone was trying to break into my computer and steal all my personal stuff. And if I booted up my computer she would show me what was happening. And while she was talking to me she dropped all the keywords to build trust between me (the victim) and her. It was an endless stream of “trusted partner, hackers, security keys, and encryption” and of course the magic sentence “we will fix this for free and we will make it so no one can attack your computer again.” Did I say it was for free? So to show me what was going on she got me to run some commands in the windows command shell (cmd) commands that for the regular PC user might look advanced and super complex. But for an old sysadmin, not so much (but entertaining). After winning my trust and convincing me that yes indeed there is something very suspicious going on (I guess in some way she was correct) She handed me over to a second line specialist that would help me clean up.
The very nice and very very very patient gentleman that was acting as the second line specialist was tasked with playing on this new-found trust and gain remote access to my computer. And again, the keywords was secure, hackers and free. The only catch was that if he was going to fix all my security problems on my computer he needed remote access, so he very painstakingly guided me through the process of installing team viewer. (I had my stupid hat on that day, so it took some time to get it done) But finally it got installed and he had remote access to my computer, and both of us was very happy. He could then show me the content of the windows event log, and with a very worried voice he told me that each of the red icons in the event log represented a successful attack against my poor computer. For those of you who have seen an windows event log you would understand that an ordinary PC user would be very worried, since the stream of red icons can seem endless.
It all came to an end when he wanted my credit card number to renew my Microsoft premium support agreement that apparently had expired. The proof of this was an expired certificate in my computers cert store (that had nothing to do with any support agreement) and he could only fix my poor little PC if I reactivated the support agreement. Unable to provide him with a valid credit card number I had to confess my sins and that I had just been playing along all the time.
But I as I said in the beginning, I now understand why people keeps getting tricked by this scam. Because they can be very convincing if you are an ordinary user (as most people are).
… like to think I saved an little old lady from getting ripped off 🙂