Friday, September 14, 2012

Indian Windows Scams - How they work

This weeks Blog topic for Contemporary Issues in Information Technology is a 'choose your own'. Originally I wanted to write a blog about how bad the iPhone 5 was and how Firefox OS will make iOS a third tier OS if not Windows 8 doesn't do it sooner. I was already drafting it when I received a phone call and I decided to write about Indian Windows Scams instead. My word count quickly grew out of proportion and I decided to recount my experience here, so I can reference it in my piece which I'm supposed to hand in and circumnavigate the 200 word count. So here we go:

I love those old CRT monitors. If I had more desk space I'd use em as well.
Recount of my experience with two dudes telling me my Windows had a problem:
Usually I don’t pick up the phone when I’m at home by myself. Stuff it, if it's somebody important for me, they will call my mobile, else they can call back later for anybody else. But it was my Birthday, so I was playing Money Penny and answering the phone. This phone call wasn’t the best (no, that belongs to a girl who I hadn’t talked to in a while) but it certainly was funny.

'Hello Sir, are you the owner of the Windows computer in your house? I'm calling from Microsoft to tell you your computer has been infected'

That thick Indian accent. That well rehearsed script. The sound of keyboards clattering away in the background. I felt like I was a Apple Fanboy that just saw a iPhone at a 10% below average price. I knew exactly what it was. A Windows Call Scam.

Windows Call Scams are nothing new. For those of you that have never sat one through because you knew better or you had nothing but Macs in your house, I’ll give you a quick run down on how they work.

Example of the the Event Viewer Windows Diagnostic Tool.
First the caller makes sure you have a Windows Computer. I said Windows 8 which caused them to be a bit hesitant for some reason but they rolled with it. Once your computer is on, the scammer will ask you to run some simple system diagnostics from your Run bar (hold windows+r for the Run bar). In my case they made me run ‘eventvrw’ which prompted me to MS Event Viewer. From there they told me to look at the Application Screen so I could look at all my errors. These tools are standard with Windows OS. The scammer then asked me to look at my ‘inf unwanted’ folder for some file. We could never find the file and I could hear him getting impatient so we gave up and moved on.

By this stage I had built up the persona of an old senile grandpa that just uses the family laptop to look at News and can’t understand why the news button redirects him to HotAndHornyGays.com. So just to recap, at this stage the scammer and I had just farted around looking at my computer and he hadn't penetrated my defences yet. When he told me to go online I was sceptical but I wanted to learn more about his method so I pretended I accidentally turned my computer off while I scrambled to get to my 'Craptop' (this laptop which I'm obsessed about that I restored after finding on the side of the road) which has a fresh Install of Windows 8, no personal files and all I’d need to do is login using my guest account email address.

AMMYY is a remote desktop program that is used to help diagnose problems and the most popular program used by the scammers.
The scammer then prompted me to this website. I could see where this was going. Ammyy is remote desktop software. He asked me to run the program and I said I was having some errors. He told me it was cool and that we could try another program, at LogMeIn.com. Now I’ve had experience with LogMeIn before (I use it on my Android Gingerbread Tablet and Smartphone. Despite its $30 for Android, its free if you know how to really use your Android) so I thought, why not?

Lets hand complete control of the ‘Craptop’ to some guy I’ve know for 40 minutes that lives across the world (the first guy told me he was calling from Australia, the second guy told me he was calling from America. These guys could have been calling from anywhere). </famousLastWords>

I quickly struggled to do something funny and only had enough time to change my desktop background to a mousepad with some porn on it (a online community I am involved with was ordering Free Custom Mousepads through Arts Cow, http://www.artscow.com/).

This is an example of one of the custom mousepads made.

At this stage after he had seen the picture and I tried to explain it was a drawing my grand daughter did, the scammer quickly changed the picture back to one of the default system pictures with only a few clicks and shrugged it off like he had seen worse. This Technological Security version of Gay Chicken was quickly reaching breaking point for me. I quickly went to youtube and typed in ‘You Get Nothing’ (Good job to Jarod ‘Jedi_Vader20’ for that idea) blasted it over my speakers and flipped off the wireless network button on the side of my Del Inspiron 1525/'Craptop'. The scammer was puzzled at what was going on and I just asked him ‘where’d you get your Microsoft Certification?’ We argued for a bit and I made him hang up.

Thats my story though of how I delt with a Windows Scammer. Except I’m not the average Computer user (final year IT Student) and I knew exactly what I was dealing with. After making a post about my experience on Facebook (I had to return so I could organize a LAN Party in December. 100+ people are already coming.) I was surprised to see the reactions I got and it turns out a lot of people that saw my post had also had scammers call them.

MFW stands for 'My Face When'

Later on I did some research. There are hours of videos of Youtubers yanking these scammers around the chain. I also though found this ACA report which mirrors my experience exactly.

What is really scary as well is that after listening to some of the videos of scammers on youtube, I genuinely think that some of these scammers don't know what they are doing and genuinely believe they are selling a product to people. Think about it, I was passed from one person to another throughout my call. Lets call the second person who I tried to login to my computer 'Scammer B' and the first person that talked me through the 'error problems' 'Scammer A'. Scammer B hires twenty people and tells them to read out from a script they give them. Scammer A is part of those twenty people. Scammer A and the nineteen others don't know about the scam and believes he/she is actually helping people. Scammer B knows its a scam and once one of the twenty people he/she has hired has found somebody with a windows error, he/she gets given the phone where he/she can work his magic. Another scary fact is that they don't need a computer to control your desktop. Like I said, LogMeIn also has apps for both Android and iOS tablets. Tablets are $50 in India, so setting up one of these scamming businesses would be really easy and cheap. Still, these are just my theories.

TL:DR - If somebody calls you up and informs you that your Windows computers has errors, tell them that they are dogs in the loudest tone your lungs can generate.

Reference Links:
[ACA report from May, 2011]
http://www.youtube.com/watch?v=1juMnpSv82c