Researchers Find 25,000 Domains Used In Tech Support Scams (onthewire.io) 85
An anonymous reader writes:
Three doctoral students at Stony Brook University spent eight months analyzing internet scammers who pose as remote tech support workers (usually pretending to be from Microsoft of Apple). Their research revealed more than 25,000 scam domains and thousands of different scam phone numbers. "Although victims of these scams can be anywhere, the researchers found that 85.4% of the IP addresses in these scams were located across different regions of India," reports On The Wire, "with 9.7% located in the United States and 4.9% in Costa Rica. Scammers typically asked users for an average of $291, with prices ranging from $70 to $1,000."
The researchers even called 60 of the con artists to study their technique, and concluded most were working in large, organized call centers. They use remote access tools, and in fact two popular tools were used in 81% of the scams, according to the paper. "We found that, on average, a scammer takes 17 minutes, using multiple social engineering techniques mostly based on misrepresenting OS messages, to convince users of their infections..."
The researchers even called 60 of the con artists to study their technique, and concluded most were working in large, organized call centers. They use remote access tools, and in fact two popular tools were used in 81% of the scams, according to the paper. "We found that, on average, a scammer takes 17 minutes, using multiple social engineering techniques mostly based on misrepresenting OS messages, to convince users of their infections..."
chief enablers (Score:5, Insightful)
My bet: TeamViewer and LogMeIn.
This is part of why I don't understand why this continues to be a big problem. They're not some fly-by-night flighty twitchy boiler room working in a different hotel room every week to try to keep one step ahead of a door kick. These are established, stable, organized, stationary, predictable groups that ought to be easy targets for law enforcement. Seeing as this also coincides with only a few geographical locations (india and costa rica) I can only presume local law enforcement is either very lax, is complacent ("hey it brings money into our local economy, that's good right?"), or is on the take.
Re:chief enablers (Score:5, Funny)
"So, this is quite the operation you have here, isn't it?"
"Yes. Yes it is. Here, here's a little something for your wife. And your children. You are a good man and your family deserves to be well taken care of."
"Thank you. And by the way, you wouldn't be using your operation to be contacting any of the citizens of our fine country, would you?"
"No. Certainly not. Not at all."
"Very well then, carry on."
Re: (Score:2)
The 2nd most popular origin was the US.
Re: (Score:2, Insightful)
Way to miss the point.
Only 9.7% were in the USA, versus 85.4% in India. That's a huge difference in risk.
And you're also ignoring the fact that IP associated with the USA host a huge number of globally-useful web sites and other online services, while that just isn't true for India.
For most Internet users, blocking Indian IP addresses would be a net gain in security and convenience.
But for most users, blocking USA IP addresses would result in almost no security gain, while losing a lot of convenience.
You're
Re: (Score:2)
Only 9.7% were in the USA
Block Florida and Texas. Problem solved.
Re: (Score:1)
They spoof phone numbers, so that doesn't work.
Foreign country (Score:2)
Re: (Score:2)
Re: (Score:2)
the paper whose results you're mangling
Ooops, that was meant to be saying that the media mangles scientific research results, not the OP.
Re: (Score:2)
Whose law enforcement? It's not like the FBI can go down to India and round up a factory-sized building with workers. India just doesn't care whether or not it is unethical, as long as they aren't doing anything illegal within India (or keep paying their taxes and bribes) they're not going to stop them.
To the Indians, people are giving them money for a service they sold on the phone. Even US courts in front of a tech-illiterate judge may not find much fault with their methodology other than that it's not en
Re: (Score:2)
The legal issue here is "fraud". They are calling and lying to the mark and telling them they
Re: (Score:2)
That low?
Whenever one of these scammers cold-call, it's invariably someone with an Indian accent at the other end.
''Difficult to track'' (Score:5, Interesting)
when they give a 'phone number for the mark to call ??? With all the resources that the NSA, GCHQ, FBI, ... have finding where that number goes to is going to be well within their abilities. That they are not finding and nailing these crooks demonstrates that they are not interested in protecting the public. It is not as if the cost to the public is small, the BBC claims £10.9bn a year (just in the UK) [bbc.co.uk]. So: one has to ask what are those clowns doing with all they money that they soak up ? Who's interests are they protecting? It does not seem to be you or me!
Re: (Score:2)
No, more like they are up to their ears in all the other things governments require of them that they do not have the resources or the time. Also, many of the scams span countries. Try going to India and claim some of their citizens are scamming Americans. (1) why should they give a flying rat's ass, (2) it means assigning resources to an investigation, (3) it involves bringing prosecution. What's in it for India?
It's almost like you have no touch with reality.
Re: (Score:3, Interesting)
Both forward to my cell phone. But I can also set them up to work with a SIP device (a VoIP phone). In that configuration, I can take the VoIP phone anywhere in the world and use those numbers as long as I
Comment removed (Score:3)
Re: (Score:3)
Re: (Score:1)
Call belkin some time, the number in the manual that came with the router. You'll get these people who tell you that you can't connect to the internet because you have a virus, not because you have a bad switch. Then the idiots will try to make you let them in so they can fix your computer for $450, even though you're calling about bad hardware that stops you from getting online.
Call up the support number for Avast and you'll get th
Re: (Score:2)
Look Donald, here's your chance. (Score:2, Insightful)
This is the one thing that would unite Americans, as declaring war on overseas scammers would be incredibly popular. Everybody hates them AND they're foreign, so it's a win-win for you.
Seriously, it's a better use of bombs than a bunch of so-called terrorists and dictators, it'll guarantee re-election.
The actual fix (Score:2)
Re: (Score:3)
Re:Where's the list? (Score:4, Insightful)
> but alas the list of domains isn't included in the appendix.
Try blocking "*.in" for starters. https://registry.in/ [registry.in]
Lodge formal complaint (Score:2)
Look To The Telcos... (Score:5, Interesting)
Most of the time I just did my best to keep the caller busy for as long as possible, purely to stop them spending time on the next victim. However, one day, as part of my challenging the caller to "prove their identity", the person I was speaking to actually managed to disclose my personal account number that I have with my UK telco/ISP. This number is printed on invoices but otherwise not used; it has no relation to my phone number, email address, or anything else.
The only way the caller could have known that detail - and correctly identified me from it - was if they were either an employee of my telco, or had stolen data from them.
I did some more digging, let the caller go, then got in touch with the anti-fraud team for my telco. Obviously telephone fraud is a big deal, with lots of un-paid bills and some large sums of money involved. So: this is a serious team with skilled people, people who can take scams seriously. I eventually got put through to an investigator and managed to convince them that they had either a leak from, or crooks operating out of, one of their India call centres.
I have not had a fraudulent call since then.
Let's just repeat the salient bit of that: an average of 4 fraudulent calls per week; one call to my telco anti-fraud team; no more calls for almost exactly one year.
I could not in truth write that my telco had a criminal gang operating out of one of their India call centres; but the evidence from my side suggests that is a likely explanation. The use of fraudulent email domains is only part of the problem, however, because without the calls we would not be prompted to visit them. [ OK, spam notwithstanding].
You would think that ISPs would be a bit more vigilant when it comes to signing up new customers; you would also expect that telcos with India-based call centres were more careful in watching their employees... Sadly, both of these activities would eat into profits. The truth is that the big telcos don't care if we are impacted by fraud, as long as they are not directly losing out in the process.
Until that changes, the calls will continue.
Re: (Score:2, Interesting)
Posting anonymously because I have modded: A similar story, with names.
We moved from Virgin Media to BT (about half the cost for the same facilities) about two years ago. Before then, not a single scam caller, although we did get a few telemarketers.
Almost immediately after the move, we started getting these scam calls from what was apparently an Indian call centre. I reckon there has to be somebody in the BT call centre who was passing new numbers to the scam shop. Since I run a total Linux installation I