Scareware scammers adopt cold call tactics

Why...

...is there no effort on the part of law enforcement to eradicate this crap? Here's the idea: Get a few credit cards (or one-time card numbers issued on a case-by-case basis through an automated system similar to that in use in the USA for one-time prepaid cards) specially issued in collaboration with the CC companies which flag up a merchant's account as soon as they're used, "honeypot cards" if you like. Issue these to a few good, trusted researchers and let them reply to these scams. Result: The scammer's financial resources flagged and monitored (and money frozen - one use of a honeypot card freezes the merchant's account without further ado) until a case can be brought or a mistaken use of the honeypot card rectified (there will be a couple, I have no doubt). You could probably do the same with PayPal, a honeypot account that immediately removes the scammer's ability to withdraw funds and freezes the account, although PP seem to give less than a rat's posterior about fraud these days.

Sod technical countermeasures, hit 'em where it hurts. Once they can no longer make money in this manner, they'll lose interest in the malware. It's so simple I can't believe it hasn't been suggested. It's also sneaky, underhanded, almost undetectable until it's too late and so much fun to imagine the scammer suddenly without access to funds after rubbing his greasy hands at the thought of yet another sucker, so it appeals to my darker nature and my finely tuned "fight fire with fire" sense of justice.

Yes, it verges on vigilantism, which is why I said trusted researchers. Anyone legit has recourse to the courts. Anyone scamming would be stupid to complain as it would immediately give away their identity, something no 'net scammer wants. Then, once the case is proven, simply get the transaction records, reverse the transactions and the 'net becomes a more trustworthy place, the CC companies aren't covering losses to scams and everyone is happy. Except the scammer, of course. If he fights it, he's identified. If he doesn't, he's gained nothing. Win-win.

Wouldn't work too well on me...

This would work too well on me... (well, besides my knowing some random guy on the phone won't know the state of my computer...)

Guy: Hey, man, your computer is pwned!! It's got the Conficker bad!

Me: Umm, I run Linux.

Guy: ...

-----------

Of course this would play out in the same amusing way for Mac users as well. And especially FreeBSD 8-). (Yes, Mac viruses exist, a few Linux viruses exist, but not at the level where either user is too likely to believe some random guy on the phone about it.)

Anonymonitiy (however you spell it)

They usually peddle this stuff online because it is mostly Anonymous.

But moving to phone sales is a new one. They must be desperate in these economic times.

Paris because the only thing scareware about her has been seen on video

They can be sued!!!

...at least from USA. They didn't put a ™ or © character on their website after "microsoft". (lower case "m" - Numpties)

Go, Redmond lawyer-dogs, GO!!!! Kill!! Maim!!! Disfigure!!!

Cheers John!

Cheers for the article and ref John. The more people we can warn and subsequently prevent from being scammed, the better :o)

fun with scareware merchants

Some time ago I got a call from the 347-289-3770 number, at home, and on my cell at that. Which means that there is a strictly limited number of ways they could have got that number, but we'll skip that.

A gentleman identifying himself as 'Ron', who had a distinct South India accent (he sounded just like someone I know who was born in Bangalore...) tried to tell me that he was calling from Microsoft and that the 'central computer registry' had notified Microsoft that my PC had a problem. I decided to have some fun. I played ignorant, and pretended to be rushing over to my machine and turning it on. (In reality I launched VMWare and activated one of my emulated WinBoxes, so I could have the proper Windows start-up noises in the background.) All the while I asked the most nonsensical luser questions I could think of, the better to drive poor 'Ron' up the wall. I completely ignored his attempts to sell me anything, I just kept babbling on and on and on... Poor 'Ron' got quite frustrated.

When I finally ran out of stuff to babble about, I asked Ron why it was that Microsoft was calling me when my main machine was a Mac and my main Winbox hadn't been connected to the Internet in over a week... I informed him that this call was being recorded, and that I had the office of the United States Attorney for the Southern District of Florida on the other line and that they wanted to have a little word with him, his supervisor, and the senior management of his company. I'd IMed a friend of mine while I was babbling, and had him on the landline. I put him on speaker, and he said that he was an attorney with the US Department of Justice, and that they had received many complaints about 347-289-3770, and were in the process of setting up a formal international complaint and would extradite and prosecute all participants in this heinous crime to the fullest extent of the law. About there 'Ron' hung up and I haven't heard from him since.

Oh

That's why I've been making all these comments. It's just malware disguised to look like me. Or is it the other way around? I get soooo confused sometimes. a la Hilton, natch.

--Glenn