Buried unfortunately deep in August’s Social Engineer podcast was some outstanding advice from British TV star R. Paul Wilson, who turned scamming into prime-time BBC TV for several seasons.
Wilson, who literally has sold someone a bridge that he of course didn’t own, has lots of experience on both sides of scamming, so his experience is invaluable. I was just disappointed that we had to listen to 45 minutes of Christopher Hadnagy and David Kennedy arguing before we could hear it, so I’ll cut through the garbage.
Friday night, I took my wife out to get some coffee to get her a few minutes away from the house. There’s a corner in the front of the store next to the window that we always sit in, and it seems like some huckster is always huckstering something there.
And did we ever find a doozie on this Friday night.
There are a few hucksters on Ebay, whom I don’t care to give free advertising by mentioning by name, who hawk “graded” cards on Ebay and claim them to be especially valuable. One even puts supposed appraised values in his listings in parenthesis, then invites you to visit his page for an explanation of “graded” value, where he cites an example of a run-of-the-mill 1970s star card, normally worth $60, being worth $2,500 once graded.
The thing is, that’s an edge case. It’s important to understand those edge cases to avoid a ripoff.
I haven’t received a fake Windows tech support call in a very long time. A couple of the operations doing this have been shut down, but based on the continued popularity of the things I’ve written about them, I wonder if some people are still getting them.
That makes me reluctant to block them, just in case they call me again, but if you’re getting those calls and want them to stop, I can tell you how to do that.
I’m all torn up this morning. I’m torn up because Microsoft has sued a couple of tech support scam outfits for misrepresenting themselves and violating Microsoft trademarks.
I’m torn up because it’s taken this long. I’m also torn up because this may mean I’ll never get to see what kind of hilarity would ensue by telling a scammer with a fake western name that my name is “Suchita.” In the deepest voice I can muster, of course. Keep in mind that if I sing in falsetto, I’m a tenor. Also keep in mind that nobody wants to hear that.
The other night my phone rang. The caller ID said some state I don’t ever get calls from, so I knew what was going to happen when I picked up the phone. I didn’t have much time, but I answered anyway.
“Hello, I am calling from Windows Technical Support. My name is Daniel,” the caller said with a very slight Indian accent.
“Oh, hi, Daniel.” I said, pausing for a second to think of a name. The last project manager I worked with was a nice guy named Naim, who had emigrated from India to Minnesota. So I stole his name. “My name is Naim.”
Long awkward pause. I grinned. Too bad “Daniel” couldn’t see me.
“Your name is Naim,” he said. His sarcasm and disbelief was so thick it was bulletproof.
“Yes Daniel, my name is Naim,” I said pleasantly, making no effort whatsoever to disguise my midwestern accent. I’ve lived my whole life in Missouri and Ohio. Read more
I guess Matt Weeks is as sick as I am of tech support scammers, because he developed a way to fight back, in the form of a Metasploit module that exploits a software defect in the AMMYY remote access tool that these scammers sometimes use. Metasploit is a tool that penetration testers use to demonstrate–with permission–how hackable a computer network is. In this case, the would-be victim is penetration testing someone without permission. Run the module when the scammer connects to the would-be victim, and he or she gets a command prompt on the criminal’s PC. At that point, the would-be victim can break their computer, perhaps by deleting critical files, corrupting the Windows registry, or something else. Anything you can do from a command prompt would be possible at that point.
I’m anything but heartbroken that this threat exists, although I’m not going to do this myself. Let me explain. Read more
Yesterday when performing a routine server inventory, I received a Windows 317 error, aka a Windows 0x13d error, when I tried to view some directories remotely from a batch file.
The exact text of the error message: The system cannot find message text for message number 0x13d in the message file for System.
If you’ve received a 0x13d error and you’re wondering what it means, it seems to be an unhealthy system’s way of saying “file not found.” In my case that’s what it appeared to be. If the lack of a human-readable error message bothers you, I found two possible culprits: One is system hardening–perhaps you’ve applied the recommendations from CIS, USGCB/NIST, or the DISA STIGs to the system–or the more likely culprit, services not running that need to be. Start with some very routine maintenance. Check the remote machine to make sure all the services that are set to start automatically are indeed running, and you might want to think about rebooting.
When researching the error code, I found an interesting scam—tons of sketchy web sites, some that did a decent job of impersonating Microsoft, offer programs to fix the issue. Microsoft doesn’t offer downloadable fix-its for error messages like this because these are the kinds of problems that require some human intelligence to resolve.