Trust Me, I’m With Microsoft…

Beware; scammers are cold calling households in the area and trying to scare people into giving them access to their computers and purchasing ”tech support services” that they don’t need.

I got a call out of the blue the other day from a gentleman who said he was from Microsoft. He asked me if I was Mr. Berryjooks of 1 Happy Lane, I said yes, and he proceeded to tell me (in a very heavy Indian accent) that a PC at my house, registered to my wife, Mrs. Belinda Berryjooks, was infected with a virus and was sending error messages out to Microsoft. He said not to worry though, he would help me clean things up.

I knew from the get go that the call was a hoax, Microsoft does not call customers, or keep watch over people’s computers, for that matter, but I wanted to find out what this guy was up to and how much of my info he already had, so I started stringing him along;

Me: “How do I know you’re from Microsoft, the caller ID says Out of Area 3241?”

Caller: “How would I know your name and address, and your wife’s name, if I wasn’t from Microsoft?”

Me: “Ah.., the phone book, possibly?”

Caller: “No sir, from when you registered your computers.”

Me: “My wife doesn’t have a PC, she has a Mac.”

Caller: “She must have a user account on one of the PC’s.”

Me: “Nope, hates PC's.”

Caller: “Sir, I cannot stress enough that one of your systems is very, very sick, and you are in dire need of professional help or you will be losing all of your data. It is critical that you allow me to help you immediately. Are you near one of your computers now?”

Me: “Why yes, I am.”

Caller: “Please go to the Start menu and select Run.”

Me: “OK.”

Caller: “Please type eventvwr at the run command prompt.”

Me: “Done”

Caller: “Now look through the event viewer for any errors or alerts, this is a sure sign that you have a very, very bad infection.”

Me: “There are always error and alert messages in the event viewer, it’s normal for them to be there.”

Caller: “Oh, no sir, this is a very, very bad thing. I need you to go back to the run command and type in the following, then I will be able to take control of your computer and help you clean it up before all of your files are destroyed.” He proceeds to give me a url to enter, which I won’t reprint here for fear of someone clicking on it.

Me: “Right. Who did you say you were, again?” Meanwhile, I’m doing a domain lookup on the web address he’s provided me.

Caller: “I told you, I’m with Microsoft.”

Me: “You are employed by Microsoft directly?” By now I know that the website he’s directing me to is based out of Calcutta and has no affiliation with Microsoft at all. I love the Whois command.

Caller: “Have you entered the address I gave you yet, sir?”

Me: “Nope.”

Caller: “Sir, I cannot help you if you don’t follow my instructions. This is very important. You are spreading viruses to all of your friends and family and all of their PC’s will be ruined.”

Me: “You didn’t answer my question, let me try it another way: If I call Microsoft’s main number, would I be able to reach you? Could the operator patch me through to tech support?”

Caller: “I can give you a number to call, sir.”

Me: “Not the same thing, but go ahead.”

Caller: “4XX.XXX.XXXX”

Me: “That’s not a Microsoft number.” I’d googled it as he read it to me and it came back as the number for a company called My Instant Support, which is owned by Edgesoft Technology Solutions, not Microsoft, and there is a slew of search entries about cold calls to users, mostly the elderly, who end up giving access to their computers and getting all kinds of dubious tech support charges on their credit cards, amongst other things.

Me: “Who Should I ask for when I call the number?”

Caller: “Brad Smith.”

Me: “Of course…”

Caller: “Sir, I have already spent upwards of 20 minutes talking to you and I can not waste any more of my time. You do understand that I cannot be held accountable for the horrible things that are going to happen to your computers if you do not allow me to log in and correct the problem?”

Me: “Understood, and I absolve you from all responsibility and consequence, Brad, and I thank you for alerting me to the danger I’m in. Above and beyond the call of duty, sir. By the way, what virus do I have?”

Caller: “The Trojan virus, sir.”

Me; “Which Trojan virus, Brad? There are many.”

Caller: “The Trojan virus, sir. I cannot help you if you don’t allow me access and have already wasted too much time on this call. Goodbye!”

*click*

Brad was definitely annoyed, and seemed to have finally grasped the fact that I was shining him on. This gave me great pleasure, but it wasn’t the end of my dealings with them…

Yesterday a different Brad Smith called me, same heavy Indian accent and same spiel. This time I stopped him midsentence by saying: “Wait, don’t tell me… you want me to check my event viewer and then give you access to my computer, right? And you don’t really work for Microsoft, you work for My Instant Support, and you are not calling on Microsoft’s behalf at all, correct?”

Brad Number Two: “ah, er.., *click*”

Damn, I lost him. Musta been a bad connection…

So, the takeaways here are:

Microsoft will never, ever call you at home.

Entries in your event viewer are normal, there should be alerts and warnings in there.

Never, ever give anyone you don’t know any personal information, especially over the phone.

Never, ever, give anyone you don’t know access to your PC’s.

These guys walk a fine line, they insinuate that they are calling on behalf of Microsoft to gain your trust, but it’s actually a carefully crafted script. When pressured, they will admit that they work for a Microsoft certified company, which only means that they are qualified to work on Microsoft products. It does not mean that Microsoft has hired them to contact you, and there is no way they are receiving error reports from your system.

There are posts from PC users worldwide complaining about these people, and all kinds of stories about large and repetitive charges on the credit cards of people foolish enough to believe them and give them access. Lord knows what type of malware is getting installed at the same time by these guys, or what data they may be stealing from the users.

Microsoft warns about these calls in their forums and recommends reimaging the PC and changing all your passwords (Computer, Bank, Credit Cards, etc.) should you fall prey to one of these schemes.

Do NOT fall prey to this scheme.

You can end up in a world of hurt if your accounts and personal information are compromised, I repeat, a world of hurt.

They seem to be targeting the Massachusetts area right now; I’ve seen a lot of entries in the local police blotters about people reporting similar calls. Probably just working their way through the local phone listings and they'll move on to another area soon. We can all help to move them along by not cooperating, and/or making their day as unpleasant as possible.

In a nice polite way, of course ; )

That is all.

Operation Ghost Click: Are You Ready For July 9th?

On July 9th, the ISC (Internet Systems Consortium) plans to shut down some DNS servers. How will that affect you? Well, pull up a chair and uncle berry will tell you a story.

Last October, after 2 years of investigation, the FBI in conjunction with a myriad of domestic and international partners, broke up a cyber crime ring based out of Estonia that was using rogue DNS servers to hijack user’s computers and ring up 10’s of millions of dollars in fraudulent ad and click revenues.

DNS, or Domain Name System, is the service that converts URL’s (eg: www.google.com) into those impossible to remember IP addresses. Your ISP provides you with access to a valid DNS server and your computer caches the server’s address. When you open your browser and enter a URL, the DNS server looks up the name and returns the proper numeric address. Think of it as an alpha-numeric translator.

These Estonian cyber thieves were infecting user’s computers with DNSChanger malware, which changes the address of your DNS server to one of their own, a rogue DNS server. The rogue server then either directs you to the wrong site, or to the correct site, but the ads you see have been replaced by ones of their choosing.

You know when you’re on the wrong site, but how do you know what ads you should be seeing when you’re on the right site?

Very devious.

But they didn’t stop there; once they had infected your computer, the malware would try to break into your router using the default settings, and if successful, it would change the DNS settings there, also. Why? Because if you have a router, your real DNS settings are cached there, and your computer caches only the address of the router. You could wipe your computer clean and still wind up being misdirected. And just as an added kick in the pants, some of the sites you are misdirected to download other malware, things that prevent OS patching and antivirus updating. Oh, those crazy Estonians...

So, how does infecting your computer make someone else money, you ask? Well, the world of internet commerce is a very complicated place. There are millions of publishers, every web site owner is a publisher, and there are just as many advertisers. How do the two get together? Through middlemen, of course; publisher networks and ad brokers. The Estonians set themselves up as a publisher network under the name of Rove Digital, one of many shell companies they created, and proceeded to cash in. It’s pretty easy to make money off of ad views and clicks if you have a bot net of millions of end user computers clicking and viewing the ads and websites you specify. Kind of like shooting fish in a barrel.

They operated with impunity from 2007 until 2011, when they were finally tripped up by an international task force. It was only a matter of time before they got caught; their malware wasn’t discriminatory and had penetrated computers in some very sensitive places, so the FBI, NASA, the National Cyber-Forensics and Training Alliance, the National High Tech Crime Unit of the Dutch National Police Agency, the Estonian Police and Border Guards and a plethora of universities, technical institutes and private sector companies all banded together and tracked them down. The FBI dubbed the effort “Operation Ghost Click”, a very appropriate name, and the operation highlights the incredible effort and international cooperation needed to combat cyber crime in our brave new world.

Breaking up the crime ring and bringing those bad boys to justice wasn’t the end of the story, though. The task force quickly realized that if they shut down all of the rogue DNS servers the Estonians were operating, they’d effectively be turning off the internet for the millions that were infected. The Internet Systems Consortium was tasked with replacing the rogue DNS servers with valid ones, and keeping them running during the cleanup process, and the DNS Changer Working Group (DCWG) , an independent group of subject matter experts, was formed to aide end users with the cleanup.

On July 9^th, 2012, the formerly rogue servers are scheduled to be shut down for good, they can’t keep them running forever, it costs a lot of cash, and anyone still infected with the DNSChanger malware will suddenly find themselves off the air. There are steps you can take to make sure you won’t be one of them, and the first step is the easiest.

The DCWG has set up an incredibly informative web site, and you need to make use of it. There’s a link to find out if your PC is infected, that’s your starting point, but it’s not all you need to do. You need to check your router also, and even if it hasn’t been compromised, you need to change its username and password from the default. Never leave default credentials in place on any device.

How do you check your router? The DCWG website has a link for that, also. The OpenDNS Store has instructions for every router conceivable. You don’t need to sign up for an account with them, you can just browse for the info you need.

Both Facebook and Google are teaming up with DCWG also, and will be alerting you if they notice a rogue DNS server address on your system, so don’t blow off any warnings you see on either site that informs you that your computer might be infected. This is no hoax, people.

If you are infected, the best fix possible is to reformat your hard drive and reload your operating system. This malware is a bear to get rid of, so if you have your system disks and a good backup, the wipe and reload method is your best bet.

If you don’t, DCWG has a link to help, of course. The DCWG Fix page has a list of free tools and self help guides, but it’s not an easy repair, and the site actually recommends that if your system is old, now might be the time to junk it and upgrade. That says a mouthful about the pervasiveness of this malware.

Don’t panic though, after all, it won’t be the end of the world if you lose internet connectivity on July 9th, but it will be a lot harder to set straight once you're off the air, so be proactive, and while you’re in a proactive mood, take a moment to read our post on creating system recovery disks and backing up, especially if you’re thinking about scrapping your system in favor of a new one. It will serve you well.

That's the end of my story, at least for now. There'll be more to tell as we get closer to the cutoff date, so stay tuned. In the meantime, I've given you lots to think about, and lots to do, so get busy. I'll leave you with one last thought, just because I can't help myself...

Beware of Estonians bearing gifts.

That is all.

Music Sharing, Malware, And You

I want to talk about music sharing. Not about the ethicality of it, that’s just a waste of breath. People are adamant about their beliefs on the subject on both sides, and I’ve found it’s useless to try and change anyone’s opinions on it. I want to talk about the consequences of music and/or file sharing, and I don’t mean the consequence of getting caught.

P2P (peer to peer) file sharing can be a very valuable tool. It’s central to quite a few things we take for granted, like SMTP email, which uses a P2P configuration between it’s mail transfer agents (or mail servers), coupled with a client-server connection with the end user (you). It also allows many users to share many files without the need for huge central servers, which can cave under the pressure of a sudden multitude of simultaneous downloads. All in all, it’s a pretty slick concept.

The problem is, when you install a P2P client such as BitTorrent or LimeWire on your home PC to share music and video, you open yourself up to a plethora of problems. Up to 30% of all music files available to download from your peers are infected, and no matter how careful and smart you are, sooner or later you’re going to hit a file that’s carrying a virus or malware that your protection software doesn’t yet have a definition for. A raging infection or two, combined with the added cpu usage from file sharing requests, can bring your system to it’s knees quick, fast and in a hurry.

Also, improper set up on installation with regards to files or folders to share, can leave you wide open to information theft. Here’s a link to a great article on InformationWeek, where the reviewer used LimeWire Pro to search out keywords such as “ssn”. The amount of personal information he culled from other users was downright scary. Now think about a double whammy, picking up malware that changes your file sharing settings, steals your personal info, then leaves the door open for others to find that same data. Oh yeah, and trashes your computer while it's at it. Yikes!

All this being said, if you do decide to venture into these murky waters, be sure to have a rescue plan in place. Take the time to make sure that your system is properly protected and backed up. Here’s a link to a simple guide, just to get you thinking in the right direction.

And if you do get hosed up, don’t call me. I know that you’re going to reinstall the P2P client as soon as you get the machine back. Don't give me that innocent look, you will, and I just don’t have the time or patience these days for that kind of “Ground Hog Day” like behavior.

That is all.