12

I've recently found out about a YouTuber whose hobby is to bait scammers, play along with them for a while, use the chance to get their information, and either expose them or completely wreck their operation. YouTube channel (Jim Browning): https://www.youtube.com/channel/UCBNG0osIBAprVcZZ3ic84vw

A vital part of this YouTuber's tactic is to reverse the remote desktop connection so he can see everything on the scammer's computer, and even control it with remote input, like in this case: https://www.youtube.com/watch?v=FO9mWvJAugQ. Note that on no occasion (at least as shown in the video) did the YouTuber ask for the scammer's permission to 'switch sides' or anything like that.

I am not trying to do what he is doing, I'm just really curious how he did it.

  • 4
    They're not using RDP but Screenconnect or teamviewer, software that natively supports reversing the connection. – LPChip Aug 1 at 12:19
11

This vulnerability is described in the Microsoft article A case study in industry collaboration: Poisoned RDP vulnerability disclosure and response. This study was done in collboration with Check Point researcher Eyal Itkin.

In this article is described an attack by an infected server against a client connecting via RDP. The attack consists of the server using the feature of the shared clipboard to copy a group of files to the other computer and paste them in the other computer.

This is also called "path traversal attack", where the malicious RDP server can drop arbitrary files in arbitrary paths on the client machine, thereby gaining total control of that computer.

The server can also notify the client about a fake clipboard update without an actual copy operation inside the RDP window, thus completely controlling the client’s clipboard without the user noticing.

Eyal Itkin's study of RDP vulnerabilities in various RDP software is available in the article Reverse RDP Attack: Code Execution on RDP Clients, where the number of vulnerabilities that he found is simply horrifying.

To protect against these attacks, the only solution is to always use the latest and fully updated RDP client. Otherwise, disable at least the shared clipboard feature while connecting.

| improve this answer | |
  • 3
    Good effort on answering the question, except that you miss one detail. The scammers are not using RDP. They simply use something that supports reversing the connection, such as teamviewer or screenconnect, etc... – LPChip Aug 1 at 12:19
  • 2
    @LPChip: This would require traversing firewalls, finding open ports and vulnerabilities in listening apps. The danger to the RDP client here is that he himself has established the connection, thus bypassing all his own defenses. Why would the attacker need to establish a new connection when one is already established via RDP by the victim himself? – harrymc Aug 1 at 12:59
  • 1
    Or not to use RDP at all... – chrylis -cautiouslyoptimistic- Aug 1 at 17:52
  • 1
    @harrymc Reversing the connection is supported by Teamviewer. You just need to click a button. Why would you want to manually traverse firewall and find open ports when you can just click a button in Teamviewer or Screenconnect? In fact, why would you want to orchestrate a clipboard attack (and write scripts/compile software/find software) to exploit the clipboard via RDP when you can just click a button? – slebetman Aug 2 at 1:35
  • @slebetman: I have used Teamviewer and it's impossible to do automatically by an infected server, and certainly not without the user knowing about it. And most important, it's impossible for Teamviewer to drop files without authorization, and certainly not inside protected Windows folders. By reversing we mean taking over a client without him knowing about it, and Teamviewer doesn't (hopefully) allow that. – harrymc Aug 2 at 6:20
5

These type of scammers look for non-tech-savy people. Software like Teamviewer detects "likely" scammer activities and warns people about scams if you get connected, for example, to an IP geofenced from say India and you are not in it:

...
We have taken the necessary steps to make sure that the remote IDs can no longer be used for illegal purposes and we are constantly working on new methods of finding and blocking such users. TeamViewer will display a warning message if an incoming connection with a potential fraudulent background is detected to warn our users of the risk of a potential scam
... (https://community.teamviewer.com/t5/Previous-versions-EN/Scammers/td-p/682)

To avoid these kind of detects and warnings the scammer sometimes let the client initiate the connection bidirectionally and then take over - if you are fast you can bug the scammers PC with something that allows you access before that happens.

Sometimes scam baiters leave e.g. a "creditinfo.xls" in a folder "FinanceData" on their desktop in hope that the scammers download it and open it. It contains a macrovirus bugging the scammer's pc and allowing remote access (not by the same tool, but providing their own backdoor).

Both things are probably borderline illegal.

There exists other ways as well - Jim Browning for example sometimes shows that he leverages WireShark to trace network connections and traffic back to the attackers. If/what he uses exactly to bug the network he intrudes into is probably not shown by a reason - I think he's cool none the less. The tool he uses does not use teamviewer, but other ways of backdooring the networks of the scammers.

| improve this answer | |
3

Jim Browning had a series of videos that explained how he does his "WhiteHat" hacking. His videos are out there still. They were very technical & extremely detailed, but not so simplified that anyone could follow along. Without a fair knowledge of coding & tech slang they were confusing. Best to leave that kind of thing to those that already are doing it. If you ain't doing now, starting would just open you up for more & worse abuse. Jim has MULTIPLE computers & boxes on boxes of spare parts. He can afford to have one go up in flames now & then.

| improve this answer | |
  • This is not an answer to the question. Also, I assume you mean “go up in flames” metaphorically, as there are very few things you can do in software which will cause this. – alexkent Aug 9 at 20:55
  • Correct, it is not an answer, just a suggestion. As for "go up in flames" I have had a PC start smoking & then burst into small flames. I am not sure what caused it beyond saying that half the motherboard was toasted & the computer was then inoperable. Luckily I did get my hard drives out without any damage to them. I leave the hacking to those with more knowledge & money. – A G S Aug 12 at 3:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.