62

I've recently found out about a YouTuber whose hobby is to bait scammers, play along with them for a while, use the chance to get their information, and either expose them or completely wreck their operation. YouTube channel (Jim Browning): https://www.youtube.com/channel/UCBNG0osIBAprVcZZ3ic84vw

A vital part of this YouTuber's tactic is to reverse the remote desktop connection so he can see everything on the scammer's computer, and even control it with remote input, like in this case: https://www.youtube.com/watch?v=FO9mWvJAugQ. Note that on no occasion (at least as shown in the video) did the YouTuber ask for the scammer's permission to 'switch sides' or anything like that.

I am not trying to do what he is doing, I'm just really curious how he did it.

2
  • 10
    They're not using RDP but Screenconnect or teamviewer, software that natively supports reversing the connection.
    – LPChip
    Aug 1, 2020 at 12:19
  • 3
    @LPChip Yes but those software certainly requires the other user to accept the remote control request. How does he do it without the scammers noticing? Jan 14, 2022 at 20:20

2 Answers 2

36

This vulnerability is described in the Microsoft article A case study in industry collaboration: Poisoned RDP vulnerability disclosure and response. This study was done in collboration with Check Point researcher Eyal Itkin.

In this article is described an attack by an infected server against a client connecting via RDP. The attack consists of the server using the feature of the shared clipboard to copy a group of files to the other computer and paste them in the other computer.

This is also called "path traversal attack", where the malicious RDP server can drop arbitrary files in arbitrary paths on the client machine, thereby gaining total control of that computer.

The server can also notify the client about a fake clipboard update without an actual copy operation inside the RDP window, thus completely controlling the client’s clipboard without the user noticing.

Eyal Itkin's study of RDP vulnerabilities in various RDP software is available in the article Reverse RDP Attack: Code Execution on RDP Clients, where the number of vulnerabilities that he found is simply horrifying.

To protect against these attacks, the only solution is to always use the latest and fully updated RDP client. Otherwise, disable at least the shared clipboard feature while connecting.

12
  • 14
    Good effort on answering the question, except that you miss one detail. The scammers are not using RDP. They simply use something that supports reversing the connection, such as teamviewer or screenconnect, etc...
    – LPChip
    Aug 1, 2020 at 12:19
  • 4
    @LPChip: This would require traversing firewalls, finding open ports and vulnerabilities in listening apps. The danger to the RDP client here is that he himself has established the connection, thus bypassing all his own defenses. Why would the attacker need to establish a new connection when one is already established via RDP by the victim himself?
    – harrymc
    Aug 1, 2020 at 12:59
  • 5
    @harrymc Reversing the connection is supported by Teamviewer. You just need to click a button. Why would you want to manually traverse firewall and find open ports when you can just click a button in Teamviewer or Screenconnect? In fact, why would you want to orchestrate a clipboard attack (and write scripts/compile software/find software) to exploit the clipboard via RDP when you can just click a button?
    – slebetman
    Aug 2, 2020 at 1:35
  • 3
    This does not answer the question. If you watch a few of Jim Browning's video, you'll notice that none of the scammers use RDP. They all use ready-made clients.
    – Technoh
    Aug 19, 2020 at 14:30
  • 9
    @harrymc The context is the question. The question never mentions RDP. None of the videos make a mention of it, I don't know why you absolutely want to focus on RDP since it cannot be what Jim Browning uses.
    – Technoh
    Aug 20, 2020 at 21:28
32

These type of scammers look for non-tech-savy people. Software like Teamviewer detects "likely" scammer activities and warns people about scams if you get connected, for example, to an IP geofenced from say India and you are not in it:

...
We have taken the necessary steps to make sure that the remote IDs can no longer be used for illegal purposes and we are constantly working on new methods of finding and blocking such users. TeamViewer will display a warning message if an incoming connection with a potential fraudulent background is detected to warn our users of the risk of a potential scam
... (https://community.teamviewer.com/t5/Previous-versions-EN/Scammers/td-p/682)

To avoid these kind of detects and warnings the scammer sometimes let the client initiate the connection bidirectionally and then take over - if you are fast you can bug the scammers PC with something that allows you access before that happens.

Sometimes scam baiters leave e.g. a "creditinfo.xls" in a folder "FinanceData" on their desktop in hope that the scammers download it and open it. It contains a macrovirus bugging the scammer's pc and allowing remote access (not by the same tool, but providing their own backdoor).

Both things are probably borderline illegal.

There exists other ways as well - Jim Browning for example sometimes shows that he leverages WireShark to trace network connections and traffic back to the attackers. If/what he uses exactly to bug the network he intrudes into is probably not shown by a reason - I think he's cool none the less. The tool he uses does not use teamviewer, but other ways of backdooring the networks of the scammers.

3
  • 1
    I feel like I've seen evidence of Jim Browning using the RAT nanocore in one or two of his videos. But he'd have to be using a custom version of it to not be caught by virus scanners. I'll see if I can find the video where it appears.
    – Brad Turek
    Aug 20, 2020 at 16:11
  • 2
    However, someone who used to be part of Jim's team claims he no longer uses nanocore.
    – Brad Turek
    Aug 20, 2020 at 16:27
  • Scambaiter on YouTube is doing similar reverse connections, I'm sure I saw a reference to Nanocore RAT on one of his videos.
    – Nick W
    Apr 9, 2021 at 10:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .