4

I'm currently working for Geek Squad at Best Buy in the front of the operation checking in client computers and I am frequently encountering bogus tech support scams which involves copious amounts of remote access software and who knows what else to gain complete access to the devices. In some instances the attackers cause data loss or disable the computers when the users don't pay for their "services".

My question is about how this happens because it's often very similar and it makes me wonder if these are connected organizations or there is some sort of script they go by when breaching someone's system. Often, there is text written in the Windows taskbar with something like "Tech Support 24/7: 1-800-555-5555" and even including the name of their "technician".

I've seen everything from VPNs installed, to VLC, and other software that somehow gets installed but doesn't appear to be malware and instead is legitimate business or enterprise software. How do they do this? Is there an initial infection with malware that they then use to install remote software, or is it that they somehow dupe these people to install these programs themselves thus not setting off any alarms with an antivirus?

From what I can tell, we will usually "clean" and remove the software, but to me, that seems like something I wouldn't be comfortable or satisfied with, and if it were my device, I would definitely opt for a complete wipe of the OS. Am I overreacting here about going nuclear with the response?

Oh, I would like to know how they make the label in the taskbar if anyone could explain that.

7
  • 1
    Social engineering attacks I would think of those scams where they trick people to do what they want and make them believe they are someone else. Jan 17, 2021 at 2:39
  • 1
    Thanks, and done. I never come across right on forums..
    – Henry A
    Jan 17, 2021 at 2:45
  • In the answer I posted, I didn't quite know what you meant about the label in the taskbar. If you could explain that more, I can try to answer that.
    – DrZoo
    Jan 17, 2021 at 3:01
  • here is a link to a similar message in a Windows taskbar: answers.microsoft.com/en-us/windows/forum/…
    – Henry A
    Jan 17, 2021 at 3:09
  • People are scammed into allowing criminals to connect to their machines. Those criminals want to be paid for doing nothing which is the reason they are criminals.
    – Ramhound
    Jan 17, 2021 at 3:42

1 Answer 1

1

As Drink Some Pimp Juice IT said in a comment, it's mostly social engineering.

You can get popups that warn about issues with your computer in a wide variety of ways. It can come from downloading shady programs, unsafe free software on the Internet, clicking bad ads, phishing emails, and more.

The way they tend to go about this is just to blast their ads to as many people as possible. They hope for someone with no technical knowledge to call their number, which is really just directs to a scam center somewhere.

The user will hop on a call with a "technician" who asks them to follow some steps to install remote access software.

What they do from there is up in the air. They could just provide bogus service and charge a fee for actually doing nothing at all, just to obtain debit/credit card details. Others may install keyloggers in hopes of getting other information like banking login. Their goal is to steal peoples money.

The best thing you can tell your customers is to never call a number that shows up on a popup, attempt to log into anything an ad may direct them to, give up any personal info, etc. No tech company like Amazon, Microsoft, Apple, etc is going to reach out to users through calls or emails to notify them that their computer has an "issue." Even if your bank calls you about an issue, just hang up and call them back with the number found on their website.

Generally removing the software and bogus crap should be enough, but you could consult with your managers about asking customers if they wish to reinstall the OS. I would imagine that option is probably more expensive and I assume you would also charge for data backup/restoration. As long as the options and pricing differences are explained to the customer, I would say it's worth asking so they can decide what they want to do.

If you want to see more in-depth about some of this Jim Browning on YouTube has fantastic videos about scam centers. I'm not sure if his exact job title, but he is involved in actually gathering evidence and trying to close these call centers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .