Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //

Risk Management

4/25/2018
09:35 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Microsoft: Tech Support Scams on the Rise

A recent report from Microsoft shows that the number of scams using tech support as a cover is on the increase. However, many times it's up to consumers and companies to protect themselves.

Scammers using the cover of a tech consultant have been around since computers first connected to the Internet. The specific scams have undergone changes and evolution, but fraudsters still find it easier to manipulate the person in front of the machine than the machine itself in their nefarious pursuits.

Microsoft Customer Support Services has noted that it had received 153,000 reports from customers who encountered, or fell victim to, tech support scams in 2017, which is a 24% growth from the previous year.

Since the reports originated in 183 countries, this is a global problem.

Additionally, about 15% of these customers lost money during the scam, which usually cost them between $200 and $400. But the loss can be a much greater amount. In fact, Microsoft detailed how it received a report of a scammer who emptied a bank account of 89,000 euros ($109,000) during a tech support scam in the Netherlands which occurred in December 2017.

(Source: Malwarebytes Labs)

Microsoft admits that it's hard to put an absolute number to the scale of the problem. All that the company can see is the reports that come to Redmond. But, the problem is larger just than what researchers see since it affects customers of various other devices, platforms or software.

Microsoft found that most of the scams show common social engineering techniques to entrap the victim.

These include:

  • Scam websites that use tactics such as browser dialog traps, fake antivirus detecting fake threats and fake full-screen error messages. These are usually effective against unsophisticated users.
  • Email campaigns that use phishing-like techniques to trick recipients into clicking URLs or opening malicious attachments. This kind of phishing is used for many other types of cybercrime, but is very prevalent in the tech support variants.
  • Malware that makes system changes or will display fake error messages designed to confuse or mislead the victim.
  • Unsolicited phone calls -- cold calls -- which are telemarketing-style calls from the scammers pretending to be from a vendor’s support team.

All of these social engineering methods have the same end goal of getting victims to contact a call center that is run by the scammers.

Usually, a fake technician will then try to convince the victim that there is some sort of problem with their device. They present it as an urgent problem that needs immediate action. Then they will get the victim to install a remote administration tool (RAT), which then gives the scammers control over the victim's device.

The control the scammers gain is then used to show fake errors or events on the device, which are then used as "evidence" that the victim needs to pay the scammers in order to stop the problem.


The fundamentals of network security are being redefined -- don't get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth-annual Big Communications Event. There's still time to register and communications service providers get in free!

Microsoft thinks that customer education will help. The company publicizes some of the more common tell-tale signs, such as normal error and warning messages do not have phone numbers and that most vendors don't make unsolicited phone calls to fix a device.

The company also realizes that the scale and complexity of tech support scams require "cooperation and broad partnerships across the industry." However, Redmond doesn't provide any specifics on how it will gain these partnerships.

It's up to users to educate themselves so that they don't fall victim to these kinds of ploys, even when they are presented with the seeming authority of a tech person endorsing them.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-22392
PUBLISHED: 2021-08-05
Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
CVE-2021-3591
PUBLISHED: 2021-08-05
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.
CVE-2021-3642
PUBLISHED: 2021-08-05
A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. This flaw affectes Wildfly Elytron versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final.
CVE-2021-3655
PUBLISHED: 2021-08-05
A vulnerability was found in the Linux kernel in versions before v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.
CVE-2021-32003
PUBLISHED: 2021-08-05
Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the service is used after provisioning. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware.