Social Engineering

It seems like once a week we get somebody walking into our store and telling us about a phone call that they received telling them that there's a problem with their computer and offering help to fix it. These calls are supposedly from antivirus companies, Microsoft or even the FBI. These calls are actually coming from criminals using a method known as social engineering to gain access to your computers. I call them criminals because what they're doing is known as pretexting and as of 2007 it is a federal felony.

Social Engineering operates on a very simple premise. That premise is that it's much easier to trick someone into giving a password for a system than to spend the effort to crack into the system. Likewise, it's much easier to trick somebody into typing commands into their computer than it is to write a trojan or virus to run the commands. This is what we're hearing about from our customers. The scam involves somebody calling your house and claiming that they're from Microsoft and that they have reports that there's a problem with your computer or your copy of Windows. In order to avoid problems for you they'd like to verify your software. They direct you to open a command prompt and type in a series of commands. After you do so, they kindly tell you that everything appears fine and apologize for the inconvenience. This seems harmless enough, but what you've actually done is open a backdoor for the person on the other end of the phone to run code remotely on your computer. Your antivirus programs won't be triggered because you've physically typed the commands in yourself. Your computer is going to assume that you knew what you were doing.

A variation of this that we're seeing a lot of lately is a version of scareware that pops up a screen when you log onto the Internet that appears to be from the FBI. The screen will tell you that you've been logged as having downloaded illegal porn or pirated movies and/or music. It will advise you that your Internet services have been discontinued until you pay the fine for the illegal downloads. It will then prompt you to make a payment via credit card for several hundred dollars. If you fail to make the payment within a matter of hours a warrant will be issued for your arrest. This scam relies on the fact that a large percentage of people engage in behaviors that would bring them close to downloading illegal materials. Many aren't sure if they've done anything illegal when faced with an ultimatum like this. Due to the embarrassing nature of the supposed crimes, people are more likely to pay the money to make the problem go away. The problem is that these screens aren't put up by the FBI and the minute you enter your credit card or bank account information your accounts will be drained and your credit cards will be maxed out.

Both of these scams are becoming very common place. With malware protection becoming more complex and effective it is becoming harder and harder for criminals to gain access to your computers through technological means. This has caused them to revert to the simple act of preying on the trust of their victims. As of this time I am not aware of any company or agency that is going to contact you via phone or web browser to let you know that there is a problem with your computer. The FBI is not going to flash a screen on your computer to accuse you of crimes. They will knock on your door with a warrant. If you are contacted by somebody looking for information about your computer or asking you to run any commands on your computer, do your research. Ask them if you can call them back, then look up the number that they give you and see who it's registered to. If you have any lingering doubts, please call us at 262.767.3300. We will be happy to look into the situation for you.