1. Welcome Guest! In order to create a new topic or reply to an existing one, you must register first. It is easy and free. Click here to sign up now!.
    Dismiss Notice

Security Researcher Tricks Tech Support Scammer Into Installing Locky Ransomware

Discussion in 'News & Current Events' started by starbuck, Aug 8, 2016.

  1. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Infosec researcher has fun at a crook's expense

    Ivan Kwiatkowski, a security researcher living in France, has turned the tables on a tech support scammer and fooled him into installing a copy of the Locky ransomware on his own PC.

    Kwiatkowski's encounter with a tech support crew came after his parents had navigated to a dodgy website that tried to trick them into thinking they were infected with the Zeus banking trojan.

    "This horrible HTML aggregate had it all: audio message with autoplay, endless JavaScript alerts, a blue background with cryptic file names throwing us back to Windows' BSoD days, and yet somehow it displayed a random IP address instead of the visitor's one," wrote the researcher on his site.

    9f48588f837c153a9625665b747eedda.png
    The browser scareware from where all of this started

    Just give tech support scammers "test" credit card numbers

    While it was easy to fix his parents' browser, the researcher went home and decided to have a little fun with the tech support crew.
    He fired up a virtual machine, accessed the site, and then called the phone number included on the tech support website.

    The researcher had three different calls with two operators at a call center in India, which didn't go that well, mainly because the researcher spoke French while the operators not so much.

    During his last call, after he agreed to the scammer's request to buy a tech support package, he started giving the crook fake but valid credit card numbers, just to have fun at his expense.

    Or just give them files from your spam folder

    While the crook was trying to carry out a banking transaction with credit card details assigned only for testing, Kwiatkowski had quite the bright idea (if we can say so ourselves).

    He went to his email account's spam folder, opened one of the spam emails, and downloaded the file attachment. In that case, it was a ZIP file containing a JavaScript file, which when executed would download and install the Locky ransomware.

    The researcher renamed this file to Photo(823).png.zip and told the tech support operator that he had problems with his eyes, and he might be reading the wrong numbers from his credit card.

    He offered to take a picture of the credit card and send it to him via a chat application the tech support operator was using.
    Kwiatkowski gave the tech support scammer his Locky-infected ZIP file and waited for a reply.

    "I tried opening your photo, nothing happens," the tech support operator told the researcher, not knowing that a hidden process was secretly encrypting all his files with the undecryptable Locky ransomware.

    a495f9345673a7154ce545b689b9cdce.png
    Kwiatkowski giving the scammer the Zip file containing the Ransomware


    Source:
    http://news.softpedia.com/news/secu...into-installing-locky-ransomware-507053.shtml
     
  2. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,620
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    I love it! It's about time these crooks got something that they deserve!
     
  3. Tony D

    Tony D Administrator Administrator

    Joined:
    Sep 25, 2009
    Messages:
    5,157
    Location:
    SE Pennsylvania, USA
    Operating System:
    Windows XP Professional
    Absolutely fantastic!!!!
     
  4. Rustys

    Rustys Registered Members

    Joined:
    Feb 29, 2016
    Messages:
    1,656
    Location:
    127.0.0.1
    Operating System:
    Linux Based
    Computer Brand or Motherboard:
    Compaq H3900 (Windows 2002)
    CPU:
    Intel (R) PXA250
    Memory:
    64 MB RAM 48 MB ROM
    Hard Drive:
    Yes
    Graphics Card:
    4 D
    Power Supply:
    Solar
    I have to agree one of the better results.
     
  5. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Just picturing the look on the scammers face makes me smile.
     
    allheart55 (Cindy E) likes this.
  6. DSTM (Dougie)

    DSTM (Dougie) Registered Members

    Joined:
    May 3, 2009
    Messages:
    8,270
    Location:
    SYDNEY AUSTRALIA
    Operating System:
    Windows 7
    Good one.
    I am guessing the call center operators may have all their computers networked and may have caused more then one computer to be infected.
    When they ring me I can hear them all in one room yabbering.
    Is that possible, Pete.
     
    Rustys and allheart55 (Cindy E) like this.
  7. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Oh yes, If one computer on a network becomes infected, mapped network drives could also become infected.
     
  8. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,620
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    Wouldn't that be great?:biggrin:
     
  9. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    The scam operator is probably feeling the wrath of his employers by now. :big_ha:
     
    DSTM (Dougie) likes this.
  10. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,620
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    Hey, it's their own fault! :funny:
     
    DSTM (Dougie) likes this.
  11. Rustys

    Rustys Registered Members

    Joined:
    Feb 29, 2016
    Messages:
    1,656
    Location:
    127.0.0.1
    Operating System:
    Linux Based
    Computer Brand or Motherboard:
    Compaq H3900 (Windows 2002)
    CPU:
    Intel (R) PXA250
    Memory:
    64 MB RAM 48 MB ROM
    Hard Drive:
    Yes
    Graphics Card:
    4 D
    Power Supply:
    Solar
    The sad thing is I use to be IT at call centers and can tell you they not only share drives they also remote to other sites.

    :comp_punch:
     

Share This Page