5

My local region in Australia is being targeted by a scam whereby victims are cold-called and told that their computer is sending 'errors' to caller at 'Windows' which should be fixed ASAP, and they are standing by to help out with a remote-access session to fix it.

It's not clear that there is any particular attack being carried out with the remote-access session (probably there are many companies trying the scam on). There's the actual sting of paying for the 'service' by credit-card, likely transfers of browser-cache files, and some reports of trojans. Let your imagination go wild.

It seems clear that one way or another, organisied crime is paying good money to harvest pwned machines. Out comes the white pages, and the call centres get to work.

What is frustrating is that there seems to be very little recourse an alert would-be-victim can take to get back at the operators (other than wasting their time, which usually involves wasting one's own - some people have also suggested keeping a loud whistle near the phone). The caller-id information (that's what we call it in .au) is witheld - possibly the number is just from a pool of VoIP gateway numbers anyhow.

It seems unlikley that the Australian government can successfully prosecute and shut down all overseas operators of the scam.

It would seem like other protections will have to be put in place to counter what is doubtless going to be a growing phenomneon. Something that's crowd-sourced, statistical, and dynamic, most likely. As an example, one might impose on telcos that if a user presses some key sequence during a call, the call legs are flagged as being a 'suspicious' call. Maybe a recording of the conversation can be made as well, to automatically collect evidence for public prosecutions?

What measures - which I could lobby my local politician for the government to adopt - would be useful in hindering this kind of social attack?

Improve this question
2
  • Happened to my mother here in Ireland. She called me in a panic. I assured her she could safely ignore it.
    – TRiG
    Aug 26, 2011 at 11:24
  • David Jacoby was able to record their paypal accounts and even their real ip: securelist.com/blog/incidents/33734/…
    – Ángel
    Sep 26, 2014 at 23:05

2 Answers 2

Reset to default
4

In the US, a telephone customer can dial *57 after the call to get a "Customer Originated Trace" - which theoretically "Provides the recipient of an abusive call the ability to request an auto-trace of the last call received". Not sure what the definition of abusive there is, or the latest reality of how well it works.

Improve this answer
1
  • Our 2 major telcos have similar features but they are oriented towards abusive/malicious/threatening calls that recur. The thing we're trying to achieve here is to quickly clamp down on a scammer before they can call more people. As such, it needs to be co-ordianated at a level higher than that of a single telco.
    – David Bullock
    Jan 30, 2011 at 3:54
1

The telcos should have a log of all calls - if they don't provide you with a way to trace or block calls, the only useful recourse is to log every one of these with your telco. If it is widespread, the telco will eventually become annoyed enough to do something about it.

Of course this requires individuals who receive these calls to take action, and overall it will take some time, so no quick response fix.

If you can lobby for something like the US *57 that would take some of the effort away from individuals, that would make it more likely for telcos to reach their response threshold faster.

(obviously there are some abuse risks...)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .