{"id":158103,"date":"2016-03-15T12:56:09","date_gmt":"2016-03-15T10:56:09","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=158103"},"modified":"2016-03-15T12:57:26","modified_gmt":"2016-03-15T10:57:26","slug":"this-is-what-a-microsoft-tech-support-scam-looks-like","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/158103-this-is-what-a-microsoft-tech-support-scam-looks-like.html","title":{"rendered":"This is what a Microsoft tech support scam looks like"},"content":{"rendered":"

Con artists will use many\u00a0tricks to steal\u00a0your money, including contacting you via a fake IT support call.<\/p>\n

While the Microsoft tech support scam<\/strong><\/a>\u00a0is nothing new, South Africans still reportedly receive calls from \u201cagents\u201d claiming to be from the company.<\/p>\n

The scam usually involves convincing you that they have detected a problem with your computer, and then take you through steps that give them remote access to your machine.<\/p>\n

Once they\u2019ve got control of your machine, the scammers use a number of tactics to get money out of you.<\/p>\n

This includes\u00a0infecting your machine with malware that\u00a0gathers data like\u00a0usernames and passwords.<\/p>\n

What a tech support scam looks like<\/h3>\n

A\u00a0number of YouTubers have set up virtual machines and taken these con artists for a ride.<\/p>\n

YouTuber Eric Henn decided to have some fun and see if he could get a technician to open files that were not intended for his eyes – as shown below.<\/p>\n

\n

The virtual machine is set up to look as though it\u00a0is\u00a0infected with malware.<\/strong><\/p>\n

The desktop also contains a folder called \u201cNaked girlfriend\u201d and a spreadsheet called \u201cbanking and checking account\u201d<\/p>\n

\"Scammers<\/a><\/p>\n

\n

One version of the scam tries to trick you into calling an “agent”. Alternatively,\u00a0they cold call you.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

They ask you to open a run dialog and open the Windows Help browser.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

You are asked to use the \u201cjump to URL\u201d feature to navigate to the website of remote desktop software.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

In this case, Citrix GotoAssist is used.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

Windows prompts you to install the software.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

Every time the \u201ctech support agent\u201d tells you to click in the affirmative.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

Installing the remote desktop software will also trigger a UAC prompt on Windows Vista and later.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

Once installed, Citrix prompts you to accept the remote desktop connection.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

Once in your machine, the con artist will run utilities to try and convince you there is something wrong with your computer.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

To try and convince the user something is wrong, the scammer runs the \u201ctree\u201d command.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

While \u201ctree\u201d is running, they paste a scary-looking string that will appear on the command line when it has finished executing.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

The “agent” also shows you a webpage that tells you just how bad your PC’s problem is.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

With fear instilled in you, the sales pitch begins.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

To the scammer\u2019s credit, in this case, they did open the spreadsheet or the folder of “naked pics”, so Eric Henn did it for them.<\/strong><\/p>\n

\"Tech<\/a><\/p>\n

\n

Watch Eric Henn\u2019s full video below<\/h3>\n