Unmasking the fake Microsoft support [email protected] Senior Security...
Transcript of Unmasking the fake Microsoft support [email protected] Senior Security...
![Page 1: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/1.jpg)
Senior Security Researcher – GReAT – Kaspersky Lab
Unmasking the fake Microsoft support scammers!
![Page 2: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/2.jpg)
David Jacoby Senior Security Researcher
Global Research and Analysis Team
Malware on Unix/Linux and alternative system
Web Application Security / Penetration testing
Vulnerability and Threat Management
![Page 3: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/3.jpg)
WHAT IS THE PROBLEM?
![Page 4: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/4.jpg)
WHAT GOOGLE THINKS PHONE SUPPORT IS
![Page 5: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/5.jpg)
WHAT IS REALLY IS!
![Page 6: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/6.jpg)
WHAT ARE WE FACING?
![Page 7: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/7.jpg)
WHAT ARE WE FACING?
* source New York Times
Rough estimation of profit
![Page 8: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/8.jpg)
WHAT ARE WE FACING?
• Pretend to be calling from • California
• Hasselt
• London
• Los Angeles
• New York
• Company claiming to work working at • Apple
• Microsoft
• Windows
• Microsoft Windows Help Centre
• Windows Office
![Page 9: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/9.jpg)
WHAT ARE WE FACING?
• Allowed method of payment • Mastercard
• VISA
• Western Union
• (PayPal)
• ”Remote Access Control” tool used • Aplemix
• Ammyy
• LogMeIn
• TeamViewer
![Page 10: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/10.jpg)
WHAT ARE WE FACING?
• Excused of calling • Computer infected with virus
• Errors detected by Microsoft
• Computer is in danger/hacked
• Speed up the computer
• License expired
• Computer has been hacked (by Afghanistan hackers)
![Page 11: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/11.jpg)
WHAT ARE WE FACING?
![Page 12: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/12.jpg)
MY STORY
![Page 13: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/13.jpg)
MY STORY
I WAS WORKING AT HOME AS USUAL
![Page 14: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/14.jpg)
MY STORY
THEY TOLD ME MY COMPUTER WAS INFECTED (how they thought i reacted)
![Page 15: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/15.jpg)
MY STORY
THEY TOLD ME MY COMPUTER WAS INFECTED (how i REALLY reacted)
![Page 16: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/16.jpg)
THEIR TRICKS
MY COMPUTER WAS ONLY WORKING AT 0%
![Page 17: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/17.jpg)
THEIR TRICKS
HAD TONS OF ERRORS
![Page 18: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/18.jpg)
THEIR TRICKS
APPERENTLY MY UNIQUE COMPUTER ID WAS INFECTED
![Page 19: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/19.jpg)
THEIR TRICKS
AND MY LICENS IS NOT VERIFIED
![Page 20: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/20.jpg)
MY STORY
THIS JUST WENT ON AND ON!
![Page 21: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/21.jpg)
THEIR TRICKS
FINALLY DID THEY ENABLE REMOTE ACCESS
![Page 22: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/22.jpg)
THEIR TRICKS
AND INSTALLED FAKE SECURITY PRODUCT
![Page 23: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/23.jpg)
COLLECTING THE DATA
NICE TYPO FROM THEIR AGENT
![Page 24: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/24.jpg)
COLLECTING THE DATA
www.helpnsupportcentre.co.cc
![Page 25: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/25.jpg)
COLLECTING THE DATA
![Page 26: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/26.jpg)
COLLECTING THE DATA
GoToAssist @
www.fastsupport.com
![Page 27: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/27.jpg)
COLLECTING THE DATA
![Page 28: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/28.jpg)
COLLECTING THE DATA
My computer is now out of risk!
O_RLY?!
![Page 29: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/29.jpg)
COLLECTING THE DATA
Payment Portal
www.pctechnocrat.com
![Page 30: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/30.jpg)
COLLECTING THE DATA
![Page 31: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/31.jpg)
COLLECTING THE DATA
![Page 32: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/32.jpg)
TRICKING THE TRICKSTERS
![Page 33: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/33.jpg)
COLLECTING THE DATA
USED MY SUPER POWERS TO TRICK THEM!
![Page 34: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/34.jpg)
COLLECTING THE DATA
![Page 35: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/35.jpg)
COLLECTING THE DATA
101.63.235.197 [01/Aug/2012:13:44:31 +0200]
"GET /personal/visa_121.txt HTTP/1.1”
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1"
![Page 36: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/36.jpg)
COLLECTING THE DATA
![Page 37: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/37.jpg)
COLLECTING THE DATA
HOW DID THEY REACT?!
![Page 38: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/38.jpg)
COLLECTING INFORMATION
![Page 39: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/39.jpg)
COLLECTING THE DATA
![Page 40: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/40.jpg)
COLLECTING THE DATA
![Page 41: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/41.jpg)
COLLECTING THE DATA
![Page 42: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/42.jpg)
COLLECTING THE DATA
![Page 43: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/43.jpg)
SUMMARY
• PayPal Accounts • [email protected] • [email protected]
• Domains
• www.helpnsupportcentre.co.cc • www.pctechnocrat.com
• Domain owners
• Sudipta Ganguly • Rohit Kayan
• Company
• Kavish Technosoft
MORE INFORMATION WAS SHARED WITH
LAW ENFORCEMENT
![Page 44: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/44.jpg)
CONCLUSION
![Page 45: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/45.jpg)
CONCLUSION
![Page 46: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/46.jpg)
CONCLUSION
![Page 47: Unmasking the fake Microsoft support scammers!...david.jacoby@kaspersky.com Senior Security Researcher – GReAT – Kaspersky Lab Unmasking the fake Microsoft support scammers!](https://reader034.fdocuments.net/reader034/viewer/2022042317/5f0615937e708231d41635c7/html5/thumbnails/47.jpg)
David Jacoby
Senior Security Researcher, Kaspersky Lab
THANK YOU