Menu
What's new
By:
Filters

OT: fraud attempt. Should I be worried?

Nick Batzdorf

Nick Batzdorf

Moderator
Moderator
There are several programmers here, so I'm hoping someone can answer this.

Today I searched for a tech support number for my new horse-sized Canon fine art printer, called the number I found online, and it turned out to be fraud assholes in India. (The issue was just an option it turns out I didn't scroll down far enough to see, it's working fine.)

At first they sounded legit, but I started to get suspicious after they'd had me install a remote access program before asking me to do anything on my end.

When the guy asked me to unplug/re-plug it in, and I said no, doing that will cause it to go through an unnecessary and expensive cleaning routine that uses a lot of ink when I turn it back on again. The idea was to get me to leave the computer so they could do bad stuff without my watching.

So he asked me to go to a website "to download new drivers," and the site had a warning. I said no, I'm not comfortable with that. He said "fine, solve it yourself if you think you're smarter than me" and hung up.

I did see they had the Terminal open, and I had typed my computer password to allow the remote access software. But I think he would have continued trying to work me if they'd been able to capture my keystrokes. (In retrospect I wish I'd captured what he'd typed into the Terminal. Damn.)

A Malwarebytes scan doesn't turn up anything, and of course I deleted the hell out of the remote access program (which is probably legitimate, they're just abusing it).

Should I be worried?

I reported it to the FTC and to Microsoft (I use Bing as a search engine).

TIA
Click to read more...
 
Last edited:
If they had remote access at any point in time, you should consider your computer completely compromised. Reinstall everything from scratch, and throw out any automatic backups from after the date of compromise.

Most scammers are low level crooks who don't have any sophisticated malware to install, and just rely on convincing people to send them money directly. But there are a small number who do use more advanced methods, and if they opened a terminal on your computer, it's certainly possible that they could have run something nasty to allow for persistence going forward.
 
QuiteAlright said:
If they had remote access at any point in time, you should consider your computer completely compromised. Reinstall everything from scratch, and throw out any automatic backups from after the date of compromise.
Click to expand...
Exactly! If they had remote access, the correct thing to do is to erase evrything and start from scratch, and if available restore from a backup before this incident. Remember to change passwords.
 
EgM said:
What he typed in terminal is saved in ~/.zsh_history

Go in the terminal and type 'nano .zsh_history' and you can scroll up and down with the arrow keys

*edited zsh
Click to expand...
Thanks. It's not showing me the history, unfortunately:

The default interactive shell is now zsh.
To update your account to use zsh, please run `chsh -s /bin/zsh`.

When I quit Terminal it told me that it would stop running the process it was running. Does that just mean I need to be more patient?
 
pegotico said:
Exactly! If they had remote access, the correct thing to do is to erase evrything and start from scratch, and if available restore from a backup before this incident. Remember to change passwords.
Click to expand...
Oh man. Can they really get through my router's firewall?

That'll take forever.
 
Sorry, @Nick Batzdorf. You've been had.

Here's a guy who tricks these scammers: https://www.youtube.com/@ScammerPayback
Very entertaining, but also you learn a bit about their methods. One thing that might make you feel better is that it seems a common m.o. for the scammers is that they do semi-legit IT work, but then fuck you when it comes to payment. They have you go to your banking site, do reverse-transfers, etc. So there's a chance that nothing bad will come of this because you nope'd out. But still, you should definitely change all your passwords :-( :-( :-(
 
Nick, dear boy, you have no alternative but to

wipe your pc
meaning burn it all down to bare metal

check that it is clean

then and only then do you take that precious backup

and reinstall it all.

or follow the advice below....

 
You must log in or register to reply here.
Top Bottom