<br><div class="gmail_quote">On 21 June 2012 13:08, Chris Robinson <span dir="ltr"><<a href="mailto:fabricator4@yahoo.com" target="_blank">fabricator4@yahoo.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
>________________________________<br>
> From: Chris Debenham <<a href="mailto:chris@adebenham.com" target="_blank">chris@adebenham.com</a>><br>
>To: Boden Matthews <<a href="mailto:boden.matthews@gmail.com" target="_blank">boden.matthews@gmail.com</a>><br>
>Cc: <a href="mailto:ubuntu-au@lists.ubuntu.com" target="_blank">ubuntu-au@lists.ubuntu.com</a><br>
>Sent: Thursday, 21 June 2012 10:02 AM<br>
<div>>Subject: Re: virus phone call scam: question/wacky replies<br>
><br>
><br>
</div><div>>* Call them out on this all being a scam (in the process have had threats and rather bad language shouted at me)<br>
><br>
<br>
<br>
</div>I've actually done that one. I was at my father-in-laws house - he's 90 and has never even owned a computer.<br>
<br>
The person (female) did not get abusive, but rather got upset and admitted that it was a scam. Surprise! I like to think it might have been a life changing experience for her ;-)<br>
<br>
I like the idea of letting them have access to a VM, just to see what will happen though. I'd be a little concerned about all the other computers on the same router though - some of them (the wife's) are Windows computers.<br>
<span><font color="#888888"></font></span><br></blockquote><div><br>I have actually tried this before.<br>I setup a virtualmachine and put it in it's very own VLAN (so can't access other machines) I also setup routing so it was the default destination for a while.<br>
They get you to go through a few steps to show some 'errors' (which are not really a problem)<br>Then they get you to go to a website and install a remote-access application to they can access your system directly<br>
(note that some of the the webpages they can refer you to even have a nice big warning about scams :) )<br>After this they futz around a bit 'cleaning' the system.<br>At this point it is all pretty innocuous.<br>
The big problem is that after all this the call ends - but the remote-access software is still installed!<br>
I left the VM running for a few days and kept an eye on it (with wireshark running on host to track network connections to the VM)<br>Nothing much happened that day - but the next evening around 9pm there was a connection to the remote-access software and someone spent a while looking around on the computer.<br>
They did things like looking for documents, and checking browser history/password store.<br>Since the VM was a clean install they didn't find anything and left after a while.<br>At this point I shutdown the VM and got rid of that VLAN/routing setup<br>
</div></div>