Tech Support scam baiting?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Dec 16, 2015 4:26 pm

Wim wrote:

"
In the grey area between tech support scam baiting and being malicious myself I’m thinking of creating an application that looks like a online banking app which connects to my (obviously fake) bank account.
When tool is run on the Honeypot target it would look like a genuine application with little or no security but when the tech support scammer transfers it to his own computer and runs it there it would trash his pc as much as possible (only local pc is targeted and the app would delete itself as its final action to avoid it going viral)
"

That's not a grey area - it is the creation of malicious code and therefore against the forum rules http://forum.419eater.com/forum/viewtopic.php?p=1468641#disallow

Quote:

We do not support the sending of viruses and "trojans" to the scammers, nor attempts to hack, phish or hijack their email accounts and/or computers. Viruses and "trojans" will be unknowingly spread to the computers of innocent people and we are only trying to make it difficult for the scammers. On top of that, the spreading of viruses and hacking attempts is an illegal activity in the UK, where this Board is located, as well as many other jurisdictions. Please do not start topics on such subjects. Such threads can and will be deleted on sight.

Posted: Wed Dec 16, 2015 4:32 pm

Straight baiting - this just means acting as much like a real victim as possible without fun and games or silliness. Can be used for gathering and reporting bank accounts, or just wasting a scammer's time, or just figuring out how different scams work (among other things). It can also be used to make a scammer think you're worth the effort before you unleash weirdness on him.

On the subject of baiting sites, B8er already wrote what I was starting to say. Malicious software is against the rules here.

Hello I'm New here! Joined: 15 Dec 2015 Posts: 15

B8er wrote:

That's not a grey area - it is the creation of malicious code and therefore against the forum rules http://forum.419eater.com/forum/viewtopic.php?p=1468641#disallow

Well I wouldn't be 'sending' him the application. The purpose was for him to download it himself when he spotted it on the target pc ... But I see the reasoning behind it so I'll drop it.

Now ... removing the 'trashing his pc' part from the application, what about the alternative I suggested?

Posted: Wed Dec 16, 2015 4:36 pm

One other area of caution is creating anything that looks like a fake bank. See the case of the First National Bank of Bedrock (pdf), although this happened a long time ago it shows that some kinds of "baiter tools" attract notice of official bodies leading to all sorts of wasted time by innocent third parties (ITPs).

Similarly, anything that looks like a phishing site will also probably go down in flames very quickly and should be avoided as well.

Hello I'm New here! Joined: 15 Dec 2015 Posts: 15

firehouse5 wrote:

One other area of caution is creating anything that looks like a fake bank. See the case of the First National Bank of Bedrock (pdf), although this happened a long time ago it shows that some kinds of "baiter tools" attract notice of official bodies.

Similarly, anything that looks like a phishing site will also probably go down in flames very quickly and should be avoided as well.

It wouldn't be anything that's readily visible online.

(Just thinking out loud for a possible scenario) When a lad is really pressing to make the money transfer and you're running out of excuses, he is allowed to connect to your own computer (in reality a protected VM somewhere safe) and he can follow your screen as you make the transfer.

... Meanwhile there are several documents on your desktop with titles such as 'financial report.xls', 'your prospect bonus.doc', an unfinished e-mail in the background about a 25 million dollar deal.

... something like that

Posted: Wed Dec 16, 2015 5:25 pm

We don't send malicious softwear. Period.

One of the reasons we don't is because a lad may be using a computer that doesn't belong to him. We have very stringent rules about not involving innocent third parties. We also do not want risk infecting victims of a scammer.

So by download or by email, not on this Forum

Posted: Wed Dec 16, 2015 6:40 pm

Welcome to Eater, Wim

Quote:

When a lad is really pressing to make the money transfer and you're running out of excuses

You can never run out of excuses.

I have one lad that I have been baiting since last march and I am still baiting him. We have been to the money gram office several several times.

Just a few suggestions.

Go for the piggy, These means a lad gives you a bank account information and your report that to a mod (the names in green) and you get to put a pig in your signature.

Your Character forgot the money gram receipt or you sent your friend/ family member to go make the payment and they forgot to get the receipt.

Your character has bad eyes and cant read the numbers very well and keeps giving the wrong numbers.

Your scanner is broken.

Your Car broke down and had to spend the money getting fixed. He will have to wait until payday.

My personal favorite The Dolla Chop (lads get really pissed at this one).

You never run out of excuses or angles to play. Be creative and If you do find yourself stuck don't be afraid to ask.

Posted: Wed Dec 16, 2015 7:04 pm

People who send Downloads that transmit the information discussed have another name: hackers. Looks, we've already been through we don't send malware and now we're on a subject that is illegal in most every jurisdiction. It may be speculative, but thems the rules.

Posted: Wed Dec 16, 2015 7:40 pm

Hello Wim and welcome to Eater. Although this thread has gone through some unexpected turns while I wrote my post, let me add a few things.

Please visit and read these:
*** 419 EATER FORUM RULES - PLEASE READ *** - Some excerpts have already been posted by others.

Definitions of scambaiting terms - This should help with some of the nomenclature used.

You referenced this:

Quote:

Although this site concentrates mainly on the Nigerian 419 scam, we are happy to deal with other types of scams if and when the opportunity arises.

By "deal with" we are usually referring to describing how the scam works, not how to "bait" it. Speaking of this, because your question is outside of the normal 419 email scam, I have taken the liberty to move it to the Miscellaneous Scams Forum.

Included in the post was B8er's quote:

Quote:

This kind of thing would never have happened when SOOI was in charge.

It was a friendly barb directed at me and my comment in the thread. As was explained, he is a former Moderator and Admin of the site. I <strike>was</strike> am still his only mentee to survive and so he, in a rabid squirrel way, refuses to graduate me from our mentor program. It's all an inside joke that most who have been here for a bit understand.

As for why we don't really discuss how to bait these Tech Support scammers, well, Juan linked to the thread and that reasoning stands. Ultimately, baiter safety is often compromised and that goes against what we preach.

If you want some ideas on what IT specialists have done in the past, check these threads:

Link 1
Link 2
Link 3

Another reason we don't really "encourage" or "discuss" techniques with dealing with the Tech Support scam is that it, inevitably, leads to discussions of hacking or installing malicious software on someone's computer. This activity is illegal. Eater has been around for awhile, and we'd like to remain that way.

Now, with all that said and as a final warning to prevent locking, we won't discuss illegal activities here, nor "techniques" for baiting those types of scammers (there are other sites out there for that). If you would like to discuss the baiting we do, feel free.

Edited to fix link and add I deleted a post that was suggesting downloading malicious software to a phone. We don't do that shit, either. Come on people!

Hello I'm New here! Joined: 15 Dec 2015 Posts: 15

yes, yes, yes ... this is a work in progress and now we're already 2 steps beyond the 'trash the pc' concept and I dropped it in any way or form 10 posts back. Please don't get hung up on it. I mentioned it once, I retracted it twice and now I'm trying continue to work on another concept around a similar platform.

I even dropped the tech support scam baiting idea right after the first reply I got so there is not even a need for a final warning ... there wasn't even a need to move the thread since I'm just brainstorming what tool could be usefull for AFF scam baiting within the original setup I had in mind. If it finally turns out to be nothing kile it ... so be it.

Where I was first trying to build something from my own idea I'm trying to work with you guys to mold and transform it into something useful for this platform.

I understand you are (all) trying to protect something good here where you invested a LOT of time and effort from some idiot IT guy who subscribed only yesterday, knows nothing about 419eater but thinks he's a godsend
... So I certainly understand some emotions are involved but please, people, read the thread before reacting to a sinlge post.

And now the thread has been moved into obscruity ...

Posted: Wed Dec 16, 2015 10:32 pm

Yes, you mentioned it and retracted, etc. The final warning, wasn't necessarily meant for you. You asked that I read the entire thread. I have. From beginning to end, as the posts were posted. Then I reviewed it, read it again, went back, had another look then finally posted. I would have done so earlier when you first mentioned my name, but real life prevented it.

As you have asked me to read it, I will ask you to read the links I provided for some ideas as to concepts created by other "IT guys."

You have gotten hung up a bit because I moved the thread. First, it doesn't fit under what we do as "scambaiting." Second, at the top right of the Index page, you will find "View posts since last visit." Many of us use this. However, if you are discussing ideas for 419-related IT modalities, it's very easy to start a new thread.

So far, you haven't proven yourself to be an idiot. We can keep it that way, if you would like. You've said you were going to read around. Do so to get a general idea of what works and what doesn't.

-bware419ers

Tech Support scam baiting?	View next topic View previous topic