Security Researcher Tricks Tech Support Scammer Into Installing Locky Ransomware

[Jack]

Ivan Kwiatkowski, a security researcher living in France, has turned the tables on a tech support scammer and fooled him into installing a copy of the Locky ransomware on his own PC.

Kwiatkowski's encounter with a tech support crew came after his parents had navigated to a dodgy website that tried to trick them into thinking they were infected with the Zeus banking trojan.

"This horrible HTML aggregate had it all: audio message with autoplay, endless JavaScript alerts, a blue background with cryptic file names throwing us back to Windows' BSoD days, and yet somehow it displayed a random IP address instead of the visitor's one," wrote the researcher on his site.

Just give tech support scammers "test" credit card numbers
While it was easy to fix his parents' browser, the researcher went home and decided to have a little fun with the tech support crew. He fired up a virtual machine, accessed the site, and then called the phone number included on the tech support website.

The researcher had three different calls with two operators at a call center in India, which didn't go that well, mainly because the researcher spoke French while the operators not so much.

During his last call, after he agreed to the scammer's request to buy a tech support package, he started giving the crook fake but valid credit card numbers, just to have fun at his expense.

Read more: Security Researcher Tricks Tech Support Scammer Into Installing Locky Ransomware

 

[DardiM]

Thanks for the share

"This horrible HTML aggregate had it all: audio message with autoplay, endless JavaScript alerts, a blue background with cryptic file names throwing us back to Windows' BSoD days, and yet somehow it displayed a random IP address instead of the visitor's one,"

That is the analog method I described here (with quick analysis) :
https://malwaretips.com/threads/warning-false-threat-detected-phone-number-scam.61208/
I found the google account used and reported them

 

[frogboy]

The good news story for the day.

 

[Ink]

Would have been better if their whole network got compromised.

 

[Deleted member 178]

Indian scammer again

Do you know that some ITs secretly use MT members' helpful benevolence to fix computers of their customers !

 

[Aura]

None, I reply: they're too expensive and @taviso keeps breaking them anyway.

My sides, I can't stop laughing

 

[FrankS]

Well done by Ivan Kwiatkowski. Ransomware at its best way!

 

[jamescv7]

For sure their security program is also known to be scamming on their system which why it did not detect.

 

[simbelmayne]

Cool story, but I can hardly believe that someone who is working in fraud schemes is so stupid =)

 

[DardiM]

The website and html used for this scam, it's level 0.5 on programming knowledge
I think the persons that you contact by phone isn't the same than the one who made it.
These last are supposed to received calls from more stupid person than them
=> Their job is easy : following steps to get payment from their target.
If the "target" want to "play" with them, they are not specially "prepared"