Thursday last week I visited a customer who had an intriguing tale to tell.......
Mrs. Smith, of The Ridgeway in Market Harborough, recounted to me that she had been called the night before by a "Microsoft Engineer" with a heavy Indian accent. The "engineer" told her that she had a problem with her PC that they had detected and they were calling up to help her. She was a little sceptical but followed their instructions.
They directed her to the System Log in Event Viewer and asked her if there were any errors. Indeed there were errors in the system log (as there almost always are). She was then directed to the Teamviewer website and asked to "Join a Session". At this point she became suspicious when they asked her for the username and password that Teamviewer had presented her.
Had she given this username and password the "engineer" on the other end would have had full remote control of her PC and could have done almost anything such as installing a virus, removing her anti-virus or stealing all of the information on the PC. Potentially they could have installed a small piece of software called a key logger and monitored everything she did on her PC such as online banking. Mrs Smith refused to give the username and password stating that her "computer guy" was coming in the morning and she would ask him to look at it. The Indian on the other line became threatening and abusive trying to intimidate her into allowing him access, resorting to profanity and eventually hanging up.
Fortunately for Mrs Smith she had already booked a computer service call with a PC PAL engineer and so she felt it better to have someone have a look at her PC in person.
This is the first time I had heard of this scam. It follows a familiar pattern of any scam - choose a "mark", create a bit of "pretext", use a "convincer", try to appear helpful and if that fails try fear or bullying a person into taking action. It is called Social Engineering and is a frequent attack vector on companies. It is the quickest way to circumvent all security controls and anti virus programs. A fairly infamous person who used this method to great success was Kevin Mitnick. His book "The Art of Intrusion" is an interesting read.
Searching the Internet, this is not the first time that this attack has been used on home computer users. It's clearly been going on for some time but that makes it no less effective. Staffordshire county council have even posted a warning on their website. If the so-called 'Engineer' person on the phone had been successful they could easily have caused untold mayhem.
So what can we learn from this? Firstly it does not matter if we have the best anti-virus or Internet Security suite if we do not use some common sense. Anyone calling up out of the blue and asking to connect to your PC should be refused. Never give up sensitive personal information such as date of birth, mothers maiden name, national insurance number, passport number and so forth to someone over the telephone (or Internet) unless you are certain that you must give out that information, but never give it to someone who has cold called you. Passwords should always be kept a secret.
Microsoft will only call you if you have logged a call with them. Microsoft do not have a habit of cold calling you. Visit the Microsoft Online Safety site to learn how to protect your family, protect you computer and protect yourself.
Keep safe out there!
