A Close Call: Almost Fell Prey to a Scammer

Another bright and sunny Saturday morning. Having been granted permission to work for the day, I was happily making pancakes in the kitchen. Suddenly a burst of shouting came from the spare bedroom. I hurriedly turned off the range hood, and only then could I make out my wife — “the boss” — anxiously summoning me to deal with a “serious problem” with her computer. Her machine was emitting a piercing beep, and on the screen was a terrifying dialog box, worded as sternly as the classic Windows blue screen. My first instinct was to shut it down and restart, but my wife said it wouldn’t turn off, and the dialog box warned that a forced shutdown would damage the data. I was puzzling over why a problem of this caliber wouldn’t simply be a shutdown-and-send-for-repair situation, but rather one that forbade shutting down, when my wife thrust a phone into my hand, saying she’d already contacted Apple customer service and was on the line with them now, and couldn’t understand the operations the rep was telling her to perform.

I took the phone. The piercing buzz from the computer droned on without end, and the rep was Indian, making it rather hard to catch every word. He told me gravely that this situation usually meant a serious piece of malware had already corrupted the boot information, and that shutting down or restarting would leave the machine unable to boot normally. He walked me through pressing several key combinations as if teaching a primary schooler, and I patiently tried them all — none worked. He repeatedly confirmed whether I’d done exactly as he said; I said yes. He asked whether I’d opened a certain system program; I said no.

The call dropped. The buzz was still shrill and maddening. I started asking my wife how the problem had come about. She’d only said a few words when the rep called back, interrupting our conversation again.

Then the rep had me hold Shift while opening Safari. Still puzzled, I opened it anyway. Letter by letter, he dictated www.support.me for me to type. The domain looked extremely respectable — phishing sites usually aren’t this classy.

img

This domain redirected to https://secure.logmeinrescue.com/Customer/Code.aspx. I took a quick look at the site — likewise not a phishing site:

img

The rep asked for my name and assigned me a code. After entering it, I landed on a download page. I downloaded the app and opened it. The app didn’t ask for any special permissions, nor did it make me enter an admin password or install anything. The rep explained that he needed me to authorize him to control my desktop, so once the app opened, it asked whether to allow xxx remote control — I clicked yes. Everything looked perfectly legitimate. It was every bit as professional as the way IT used to remote-control my Mac back when I was at Juniper.

After taking control of my mouse cursor, he asked if I could see it; I said yes. He opened the control panel, clicked into Security & Privacy, and saw that my firewall and FileVault were both off. He told me that because my firewall and FileVault were off, malware could easily get in. The firewall being off puzzled me — it might have conflicted with Norton’s firewall; I’d turned it off earlier when I installed Norton, and my wife wouldn’t have touched it for no reason. FileVault I simply hadn’t enabled — this machine was just for her to browse the web, hardly worth encrypting every file. The rep told me that from now on I shouldn’t use this computer for online banking, online shopping, or anything of the sort. I said okay. Then the rep noticed Norton on the computer. He said we shouldn’t have Norton installed — Norton was very compatible with Windows, but poorly compatible under Mac, and Mac’s built-in firewall was good enough. This put me on alert: the statement was partly reasonable (Mac’s security makes Norton less necessary than on Windows), but hearing it come from the mouth of an Apple rep felt off.

I asked my wife which customer service number she’d dialed. She said it was the one in the alarm dialog box: 617-714-0762. I immediately opened my laptop and Googled the number. Damn it — sure enough, it was a phishing number! All sorts of scams!

Meanwhile, the rep was putting on a show — he opened the Console and showed me netstat, saying: “Look, there are so many ESTABLISHED connections here — do you recognize all of them?” Then he opened the log viewer, filtered by error, and said these were all behaviors of malware. I watched his performance and asked what the next step was. He said, “I need full control of your system, and then I’ll do various cleanups.” I said I’d just go to an Apple Store and have someone help me reinstall the system. The rep got anxious — he opened Apple’s website in Safari to show me the AppleCare terms, and said that would cost me money, $249, whereas with him it wouldn’t cost a thing. By now the phishing was glaringly obvious. I immediately turned off the Wi-Fi so he could no longer access the computer, then told him I still preferred to take it to an Apple Store. He kept jabbering on, trying to persuade me to fix it online. I ignored him and hung up.

After hanging up, I was filled with regret. First, I should have looked up the number sooner. In the year-plus I’d spent in the US, I’d developed a habit: whether it was a voicemail, a text message, or a number given to me mid-call to call back about some service, I’d always Google it to see if there was any problem with it. There are simply too many scammers in this world — you can’t guard against them all. This time, because I’d started with a preconception (my wife told me it was Apple customer service), I didn’t verify the number right away and took a hit.

Second, I should have ignored the rep and instead first asked my wife to understand how the problem had arisen. If I’d known earlier that the dialog box had suddenly popped up while she was browsing, I might have looked more carefully at the root cause. The maddening buzz and the rep on the phone — these high-tension distractions occupied my brain, keeping me from thinking clearly.

Third, I shouldn’t have downloaded and run software so carelessly. Although support.me / LogMeIn Rescue is legitimate software used by many companies’ IT departments, scammers cleverly exploit systems like these to carry out their cons.

Looking back, let me lay out the scammer’s playbook:

• Lure the user into calling a “customer service number” via a pop-up on a web page
• Win the user’s trust through professional tools (LogMeIn)
  • Explain how malware might have gotten in (e.g., firewall not enabled)
  • Use the contents of netstat / the log viewer to “prove” the system has been compromised (ordinary users have never touched such tools, and have no idea what the contents mean)
  • If the user’s system has software that would interfere with their subsequent operations (like Norton), try to plant seeds of doubt — that the software is incompatible, problematic, and so on
• The rep then escalates to requesting system access (having the user type in the admin password or hand it over), so as to install malware in broad daylight

So when you run into something strange, don’t panic — Google it first to confirm. Google is still, to this day, the most trustworthy partner you have. If Googling a phone number or URL turns up negative information, you should be on your highest guard. Also, no matter how much groundwork a scammer lays, their ultimate goal is always to get you to hand over: your admin password, your credit card, certain specific pieces of information (Apple ID / password), and anything else that can be tied to money. So the moment you notice such a situation, you should be on alert at once — don’t just give whatever a fake “customer service rep” asks for.