full-disclosure - Phone Scam

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 20 Jul 2011 14:19:37 +0100
From: Dave <mrx@...pergander.org.uk>
To: full-disclosure@...ts.grok.org.uk
Subject: Phone Scam

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

OK This is not new, but it happened to me just an hour ago.

A stranger on the end of a phone call tells you your PC is infected, and you should download and install a RC server so it can be fixed.

I just been through this and installed Ammyy admin from ammyy.com (Whois - dataguarded) as per the strangers instruction on a VM XP install.
Nothing to see here, so what, big deal etc. etc.

What maybe interesting to some is the IP address it connected to:
prag178.startdedicated.com 62.75.224.229 ports 443, 80, 8080

I reveal the IP address for those of you who might like to update IPTables, databases or just like to write down numbers.

These people scam the ignorant PC user into believing their PC is rife with viruses and trojans in order to get them to part with money.
I wasted an hour of their time, got a first hand education and most likely an infected XP VM to analyse.

regards
D
- -- 
Mankind's systems are white sticks tapping walls.
http://www.propergander.org.uk
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEVAwUBTibV6bIvn8UFHWSmAQKwOQf/T3P9uZ0/OIvRT308j3XEvr6zm7WBgJTP
SGhvrLzCh9utqdgwKl21kIW/EOdgZ4tw1XsRGLYM4Y3uqrdop1RlufDgm3XWs8W5
WNUQvq7KbqpGpTkfeA+FN2aNp14n2yKLFuLCVYn4lbiQQLD/iENa4qPasBV0QBHW
z5MMKdoH13GLrdRn4Z2IfpxKZDKAoKL3TkyWd44qOLam8KqVG0ziPDWuoLF86krq
tek5yIS1+Ijdaqut+V2mOGgXL8Edlp8Q4uwqzIrba3WALrmtEXIw675EGzNP6Bg7
6tJCYYwITwsinvcOvJR84o9C3p1zTZ7uSfxKf91kZF/xbK1V5OBUaA==
=trZf
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/