Some people…

Yesterday

I had one of those pesky con artists, this time claiming to be from the Spark Security office (Spark is NZ’s largest ISP) informing me that there was a problem with my internet connection and it would need to be shut down, however if I cooperated the issue could be fixed on the spot. As usual, I let the caller lead me through the various steps of trying to gain control of my computer. As typically happens, she incorrectly assumed I was using Windows (I was asked to describe the key to the right of the left Ctrl key) and we spent a fruitless half hour trying to bring up the Run command box. However as I run a variant of Linux, that’s not an option.

Finally she attempted to get me to download and install a remote desktop application, on this occasion AnyDesk, usually it’s TeamViewer. It was at this point that let her know I wasn’t entirely stupid and needed verification that she was indeed who she said she was. We then spent another twenty-five minutes discussing or perhaps arguing about her credential. Strangely, when I told her that so far this year I’d had at least ten hoax internet related calls she tried the “not everyone is evil, so you should be more trusting”. Yeah right.

We spent another twenty or so minutes while she tried to persuade me that all I needed to do was trust her, and I insisted I wasn’t able to do that. She finally gave up after (for her) a frustrating fifty-four minutes. I despise the actions of such individuals. I’m not going to judge the person as harshly as I don’t know their circumstances, but attempting to fleece someone simply because one can is surely a marker of one’s contempt for others.

Today

The Wife and I went to our usual barber/hair stylist for haircuts plus a beard trim for me. He’s a very sociable guy who seems to be able to encourage his clients to chat about all and nothing. The Wife had her hair done first and the room filled with loud and very public conversation between her and Ihaia (the barber) including politics (NZ and the US), families (his and ours), the weather (it’s been atrocious today), and of course Covid (especially the regarding deniers and anti-vaxers). Even I am able to participate although perhaps less fluidly than other customers, and always privately. During my time in the chair, I happened to mention that yesterday was our fiftieth wedding anniversary.

Afterwards, as the Wife was about to take out her EFTPOS card Ihaia told her to put it away as the haircuts were on him. When the Wife asked why, he said it was a fiftieth anniversary gift. Obviously, she hadn’t heard my conversation with him. While the Wife almost broke his neck in a heartfelt hug, the other customer clapped and cheered. Now that’s a good feeling.

Conclusion

While I’ve been at the receiving end of abuse for much of my life, I understand why. Most people are able to empathise only with what is familiar to them. They have no way of understanding what an autistic person experiences – hell, even many so called autism experts have no clue – so they judge my behaviour in neurotypical terms. Making allowances for that, I find most (but not all) are kind and generous.

Then there are the few who have little or no interest in the well being of others, and seem to have utter contempt for them. One being the former POTUS and another being yesterday’s “Spark security officer”. Fortunately I’ve never met one in person. They either arrive in news items, by email or telephone, always from a location outside of Aotearoa. It’s only since the internet has become ubiquitous that I have had personally experienced scam attempts. I wonder if this says something about the internet, or modern society, or is it simply a reflection of the fact that I’m fortunate to have been born in the least corrupt nation on earth?

Distressing

This afternoon I spent some time on the phone while three “experts” from Spark (my telephone & Internet provider) tried to “help” me solve a “problem” with my Internet connection.

I usually enjoy these “sessions” and try to string along those providing the “assistance” for as long as possible. My aim it to make their “support call” stretch out to more than an hour, but today I only achieved 43 minutes. My reasoning is that while they’re trying to scam me, they can’t scam someone else.

Today I chose to put the phone onto speaker so that I would could have both hands free to undertake other activities while frustrating the hell out of the callers. This was the first time I’ve done that. And it was my undoing.

The wife, who is much less tolerant or sensitive towards people who she believes is in the wrong, today showed a more sensitive streak.

In most interactions with others, I tend to be as courteous and polite as possible, and the wife frequently chastises me for not being more aggressive or confrontational in cases of disagreement. Usually she has little regard to the sensitivity of others when it comes to achieving her goals. She can be ruthless. I know. I have witnessed her in action for nearly 50 years. My ways are much more gentle and yet I’m not convinced she’s any more successful than I am.

I must admit that I find it difficult to read emotion at the best of times no matter how hard I try, but when it comes to dealing with people such as this “help desk” trio, I honestly have absolutely no interest whatsoever. And when it comes to dealing with scammers such as these, I’m grateful for having this autism characteristic.

I had switched the phone to speaker at about fifteen minutes into the call and the wife was able to listen in on the conversation. At first she seemed amused, but when I glanced up at about the 30 minute mark, her grin had gone and something which I have learnt to be associated with concern was showing. Concern for what or who I couldn’t decipher.

However, at about 40 minutes I could tell that the wife was clearly upset and I assumed it was because I was wasting time and hadn’t completed a task for her that I had started moments before the phone rang. At that point I let the the trio know that I knew they were scammers. Of course they tried to bluster their way out and threatened to suspend Spark’s services to me. On my suggestion that they do so, they hung up.

It was only then that I discovered why the wife was upset and distressed, and that was because of how I was winding up the trio According to the wife, they were very frustrated and the woman caller was almost in tears. This was a surprise to me as I’ve seldom witnessed her being sensitive to the feelings of others in times of conflict, and never when she considers the other to be in the wrong.

She’s brought up the subject of how upset the woman was on several occasions over the rest of the afternoon and into the evening, and I can only assume that she was sensitive to their emotions because she was not directly involved – she was an observer and not a participant. Whatever the reason, it is a new and surprising revelation to me. Even after all this time she can still surprise me.

Lesson learnt. Next time (and that’s bound to happen again before the year is out), I won’t enable the speakerphone.

Come on then, I dare you…

I am reasonably tech savvy. I worked in the I.T. industry for 35 years providing technical support in the banking and retailing sector, and although I retired from the industry almost 20 years ago, I have retained an interest in it, and in computing in general.

So when my Spam filter catches an email such as the one below, I sigh, knowing every claim made is absolutely false. I don’t need to fear that there might be a chance that what I view online will be disclosed to anyone I might (or might not) know.

While I prefer to keep my online browsing preferences private, there is nothing that would be terribly embarrassing or worse if others were to discover them. And to ensure that I don’t stumble across websites I’d rather not see, my home network makes use of DNS filtering through OpenDNS.

It’s not perfect. I stumbled upon copies of the Christchurch shooter’s live streaming of the event when it appeared on popular social media sites in the days after the incident, even here on WordPress. But for me personally, I appreciate the high level of selective filtering it provides, so the chances of any user on my home network being able to view an online pornographic video are remote.

Leaving aside the remote possibility of anyone watching porn from my home network, let alone my computer, and for the benefit of the scammer, here’s why the email can safely be ignored:

Hello,

Hello to you too. If you had access to my computer as claimed further below, I’d expect you to know my name, and to use it to prove the legitimacy of your claim. Using a salutation without my name is the first indication that you really know nothing about me

As you may have noticed, I sent this email from your email account (if you didn’t see, check the from email id). In other words, I have fullccess to your email account.

No you didn’t. Spoofing the from address is an extremely simple and trivial process. Every email client (even Outlook Express)  provides an easy means of doing so. Besides, a quick check of the email header, provides all the information I need to know that the message originated somewhere other than my own email account. In this particular case you relayed your email via a Yahoo mail server located in the USA.

I infected you with a malware a few months back when you visited an adult site, and since then, I have been observing your actions.

Really? Even on the very remote chance that I accidentally came across an “adult” site and that the site contained malware you had inserted, the odds of it being code that could infect my computer are orders of magnitude smaller. I don’t use a popular Web browser and I don’t use a popular operating system. While no operating system is perfect, any vulnerabilities discovered in Linux are patched almost immediately. This is one of the advantages of using an open source operating system. So unless your code is targeted specially towards Linux, and is using some as yet unidentified vulnerability that you discovered more than a year ago, it’s simply not possible to install malware at the operating system level.

The malware gave me full access and control over your system, meaning, I can see everything on your screen, turn on your camera or microphon and you won’t even notice about it.

Even in the extremely remote chance that malware has been installed, and that it had managed to gain root access when my logon user ID hasn’t, nor do any of the applications, including web browsers, have root access, your claim that the malware was capable of manipulating my camera and microphone is laughable, You see, there needs to be a camera or microphone for you to manipulate. There isn’t. But ignoring that inconvenient truth, shall we continue?

I also have access to all your contacts.

Aside from having access to a nonexistent camera, your malware, you would need to have an intimate knowledge of my operating system, and the software installed. Your malware would have to know what software I use for my contacts and where on the system the information was stored. Give me that information and I might believe you.

Why your antivirus did not detect malware?
It’s simple. My malware updates its signature every 10 minutes, and there is nothing your antivirus can do about it.

As I run Linux on my computer, I have no need for antivirus software. You also clearly don’t understand what a signature is. It is not something within your malware. It’s something antivirus applications create from information gleaned from malware. It doesn’t matter how much your malware modifies bits of its code, the antivirus folk are clever enough to figure out how the modifications are made and build in a suitable method of identification. And as you have been sending me identical messages for more than a year, I have every confidence that if in fact there was any malware at all, every antivirus application would have long ago figured out how to identify it. So I have every confidence that even if I did run a version of Windows or MacOS, which I don’t, I would be well protected by any antivirus program I chose.

I made a video showing both you (through your webcam) and the video
you were watching (on the screen) while satisfying yourself.
With one click, I can send this video to all your contacts (email, social network, and messengers you use).

I’m rather fascinated by your claim. In fact I look forward to viewing said video. I’ve looked and looked, but for the life of me, I cannot find this web cam. Can you enlighten me?

You can prevent me from doing this.
To stop me, transfer $989 to my bitcoin address.
If you do not know how to do this, Google – “Buy Bitcoin”.

My bitcoin address (BTC Wallet) is 1Hmn2KAK2Z3VjkpMz26nmh9KVAV6KqYiYp

If you have access to my computer, could you not have simply accessed my bank account and my credit card details?  The username and password for my online banking are stored in encrypted form within my web browser and surely it would be a trivial matter for you to obtain it, especially if you have access at the operating system level. You wouldn’t even need to decrypt the password. With your supposed knowledge it should be a trivial exercise to fool the browser into decoding it for you.

After receiving the payment, I will delete the video,
and you will never hear from me again.
You have 48 hours to pay. Since I already have access to your system
I now know that you have read this email, so your countdown has begun.

As it’s been close to 9000 hours since I received your first email, and I have received around to 200 subsequent messages, why should I believe this 48 hour deadline is any more final than all the others? It’s quite obvious that you have no idea whether or not I have read your message. The most common technique for knowing if an email has been read is by embedding web link to a transparent 1 x 1 gif. My email application does not display linked images by default. I have to explicitly enable it for each message. The other common technique is to include a flag requesting an acknowledgement when an email is read. My email application is configured to never send an acknowledgement. Besides, I read the contents of your email from within my online Spam filtering system control panel, which, not being an email client, can not open links nor send acknowledgements.

Filing a complaint will not do any good
because this email cannot be tracked.
I have not made any mistakes.

You fail to understand how emails are sent. I can tell exactly the last server and location that the message passed through before it arrived at my mail server (yes, I have my own mail server). Armed with that information and the cooperation of email server hosts, I can track the message to a vpn and beyond, or to a compromised computer. I’ll concede that I’m unlikely to find your identity, but that’s of little concern.

If I find that you have shared this message with someone else, I will immediately send the video to all of your contacts.

Well, as you can see I have shared it. Come on then, send the video. I dare you.

Take care

Of what?

Some further details for those still reading: Some of the messages contain a username and password that I possibly did use many years ago, but not in the last ten years. Over the three decades that I have had online access (does anyone remember NCSA Mosaic?), I have been notified a few times that a website I use has been hacked and and there’s a remote chance that user credentials might have been compromised. This is the most likely source of the user credentials included in some of the scam attempts. In most cases, they have been sites that I had stopped using, but even in the two cases where I am still an active user, I’m not particularly concerned.

You see, I never use the same username and password on more than one site. Yes folk, I’m one of those nerds that use a different user ID and password for every website, and for every computer login. Perhaps I’m fortunate in that I also own several domain names, and can create an unlimited number of email addresses. So even though a great many websites now require an email address as the user ID, I can still create a unique email address/user ID for each and every site.

What the scammer probably doesn’t realise is that every Spam filtering system worth its salt, now recognises such messages as Spam, and will have done so for many months. The intended recipient is unlikely to even see these blackmail attempts.

Hacked router follow up

I was hoping for an interesting episode this morning following yesterday’s fake Spark call regarding a hacked router. It was rather a let down.

The call didn’t come until 10:30 am – an hour late. The caller seemed to be unaware of yesterday’s call, while I stuck to role playing a continuation from yesterday. I kept interrupting their prepared script to tell the caller that I was fully aware that why they were calling and could they just cut to where they could fix it. Eventually I got put through to the “national router specialist” who would help me. As he started through his script, I continued to interrupting to virtually repeat what he was about to say. This would totally confused him and he would start off from the beginning again each time I fell silent. I’m sure his ability to understand what I was saying was almost zero, but hey, I’m an elderly guy with a strong Kiwi accent and I played the role of a bloke that is rather short of patience. He struggled for around 15 minutes to make headway, but it was blindingly obvious that he was not able to deviate from his prepared script. I reminded him that someone from Spark called yesterday, which he denied, so I asked how I knew what he was going to say before he said it. Then he hung up.

I’m sure they’ll call again in a few weeks. and I’ll try to play a more patient personality. Today’s effort only wasted little more than fifteen minutes of their time. I do hope it was sufficient to keep at least one person out of their grasp.

Oh no! My router’s been hacked!

Or so says a Spark (my telco and Internet provider) technician who phoned me a short while ago. I’ve had several phone calls a day over the last week from a variety of South Island phone numbers, but invariably, either the caller hung up as I answered, or did within a few seconds. Today one of those callers made a successful connection. The call went like this:

Tech: hello sir. I am [name unrecognisable] from Spark technical support.
Me: Hello. What can I do for you?
Tech: We are calling you because there is a problem with your router. Do you understand?
Me: I understand what you are saying. Why do you think it has a problem?
Tech: I’ll show you. Look at the lights on your router. Are any of them blinking?
Me: Just a minute while I go look. It’s in the next room. Hang on a mo. [pause of around 30 seconds] Yes, several lights are flashing.
Tech: Can you tell me which ones are blinking?
Me: Hang on a bit will you, I didn’t note down which ones. I’ll just grab a a pen and paper and be back in a jiffy. [Quietly] Now where’s a pen that works? [short pause, then louder] Got them, Back in a second. [40 seconds of silence] Are you there? The lights that are flashing are Internet, W L A N, L A N 2, L A N 3 and L A N 4.
Tech: OK sir. Do you know what the WLAN light is for?
Me: Please, tell me.
Tech: WLAN stands for “Wireless Local Area Network”. Someone is using your wireless connection without your permission. That blinking light is an alarm saying that the wireless network has been hacked.
Me: Oh dear. How do I fix that?
Tech: That’s why we’ve called sir. I’ll just transfer you over to one of our router specialists who will lead you through some simple steps to solve the problem. Just wait a minute while I transfer you.
[30 second pause]
Tech2: Hello sir, I’m Gerald [or perhaps Gerard?] from the Spark specialist support team. Do you understand why we have called you?
Me: I think it’s because someone is using my wireless router without my permission.
Tech2: That’s right. But I’m here to help you fix that. Someone has hacked the router so that they can do all sorts of things without you knowing about it, and that flashing light is a warning. You should have reported it you know. It will only take a moment to fix if you follow my instructions. Can we go ahead and do that now?
Me: Sure.
Tech2: As you may understand, a router is digital appliance, and as it doesn’t have its own screen or keyboard, we need to communicate with it by using another device such as a computer or laptop. Do you have one of those?
Me: Yes I have a computer.
Tech2: Good Turn it on please.
Me: Just a minute. [Another 30 second pause] Ok it’s on.
Tech2: That’s great. Is it a Mac of a Windows computer?
Me: How do I tell?
Tech2: There should be a brand name or logo on the computer. Can you tell me what it is sir?
Me: It says “Dell”.
Tech2: It’s probably a Windows Computer, but just to be sure, do you see a button with “CTRL” nearest yo you on the extreme left of the keyboard?
Me: Yes.
Tech2: Does the button to the right of it have a Microsoft Windows logo on it?
Me: What does the logo look like?
Tech2: It looks like a wind with four panes of glass.
Me: Yeah. It does look a bit like a window.
Tech2: That confirms it’s a Windows computer. So this is what I want you to do: Hold down that Windows button and hit “R”.
Me: Done that.
Tech2: Did a window pop up?
Me: Yes.
Tech2: OK. Now type in C for Charlie, M for mother, D for Doctor.
[pause while I type s.l.o.w.l.y.]
Me: Done that.
Tech2: now hit Enter and tell me what you see.
Me: Exactly the same as what was there before I pressed Enter.
Tech2: Can you tell me what you had typed?
Me: C for Charlie, M for Mike, D for Delta.
Tech2 [with some hesitation]: Um… That’s right. [pause] And you say nothing happened when you hit enter?
Me: Well, I didn’t exactly hit it, but I did press it firmly.
Tech2: I see. It looks like the hackers have done more than hack you router. We’re going to have to get into this more deeply. But don’t worry, we’ll put an end to those hackers, although we will have to do a bit more at our end first.
Me: I see. What do I do now?
Tech2: We’ll make some preparations, then would it be OK to call you back between 9 and 9:30 tomorrow morning?
Me: Sure, I’ll make sure I’m here.
Tech2: That’s great. I’ll call you back between 9 and 9:30. Goodbye, sir.
Me: Goodbye.

I’m looking forward to tomorrow. What they don’t know:

• For 35 years, I was an engineer for a major international I.T. Company, and for most of that time specialised in networked systems in the banking and retail sector.
• Our home network consists of Linux and Android devices only (plus a Kindle). There isn’t a Windows device in sight, and hasn’t been for more than 10 years.
• I know they are scammers.

If I’m in the mood, I like to string these pricks along for as long as possible. The last few times, I haven’t been, so I’ve asked them to quote my Spark account number, and of course they were unable to do that. I invite them to call me back when they have it, but for obvious reasons they never do.

In (Not) Windows Support Desk I relayed a similar incident, although this time I look forward to my role play as a less than savvy senior Internet user. After all, they are role playing at being support personnel, so it seems only fit and proper that I play an appropriate role for them. I am impressed with their apparent courtesy. Being addressed as “Sir” all the time, might be flattering to some people, but I know it’s simply because they have no idea what my name is. I wonder what term they’ll use when they eventually discover I’m playing with them.

I’m not confident that they will call back tomorrow morning, but I really hope they do. The longer I keep them tied up, the less opportunity that have of doing real harm to someone else. It’ll be my good deed for the day.