[My colleague Josep Albors, knowing of my interest in support scams, recently contacted me about the spate of support scam alert messages reported by some users of iOS devices, the idea being to persuade the victim to ring a scammer ‘helpline’ by making them believe that they’re talking to a legitimate helpdesk about a real problem. Here’s a summary of the Spanish-language blog he wrote following our conversation. This article will be added shortly to the tech support scam information resources on this blog.]
Telephone scams that masquerade as support services have been with us for years. In fact, our colleague at ESET, David Harley, is an expert on the subject and has spoken at length on the topic in the blog WeLiveSecurity .
Over the years, criminals have honed their techniques, trying to increase the number of victims drawn into this deception. Today we will discuss one of the most recent cases of support scams, mainly targeting users of iPhone and iPad devices.
ALERT
This time the criminals have changed their approach and are no longer cold-calling their victims passing themselves off as support service staff trying to help victims solve non-existent problems on their computers (at a price, of course). In this instance, they are looking for users to call them after seeing some troubling ‘alerts’ on their devices intended to make them think that something is wrong with their system.
In the last week or two several users (mainly in the US and UK) have reported seeing an alert window in the Safari browser on their iPhones and iPads. Our colleague David Harley addressed this specific issue in his blog about threats to Mac and IOS .
Victims see a screen popup that indicates that the system has crashed because of a third party application and advises them to call a phone number for an immediate solution.
The peculiarity of this popup is that, however much you press the OK button, the message will still appear in your browser, even if you close it and return to open.
Fortunately, it’s possible restart the browser and close the tab before it is loaded (or take a more drastic measure by deleting all browser history) so as to remove this annoying message. The purpose of the scammers is to make victims believe that there really is a problem so that they will make the phone call, whereby the scammers will ask for money in order to solve the non-existent problem.
Here’s the format of a typical message of this type:
[URL of scam site]
Due to a 3rd party application in your phone,
iOS is crashed Contact Support
for Immediate Fix.
[US toll-free number]
[OK]
Other variants claim that clicking OK will send a bug report to Apple and state explicitly that the ‘support line’ number is Apple’s.
DETECTION OF THIS THREAT
It is easy to fall into such traps where the default browser (Safari in this case) does not react to this kind of deception and does not block malicious sites as some other browsers do.
If you try to access a malicious web site with Chrome or Firefox from a desktop computer, you will see a warning that you have been targeted by a phishing attack and access to the malicious web page will be blocked.
Some security solutions will also detect this website as a potential phishing threat if you access it from your browser on a desktop system, or indeed on an Android device.
CONCLUSIONS
David Harley comments:
There are a couple of interesting aspects of this variation on the support scam: one is that it’s a further indication of a trend away from cold-calling and towards luring potential victims into calling the scammer. In the past it’s also been done by seeding social media sites with testimonials, or fake support sites using scraped content and dubious generic advice, as Martijn Grooten and I discussed in a blog some years ago.
There have also been many reports recently of tech support services advertised in the US where calling gets you into a conversation with someone using very similar, misleading sales techniques as those we associate with the classic cold callers from Indian call centres: see, for instance, http://www.welivesecurity.com/2015/06/03/confessions-support-scammer/ Tellingly, one of the ‘confessions’ I quoted there made the point that:
Basically we had “marketers” who would put pop ups on people computers saying that they may be infected with a virus and giving them a number to call.
The advantage of seeding the internet with fake pop-ups is that the technique has the potential to work across almost any platform, depending on how secure the browser technology is. (For instance, similar attacks have been reported on OS X/Safari very recently.)
The third interesting point – though it actually follows on from the second – is that when people call you to describe their problems, you don’t have to invent over-used gambits like the Windows-specific CLSID and Event Viewer tricks to convince them that they have a problem. So again, it’s platform non-specific.
It seems clear that criminals continue to incorporate new techniques to ensnare new victims. As far as telephone scams specific to fake support are concerned, the claims we see are more-or-less complete fiction, but we will watch with interest to see what further innovations they come up with.
