Saturday Morning Phishing Call

Fairly early Saturday morning, my phone rang. Although I didn't recognize the number, I answered, learning during this election period that if I ignore the pollsters attempts to contact me, they just call back, again, and again...(I don't know if it is that my opinion is extremely valuable or if there are just lots of pollsters that I receive so many calls. I suspect the latter.)

“Hello?”

“Yes, hello, Lee. My name is Marcus, and our servers have detected some hacking in your computer, and I am calling to help you.”

I don't know about you, but it always throws me off a little when a stranger calls me by name. However, I was instantly alert, mostly due to the use of a verb (hacking) in place of a noun, and the accent. I would place Marcus in India. I would expect his servers to find a virus or malware – the results of hacking. Not completely certain how they would detect the act of hacking without detecting the results of hacking.

“Marcus, please tell me my computer IP address where you detected the hacking.”

“Lee, I don't have your IP address, but I do have the ID of your Windows computer.”

“Continue, Marcus. What is my computer's ID, and please, which version of Windows am I running?”

The version question was just to string him along a little. I realized as I asked it that there was a good chance he could guess correctly – I think there are only 3 versions remaining in widespread use. I chuckled, thinking of the scene in the movie Elf where Elf asks the department store Santa, who he believes is fake and wants to prove it, “Yeah? If you're the real Santa, what song did I sing for you on your birthday?” “Why, Happy Birthday, of course!”

I was really intrigued, and a little concerned, that he might actually have my computer ID. So, I wanted to play along just to see. While we continued talking I was busy pulling up the two values that he might have: My computer ID and my Windows ID, just to see which he might give me as 'proof' that his servers had indeed detected hacking on my machine.

Marcus was pretty slick, too. He didn't attempt to answer the Windows version question, deflecting with “I'm not talking about your OS. I'm talking about your computer ID”

“I'm ready, Marcus. Please, give me my computer ID.”

“888DCA60-FC0A-11CF-8F0F-00C04FD7D062”

Whew. That was neither my windows ID nor the number on the back of my computer. Didn't match my MAC address, either. But what was it, and why would Marcus think I would accept it as my number?

“That's not my computer ID, Marcus.”

“Sir, it is your CLSID. Please, press your windows key, and then 'r', and type the command 'assoc'”

Some more time occurred as I acted stupid and had him explain several times where the windows key was and how to recognize it. (For humor imagine a non-English speaker attempting to describe what that key looks like – nothing I was hearing made any sense!) I know well what windows+r would give me the command prompt, and I wasn't going to start running unfamiliar commands that some caller asked me to. So, while he was busy attempting to get through to me what to do, I was searching (I don't 'google', since, #1, Google is a noun, and should not be used as a verb, and #2, I don't use Google has my search engine, having switched to DuckDuckGo) for 'Assoc scam'. Which I found, here.

I also typed help assoc in the command window, and realizing that the assoc command by itself was only Marcus' attempt to 'prove' his legitimacy, I typed it. And sure enough, there is the CLSID that matches the string Marcus gave. Fortunately, the CLSID is not unique to any particular computer, and so I now knew that Marcus possessed no identifying information on my computer.

It was time to end this phishing call. “Marcus, that value is not unique. In fact, that is a known scam, and that makes you nothing more than a common thief, a worthless piece, a horrible human being, and a waste of resources. You should find something constructive and productive to do rather than attempt to steal.”

I suspect that Marcus did not want my (well meant) advice: He hung up on me! Oh well...

But my taking this call had become a useful teaching opportunity for me. My children had been following along wondering just what was going on. They were very excited by the conclusion, but we were able to go back over the details: How I had revealed nothing to the caller, not answering any of his questions, asking my own to stall, searching details, being very suspect of his motives. We talked about good security – I absolutely didn't run any command he asked me to, and that I could have just ended the call early (which is probably best) – and that legitimate companies will not call and ask you to allow a connection to your computer.

The final point is the most important: Your bank, your doctor, your credit card company, none will initiate a call to you and ask you for personally identifying information or a connection to carry out their business. Neither will the FBI or any other legitimate institution.

It is interesting, with all the high profile stories in the news about hacking, the majority of theft of ID or financial information still occurs through phishing – one person talking to another, and manipulating the victim into giving out the necessary information. As we've become more sophisticated in our understanding of phishing, so the phishers have gotten more clever at presenting 'proof' they are who they represent to be.

The stakes keep growing, too, as more and more personal information is gathered on us and stored on Internet connected devices. As we've seen, through the breach of Target, Home Depot, and Sony, large companies are not up to keeping our data safe.

Which poses the question: Should they even be allowed to maintain data on us? Should it even be a possibility that Marcus could have obtained (perhaps through a hack of a major computer reseller) my actual computer ID? Or my user profile as stored up by Google, Microsoft, Yahoo, Amazon, etc.?

Security expert Bruce Schneier thinks about this a lot. Through reading his book 'Data and Goliath' and rebuffing attempts like this morning, I've started thinking about it more, too.