Hacker News Reader

Comment by BorisMelnik | Hacker News Reader

This may sound cliche, but ransomeware truly is plaguing the nation. 3 "phone room" busts here where I live in the last month or so, all of which were the "tech support" hot lines that you called into after you've paid the ransom to "fix your PC."

sure, there are many different levels of extortion. Some outfits are very upfront i.e. "your PC has been locked..." others are much more subtle and appear to come across as a legit operation and it isn't until you speak to your techie son-in-law that you find out you've been hit.

IMHO the best way to nab these guys is the phone rooms. More and more cities / states are requiring these rooms to have licenses and in my city the FBI has set up a temporary shop to go after these guys.

View on HN

What exactly is a phone room and how will it help stop ransomware?

A phone room or boiler room operation will not stop ransomware - in fact quite often it's another sort of scam in itself.

Here's a short article explaining the process and the Verge covered the subject in length: http://ipensatori.com/2014/05/27/tech-support-scams-what-lie...

http://www.theverge.com/2012/5/10/2984893/scamworld-get-rich...

thank you, exactly. lots of that going on here. 3 years ago it was timeshare sales then timeshare recovery i.e. "helping victims get their money back from the scam, which in and of itself was a scam."

The problem is not the ransomware neither the criminals ... it's the way internet/computer users became completely unaware of what they are using and blindly trusting everything.

Think of this as a natural balance to the ridiculously insecure internet and people's tech culture. If we are all going to live in a world where we use internet and technologies everyday, we should have a minimum of knowledge on how it works and not blindly trust everything.

One other point, it's useless to try stopping these guys, they are selling the software on the blackmarket with source code, the more you catch the more room you give to new criminals and the better breed the virus becomes ...

I think you're right: People are not afraid of computers anymore, and when they are, it's in all the wrong ways.

When I was younger the internet terrified people. I learned all kinds of simple "don'ts" in the 90s that it seems all got completely forgotten within a decade and now no-one learns anything anymore.

I didn't even use my real name online until a couple of years ago. It was like the first rule of the internet: never put your real-life details on the internet.

Now we have Facebook.

News stories and Outlook viruses made it abundantly clear that you should never ever ever click an attachment if you didn't specifically request it and know exactly what it is (And even then, best to double check).

Now there's a whole bloody black-market industry built on attachment malware.

I was told to never re-use passwords, never write them down, and never give my password to anyone.

Now we have apps that conveniently collect every single one of your passwords to provide a single-point weakness where one password unlocks your entire bloody online identity, and the point of even having separate passwords is completely lost. And it's somehow supposed to be 'more secure'.

I don't understand the internet anymore.

The point of services like last pass is that a website with shitty security won't compromise all your accounts on websites with decent security.

The point is you only trust one security specialist company rather than many non security specialist companies.

It's getting to the point where if you don't use something like lastpass, then reusing passwords to some extent is needed - or do you remember 20 different passwords for each site you visit, even when you visit them only once a year?

You're right that the password-vault part is the weakest part of the post, I think, though I'd argue many people probably don't even use (relatively) secure options like LastPass, and probably default to "password managers" built in to browsers or OSes.

I just have this weird cognitive dissonance when I see the 'big threats' that get posted sometimes online. The other day I read a Reddit post about some Dangerous New Threat to Bitcoiners, that amounted to nothing a slightly-more-clever-than-average attachment virus. I don't understand how anyone managed to get as far as even operating a Bitcoin wallet and somehow never learned basics like "don't click blindly on email attachments".

> I don't understand how anyone managed to get as far as even operating a Bitcoin wallet and somehow never learned basics like "don't click blindly on email attachments".

Perhaps you're not the best person to be giving security advice if you don't understand why people - even those who should know better - click on email attachments?

I bet you don't know how the power circuit in your fridge works and still you expect it not to burn down your kitchen while you sleep.

Not quite. A better analogy here is this: there is a supplier of fridges that is notorious for unreliable power circuits. People know this, and buy those fridges anyway, hoping that it won't happen to them, because the fridges are popular and have a particular copyrighted layout of the door and shelves so that they don't have to learn anything new when visiting friends or moving to different house. Initially, the fires weren't the people's fault; but when the people kept buying and installing those fridges in spite of the problem, they expressed their disregard for the issue with their dollars. At that point, they began to deserve the consequences. (Of course, the analogy is quite flawed because not everyone knows; there are always some new users who think they are getting a safe fridge, and are cheerfully sold the death trap.)

Just don't be surprised when everything turns into a walled garden.

Reply on news.ycombinator.com