Re:I am calling from Microsoft and we detected an issue with...
by DyslexicAtheist on Tuesday January 08, 2019 @03:36PM
(#18859403)
in English:
The phone just rang at the CCC.
"Sir, I am calling from Microsoft and we have detected an issue with your windows installation."
JACKPOT.
I was connected to someone who spoke German. How convenient.
The nice lady helped me to set up the RDP access in the Windows 7 VM.
She then led me through a lengthy process. The system was infected, you could clearly see that at the terminal output (only really colored in red).
"There is a service fee to clean the system."
"I have my credit card data stored in a file, wait a minute."
The lady then copied the file directly to her own computer. Then it became quiet in the line. Perhaps the ransomware coupled to the file was responsible for this, which otherwise serves as a test payload for customer systems.
Of course, the variant only encrypts five files and then stops. So if you set it that way. Much cursing and the conversation was abruptly interrupted from her side.
Maybe I call back, pretend to be a Microsoft employee and offer to disinfect the computer?
The phone just rang at the CCC.
"Sir, I am calling from Microsoft and we have detected an issue with your windows installation."
JACKPOT.
I was connected to someone who spoke German. How convenient.
The nice lady helped me to set up the RDP access in the Windows 7 VM.
She then led me through a lengthy process. The system was infected, you could clearly see that at the terminal output (only really colored in red).
"There is a service fee to clean the system."
"I have my credit card data stored in a file, wait a minute."
The lady then copied the file directly to her own computer. Then it became quiet in the line. Perhaps the ransomware coupled to the file was responsible for this, which otherwise serves as a test payload for customer systems.
Of course, the variant only encrypts five files and then stops. So if you set it that way. Much cursing and the conversation was abruptly interrupted from her side.
Maybe I call back, pretend to be a Microsoft employee and offer to disinfect the computer?
source (in German): https://twitter.com/grauhut/status/1082650738927591425