News for hackers. Stuff that matters.
Re:Don’t plug in that free Microsoft Office USB drive you go... by iforgotpassword on Saturday August 20, 2022 @04:08AM (#32530234)
Yeah like, I see that it's cheap to run those scam ads on fishy websites and just wait until someone is tricked into calling, or run a robocaller and wait until someone presses 1.

But having all this designed, ordered, packaged and shipped, just so maybe the receiver calls seems way too much effort. How does this scale? I'd see this make sense for targeted attacks, but like this? Wow.

Re:Don’t plug in that free Microsoft Office USB drive you go... by sigmoid10 on Saturday August 20, 2022 @06:56AM (#32531023)
I don't really see the design or packaging as an issue, after all that can be done for cents apiece in high volume productions. But the USB drives are definitely interesting. Even when ordered in large batches from cheap chinese manufacturers, they will probably cost a dollar per drive. So if you send that to 10k people, you have to expect a very high payout. The approach is certainly more effective than a spam mail, but then again sending an email costs several orders of magnitude less. So I wonder if this is really orders of magnitude more likely to capture people. Perhaps with strong pre-selection.
Re:Don’t plug in that free Microsoft Office USB drive you go... by surfpel on Saturday August 20, 2022 @05:53PM (#32535467)
$1 per drive for how much storage? I’m sure these don’t even need a single Gig. Probably could get lots of super cheap ones during liquidation events or salvage operations and what not.
Re:Don’t plug in that free Microsoft Office USB drive you go... by sigmoid10 on Saturday August 20, 2022 @09:12PM (#32536557)
I just looked it up: Even if you accept less than 1 GB you'll have a hard time finding drives below $3. The USB controller chip alone is about $1 and you need some actual storage and a casing as well. Even if you're really proficient at acquisition and manage to get them for 10% of that price, it's still orders of magnitude more expensive than email based spam.
Re:Don’t plug in that free Microsoft Office USB drive you go... by surfpel on Saturday August 20, 2022 @11:34PM (#32537186)
> ...USB controller chip alone is about $1...

That's for official parts and at lower quantities I presume. Knock off chips are often pennies, especially at scale. When I buy chips for side projects, I often just source them from ebay/alibaba where you can get them for ridiculously cheap prices. [1][2]

> ...it's still orders of magnitude more expensive than email based spam.

Relative to how much they drain from elderly folks retirement accounts, I think it's a logical investment for them given that existing scammer tactics are being made obsolete.

In any case, I just checked Alibaba and found several listings [3][4] that claim ≤50¢ at scale. They look rather professional and you could even brand a logo on them.

1 - https://www.ebay.com/itm/392526892417 (USB - Serial converter, NOT a USB drive IC)

2 - https://www.ebay.com/itm/392540419491 (power bank chip)

3 - https://www.alibaba.com/product-detail/Usb-Drive-Usb-Drive-L...

4 - https://www.alibaba.com/product-detail/Cheap-customized-Logo...

Re:Don’t plug in that free Microsoft Office USB drive you go... by sigmoid10 on Sunday August 21, 2022 @06:35PM (#32545187)
Half a dollar is still orders of magnitude more expensive.