In July 2024, a flawed security software update caused widespread disruption across various sectors, including flights, healthcare, and banking. This chaos provided an opening for scammers who executed support scams by exploiting people's fears, claiming they could resolve the issues but actually seeking to take over systems and steal data. The video examines how these scams operate by leveraging real events and incidents to deceive people.

Support scams often start with something real, like a software failure or natural disaster, which scammers exploit to contact potential victims through various means such as phone calls, emails, or pop-ups. They might pose as tech support and convince individuals to download software that gives them control over the victim's data. The video warns against falling for these traps by staying skeptical and vigilant.

Main takeaways from the video:

Please remember to turn on the CC button to view the subtitles.

Key Vocabularies and Common Phrases:

1. outages [ˈaʊtɪdʒɪz] - (n.) - Interruptions or failures in service, especially electricity or technical systems. - Synonyms: (blackouts, disruptions, interruptions)

There was an update and it caused massive outages.

2. scammers [ˈskæmərz] - (n.) - Individuals who perpetrate fraudulent schemes to deceive others in order to gain something of value. - Synonyms: (fraudsters, swindlers, tricksters)

Here come the scammers and they're feeding on people's fear.

3. soft target [sɔft ˈtɑːrɡɪt] - (n.) - A person or location with little to no protection, making them vulnerable to attacks or exploitation. - Synonyms: (easy mark, vulnerable target, defenseless spot)

This soft target heard about that news that's already in the background.

4. vectors [ˈvektərz] - (n.) - Paths or means by which something is spread or communicated to another area or group. - Synonyms: (channels, routes, conduits)

Lots of different vectors of getting some sort of communication between the bad guy.

5. exploit [ɪkˈsplɔɪt] - (v.) - To take advantage of a situation or person in an unfair or deceitful way. - Synonyms: (manipulate, abuse, misuse)

Now how are they going to exploit what really happened to their advantage?

6. trojan [ˈtroʊdʒən] - (n.) - A type of malicious software that tricks users into loading and executing it on their systems. - Synonyms: (malware, virus, worm)

It's what we know as a Remote access trojan.

7. disinfect [ˌdɪsɪnˈfɛkt] - (v.) - To cleanse and remove harmful or unwanted elements, particularly in a computing context to remove malware. - Synonyms: (cleanse, purify, sanitize)

Here's some special software that we need you to download onto your system in order to disinfect the virus.

8. implant [ɪmˈplænt] - (v.) - To insert or fix something in a place, especially secretly and usually by deceitful means. - Synonyms: (embed, place, introduce)

Keep them up to date with the latest security software. That's going to make it harder for the bad guy to implant that rat.

9. persistent [pərˈsɪstənt] - (adj.) - Continuing to exist or occur over time, often despite challenges or opposition. - Synonyms: (enduring, ongoing, perpetual)

Those things are not always persistent across a reboot.

10. beachhead [ˈbiːtʃˌhɛd] - (n.) - A secure starting point from which further progress is made; in tech, a stable position gained within a system to launch more actions. - Synonyms: (foothold, base, stronghold)

If your system is patched, it's harder for them to establish that kind of beachhead into your systems.

Support Scams - The Hidden Threat to Your Data & Cyber Security After Major World Events!

Thousands of flights canceled, doctor's offices shut down, banks unable to transact business. People can't even take their money out. All of that happened in July of 2024 as a result of a widely distributed bad piece of security software. There was an update and it caused massive outages.

Well, that was bad enough, but then like ants to a picnic, here come the scammers and they're feeding on people's fear, uncertainty and doubt in order to conduct what is known as a support scam. They say they're there to help help resolve this issue and get things back in operational again. In fact, what they're there to do is take over your system and steal your data. What can we do about support scams? In this video I'm going to take a look at what they are, how they work and what you can do to guard against them.

So how does a support scam work? Well, it starts in truth, so we start with an actual thing that really happened. So for instance, as I mentioned in the beginning, there might be, let's say, security software that we happen to know had some major outage or let's say there's a major data breach, for instance, one of the telcos recently had one of those and lots of people's information was compromised in that. It could be your favorite operating system and the technical support related to that.

And then these things are all sort of it related things. But think larger because there could also be natural disasters and things of that sort. So maybe a tidal wave, an earthquake, famine, any of those kinds of things. So something that really in fact happened, this happened, there was news that was made and this soft target heard about that news that's already in the background. Now the scammer comes in to exploit that.

Now how are they going to exploit what really happened to their advantage? Well, the way they're going to do it is they're going to contact the victim and they could do it a lot of different ways. They might do it with just as direct a thing as doing a phone call with a person. They could do it through an email, they could do it through an SMS message, they could do it through a pop up that occurs on the victim's system because maybe they've already gotten some software on that system and now they can control the system at least to that extent. So they put up the pop up message that says, you know, you've got an issue here and now you need to fix this and when you click on this, then call us.

So sometimes they put something up that makes the victim call the bad guy. So it could happen either way. It could even be in a snail mail. Something as low tech as that. How would that be? You send a letter out, you put in a QR code and say if you need support, click on this QR code, scan the QR code and then follow the website. Which then leads us back to this person.

So lots of different vectors of getting some sort of communication between the bad guy who's going to exploit this and the good guy who knows about the issue but doesn't really understand all the details of it. What he's going to say is, I am, let's say, tech support, and we found a problem on your system and we need to help you fix that. So you need to do the following things.

For instance, in many cases, they're going to tell you, here's some special software that we need you to download onto your system in order to disinfect the virus to take care of that, what have you. And this thing is not going to help. It's what we know as a Remote access trojan. It's software that, once it's downloaded, gives this guy complete control over his system. He can see all the data that's on there, he can erase it, he can make copies of it. He has complete control at that point.

So in other words, all of the good stuff on this guy's system now essentially belongs to him. There are a lot of other different versions of this as well. Where one of these things, somebody says, the natural disaster, okay, we're raising money for this particular cause or that thing. Wouldn't you like to contribute? Here's a website, go there and contribute. And in fact, where you're doing is sending your money to that guy, not to the legitimate ones.

So in other words, this guy capitalizes on something that really happened. It again capitalizes on the fear, uncertainty and doubt of a real world incident. And that makes this person a soft target. Okay, I've talked about the problem. What am I recommending that you do the best thing. The best prescription against this is skepticism. You've got to be skeptical and not believe every single thing you hear or receive or phone call that you get or anything of that sort. You've got to wonder about these things, and hopefully you will now that you see what is happening and what's possible.

For instance, your operating system vendors, tech support people are not going to cold call you out of the clear blue. They're not going to do that. They're not going to say, we've been looking at Your system and we see that there's something going on with it, okay, just hang up at that point. Also, the IRS is not going to call you directly and tell you that you've got back taxes to pay. They will contact you through other means first. I had that on good authority hearing it directly from a director at the IRS at a recent security conference I attended.

So be skeptical about these cases where they're making the contact to you first. Then if you do get one of those emails or phone calls or anything like that, let's say it's a phone call and they claim to be one of these organizations and you're not sure, well, guess what? Look it up. In other words, say, you know what? If you're really with this organization, fine. Tell me your name, your employee number, I'm going to hang up, I'm going to call that organization and see if in fact this is legitimate.

And when you do the call up, you look it up on your own. Don't take the phone number that was in the email that was sent to you. Go to your own search engine and look it up that way. Then make the call, then make the contact. So that way you've done verification. Don't just trust what you got.

Also, you want to patch your systems. Keep them up to date with the latest security software. That's going to make it harder for the bad guy to implant that rat, that remote access trojan that I mentioned to you, or a lot of these other kinds of things where the pop ups start coming and you don't know why, and the pop ups are saying you're infected with malware. Well, in fact, a lot of those popups are in fact the malware itself that is then trying to get you deeper down the hole. So if your system is patched, it's harder for them to establish that kind of beachhead into your systems.

Also maintain good backups. You want to make sure that whatever information you have that's sensitive, you've got multiple copies of it. Maybe one copy in the cloud, another copy on a local disk device of some sort so that you can go to either one as necessary.

And then if you do keep getting those pop up messages telling you you've been infected, you need to do this, you need to call this number, you need to whatever, just do this. Reboot your system. That may not fix all of them, but it'll fix a lot of them because those things are not always persistent across a reboot. If it is persistent and you reboot and it still is there, well then what you could do is reboot into safe mode. And then from there, after you've already downloaded one of the reliable malware scanners, use it to scan your system and disinfect it from anything. That way, when you reboot again, you'll come up clean.

And then, ultimately, after you've done all of these things, make sure to pass the learnings on to others. Help others. Tell your parents, your grandparents, your kids, your friends. Make sure they know that these kinds of things can happen and this is what they need to be doing about it. In fact, send them this video. That way they'll be protected just like you are.

Cybersecurity, Support Scams, Fraud Prevention, Technology, Education, Global, Ibm Technology