TFBW's Journal: Winpopup: Now they REALLY want you to phone me!

In their latest mutation, our spam-kiddies are now using the Windows message protocol to put up alerts on the screens of unsuspecting Windows users. These contain a dire warning that your computer has been compromised, and you should contact tech support -- on my home or mobile numbers. (My thanks to the person who submitted this in my feedback box.)

Message from NUTTERS.ORG to X.X.X.X on 3/25/2003 4:48:35 PM
A HACKER HAS GOTTEN INTO YOUR SYSTEM
CALL TECH SUPPORT IMMEDIATELY:
[phone]
OR
[phone]
YOUR ENTIRE SYSTEM MAY RESET IF YOU DO NOT CORRECT IT.

Yes, folks, TFBW's tech support service is standing by 24/7 to solve your problems -- even if we've never heard of each other before.

How many more tricks do you think they have up their sleeves? And how cussedly stubborn am I going to be about putting up with this in good humour? Stay tuned to find out!

Oh the irony!

[TFBW]

One of the people who phoned me about this matter ended the call by asking if I'd be interested in making "residual income"! Can you believe it? If only he knew!

Assessment

[TFBW]

TFBW's impromptu technical support line has determined the following things about this particular attack after conversation with customers. The people in question seemed to uniformly be Telstra Broadband (cable) customers running the dreaded Windows XP. Shame, shame, shame on Microsoft for leaving their customers so vulnerable to spoofed messages. There's nothing quite like being the indirect target of such an attack to get a feeling for how serious an act of neglect this is.

The attack seems to have starte

Other variants on the popup

[TFBW]

There are at least two other variants that the spam-kiddies have used so far in the Messenger Service popup thing. One involves a virus warning with the distinctive string "JCANEDA" and instructions to "call your ISP", with my phone numbers provided.

The second shows the depths to which these kiddies will go in their attempt to annoy people. It says, "known pedophile Brett "the famous" watson my be in your area. His targets are young boys ages 5-12 and he is to be considered very dangerous. Las seen in NSW,

New message today

[TFBW]

The latest message is something about your computer having contracted the "Brett Watson" virus by "Nutters.org". It contains my usual contact numbers, and also suggests that the victim call Telstra, which is good advice, given as how the vast majority of these people are on Telstra's broadband service.