Schneier on Security

Clive Robinson • April 12, 2017 3:05 PM

I’ve yet to receive any unsolicited phone calls from “The land of the sweatypour TecSup scammer”, which might make me unique 😉

Not that they could “help” me as I’ve mentioned in the past I don’t connect mutable PC systems to the Internet as standard policy, and where I do have to make a connection to “download” I use what is effectively an “immutable” system with an older 486 based motherboard and “Real ROM” only BIOS and IO hardware with an older CD drive that likewise has “Real ROM”.

For those that want to do likewise, you are probably way to late to get a PC that lacks “Flash ROM” which is sadly mutable by rouge software. However if you have a hunt around you will still find PC104 embedded boards made for industrial control systems and those designing “Space Qualified” CubeSat systems, though they are by the time you put them together a tads expensive (around $500 is the cheapest you will pay).

However the question you should ask is “what price security”?

A cheaper option for all those that are not “Persons of Interest” to a national SigInt agency is to build a minimal system with next to no IO no harddrive or other mutable storage and a couple of realy cheap all in one motherboards. If the PC starts to “act odd” just pull the motherboard, swap the CPU and RAM onto your reserve motherboard and if the problem disapears, punt the motherboard onto sombody else second hand, and use the cash as part payment for your next reserve motherboard. If the problem does not disappear then change the minimal IO. I’ve built a couple of such systems for other people and so far they’ve not had to use the reserves due to malicious code, just the occasional cheap hardware early death and the swap fix was less than $100.

If you are more confident about your abilities you can also download in advance BIOS reflash for the all in one motherboards and reflash the motherboard if you suspect problems. However the only time I’ve reflashed a motherboard was when the motherboard manufacturer came out with an update.

As for stringing the scamers along, I used to get moronic “financial services” types calling along with the double glazing sales bods and market researchers. The number they called was one I only used for outgoing calls so had never given the number to anyone. After stringing a couple along you realised they were “working to a script” thus you did not actually have to speak to them other than give them phoney info to get them into their script. Then all that surficed was an audio recording that made an electrical scratching or drill noise and then you would say “I’m terribly sorry but I missed what you said due to that noise, could you please start again” and a couple of variations, you just leave it on an endless loop until they hang up.

Unfortunatly they have a habit of calling back again later which is tedious and a friend who had a PC based VoIP system found that a push of a button audio recording of a screaming totally enraged and frenzied person, not even pausing for breath calling them “illigitiamte”, “ladies of negotiable virtue”, “the offspring of satan / a camal / dung heap”, “questioning their ability to procrate” etc etc –but in less temperate words– generally not only got them to ring off fairly quickly, but also mark his entry in their call database with a “Do not call foul language” flag, thus you did not get repeate calls… As my friend pointed out if they are daft enough to call back there was plenty more where that came from. His view was that you would demoralize them slightly and potentialy put them off their game on the next call or with luck seek alternative employment or maybe even top themselves.