16

My father-in-law purchased a $400 lifetime support contract with a company (Cyber PC Experts).

Recently his computer has been acting up—running very slowly—so he requested support. The service tech took control of his computer remotely (from India) and pretty much fixed the issue.

A few days later, he gets an email from them saying that they need to check his computer again because it was hacked.

They did a few things to his computer while he was watching to show that it was “hacked.” Then proceeded to try to sell him a ~$1000 software/config to clear current “hacks” and to thwart future hacks.

I wasn’t involved until I heard this and went over to his computer and took over the phone conversation with the tech that was remotely using his machine.

My father-in-law told me that they showed him an IP address and then showed him the geographic location of the IP address and said that was where the hacker was. They even zoomed in and showed the building. It was a location in Los Angeles… Where my father-in-law lives.

I used a website to “Find My IP” and it matched up with IP address that the tech was showing him. Basically I think it was the public address that our cable provider shows as public for our home. I tried to “Find My IP” using other computers at his home and it gave the same IP address. So it was probably Time Warner’s data center.

The tech on the other end was also showing him the output of the netstat and top commands. They were telling him that there were a lot of “sleep”-ing processes and that supposeduly means his computer has been compromised. They also said that the high % of idle CPI cycles means that the computer was slowing down.

So, I basically kindly declined to buy the ~$1000 software to clean out his computer and prevent future hacks.

Am I right to call their bluff? Has anyone else encountered this kind of scam before?

Here are some report on Cyber PC Experts:

Improve this question
6
  • 5
    Also, would you mind telling us the company/service your father-in-law paid for? Why the hell do they want to charge $1000 for a fix if he already purchased a lifetime tech support contract for $400 anyway? – Omega Aug 23 '15 at 7:37
  • 4
    Would you mind adding the company's name? – klanomath Aug 23 '15 at 7:59
  • 2
    Sounds like a total scam from the beginning. Have you googled the name of the company? – Tom Gewecke Aug 23 '15 at 10:00
  • 8
    In all honesty, his computer was most likely compromised and hacked when he gave the person on the phone control of the computer. Situations like this often aren't just scams to collect money: they're social engineering to gain access to a computer (either to install malware/backdoors so they can access it later, or to scrape sensitive/personal data while they're "fixing" your computer). At this point, I cannot emphasize enough the importance to erase and reinstall as Graham suggests in his answer. Consider his computer already compromised. – Cornstalks Aug 23 '15 at 17:55
  • 2
    For that price you could practically buy a new Mac. – zundi Aug 24 '15 at 1:57
22

Your gut reaction feels correct. The description of sleeping processes and idle % CPU use is misleading.

The description of tracking IP addresses to a single location is unrealistic.

The costs involved are high. For that sum, consider suggesting your father-in-law engages a local Mac expert – or go to a local Apple Store for help.

Erase and Reinstall

If possible, back up your father-in-law's Mac to an external hard drive. Then erase and reinstall OS X:

  1. Before you begin, make sure your Mac is connected to the Internet.
  2. Restart your Mac. Immediately hold down the Command (⌘) and R keys after you hear the startup sound to start up in OS X Recovery.
  3. When the Recovery window appears, select Disk Utility then click Continue.
  4. Select the indented volume name of your startup disk from the left side of the Disk Utility window, then click the Erase tab.
  5. If you want to securely erase the drive, click Security Options. Select an erase method, then click OK.
  6. From the Format pop-up menu, select Mac OS Extended (Journaled). Type a name for your disk, then click Erase.
  7. After the drive is erased, close the Disk Utility window.
  8. If you’re not connected to the Internet, choose a network from the Wi-Fi menu.
  9. Select the option to Reinstall OS X.
  10. Click Continue and follow the onscreen instructions to reinstall OS X.

This should entirely remove any third party tools and processes that have been installed by the support company.

With the reinstalled OS X, only restore personal files and documents from the back up.

An Aside: Distractions and Blame

Please do not blame the father-in-law. We have not been asked to judge the company or individuals affected. @milesmeow asked for help to decide if their decision was defensible and if others have encountered this type of situation.

Improve this answer
6
  • What if they also installed some crap on the recovery partition ? The right way to reset the Mac would be to create a bootable USB stick from another, known-good machine and then boot on that instead of the recovery partition. – André Borie Aug 23 '15 at 9:55
  • While they may have affected the recovery partition, a simple recovery today would be a good start. If problems continue, a known-good clean reset should be the next step. Going to an Apple Store and flagging up this scam with Apple would also be helpful. With enough reports, maybe Apple will take notice and deploy Gatekeeper's filter on the related process signature. – Graham Miln Aug 23 '15 at 10:04
  • 2
    @AndréB. As long as you have an internet connection, you can reboot a Mac and it can start the whole complete reinstallation process from the internet. – gnasher729 Aug 23 '15 at 12:27
  • 1
    It worked for me with a brand new unformatted hard drive :-) I think the first thing downloaded is the recovery partition. – gnasher729 Aug 23 '15 at 14:43
  • 5
    The description of sleeping processes and idle % CPU use is wrong. – user207421 Aug 23 '15 at 22:16
14

A lot of the things they said are absolute nonsense. Sleeping processes are absolutely the norm. For example you might have a process looking after your printer, and that process will be sleeping 23 hours and 59 minutes a day except for the one minute where you are printing. High percentage of idle time: There's absolutely nothing wrong with that. Your Mac is supposed to be "idle" most of the time. "Idle" means your computer isn't using its battery, it isn't heating up, everything is fine.

Of course they are telling your relative this nonsense to frighten him into handing over more money. Common sense: What are the chances of a hack happening just after they fixed an issue with his computer? What a coincidence. However, there is unfortunately a chance that his computer is hacked - by the friendly guys who fixed it. And since they are trying to pull a scam on him, they cannot be trusted.

I'd strongly recommending to make an appointment at the nearest Apple Store to have a look at the computer, and for general advice what to do.

Improve this answer
1
  • 3
    Yep. Even if it's somehow not a scam, at best they're dangerously incompetent. In any case, get as far away from them as you can. – Gordon Davisson Aug 23 '15 at 16:27
7

My wife was subjected to a similar scam while I was away on a business trip. By letting a remote user install software that (they say) enables them to provide them with tech support, you have actually enabled them to install anything they like, for example, a program to trap keystrokes while you are typing passwords.

The only safe response is to delete and reinstall the OS from a new download and also reinsatall all applications, and then to restore only personal data files (no executable files) form the backup, as you have already been advised.

The scammers are relying on the fact that most users will not know what hidden viruses look like in netstat or a top. (If the computer really had been hacked, then netstat and top would probably have been replaced by hacked versions that did'no show the virus activity.) SLEEPING processes, as has been said, are absolutely the norm.

Improve this answer
5

Technically they are entirely correct that the PC has been compromised, and that the one who compromised it was your father in law, therefore using your father in law's IP.

By allowing a malicious third party (Cyber PC Experts) direct access to the PC/Mac, the Mac has been compromised, and must be reinstalled from scratch.

There are several warning signs:

  • They deliver lots of "proof" even tough all of it sounds somewhat fishy. If called out on one, they just offer another one. To someone with a software background it's immediately clear that what they are saying is wrong, so verify their proof with an acquaintance who works in software.
  • The cost is ridiculously high. This must raise warning flags. Any consumer protection software package is much less than $100 per year, software repairs are $300 tops. To avoid this warning flag, scammers often go for smaller amounts than the one stated in the question and then slap on a recurring charge or something similar.
  • If you type the name "Cyber PC Experts" into a search engine, the 3rd, 4th, and 5th link claim they are scammers.

So how to protect yourself?

  1. Before hiring a company, perform due diligence first, look up the company on a search engine. If someone else hired the company don't assume they did due diligence, so do it for them. The absence of any information is just as bad as the presence of information that claims they are scammers.
  2. If you get a blind call it's always a scam. Don't let them "prove" their identity with an email, because there are dozens of ways they can fake that for the average users.

One additional thing your father in law must do is to check his credit card statements, because he probably handed over his credit card to criminals. If he didn't, then he probably paid with a check, which carries it's own risk.

Improve this answer
1

Yes it's a scam.

It doesn't need 'evaluating'. It's a famous known scam run by a couple of outfits in India.

Windows users are plagued by it all the time, and you can do a search for "Windows support scam India" to get the picture, where they say 'It's Windows calling'.

They get you to do the equivalent operations on Windows, - to panic about some innocent system information that they try to present as evidence of a 'virus' and that you've been 'hacked'.

It sounds as if they have diversified their operations to Mac systems now.

Why did your father-in-law get roped into that ? Apple themselves offer a comprehensive aftercare package if you want it, albeit it can get expensive. Or you can just go into their 'genius bars' for free.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .