A perfect example of social engineering was a program called XP antivirus program used all the methods
were discussed to convince a user to start it.
XP in a virus was created to win the money as users were required to pay for it.
This largest social engineering attack in history took place at the end of 2008
after entering a web site links to which were all over the Internet or window looking just like any
system window came up.
In the slide you can see a window created for Windows XP.
But later versions of Windows Vista were prepared to weather one version came up or the other was purely
random because the script didn't check the version of the victims operating system.
But users usually didn't notice that
the message said attention if your computer is infected you could suffer data loss which is something
nobody wants
erratic PC behavior.
PC freezes and crashes.
In 2008 most computers were prone to such problems.
So most users reading such a message thought that it was created specifically for them.
The message ended with the question do you want to install XP antivirus or scan your computer for malware
now.
Sure you'd want to OK was a highlighted option when a user clicked it.
The attack went on.
The message was straightforward detect and destroy viruses before they destroy your computer.
If a user clicked cancel another message came up this time asking the user why they don't want to protect
their computer if the user chose OK.
The window that came up suggested that a system scan was being performed the scan always detected a
large number of the most dangerous viruses of all sorts.
Names of these viruses were fake.
The scan was a scam to
even in 2008 it was impossible to remotely scan a hard drive without any kind of interaction with the
user.
It was just a realistically looking animation.
Please note that all messages were written in perfect English
automated translations examples of which we have seen previously were used.
It all looked rather professional
after the scan was finished.
A user was presented with two options to ignore the threads was one of them but nobody would ignore
such threats.
Everyone chose the other option.
Remove all this however required users to install the XP antivirus Donlin version could only perform
a scan but to delete the viruses.
The full version was required.
For people who understand how operating systems work such a strategy makes sense attackers must somehow
convince the user to perform actions they need him or her to perform.
You can scare the user.
You can promise them something or you can do both.
The goal of the first phase of the attack was to gain the users trust so they would install the XP anti-virus
you can gain more trust by employing an element well known to the user certified for Windows logo as
one example most real installation programs don't display this logo.
The virus however had such a logo.
In reality it's just a bitmap that can be placed anywhere
apart from the logo.
The installation program displayed a link to the end user license agreement
to use a program legally.
You need to own a license and you need to read it through the most interesting bits of the program's
license are marked and read the license mentioned customer support team in case of any problems the
user should contact it for help.
There was even a chat window on the XP and a virus Web site history of previous interactions with the
users was displayed to.
You could see that people reported problems and someone responded.
The creators of the attack made it all look very professional.
The lessons also stated that by accepting it the user agreed that the details of his or her credit card
were being retained within the entire period of the subscription
during the initial scan.
Nothing suggested that a payment would be required then the license indicated that for using the program
the user would not pay once but on a regular basis the license also explicitly stated that decomposition
was prohibited
the user couldn't have been given the chance to monitor the XP antivirus activities because that might
have given away its real purpose.
The second point of the license agreement stated that the program would uninstall the software it wasn't
compatible with obviously XP antivirus was incompatible with real and virus scanners.
Basically users agreed to uninstall ation of already possessed anti-virus software.
However you didn't have to read the license because it was optional.
You didn't have to accept.
Moreover the creators of XP and virus stated that they were not responsible for its actions performed
on user's computers.
That's something everyone's use to.