Blackshades Breakdown

The last couple of weeks has been dominated by talk of Blackshades and the FBI crackdown on those using it.  We did a number of media interviews around Blackshades and here’s what we think people should really be focusing on:
The price:  At $40.00, Blackshades was a bargain.  Such a low entry point is great for mass adoption and a quick payday.  Mass adoption however, stirs up attention from law enforcement.  While the FBI managed to make almost 100 arrests, I doubt that any of those are what we would consider high value targets.  
The Response:  The FBI has made a lot of noise about this operation, and rightly so.  The scale of the operation was huge, involving 300 searches in 19 countries.  With almost 100 arrests, it’s clear that the FBI has gotten better at working with their counterparts around the world.
Sadly, while the FBI is bringing justice to those using the Blackshades malware, the NSA is busy doing the exact same thing that the people arrested were.  I think it’s safe to say that their software cost a lot more than $40 though.
Blackshades gives people something to be scared of:  
Let’s face it, the general public just doesn’t care about their privacy as much as we might like them to.  If their credit card info is stolen, the bank picks up the tab.  Someone might read their emails or gain access to their social media accounts?  They’re already posting most of their personal lives for all to see anyway.

What people are scared of is someone posting naked pictures of them online.  The webcam functionality of malware is usually of little concern to security folk.  It is, however, a big concern for the average citizen.  Having to replace your credit card is an annoyance.  Naked pics of you being passed around your school or workplace is something that might actually elicit a change in behaviour.

Google scam – Part 2

Image representing Google as depicted in Crunc...
Image via CrunchBase
Those of us who deal in IT security have the
luxury of being able to ignore the typical scam unless it impacts our network,
family member or close friend. These scams are generally not all that
technically interesting and frankly, it’s easy to feel like such scams are
beneath us somehow.
Many of us have been using computers since before
the rise of the internet, and being computer and internet literate we are more
than capable of distinguishing a scam with ease, unfortunately there are also many
who aren’t.
To a large segment of the population, the
internet is just as mystifying as a good magic show.  They can see the set pieces and the effects,
but can’t quite grasp what goes on in the background.  They’re not idiots for being conned, they are
victims; victims because they didn’t have the knowledge to see through the scam.
Recently my friend, a fellow entrepreneur who
I’ll refer to as Jocelyn, found she faced a high pressure telemarketing scam
based on Google listings.
Having just opened her business last summer, every
day she faces a long list of calls to make, bills to pay, appointments to keep and
the last thing she has time for is to know all the details of how Google
listings and SEO work.
Here’s a breakdown of how the scam unfolded:
  • Business Registry Center (BRC) contacts
    Jocelyn and she explains she’s not interested.
  • Being telemarketers they’re very persistent
    and advanced their tactics detailing Jocelyn’s business who suffer and close if
    she doesn’t accept their offer to ensure her business is registered and promoted on Google Local
    Business listings. BRC keeps calling to pressure with more stats and ‘facts’ to validate their claims.
  • Jocelyn checks out the BRC website at
    and is taken in by initial appearances that seem legitimate. The text is well
    written and they seem to know what they are talking about.
  • Jocelyn decides to accept the offer to
    receive the BRC information package and take more time to review their offering.
  • Business Registry issues the information
    package with an invoice.
  • The BRC package arrives that includes a cardstock
    folder with Shutterstock images on it, a one-page letter explaining how important Google Local Business Listing is and
    the invoice.
  • Jocelyn immediately called Business Registry
    Center to ask about the invoice and explaining there must be some
    misunderstanding as she only requested the information package and did not agree to the services. The agent advises Jocelyn that when she agreed to send
    her the package it was her verbal agreement to the service package and that
    they had the conversation recorded.
November to January 
  • For two months Business Call Registry
    calls non-stop. Almost every day and escalating at the end to eight or 10 times a day, often while Jocelyn was with a
    client. The calls became progressively aggressive threatening to send her to debt collector
    and destroying her credit rating. Believing the lies Jocelyn sends in her credit card
    number with the invoice.
  • Jocelyn consults friends and immediately
    calls her credit card company to cancel the transaction.
  • Following up with due diligence the credit
    card company contacts BRC about the cancellation of the transaction. RBC does not respond to the inquiry by the
    credit card company. Jocelyn is completely reimbursed by her credit card company.
  • Jocelyn details the scam to me and I then
    investigate you can see details from my findings on my earlier blog here.
  • Wanting to protect others I work with
    Jocelyn to contact Montreal Police Department, because the physical location of RBC is in Montreal, Quebec. Montreal police
    advise that this must be followed up with Ottawa Police Department.
  • Ottawa Police Department informs us that
    because the money was reimbursed there is no fraud and no charges can be laid.
  • Concerned that others might fall victim we
    contact local news teams and work with the media and social media to make others aware of this scam.

These people are preying on those who lack specialized knowledge, nothing else. They are thieves, and should be dealt with as such.  They may as well have skimmed her debit card or grabbed the cash from her register.

We can’t stop the scammers from ripping people off.  Like cockroaches, they will scurry off and set up elsewhere as soon as they can.  That doesn’t mean that we shouldn’t stop them at every opportunity.

I welcome your thoughts and comments on how we can resolve these annoying scam artists. 

Enhanced by Zemanta

Google Places for Business Scam

Business Registry Center, with a post office box in Montreal, is calling businesses and non-profits offering to list them with Google Local Business Listings, now known as Google Places Business.  For the listing that is free with Google, they are charging $499.  A rip-off perhaps, but maybe not too bad?  It gets worse.

CBC News Story
CBC News Video
Telephone: +1-888-416-7472

6228 Saint Jacques, 
Suite 417, 
Montreal, QC H4B 1T6

From the user agreement found on their site:
 Although never mentioned in any of the phone calls, the user agreement states that you are signing up for two years of service at the spectacular rate of over $5, 500.00.  The user agreement is apparently binding, even if you’ve never been to their site to read it.

You authorize them to charge any card that “they are aware or become aware of”.
In case you don’t follow their terms or even threaten to do so:

So what do you get for your $5,500.00? Well, pretty much what you get for free with Google.

The earliest activity I can find dates back to September of 2012.  Here is one of the dozens of complaints on  It seems they finally moved from disks to the cloud.

And finally, what I can only assume is a sister site at  Different theme, but the content is identical.  
This “office” is located at a UPS store in MN.  

Telephone: +1-888-311-0262
Fax: +1-866-929-0748
1043 Grand Avenue, 
Suite 145, 
Saint Paul, MN 55105.