MR. NICE GUY

it | streaming |
DIAL F FOR FRAUD
WHO PAYS THE BILL WHEN A HIJACKED
COMPUTER CALLS AFRICA? | BY SEAN DAVIDSON
Odds are, you don’t know anyone
in Chad. Or Madagascar. Or
Sao Tome. And, let’s assume for
the sake of argument, you are
not in the habit of making longdistance
calls to the far side of the Atlantic
in order to gamble or download porn.
But that doesn’t mean you won’t get
stuck with the bill, as victims of a recent
internet scam learned when their modems
— hijacked by a new breed of malicious
software — dialed some very expensive
numbers in various faraway lands.
David Stephenson of Midland, Ontario,
was surprised to find almost a dozen calls
to the African island nation of Sao Tome
on his April phone bill, bringing it to a
grand total of $371. He insists no one in
his family made the calls, and blames viruslike
code that infected his PC.
“It’s piggy-backed down into my computer.
It’s set up its own files. It’s set up its own
dialer,” says Stephenson, a police officer.
“Someone put a program into my computer
without my consent or knowledge.”
He soon learned that two co-workers
and a neighbour had also been stung by
the so-called “spyware,” and were having
little luck pleading their cases to Bell
Canada. Other incidents throughout the
705 and 519 area codes had also been
reported by local media.
Bell agreed to investigate Stephenson’s
bill. “I told them I’d pay what I owe, the rest
I’m not going to pay,” he says. “It’s fraud.”
Except that it’s not, at least not according
to Bell Canada. The phone company says it
doesn’t matter who or what dialed the
phone, or why — if the call was made as
described on the bill, the customer
is responsible for the
charges. “The bottom
line is people should be
more aware of their
actions online,” says
spokesperson Andrew
Cole, “in particular reading
online warnings and
disclosure boxes before
downloading anything.”
Spyware often comes
bundled with other, frequently
shady software
and secretly writes itself
to the hard drive during
the install process.
Notice can sometimes be
found buried in the
lengthy end-user agreements.
But security weaknesses
in certain software
— most notably the notoriously
flimsy Microsoft
Internet Explorer —
make it possible for malicious code to
sneak onto a computer without so much as
a single “OK” click. Virus scanners are
little or no help.
The exact behaviour, and origin, of the
Sao Tome dialer remains unclear, but Cole
says only “a very small percentage” of customers
have been hit.
PhoneBusters, a joint anti-fraud unit of
the RCMP and the Ontario Provincial
Police, has 102 cases on the books, to the
tune of $62,000. But Detective Staff
Sergeant Barry Elliott thinks the actual
numbers are much higher, in part because
ILLUSTRATION BY VADIM MOSCOTIN
famous 38 | july 2002
fight
back
Don’t panic just yet. Not all spyware, or its
cousin adware, is as malicious as those
long-distance dialers. But safety-conscious
surfers should be aware of this new and
growing nuisance.
Ad-aware
www.lavasoftusa.com
Available gratis from software developers
Lavasoft, Ad-aware has quickly become
the remedy of choice against this sort of
invasive, troublesome code. Like a virus
scanner, it snoops through the hard drive
in search of, and deleting, known spy- and
adware. Always be sure to use the most
recent version.
PhoneBusters
www.phonebusters.com
Although set up to foil telemarketers, this
Canada-wide anti-fraud unit also deals
with other phone-related crimes across
Canada. Call toll-free at 1.888.495.8501.
Spychecker
www.spychecker.com
Every day this public database of known
spyware products is updated — thanks to
tips from ad companies, the net and “reliable
sources” in the software biz.
phone companies, he suspects, are playing
dumb.
“I think Bell’s hiding the true numbers,”
he says. “They’re trying to stick it to the
customer…. There’s very little co-operation
by telephone companies in this country to
fight fraud.”
Cole says Bell isn’t hiding anything, but
repeats that the Sao Tome scam doesn’t fit
the company’s definition of fraud.
Until it gets sorted out, David
Stephenson is still on the hook for more
than $300. He says he had to wipe his
entire hard drive to get rid of the dialer,
and is thinking about installing a firewall
for added security.
“And from now on, I leave the phone
unplugged from the computer,” he says.
“Even when it’s turned off.”
Sean Davidson is the deputy editor of Famous.