So how does the "You've won a free laptop" scam work?

[Crazy Dave]

I've been pretty good at figuring out internet scams but this one seems a little different. With one offer they supposedly send you a free laptop and you agree to let them monitor it. So the way I see it is you get a $400 - $500 laptop with dozens of back-door, trojan applications, remote connections, etc. They then steal your identity and monitor your banking transactions and if you got good credit run up tens of thousands in fraudulent transactions.

Is that about the sum of it?

[Kutjara]

1. That sounds about right.

They could also use your laptop as a "zombie" to carry out attacks on other networks, send spam, host illegal file downloads or kiddie porn, crack passwords and generally get up to mischief. Then, when the cops get an itch to kick down a door and bust some heads, it'll be your house they visit.

[moggie]

3. Unless you wipe it

I've never heard of this scam... but assuming it is a scam, I'd feel no compunction about wiping their infected OS and reinstalling. I don't use Windows, anyway: first thing I'm going to do with a non-Mac laptop is install Linux. How are they going to tell the difference between "laptop never used" and "reimaged laptop with different OS"?

[Kutjara]

4. Unless there's a rootkit on it.

Unless the user knows what they're doing, rootkits can persist even through full disk formats (by the simple tactic of masking the existence of the sectors they use from the BIOS). No matter what you later install, the rootkit is still there and can still phone home.

Of course, if you're using Linux, there isn't much a Windows rootkit can do to your data (unless you're using something like ntfs3g to give your Linux box NTFS access), but it could still be used as a repeater node on a botnet.

Don't even get me started on the new breed of rootkits that can run the user's entire OS in a hypervisor, while getting up to all kinds of mischief that even the best anti-malware tools can't detect (because they don't know they're being run in a virtualized sandbox).

Anyway, I assume the guys running this scam make it a condition of service that the user leaves the laptop's OS alone. If the machine stops calling home, the user is in breach of the agreement, and I'll be the small print makes him immediately liable for the full price of the machine.

[moggie]

5. Not if you can remove the disk!

Stick it in an external enclosure, really wipe it from another Linux box, put it back. The original BIOS doesn't get a look in.

Anyway, I assume the guys running this scam make it a condition of service that the user leaves the laptop's OS alone

Working in IT, I'm very honest about licence conditions, even on my own money. I have no illegal software. But if these people are scam artists, I'd scam them back, no problem.

[Kutjara]

8. You can certainly do that, but it's probably beyond...

...the capabilities of the people these scammers are targeting. They're relying on "clueless Windows users" to just accept what they're given.

I agree I'd have no qualms about repurposing one of these machines in a heartbeat, but it really depends if the scammers want a credit card number "for identification purposes" or have other means of ascertaining your true identity so that they can sue you into penury if you violate their license terms.If not, then they're fair game.

[Ilsa]

6. But you can't be liable for something that breaks the law, like

a computer that steals your ID, can you?

[Kutjara]

7. Ultimately, you probably can't, but...

...that isn't much consolation when you have SWAT pointing their guns at your head at 6am. Also, it will be up to you to prove you're innocence.

A few courts have indicated that people who don't secure their wifi connections may be liable for any misuse by third parties, so it's conceivable that the same rules could be applied to individual PCs.

[texanwitch]

2. Yep.

Have to wonder what is under the hood.

You don't get something for nothing.