RDP at home is certainly difficult, but I have to disagree on the performance bit. In fact, RDP is probably by far the best such protocol in use right now.
Yes, I just had a look at paypal's user agreement, and this does seem to be the case. That begs the question - why are the hackers even bothering to do this, if all their transactions will be cancelled? Are they hoping that a small % of their victims won't notice the fraudulent transactions?
Most paypal fraud, like credit card fraud happens at a very small scale. A fraudster pays $50 for 50 accounts and then spends a day with them and maybe walks out with $300.
The guy selling the accounts sells hundreds of thousands of them, and obviously doesn't get involved in the fraud itself.
This is why this whole thing is so strange, there's a bunch of people claiming that someone hacked teamviewer and is now using that access for petty paypal fraud instead of targetting the tens (if not hundreds) of thousands of PoS systems teamviewer is used to manage.
>Are they hoping that a small % of their victims won't notice the fraudulent transactions?
No, they certainly don't care if the payments get charged back or not. If they try to send money to their own account, it'll be suspended before they can actually withdraw it out of PayPal.
Instead in this case they seem to be trying to buy itunes gift cards, undoubtedly with the intent to sell them (on sites such as g2a.com) before they get cancelled.
It's a very different process challenging credit-card-funded payments vs. those funded by bank account or funds already in the Paypal account. The former is easy, and you have two levels of challenge (via Paypal and via the credit card issuer).
On PPs end challenging them will be all the same, and generally you'll win the dispute instantly by calling them.
However of course bank funded payments will have some delays. Letting things pull money from your bank account like that is a terrible practice, and people should know better.
Have you actually pursued this process for payments funded by balance or bank transfer beyond a week or so after the charge?
I have.
It's fine if the recipient's account is still active and they successfully get the money back from their deposits or linked account. But in deliberate fraud cases, their only reclourse would be to to refund you out of their own pocket. Paypal has no incentive to do so. Once the money is beyond their reach (e.g. withdrawn via debit card or transferred to an outside account which is then closed), they will not help, in my experience.
Even if you fund via a credit card, if the payment recipient is beyond their reach, they make you jump through numerous fake loopholes (in one case I had, they claimed they had proof of delivery... and gave tracking data for an item shipped from the wrong state and shipped to a location 2000+ miles from me and to another name). I then contested the charge via my card issuer; the phone rep said that this happens often.
I say this as a user from the year they started business (back when they paid a $5 bounty to sign up) and with over 50,000 Paypal transactions.
I've been on the phone with PayPal on far too many occasions, and they definitely know how to handle these issues quick.
Although, you wouldn't even really have to call them. You can dispute the charges with like two clicks on your account page. It's just that if you call them, they can instantly settle the dispute in your favor.
>Of the hundreds of support requests I've responded to post-attack, all except one attack was carried out over TeamViewer.
And my experiences with repeatedly calling these guys had different results, that's fine.
>A tech support scam attacker would have many first-time connections to many other first-time TeamViewer users who are generally seniors instructed to run the TeamViewer app over the phone. While they may use a pool of computers/TeamViewer IDs, and a pool of IPs, there's limits to the cost-effectiveness of scaling that variation, and a pattern should definitely be visible.
And then the scammers will just switch to VMs and socks5 proxies. (They probably already use the socks, considering they're buying them in bulk)
>"Assuming proper rate limiting" seems like a large assumption, given that the possible attack vectors are guessing the random alphanumeric passwords and testing password dumps for account pairs from other services that work with TeamViewer.
The mere fact that this all happens over the network is a plenty of ratelimiting.
>Defaulting to accepting any connection from anywhere seems like a great example of poor security configuration by default.
Yet, we've heard from people who have used passwords unique to TeamViewer, who have enabled two-factor authentication, and have found no malware on their computers, losing control of their systems in the past few days via TeamViewer.
Apparently TV disagrees, but in this case I'm inclined to believe their unfortunate users.
To expand on this further, most (i.e. not all) of the reddit reports are meaningless as on any given day there's going to be tens of thousands of examples of this kind of fraud.
Unless the reporters have some specific evidence that teamviewer is at fault, it's overwhelmingly likely that many of them were hit by some totally unrelated fraud.
Well it's related to Teamviewer for sure, because it shows up in the people's Teamviewer connection logs. Yeah it could be other malware that is stealing the Teamviewer credentials from their computer. But that seems like more work than necessary, because only a few percent of people have teamviewer installed and running, and they could attack everyone by having them malware install their own remote access service.
Just look up "sham transaction" for plenty more. It's a very well established concept and doctrine. Nobody should be splitting hairs about avoiding vs. evading taxes, or generally pontificating about fiduciary duty, without understanding it.
Based on my reading there certainly exists such a duty when it's beneficial, obviously tax avoidance isn't explicitly beneficial though. Potential law changes or even bad press could cost more than the amount of money saved.
Could you please try to be more consistent about which of your two accounts - ryanlol vs. ryanl0l - you use for your replies here? Keeping up with one is tedious enough.
It's not my client. It's you replying with one account so you can still downvote with the other. That "all's fair" attitude seems to exist in more domains than just taxes.
If you're that worried about your internet points, perhaps you should email hn@ycombinator.com and find out that I've in fact not downvoted your replies.
(In the future you might want to do that before accusing others of such)
