DHS warns of fake help-desk scams


A federal employee fell for a fake help-desk cyberattack scheme in January, and the Department of Homeland Security warned that more such attacks could be on the way as the end of Microsoft support for its Windows XP operating system approaches.

According to a March 11 unclassified/for official use only memo prepared by the DHS Office of Intelligence and Analysis and the FBI, an employee working from home on Jan. 14 using a virtual private network called a fake computer help line number. That call enabled the bogus help desk to gain access to the computer's hard drive, said the memo.

The memo, posted on the Public Intelligence open source website on April 1, did not name the agency the employee worked for, but said the incident is under investigation for possible malware implantation or backdoor access to the government-owned computer.

The memo went on to warn that with the looming expiration of Microsoft's support and security updates for Windows XP on April 8, cyber criminals could see an opportunity to dial up the volume on fake emails and cold calls in a new round of help desk cons targeting XP users.

It didn't specify whether the government computer involved in the January incident used XP, but federal agencies have been moving for years to get rid of computers using the aging platform. According to analysts however, thousands of XP-based machines could be operating at government agencies around the globe after the deadline. The Wall Street Journal reported April 1 that cyberscurity firm Qualys estimated that more than 10 percent of computers used in government and corporations worldwide will still use the 12-year-old operating system after April 8.

In its memo, DHS detailed how the fake help desk scam works.

The ploy usually begins  with an email or a cold call with the contact representing themselves as a help desk employee from a legitimate software or hardware vendor. The bogus representative tries to convince victims that their computers are malfunctioning, sometimes using a computer log that shows a lot of mostly harmless or low level errors. They then convince the victim to download software or let the "technician" remotely access their machines.

About the Author

Mark Rockwell is a staff writer at FCW.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at or follow him on Twitter at @MRockwell4.

FCW in Print

In the latest issue: Looking back on three decades of big stories in federal IT.


  • Anne Rung -- Commerce Department Photo

    Exit interview with Anne Rung

    The government's departing top acquisition official said she leaves behind a solid foundation on which to build more effective and efficient federal IT.

  • Charles Phalen

    Administration appoints first head of NBIB

    The National Background Investigations Bureau announced the appointment of its first director as the agency prepares to take over processing government background checks.

  • Sen. James Lankford (R-Okla.)

    Senator: Rigid hiring process pushes millennials from federal work

    Sen. James Lankford (R-Okla.) said agencies are missing out on younger workers because of the government's rigidity, particularly its protracted hiring process.

  • FCW @ 30 GPS

    FCW @ 30

    Since 1987, FCW has covered it all -- the major contracts, the disruptive technologies, the picayune scandals and the many, many people who make federal IT function. Here's a look back at six of the most significant stories.

  • Shutterstock image.

    A 'minibus' appropriations package could be in the cards

    A short-term funding bill is expected by Sept. 30 to keep the federal government operating through early December, but after that the options get more complicated.

  • Defense Secretary Ash Carter speaks at the TechCrunch Disrupt conference in San Francisco

    DOD launches new tech hub in Austin

    The DOD is opening a new Defense Innovation Unit Experimental office in Austin, Texas, while Congress debates legislation that could defund DIUx.

Reader comments

Thu, Apr 3, 2014

The user should have known better. When was the last time his IT dept was "pro" active in trying to fix a possible problem? All the government IT depts. are too busy to go looking for work. The user usually has to come to IT and mention a problem.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group