Cybercrime in Action - Blackmail
- Security Panda (you were expecting someone
- Jan 19, 2019
- 6 min read
Hi - I am a hacker who broke your email password...
This turned up in my email (Google actually classified it as spam), and I suspect similar missives are turning up in a lot of mailboxes. Recently it seems that there has been a glut of breach data showing up for sale and even for free, and criminals are happy to take advantage of it. This is an example of an attempt at blackmail.
I practice good password hygiene so I'm not really concerned, but I thought I’d take the opportunity to talk about it and try to raise some awareness.
Let me get this out of the way first, then you can scroll down to the juicy details of how they phrased the email to try to scare me into paying up. There are quite a few things that anybody can do (and everybody should do) to make those criminals 90% helpless, even if they’ve purchased and cracked a bunch of passwords or password hashes:
Change your password every time you see a news story about a breach, or every thirty days, whichever is shorter. I know this is a pain, I know it means memorizing a new password regularly, and often we have a LOT of passwords. If you absolutely must use a password keeper, make sure that the longest, most complex, and best-guarded password -ever- is the password to your keeper, because you’ve just put all your eggs into one basket. Realistically there aren’t many good options for dealing with keeping track of all the passwords that online connected life really requires, so you'll have to find the balance between security and usability that works for you. Please don't ask me which password keeper I use, I actually have a far more complicated method for guarding my credentials. You don't even want to know.
Try pass phrases. Those are entire sentences, instead of one or two-word passwords. If the system you’re making a new password for won’t accept spaces, run the sentence together. It’s for security, not an English test. :) DON’T use quotes, song lyrics, memes, or other easily-guessable sentences. DO switch it up and feel free to substitute numbers and special characters for letters, or use foreign or deliberately misspelled words. Here are several examples:
The Simpsons are hilarious!
I like milk chocolate bunnies and I cannot lie.
I love my dog Sp1k3.
MymomlikestheBeeGees.
I want to monter like l’aigle.
Go ahead, punch those into the brute-force cracking tools and see how long it takes. I won’t wait. ;)
A lot of online services offer two-factor authentication. If it’s available, take advantage of it. The fact that it takes a minute or two longer to log into the service is a small price to pay for the peace of mind. Once you’ve received it, never, ever give out your authentication token to anyone via text, email, or over the phone, and make sure that the website you’re logging into is the legitimate website.
Password re-use. Never use a password for more than one site! If someone DOES manage to get ahold of your password, this keeps the damage (hopefully) to a minimum. I’ll be honest, I didn’t follow this rule when I first started out, but I follow it religiously now. It’s never too late to develop good habits.
Now, about that email. The blocked-out part next to my user name in the screenshot is an ancient password, but it still gave me a nasty frisson.
Imagine how I would feel if it was a password that was still legitimately on my email account? Actually, I probably wouldn’t feel anything, because my account would probably already have been opened and pillaged by the criminals for any and all important information plus all my contacts PLUS it probably would have been used to send malware-impregnated messages to everyone I know.
I promised the body of the email, and here it is. Note that this is a definite criminal act, falling under the definition of "blackmail". If I could hunt them down from the spoofed email (fat chance), I could file criminal charges. I've redacted some items and added some comments to the text (mine are the ones not italicized).
Hi
I am a hacker who broke your email address as well as device a several months back.
You typed in your passcode on one of the internet sites you visited, and I intercepted it. [This is why you should never use the same password on multiple sites - this is actually a legitimate technique criminals use.]
This is the security password of REDACTED@gmail.com upon moment of hack: REDACTED
Of course you can will change it, or perhaps already changed it. [Yep, couple of years ago...]
Nevertheless it isn't going to matter, my malicious software updated it every time. [No, it didn't.]
Do not really attempt to contact me personally or even find me, it is impossible, since I sent this mail from your account only. [Well... you tried to make it look like my account, and I'd bloody well like to have a go at finding you, but you're probably in another country.]
Via your own e mail, I uploaded harmful code to your Operation System. [*sigh* No, you didn't. And it's 'OperatING', not 'OperatION', for the record.]
I saved your entire contacts with friends, co-workers, family members plus a complete record of visits to the World-wide-web resources. [No you didn't, you never got into my email account.]
Additionally I set up a Virus on your system. [Do I have to say it? 'No, you didn't.' Although, this is a great chance to mention making sure you have reputable antivirus software, and that you keep it up to date.]
You're not my only prey, I normally lock desktops and ask for a ransom.
But I ended up being struck through the internet sites of close content material that you generally go toR 04;.
I am in surprise of your fantasies! I've by no means observed anything at all like this! [Implying that I've visited some very naughty websites indeed.]
Thus, when you had enjoyment on piquant web pages (you know what I am talking about!) I made screen shot with using my program via your camera of yours system. [There's a teeny-tiny remote possibility that any of this other nonsense is possible, but my camera is physically blocked with one o' them little privacy guard shields. I highly recommend them, companies give them out as freebies all the time. So this is just more bogeyman lies.]
And then, I combined them to the content of the particular currently seen site.
Now there is going to be fun when I send these pictures to your connections!
Yet I am certain you don't need it.
Thus, I expect to have payment from you intended for my silence.
I believe $1055 is an suitable price with regard to it! {Nice touch - Not too high for most people to afford, but not an insignificant amount.
Pay with Bitcoins. [Really..? Bitcoins?]
My Bitcoin wallet: REDACTED (Note - this wallet address has been reported as being used for a malicious purpose. Mine isn't the only report on this wallet address.)
In case you do not know how to do this - submit in to Google 'how to transfer money to the bitcoin wallet'. It is simple.
Right after receiving the given amount, all your info will be instantly eliminated automatically. My pc virus will also remove itself out of your os. [From an implementation stance, this is a cat's whisker away from impossible. LOL.]
My Computer virus possess auto alert, so I know when this e-mail is opened.
I give you two days (48 hrs) for you to make the payment. [I'm writing this five days later. Guess I'm in trouble now.]
If this does not take place - all your associates will certainly get outrageous photos from your darkish secret life and your system will be blocked as well after 48 hours. [Hmmm.... Nope, still using it.]
Do not end up being silly!
Police or pals won't support you for certain ...
P.S I can provide you with recommendation for the future. Don't type in your passwords on unsafe internet sites. [The only 'good' statement in here! Definitely don't type in your passwords on unsafe internet sites.]
I hope for your wisdom.
Good bye.
I know I'm not the typical target for this kind of attack - I'm even making a bit light of it, tweaking the nose of these criminals a bit. I'm taking a risk in doing so, and I know it's truly a serious issue. There are definitely people who would be in a position to fear that everything said in the email was true, and that the criminal really was in possession of potentially compromising information.
If you receive one of these emails, please know that there is an excellent chance that the only thing you did "wrong" was to not rotate your password and it was included in one of the numerous data breaches. The perpetrators of these activities are criminals, they are the bad people. You are also not alone in your experience, and it can be a truly terrifying experience. I sincerely hope that no-one ever has to fear that a malicious criminal will take action that could have dreadful consequences on the lives of the victims.
You as individuals can take action to help safeguard yourselves against this kind of threat. Parents, help your children understand how to look after the security of their online accounts. Grandkids, help your grandparents understand online safety. Share this information with your friends, coworkers, casual acquaintances, that guy you somehow end up sharing the elevator with every day... No one deserves to have their online privacy violated. Securing your online credentials properly can help prevent that.
Commentaires