Sextortion Scam on the rise

I received a phone call from a client of mine the other day, I could hear in the voice that something was not right, there was almost a whisper to the voice and I struggled to hear what was being said. I heard bits and pieces of the conversation but what I heard did not sound good. "Hacked..., extortion..., wants money..." thankfully in the end it turned out all ok.

A relatively new variant of an email scam is doing the rounds this year, it is called sextortion.  Sextortion is when someone threatens to distribute your private and sensitive material if you don’t provide them with images of a sexual nature, sexual favors, or money.
The way the scam works is basically you receive an email claiming that your computer has been comprised and that your webcam was used to record you viewing porn sites.

The email further goes on to say that you must pay the "hacker" an amount of BitCoin or else they will release the "footage" of your browsing session to all your contacts. What makes this scam scary is that it actually has your password! Well not exactly, but a password you most likely used some time ago.

Thanks to all the data breaches over the last few years, your email address and certain passwords are easily available on the web for those that wish to find them. What these scammers have done is link your password from some time ago that was breached with your e-mail address. When you read the email for the first time you see your password and really think this may be possible.

The emails I have seen from my clients are very similar to the copy below,

“I’m aware that <substitute password formerly used by recipient here> is your password,” reads the salutation.

You don’t know me and you’re thinking why you received this e mail, right?

Well, I actually placed a malware on the porn website and guess what, you visited this web site to have fun (you know what I mean). While you were watching the video, your web browser acted as a RDP (Remote Desktop) and a keylogger which provided me access to your display screen and webcam. Right after that, my software gathered all your contacts from your Messenger, Facebook account, and email account.

What exactly did I do?

I made a split-screen video. First part recorded the video you were viewing (you’ve got a fine taste haha), and next part recorded your webcam (Yep! It’s you doing nasty things!).

What should you do?

Well, I believe, $1400 is a fair price for our little secret. You’ll make the payment via Bitcoin to the below address (if you don’t know this, search “how to buy bitcoin” in Google).

BTC Address: 1Dvd7Wb72JBTbAcfTrxSJCZZuf4tsT8V726

(It is cAsE sensitive, so copy and paste it)

Important:You have 24 hours in order to make the payment. (I have an unique pixel within this email message, and right now I know that you have read this email). If I don’t get the payment, I will send your video to all of your contacts including relatives, coworkers, and so forth. Nonetheless, if I do get paid, I will erase the video immidiately. If you want evidence, reply with “Yes!” and I will send your video recording to your 5 friends. This is a non-negotiable offer, so don’t waste my time and yours by replying to this email.

This scam is unfortunately likely to evolve and as more personal details get leaked / breached the scammers will probably add more data into the mails to make it sound even more believable, we may even see other scams using this method to try and con you. Think of those fake Microsoft tech support calls, now they have a "password" you could be easily fooled into giving them access to your computer.

There are some things you can do so as to not become a victim of sextortion:

1. Keep your browsing to "safe" sites;
2. Do not send revealing pictures of yourself to anyone (you never know who is actually getting them);
3. Turn off or block any webcams when not in use;
4. Think before opening that unexpected email with the attachment;
5. If you have not changed your passwords recently, I would suggest you do soon.  

Password construction and management

Passwords are the first line of security in many applications and used by everyone every day. Passwords give access to such a vast array of services like Internet banking, Facebook, Twitter and even your pc (for those that have a password).

Keeping track of all these passwords can become very difficult and to have a different unique password for each and every application is near impossible, so what is one to do? There are a number of options available but before that lets go over some absolute no-no’s when dealing with passwords.

Do not write the password(s) down on anything and do not leave the post-it note with your password stuck to your monitor or underneath the laptop. Apart from breaking the first rule why bother having a password.

Try not to use family names, favourite sports team, pets or birthdates as your password. With the increase in use of Facebook and other social media it is very common these days for people to put such personal information onto the web and for a hacker this is the easiest place to start when trying to access your account.

Passwords should be as complex as possible, but this brings its own complexity t it. If you make the password to difficult you will either forget it or you end up writing it down, breaking rule 1. A possible solution is creating your own unique formula for passwords.

Facebook password could be something like Fr13nd$456 and Twitter maybe B1rd!35, by associating the site with what you do on it can help you create a unique password that meets the general norms of strong password creation.

Creating strong passwords normally require a mixture of the following:

1.       Be Alphanumeric (letters and numbers)

2.       Contain a special character (!, @, %, etc...)

3.       Be at least 7 characters or more in length (the longer the better)

4.       Refrain from using normal words found in a dictionary

Trying to manage passwords is difficult and most people do get lazy and set one password for every site. This may be fine if you have a very strong password but remember if you have password for all it is like having a master key to everything.

Another tip when setting up new accounts or registering for something on a page and you need to answer a personal question in case you forget your password, do not put the real answer. So if you select your personal question to be your mothers’ maiden name, use your grandmother’s name instead. Just doing something a little extra will help protect yourself that much more.

IT Security in the small business – Part 2

It is still with some alarm that I come across people and their lack of understanding of the importance of keeping their passwords safe and making passwords more difficult than ‘12345’ or the good ol’ favourite ‘password’.

Passwords still are and will be the primary security mechanism for computing for many years to come.  A Password in its simplest definition is a word or string of characters that will authenticate and allow you access to the information you seek.

It is surprising that most people do not change the default the ADSL router passwords for example and even if they do, the password is changed to something easy like ‘12345’ and even further to this the password is left on a note stuck to the router.

Granted most people think passwords are a waste and a nuisance. How would you like it though if anyone could just access your details like for instance your bank details? Or gain access to your e-mail account or even get onto Facebook as yourself and say what they wish.

Since the majority of passwords are ‘12345’as proved in various e-mail hacks a couple of years ago, why are people still reluctant to change their default passwords? In many corporate companies, people are forced to change their password every 60-90 days. Yet in the small business, most computers do not have passwords, anyone can access the computers and worst of all if there is even a password set, the entire office knows what it is.

Often people will use the same password and username on all the sites they are registered for, so the username and password for Facebook will probably work on a number of different sites. People need to be taught about password management, how to construct difficult but easy to remember passwords.

The ramifications of a leaked password for a normal person are bad enough, but imagine now that person is the accounts person for your company. Most likely the password that person used is also going to be used to gain access to your accounting package. That is of course if there was a password setup in the first place to protect your data?

Further articles will detail some tips on how to manage and construct passwords.