ESET Ireland looks at the latest scam targeting Irish users, using their passwords as bait, mentioning adult websites and trying to extort large sums of money.
“It is just so unfortunate. I’m aware login123 is your password. More importantly, I know about your secret and I’ve evidence of this,” says an email received by many Irish users in the past weeks. As the password mentioned is an actual password that may at some time be associated with the email of the receiver, this certainly gets their attention.
Then the cybercriminal continues: “I setup a malware on an adult video clips site that while you were busy watching video clips provided me with access to your screen and web camera.” Such things can certainly be done, so the victim is likely to be worried at this point.
Now it’s time to push the punchline: “The two choices are with the idea to ignore this letter, but I will definitely send your video recording to all of your contacts including relatives, co-workers, etc., or simply pay me $2700.” or in another example “… either disregard this message (not recommended), or pay me 0.95 BTC to close this chapter for life.” These days 0.95 Bitcoin comes to about €6500 and the email ends with instructions on where to transfer the funds to avoid having your embarrassment exposed.
So, how bad is it?
No need to panic, it’s not as bad as it seems. Though the password they mention is an actual password the user has or may have had in the past, it was likely acquired in one of the many data breaches in the last few years. Millions and millions of Twitter, eBay, Yahoo, Google, Microsoft and other passwords and emails were stolen. Google says hackers steal almost 250,000 web logins each week. Closer to home Eircom was in the headlines over potential hacks. This is how the cybercriminals are now making use of what they acquired.
What about the ‘adult’ bit?
Although various forms of sextortion are nothing new and cybercriminals can sometimes activate laptop or mobile cameras remotely and record what they see, in the case of these latest emails, it is mostly a bluff, to get the victim to panic and act quickly.
How to stay safe?
Password hygiene! These sorts of threats are made more potent if you use the same password for a long time and over several platforms. As we always say:
- Short passwords are bad. Long passphrases are good
- Never re-use an old password
- Change your passwords/passphrases periodically
- Ensure that every account you have has a distinct password/passphrase
- Use two-factor authentication for added security
- Use a reliable password manager
So, be mindful of your passwords, keep your web or mobile camera covered most of the time and avoid dodgy websites and you should be able to safely ignore such emails.
written by Urban Schrott and Ciaran McHale, ESET Ireland
