“I’m a Hacker, and I Have Your Password!”

Have you gotten it yet? I’m talking about the phishing email (if you don’t know what phishing is, look back at this article) claiming that a hacker has stolen your password, sent you an email from your own email account, turned on your webcam, and recorded you looking at porn – then threatening to send those pictures to everyone in your contact list, which they claim they have accessed, unless you send them in the neighborhood of $800 in Bitcoin. They even include helpful advice on how to use Bitcoin. This particular phishing email seems to be more convincing / alarming to a lot more people due to several elements. Let’s break it down into what it really is, and what you can do about it.

1. One unusual aspect of this email is that the author actually claims to be a hacker. Usually, they are sneaky about that, but this one comes right out and admits it, actually boasts about it. And they come right out and blackmail, hoping for a payoff in bitcoin.
2. They claim to have your password, and they prove it by telling you what your password is. And, in my experience, they actually DO have your password. One of them, anyway. If you’re like most people, this is the password to your very soul, and you use it everywhere, because it’s just too hard to remember a different password to every account. I’m right, aren’t I? How did they get it? In all likelihood, from the Yahoo! breach (spoiler alert, all 3 BILLION passwords were compromised) or another of many similar breaches.
3. Did they really turn on my webcam? No, probably not. Could they? Yes, it’s possible. Here’s an interesting article on that from Norton.
4. Did they really see me watching porn? I hope not. Hopefully, that’s not an issue for you, and if it is, you need someone other than me to help you with it. Seriously.
5. The punchline is that they want you to pay them NOT to send these incriminating (imaginary) pictures to your boss, your family, and especially your significant other.

Honestly, the best part of this phishing email is that laughably bad grammar. Here is the content, in full, for your entertainment:

Hello!I‘m a programmer who cracked your email account and device about half year ago. You entered a password on one of the insecure site you visited, and I catched it. Your password from xxxxx on moment of crack: xxxxx Of course you can will change your password, or already made it. But it doesn’t matter, my rat software update it every time. Please don’t try to contact me or find me, it is impossible, since I sent you an email from your email account. Through your e-mail, I uploaded malicious code to your Operation System. I saved all of your contacts with friends, colleagues, relatives and a complete history of visits to the Internet resources. Also I installed a rat software on your device and long tome spying for you. You are not my only victim, I usually lock devices and ask for a ransom. But I was struck by the sites of intimate content that you very often visit. I am in shock of your reach fantasies! Wow! I’ve never seen anything like this! I did not even know that SUCH content could be so exciting! So, when you had fun on intime sites (you know what I mean!) I made screenshot with using my program from your camera of yours device. After that, I jointed them to the content of the currently viewed site. Will be funny when I send these photos to your contacts! And if your relatives see it? BUT I’m sure you don’t want it. I definitely would not want to … I will not do this if you pay me a little amount. I think $801 is a nice price for it! I accept only Bitcoins. My BTC wallet: xxxxx If you have difficulty with this – Ask Google “how to make a payment on a bitcoin wallet”. It’s easy. After receiving the above amount, all your data will be immediately removed automatically. My virus will also will be destroy itself from your operating system. My Trojan have auto alert, after this email is looked, I will be know it! You have 2 days (48 hours) for make a payment. If this does not happen – all your contacts will get crazy shots with your dirty life! And so that you do not obstruct me, your device will be locked (also after 48 hours) Do not take this frivolously! This is the last warning! Various security services or antiviruses won’t help you for sure (I have already collected all your data). Here are the recommendations of a professional: Antiviruses do not help against modern malicious code. Just do not enter your passwords on unsafe sites! I hope you will be prudent. Bye.

Bad Hacker Dude (I shamelessly stole this title from a fellow Cybersecurity instructor) does give a few good bits of advice here: “Do not take this frivolously!” Your password has been compromised. And you are probably using it on multiple accounts. Change it everywhere you have used it. And don’t keep using the same one. What should you change it to? Follow this advice from the folks at Webroot.

Second good piece of advice from BHD: don’t look at porn. For so many reasons… but from a technical rather than moral standpoint, those websites are notorious for serving up malware. One of my colleagues, when asked why he got into Information Technology, said, “Every time I looked at porn, my computer ended up messed up, and I was too embarrassed to take it to the Geek Squad, so I learned IT.”

Lastly, if it’s not obvious, don’t pay the ransom. Clearly, enough people are that it is worthwhile for these people to keep doing this. Don’t be part of the problem.