Written by Alvaka Networks CEO, Oli Thordarson. Oli discusses a client’s experience with a sextortion scam email and provides some helpful suggestions on how to both handle and avoid this type of online phishing.
I got a call from a long time Alvaka client. Let’s call her Betty. She was concerned about a threatening email she had just received. This scam is widely distributed, but many are not comfortable talking about it. The email Betty received started out with:
I’m going to cut to the chase. I know ***** is your pass word. Moreover, I know your secret and I have evidence of this. You don’t know me and no one employed me to look into you.
It is just your bad luck that I discovered your misadventures. Actually, I setup a malware on the adult videos (porn material) and you visited this website to experience fun (you know what I mean). While you were busy watching videos, your browser started out operating as a Rdp (Remote control desktop) having a key logger which gave me access to your display and webcam. Immediately after that, my software collected your complete contacts from your messenger, facebook, as well as mailbox.
Betty knew this message was a scam because she has become very sophisticated on security over the past few years, plus she doesn’t go to websites to watch the videos in question. But the fact that they had one of her passwords, albeit old, alarmed her. The good news is this email extortion tactic is a bluff. The scammer is tapping into an old database of compromised passwords published somewhere, as there are many. The scammer, in almost all likelihood, does not have any incriminating video of you, nor does he/she have the contact info of all your friends and coworkers.
But this type of scare does point to the need for extra precaution. Some suggestions are….
- To invest in the little camera blocking shields for your laptop, tablet, PC, etc. They can be had very quickly and easily for a few dollars at many outlets such as Laptop Camera Cover. Sometimes vendors give these away at trade shows, etc.
- You should also have good mail spam, malware, phishing filtering and link integrity checking services for all your email, such as Alvaka’s Mailworx spam filtering service.
- Lastly, be astute about how you are using your computer, where you surf, and what files and links you open.
The email scam ultimately demands payment in bitcoin, in amounts ranging from $700 to more than $8,000. If you want to read more about this scam, KrebsonSecurity has a great explanation, Sextortion Scam Uses Recipient’s Hacked Passwords.
Wikipedia has a definition of sextortion, but it is somewhat dated and inaccurate in relation to the digital form of this exploitation; the same applies to the FBI’s What is Sextortion? video.
Additionally, CBS News did a report on the topic, Sextortion scammers use stolen passwords to prey on victims.
Here is the full text of the email she got:
From: firstname lastname
Sent: Thursday, August 2, 2018 1:33 PMI’m going to cut to the chase. I know ***** is your pass word. Moreover, I know your secret and I have evidence of this. You don’t know me and no one employed me to look into you.
It is just your bad luck that I discovered your misadventures. Actually, I setup a malware on the adult videos (porn material) and you visited this website to experience fun (you know what I mean). While you were busy watching videos, your browser started out operating as a Rdp (Remote control desktop) having a key logger which gave me access to your display and webcam. Immediately after that, my software collected your complete contacts from your messenger, facebook, as well as mailbox.
After that I gave in more hours than I should have looking into your life and generated a double-screen video. 1st part shows the recording you had been watching and other part displays the recording from your web camera (its you doing dirty things).
Frankly, I’m ready to forget exactly about you and allow you to continue with your life. And I am going to offer you 2 options that will accomplish that. The above option is either to ignore this letter, or simply pay me $ 2250. Let’s investigate above 2 options in more detail.
Option 1 is to ignore this e-mail. Let us see what is going to happen if you take this option. I will certainly send out your video recording to all of your contacts including relatives, colleagues, etc. It does not help you avoid the humiliation your self will must feel when friends and family discover your dirty videos from me.
Second Option is to send me $ 2250. We will call it my “privacy fee”. Now lets see what happens if you choose this option. Your secret will remain your secret. I’ll erase the video immediately. You continue on with your routine life that none of this ever occurred.
At this point you must be thinking, “I will call the cops”. Without a doubt, I have covered my steps to ensure that this e-mail can’t be tracked back to me plus it won’t stay away from the evidence from destroying your lifetime. I’m not trying to dig a hole in your pocket. I am just looking to be compensated for the time I put in investigating you. Let’s assume you have chosen to create this all disappear completely and pay me my confidentiality fee. You’ll make the payment by Bitcoin (if you do not know this, type “how to buy bitcoins” in google search).
Amount to be paid: $ 2250
Send To This Bitcoin Address: 1G8KVdvtaRd*KviRjvrDDAEWPQpFRPdscV8 (You need to Remove * from this address then note it)Tell no-one what will you be utilising the Bitcoins for or they possibly will not sell it to you. The procedure to acquire bitcoin can take a short time so do not delay.
I’ve a specific pixel within this message, and at this moment I know that you’ve read this e mail. You now have 2 days in order to make the payment. If I don’t get the BitCoin, I definitely will send out your video recording to your contacts including relatives, coworkers, and so forth. You better come up with an excuse for friends and family before they find out. Nonetheless, if I receive the payment, I will destroy the video and all other proofs immediately. It is a non negotiable one time offer, thus kindly don’t ruin my time & yours. Your time has started. Let me tell you, my malware will definitely be recording what action you take when you are done reading this message. Let me tell you If you do something inappropriate then I will have to send your videotape to your members of your family, co-workers before your time ends.
Smoke testing is a term used to describe the testing process for servers after patches are applied. 
Estimating an average time for patching servers and PCs can be a bit tricky. It can vary from one month to the next, depending upon the number and complexity of the patches released by your software vendors. You must consider all versions of operating systems and have a complete inventory of all your application software to do this job correctly. Our experience has shown that manual patching of systems takes on average of about 1.5 hours each.
This is a basic cost calculator for you to compute your typical monthly cost for patching your servers, PCs, laptops, tablets and associated application software. It also forms the basis for you to begin calculating your Return on Investment for software patching, or for comparison with alternatives to the manual process of patching operating systems and application software—such as Patch Management as a Service, also known as Vulnerability Management as a Service.