Beware scammers

[redsturgeon]

On Monday I received a scam email basically saying that they had my password and had used it to take control of my laptop camera and video me watching porn (they said I had great taste btw,lol).

The password they showed was indeed an old password of mine, still perhaps used by me as a default when low security is adequate.

They threatened to send a video of me watching porn to my contact list if I did not send about £1000 via bitcoin.

I ignored it and deleted it mainly because even if true I failed to see how any of my contacts would be remotely interested in a split screen video of one half some porn and the other half me with a look of concentration on my face and it certainly was not worth £1000 to deny them the pleasure.

Anyhow I now read that this is a popular new scam as described in the link below...does anyone actually fall for this stuff?

https://krebsonsecurity.com/2018/07/sex ... passwords/

John

[Slarti]

I've had 2 or 3 of those in my ISP's spam trap. But the email addresses they were to were not of anybody who has ever been on my domain and the passwords were not valid on my systems.

I think that they are selecting people from http://haveibeenpwned.com/ where, as well as real ones, there are many, many false email addresses.

Slarti

[melonfool]

I've had this scam a few times, it's hilarious the way they word it!

Funnily enough I got it yesterday on my new laptop, which has not only never been used to look at porn, it has never even had any contacts set up in it yet (well, it has now, but it hadn't when the email came).

The first time I got this I did actually report it to Action Fraud because it is very nasty and I do think it could catch some people out. AF sent me several letters, all variously telling me they couldn't really do anything and offering me 'victim support'. I can't help feeling the balance between annoying admin and police action is tipped in the wrong way.

Mel

[melonfool]

I've had 2 or 3 of those in my ISP's spam trap. But the email addresses they were to were not of anybody who has ever been on my domain and the passwords were not valid on my systems.

I think that they are selecting people from http://haveibeenpwned.com/ where, as well as real ones, there are many, many false email addresses.

Slarti

Are you suggesting that if I put my email address in their search tool, they retain it? Because I didn't think they did?

Mel

[Slarti]

Are you suggesting that if I put my email address in their search tool, they retain it? Because I didn't think they did?

Not at all.

But you can check a domain, rather than an individual email address, and there are 82 accounts from my domain that have been Pwned, most of which have never existed.

I'm sure that it is not beyond the wit of many people (but not me) to grab somebodies domain details for evil purposes.

Slarti

[melonfool]

But, email addresses on domains don't need to exist, do they? I own my company domain and any email sent to anythingatall@mycompanydomain.co.uk will get to me.

Mel

[Slarti]

But, email addresses on domains don't need to exist, do they? I own my company domain and any email sent to anythingatall@mycompanydomain.co.uk will get to me.

Mel

True, well it will end up in an Unknown basket to be investigated, but sending emails to someone to try and blackmail them, it helps to know if they are real. I would have thought.

Slarti

[melonfool]

But, email addresses on domains don't need to exist, do they? I own my company domain and any email sent to anythingatall@mycompanydomain.co.uk will get to me.

Mel

True, well it will end up in an Unknown basket to be investigated, but sending emails to someone to try and blackmail them, it helps to know if they are real. I would have thought.

Slarti

That is true. I have just unsubscribed from something I keep getting and wasn't sure if I had signed up to or not, but when I unsubbed, it unsubbed 'contracts@mycompanydomain.co.uk' and I've never used that so...... No, I didn't sign up to it!

Mel

[Slarti]

I have just unsubscribed from something I keep getting and wasn't sure if I had signed up to or not, but when I unsubbed, it unsubbed 'contracts@mycompanydomain.co.uk' and I've never used that so...... No, I didn't sign up to it!

There are unscrupulous people out there who sell lists of "confirmed" "approved" email lists to less than clever marketing departments.
GDPR seems to have improved their willingness to take you off their mailing list.

I did have an argument a few weeks back with one company that was insisting it could keep spamming me, under GDPR as it was B to B. It was only when I pointed out to them that the company they were mailing had been dissolved in 2014 that they gave up.

Slarti

[melonfool]

GDPR, of course, does not draw any distinction between BtoC and BtoB. If the email address they are using has a name in it, it's data.

If not, it is governed by PECR anyway.

Mel

[Slarti]

GDPR, of course, does not draw any distinction between BtoC and BtoB. If the email address they are using has a name in it, it's data.

If not, it is governed by PECR anyway.

Mel

If they are cold mailing a B2B address they can claim fair use for business, if it is to a random stranger, me, I can tell them to remove me from their records. According to the ICO,

Slarti

[melonfool]

GDPR, of course, does not draw any distinction between BtoC and BtoB. If the email address they are using has a name in it, it's data.

If not, it is governed by PECR anyway.

Mel

If they are cold mailing a B2B address they can claim fair use for business, if it is to a random stranger, me, I can tell them to remove me from their records. According to the ICO,

Slarti

By 'fair use' (not a GDPR term), I assume you mean 'legitimate interest'? In which case they have to have done a legitimate interests assessment which would mean they have to be able to show, to at least *some* extent that they have considered your rights alongside their own 'legitimate interest' (the assessment can be found on the ICO website).

Mel

[UncleEbenezer]

Yes, I admit, I've been browsing that terrible site Lemon Fool, and my password (if I could remember it) is probably a bit weak.

Now, if you can remind me of my account ID and password to access those bitcoins?

[Slarti]

By 'fair use' (not a GDPR term), I assume you mean 'legitimate interest'? In which case they have to have done a legitimate interests assessment which would mean they have to be able to show, to at least *some* extent that they have considered your rights alongside their own 'legitimate interest' (the assessment can be found on the ICO website).

Yes, legitimate interest. I got the terminology wrong, off the top of my head.

The people I had the discussion with seemed to think that they had done enough by buying an "approved list" and mailshotting to that. They were not happy to realise that they had been conned.

I wonder if they troubled to check all 500,000+ addresses that they had bought, or just searched for and deleted the ones to my domain?

Slarti

[bungeejumper]

I had the same email a few days ago, and I'm still chuckling at the mystery of where anybody could have got any exciting video of me, since my only webcam is on my laptop, which is locked inside a drawer. Yes, folks, I freely admit it, I'm a plywood fetishist who's moving on from Homebase to the real hard stuff, Oak Furniture Land. And I don't care that I've been outed, because my laptop hasn't.

As with the OP, this person had got hold of a very weak password that I use for a zero-security website. (BBC news, I think. Good luck with getting any dirt from that one, madam.) And as it happens, my browsing record is as pure as driven snow, so stick that up your junta, whoever you are. But yes, the language was threatening and it didn't feel good to be getting this kind of stuff. If I'd been in any kind of anxiety state, I suppose it could have set me back quite badly.

OTOH, if I'd been the US president I'd probably have paid up.

BJ

[swill453]

And as it happens, my browsing record is as pure as driven snow, so stick that up your junta, whoever you are.

Yes, incognito browsing is useful, isn't it?

Scott.

[Infrasonic]

T

he people I had the discussion with seemed to think that they had done enough by buying an "approved list" and mailshotting to that. They were not happy to realise that they had been conned.

A bit O/T, but anyway...
Years ago when faxes where still a thing (unless you're the NHS in which case they still are) I kept getting masses of fax spam from one company who seemed to think I was an architect. (It was a recycled BT number with alternative ring that I had as my 'business' line.)
Eventually I had enough and contacted them to ask them to stop, it carried on.

So I wrote the boss a snotty letter pointing out that as an individual / sole trader it was illegal to fax me for marketing purposes without my permission, and that the company they were spamming hadn't been at the address they had for over ten years or had that phone number (I contacted the architects as well to check when they moved...)
Cue apologetic reply letter explaining how they used a 'reputable' company for their marketing lists. To which I replied as the data was ten years out of date I thought they had been scammed by some third rate charlatans (and a five second Google had revealed the current contact details for the company they were trying to spam anyway.)
The faxes stopped after that...

[bungeejumper]

Years ago when faxes where still a thing (unless you're the NHS in which case they still are) I kept getting masses of fax spam from one company who seemed to think I was an architect. (It was a recycled BT number with alternative ring that I had as my 'business' line.) Eventually I had enough and contacted them to ask them to stop, it carried on.

Oh, the wonders of crossed fax lines. Back in the day, I started getting faxes that seemed to have been intended for a large tyre manufacturer, not very far away from my home. They had been sent by the company's main office in Germany.

It was rather tiresome to have my phone line tied up while these unwanted faxes were incoming, and even more tiresome to be paying for the chemical ink paper that my fax machine was forced to use. (There was no way of saving faxes electronically to my had disk, as you can nowadays.) I tried repeatedly to get the company to sort it out, but without success.

Then one day it got more interesting. One of the faxes contained a German lawyer's letter about an ongoing damages claim, which alleged that the company's tyres had burst and had overturned a lorry, with disastrous consequences. The damages at stake ran into many millions, and the whole thing was super-confidential and for-your-eyes-only, and the press would have loved it. I posted the print-out to the company's CEO, suggesting that he get his act together. He never replied. The faxes mysteriously stopped.

BJ

[melonfool]

I was once given a recycled phone number that had previously been some company fax number and the phone rang day and night, with just the high pitched screech when I picked it up.

It took ages to get BT to change the number again and it was a royal nuisance, had to turn the phone off, which sort of defeats the purpose of a phone.

Mel

[Infrasonic]

Then one day it got more interesting. One of the faxes contained a German lawyer's letter about an ongoing damages claim, which alleged that the company's tyres had burst and had overturned a lorry, with disastrous consequences. The damages at stake ran into many millions, and the whole thing was super-confidential and for-your-eyes-only, and the press would have loved it

I once had that with some Vodafone emails, which I had linked to my domain.
Vodafone were in the process of closing down (yet again) another one of their email systems and I managed to get some very private legal stuff from a third party company sent to my inbox.
I contacted the company to let them know, forwarded them the emails as evidence, and asked them to let me know if they got any of my emails (far more pedestrian content unfortunately.)
Then we both contacted Vodafone to read them the riot act...