Sadly, phishing emails are a part of modern life on the Internet. Bad people doing bad things exist in cyberspace as much as in the real world. Until technology surpasses the use of passwords to authenticate our identities, the password breach is likely here to stay. Couple bad actors with data breaches and you get some pretty outlandish attempts at fooling people into parting with their money.
You are aware of phishing emails from your security awareness training but one creative phishing tactic you may not have heard of is called, "sexploitation." It's called that because it preys on people's fear of being shamed or embarrassed in front of their family, friends, or coworkers.
Here's what is looks like:
From: W C <l1f6j0a5k@outlook.com>
Sent: Wednesday, May 6, 2020 10:38 AM
To: Dan Wardon <dwardon@vcs.net>
Subject: Geude1t
πΈ ππππ , πΆπππππ·π, ππ π’πππ πππππ πππ.
πΈ ππππ π’πππ ππππππππ πππππππππ πππ πππ πππ πππ‘π ππ ππππ’-ππππ πππ, ππ πΈ π πππ πππππππππ’
ππππ ππππ π’ππππππ π’ππ ππππ πππ ππ πππππ πππ πππ ππππ ππ π’πππ ππ‘πππππππ.
π·π, π’ππ πππ'π ππππ ππ. π±ππ πΈ ππππ πππππ’ πππππ πππππ π’ππ. ππππ ππ πππππππ ππππ,
ππππππππππ ππππππππ πππ πππ ππ πππ πππ πππππππ ππππππππ’ ππ π’πππ ππππππππ ππππ ππππ
π·π½πΉ πππ’π.
πΈππππππππ, π’πππ πππππ πππππ, π ππππ ππππππ ππ ππ πππ πππππππ’ ππππππ π ππ’ πΈ 'π π ππππππ
ππππ ππππππππ ππππ ππ π’ππ.
ππππ πππ ππππππππ ππππ π’ππ π πππ ππ πππ πππ πππππ ππππππππ ππππππ πππππ, ππ’ ππππ πππ
πππππ ππ ππππππππππππππ ππ π’πππ ππππππππ ππ’ππππ π ππππ πππππ ππ πππππππππ π ππππππ’
πππππππ ππ π’πππ ππππ ππππππππππππ’ ππππππ’ ππ’ ππππππππππ π’πππ πππ.
(π’ππ πππ π ππππππππππππ’ π ππππ ππππππππππ πππ ππππ)
πΈ ππ π πππ ππππ πππππππππ. πΈπ πππ ππππ π’ππ ππππ πΈ 'π πππππππ ππππππ, ππππ πππππ’
πππππ πππ πΈ π πππ ππππππ ππππππ πππ πππππππππ ππππππππ’ ππ πΌ ππππππ π’ππ ππππ .
πΈπ πππππ πππ ππ πππππ π’πππ πππππππ, ππ π ππππππ, ππππ, ππππππ πππ ππππππ (πΈ'π πππ
ππππ! πΌπ’ πππππ ππππ πππ ππππππππ’ ππππππ πππ πππππππ πππππππ).
πππππ π’ππ ππ ππππ ππ ππππ ππππ πππ’πππ'π ππ’ππ πππππ πππππ ππ? πΈ πππππ ππ...
π½ππππππππππ, πππππ'π πππππππππππ’ ππππ ππ ππ ππππ πππππ.
πΈ π ππππ ππππ ππ ππππ π’ππ π πππ ππππ, ππ ππππππππππ πππππ.
πΏπππππππ πππ³ πΈπΆπΆπΆ ππ πππππππ πππ ππππ ππ ππ πππ πππ π πππππ πππππππ:
1Kg7Siaff7yD*4S2jrZiTTe532sswtt66ki9_+@2!swFSTqdqBKCH7Rdagx
[ππππ-ππ΄π½ππΈππΈπ π΄ ππππ’ & πππππ ππ, πππ ππππππ * ππππ ππ]
(πΈπ π’ππ ππ πππ ππππ πππ , ππππππ πππ ππ πππ’ πππππππ. π³π πππ π ππππ ππ’ πππππππππ ππππ)
πΈπ π’ππ ππππ πππ ππππ ππππππππππ 'ππππππππ' (πππ'π ππππ ππππ ππππ?). πΈππππππππππ’
πππππ ππππ, πΈ π πππππππππ πππ πππππ ππ πππππππππππππ πππ ππ πππππ π πππ π’ππ πππππ. πΈ
π πππ πππ πππ ππ πππππ’πππππ πΈ ππππππ ππππππππ ππ π’ππ. πππ πππ’ ππππ’ π πππ πππππ’ ππ
ππππππ π’πππ πππππππ πππ’ ππ πππ’ ππππ π πππ π£ππππππππππ.
πππ ππππ πππ πΈπΊ πππππ ππ ππ ππ. ππππ ππππ ππππππ ππ πππππππ’ π’ππ πππππ πππ ππππ
π-ππππ. πΈ ππππ ππππππππ ππππ ππππ π πππ ππππππ ππ ππππ π’ππ ππππ ππππ πππππ πππππππππ
πππ'π πππππππ ππ ππππ’ πππππ.
The goal is to get you to believe they actually have video or other proof of some sort of embarassing thing, and will send that information to everyone in your contact list. Some fall for it because after all, they have your correct password.
However, this whole thing is a scam. There is no malware, and they do not have access to your computer, nor do they have incriminating video of you.
Here's what happens.
Think about the last time you heard about a data breach, whether it was Target, LinkedIn, Adobe, or many others. When passwords are used at multiple legitimate service providers, say your LinkedIn account, and one of those sites/services is compromised, those passwords wind up in the dark web amongst a very long list of other breached accounts that may number into the millions. These lists are marketed as commodities, to be bought and sold many times over.
Some bad actor purchases these compromised accounts and formats them to be used in phishing scams. They use a simple mail-merge script to send automated emails such as this one. They substitute the names, passwords, and email fields to make them appear personalized. In fact, these are completely automated programs that send out hundreds of thousands or even millions of emails hoping someone bites. And sadly, due to the sheer number of attempts, many people do. Why do people send out phishing emails? They do it to make money.
If they send out 500,000 emails and only .25% reply, that's still 1250 people. Now lets say half of those people, 625, reply to the ransom by sending $2000, that's a huge number ($1,250,000) and that's why they do it.
The best course of action is to periodically change your passwords. While people have accepted that this is good practice, and some services such as banks, and VCS, force periodic password changes, many people prefer to keep the same basic password pattern but merely change the number at the end. However, knowing this is a common practice, perpetrators will factor this into their brute force methods (again, automated scripts) and will try to see if they get a hit. So changing your password from $omeC0mpl3xP@s$w0rd to $omeC0mpl3xP@s$w0rd1 really doesn't do you any good.
This is also a good reminder not to use the same password across multiple sites and services. If the breached password exists for some of your current services, you should immediately change it wherever itβs still active, even if only part of it is used. Even if it doesn't currently exist as part of a breach, there is a chance it's not "if" but "when." So to mitigate this risk (and to drive the point home) never use the same password across multiple services.
Nowhere is this more important than when you're doing online banking. Passwords related to all financial information (i.e. banking, retirement accounts, investment accounts, budgeting apps, etc.) should be completely unique and complex.
Many folks think it's impossible to remember all of these different passwords, and they're right. To help manage all of these different, complex passwords, we recommend using a password manager such as 1Password or LastPass.
To check to see if any of the companies in which you do business have been breached, and if your credentials have been found to be on the dark web, please visit https://haveibeenpwned.com/ and enter any email to conduct a search.
Comments
0 comments
Article is closed for comments.