I have been warning you for a couple of year about extortion emails in which the intended victim is told in the email that his computer and web cam have been hacked and that the scammers have video of him watching porn online. They threaten to send the videos to people on his contact list unless he pays a ransom in Bitcoin or some other cryptocurrency. Recent figures from the FBI’s Internet Crime Complaint Center (IC3) indicate that the instances of this scam dramatically increase 242% over the previous year. The truth is that while it is possible to hack into someone’s webcam, these emails are being sent out as mass mailings without the videos they claim to have. The scammers’ hope is that some people will be fearful enough to send the ransom. In the Scam of the day for January 27, 2019 I wrote about how the scam had evolved whereby, in order to appear as a more legitimate threat, the scammer included in the email a password the targeted victim had used. Again, however, this email extortion threat is baseless. The password that was included in some versions of this email scam is indeed one that the targeted extortion victim had used, however, it was obtained by the scammer from one of the many data breaches in which passwords were stolen. This emphasizes the need to have unique passwords for all of your online accounts so that if there is a data breach in which your password is compromised, it will not pose a threat to all of your online accounts. This scam also illustrates the vulnerabilities of webcams to being hacked. There have been a number of scams of which I have reported in which people’s webcams have been hacked and compromising videos taken. Often when people install webcams, they use default logins and passwords. These default passwords are easy to find online. Generally, when you hook up anything wireless to your router, it comes with a password and login so it is critical that whenever you install any of these Internet of Things devices, you change the password and login to protect yourself, which leads us to my second concern – routers. A study by security company Avast found that about 80% of Americans do not properly secure their routers, leaving themselves vulnerable to being hacked. Many people still use either default passwords or easily guessed passwords, such as “password” for their routers. In the latest evolution of the sextortion scam, the scammers are using subject lines that appear to be a security alert. Often the subject line will include the targeted victim’s email address or password to get their attention. Here is a sample email supplied by security software company Malwarebytes:
“I am well aware [REDACTED] is your pass words. Lets get right to point. Neither anyone has paid me to investigate you. You may not know me and you are probably thinking why you’re getting this e-mail?
actually, i installed a software on the adult videos (pornographic material) web-site and do you know what, you visited this website to have fun (you know what i mean). While you were viewing videos, your web browser began working as a Remote Desktop that has a keylogger which gave me accessibility to your display and also cam. Just after that, my software gathered every one of your contacts from your Messenger, Facebook, as well as email . after that i created a double video. 1st part displays the video you were viewing (you’ve got a nice taste haha), and next part shows the recording of your cam, yeah its you.
You have not one but two choices. Shall we read up on these options in aspects:
First alternative is to just ignore this message. in such a case, i am going to send out your actual video to every single one of your personal contacts and think regarding the awkwardness you will definitely get. and definitely if you happen to be in a loving relationship, how it would affect?
Number 2 solution is to pay me $889. Lets name it as a donation. in this situation, i most certainly will asap remove your video footage. You could carry on daily life like this never occurred and you surely will never hear back again from me.”
As we connect to the Internet through more and more devices that are a part of the Internet of Things, it becomes increasingly important to be cognizant of maintaining proper security in all devices including, of course, routers and webcams. Laziness can have dire consequences. Never use default logins and passwords. As soon as you install any device that accesses the Internet, make sure that you protect yourself with secure logins and passwords. It is not difficult to hack into the webcam of a computer from afar. The same types of tricks used to get people to unwittingly download keystroke logging malware that enables the hacker to gather all of the personal information from your computer to be used to make you a victim of identity theft can be used to get you to download the malware that enables the hacker to take control of your webcam. Never click on links in emails or download attachments unless you are absolutely positive they are legitimate. They may be riddled with malware. Also, install and maintain anti-malware and anti-virus software on your computer and other electronic devices. For external webcams that are not a built-in component of your computer, a red light will signal that the camera is operating. Be aware of this. It is a good idea to merely disconnect the external webcam when you are not using it or merely take a post-it and cover the webcam’s lens whenever you are not using it. Two years ago a photograph taken in 2015 was made public showing Pope Francis using his iPad with a sticker over the built in web camera. This simple technique is also used by Mark Zuckerberg, former FBI Director James Comey and me. It is a simple and easy solution. For built in webcams, they too will generally have a blue light to indicate that it is operating, however, again, it is a good idea to merely cover the lens when you are not using it.
If you are not a subscriber to Scamicide.com and would like to receive daily emails with the Scam of the day, all you need to do is to go to the bottom of the initial page of http://www.scamicide.com and click on the tab that states “Sign up for this blog.”