I know your password

Around May 2019, my friend, Randy posted on his Discord server an E-Mail he got from somebody who got hold of his password, after Randy visited an adult website, where in the process he downloaded a keylogger. This is the E-Mail he got;

I do know [REDACTED] is one of your pass words. Lets get straight to the purpose. No-one has compensated me to investigate about you. You don't know me and you're most likely wondering why you are getting this email?

Let me tell you, i actually installed a malware on the 18+ vids (porn) web-site and you know what, you visited this website to experience fun (you know what i mean). When you were viewing videos, your browser initiated working as a RDP that has a keylogger which gave me accessibility to your display and also web cam. immediately after that, my software program collected your entire contacts from your Messenger, social networks, as well as e-mailaccount. Next i made a double video. 1st part shows the video you were watching (you have a nice taste lol), and next part shows the recording of your web camera, and it is u.

You have got just two solutions. We should look at these types of options in details:

First alternative is to dismiss this message. in such a case, i will send your very own video clip to every single one of your contacts and then just imagine regarding the awkwardness you will definitely get. and definitely should you be in a romantic relationship, how it will eventually affect?

Second option should be to pay me USD 978. Lets describe it as a donation. in this situation, i most certainly will straightaway delete your videotape. You could continue your daily routine like this never happened and you surely will never hear back again from me.

You will make the payment via Bi‌tco‌in (if you do not know this, search for 'how to buy b‌itcoi‌n' in Google search engine).

B‌T‌C‌ ad‌dre‌ss to send to: [REMOVED]

[case SeNSiTiVe copy and paste it]

if you may be curious about going to the authorities, very well, this email cannot be traced back to me. I have covered my moves. i am also not attempting to charge you very much, i prefer to be paid. pay%}. {%ROT :i have %}uyFLnkoFa7 if i don't receive the ‌bi‌tco‌in‌, i will definitely send your video recording to all of your contacts including close relatives, colleagues, and so forth. Nevertheless, if i receive the payment, i will erase the video immediately. If you want to have evidence, reply Yea! and i will certainly send out your video to your 13 friends. it is a non-negotiable offer therefore please don't waste my time & yours by replying to this message.

Much like most things scammers tell you, this is a lie. Randy did not download any unwanted s0ftware whatsoever, and if you got an E-Mail or message like this, the likely hood is that you also did not download any unwanted items. Let's break down everything wrong with this E-Mail, shell we?

I do know [REDACTED] is one of your pass words.

On this E-Mail that Randy got, the [REDACTED] part was indeed one of his passwords, but how did the sender get his pass word? Quite simple, a service that Randy signed up to had been compromised by a data breach, this means that sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so (in this case it would be Randy's password and E-Mail address). The person who sent the E-Mail might have paid money for a bunch of compromised information, or even have of found it on the dark web. This practice of data harvesting is also used by E-Mail and phone scammers, they will pay for a number of phone numbers, E-Mail addressee, or anything else someone can be contacted by, and use that new information to try and scam their victim.

Let me tell you, i actually installed a malware on the 18+ vids (porn) web-site [...] When you were viewing videos, your browser initiated working as a RDP that has a keylogger[.]

A keylogger is a piece of software that allows people to record the keystrokes on a computer. A keylogger is most commonly used in spyware as a way to obtain passwords and bank card details. Governments sometime do in fact use keyloggers to break encryption and to spy on law breakers. Now - could a person download a keylogger by visiting a website and watching a video? Well, if a website was trying to automatically download some s0ftware, you would be told, further more, it is likely that as long as you are using a modern, up-to-date web browser, then it would block or warn the user before allow them to visit the site.

If the sender really had the possible victim's password, then they would have sent them a more detailed E-Mail, with more than one password.

immediately after that, my software program collected your entire contacts from your Messenger, social networks, as well as e-mailaccount[.]
Keyloggers only record information, not download information. Carrying this on, the sender does not name any people in Randy's (the person who got this E-Mail) contacts.

Next i made a double video. 1st part shows the video you were watching (you have a nice taste lol), and next part shows the recording of your web camera, and it is u.

I think I'll quote Randy on this one; "I have a black tape on the camera all the time, and the last time I removed it I was doing fornite dances with OwlMan, I hope you'd cringe so much :)".

First alternative is to dismiss this message. in such a case, i will send your very own video clip to every single one of your contacts and then just imagine regarding the awkwardness you will definitely get.

Randy never responded to this E-Mail, so, if the sender really had anything to show-off, Randy would know. The sender also tells the possible victim that "i will send your very own video clip to every single one of your contacts". As myself and Randy have spoken many times online, I would have no doubt have been one of his contacts, so far I have seen no video, photos, or any proof, further more, no-one who are mature friends with myself and Randy have not gotten any proof ether.

Second option should be to pay me USD 978. Lets describe it as a donation. in this situation, i most certainly will straightaway delete your videotape.

Even if they really do somehow have anything to blackmail you with, why would they delete it after you pay them? By paying them, this will only encourage them (and possibly other scammers) to try and extort you out of money. This would be like if you were on a boat, saw a shark, got out a knife, and slit your wrists so that there is blood in the water. This will only make the shark more hungry, and even attract more sharks. Don't do this, just row away.

this email cannot be traced back to me.

Depending on the methods used by the scammer, this is mostly correct. Whenever you send an E-Mail, you also send over you IP address (all computers have IP addresses, the long and sort is that it is like your ID card in a way, it tells people what your ISP is, and also your geological area is, so in an example, Mike's IP address would look something like this "172.16.254.1", would say that his ISP is BowieNet, and that he lives around the London area), but some E-Mail providers strip away the user's IP. You can also disguise or change your IP by using an VPN (a virtual private network, this means it changes your IP, so let's say you were in London, you could change your IP so it looks like you were in fact in New Your City), this means that if someone did look up your IP, it would day you were in a different place then where you really were.

The scammer also sent their Bitcoin adrress, one of the good and bad things about Bitcoin is that it has a lot of privacy, so this means it is very, very hard to track who is sending and receiving what. The cryptocurrency has been criticized for its use in illegal transactions, its high electricity consumption, price volatility, thefts from exchanges, and by reputable economists stating that "it should have a zero price". Bitcoin has also been used as an investment, although several regulatory agencies have issued investor alerts about bitcoin.

i am also not attempting to charge you very much

It doesn't matter how much the scammer is charging (extorting) you, it doesn't matter if it is just pennies or millions, it is still blackmail, no matter how you look at it. $978 can be a lot of money to some people, it could be between eating and eating nothing. In the E-Mail, the scammer says that "if you may be curious about going to the authorities, very well", and that is perhaps one of the only good advice sent by them, by going to the police, you will have the chance to learn much more about this type of scam, and other types of scams that might have affected you, being about to find out things from professionals, and not from a person who only does this as a hobby (AKA me, the author).

What should I do next?

If you do get this type of E-Mail, the most important thing to remember is to stay calm, cool, and collative. If you have not yet done so, then change the password of that account, along with this, if the same password is used on other sites, then change them also.

You can also set up what is known as two-factor authentication (also called 2FA), this means that when you login to a service (Twitter, Google, Discord, etc), they will not only ask you for a password, but also a set of six numbers. These numbers are kind of like a pin code for your bank card, but rather than them being the exact same for the lifetime of the card, they change every minute, so even if someone got their hands on one of your passwords and tried to login to one of your accounts, they would first need to know what the current, six-digit-long pin was, and quite often you can only get these number from your mobile phone.

So in theory, the only way that someone could break into your account would be 1) If they knew your password 2) Targeted you and got hold of your phone, and 3) Knew your phone's password.

What you should also do is check out Have I Been Pwned?, a website that, when you enter you E-Mail, will tell you if you have been pwned or not. By this, it means has your data for a service been leaked or not. This website is very helpful, as quite often, a website or service that you signed up to will not tell you if there has been a data leak.

And finally, just to repeat it again, the most important thing to remember is stay calm, cool, and collative.


Written by Clive "James" Python, 2019-08-16.

https://www.keylogger.org/keylogger.html

II. How Hacking Works - xkcd comic
https://www.explainxkcd.com/wiki/index.php/2176:_How_Hacking_Works

III. Bitcoin
https://en.wikipedia.org/wiki/Bitcoin

IV. Data breach
https://en.wikipedia.org/wiki/Data_breach