# Got a ransom note from a bitcoiner? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [July 19, 2018, 9:19pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228 "2018-07-19T21:19:58Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [July 19, 2018, 9:19pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/1 "2018-07-19T21:19:58Z")
Anyone get a ransom note from someone, asking for bitcoin? I just got one from a mailer at [outlook.com](http://outlook.com), claiming that if I don’t pay up, he will send a video to all the names in my contact list, showing all the porn I have been watching, and showing my face from my computer’s cam. Since my computer doesn’t have a cam, at least part of this is fake. And if he sends out that video, I hope he sends me a copy so I can see what I have been supposedly watching. He does supply one piece of info that would be hard to find out or guess. That makes me a bit unnerved. However this fucker ain’t gettin’ no bitcoin from me. Anyone else deal with this? ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [July 19, 2018, 9:25pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/2 "2018-07-19T21:25:45Z")
Yeah, I’ve been getting these emails for a week or so. Since they are clearly a scam, I’m ignoring them. ETA: they have an old password of mine that must have been compromised years ago. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [July 19, 2018, 9:34pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/3 "2018-07-19T21:34:47Z")
> [@beowulff](#): > > ETA: they have an old password of mine that must have been compromised years ago. But the fact that they have _any_ password, even an old one, suggests that some of their claims might be true, like installing a password logger on a porn site. Since I don’t use the same name or same password for most sites, knowing one isn’t going to get this dude very far, but… ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [July 19, 2018, 9:41pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/4 "2018-07-19T21:41:40Z")
> [@Musicat](#): > > But the fact that they have _any_ password, even an old one, suggests that some of their claims might be true, like installing a password logger on a porn site. > > Since I don’t use the same name or same password for most sites, knowing one isn’t going to get this dude very far, but… Do you actually have an account on a Porn site? If so, that might be cause for concern. But, really, the whole email sounds like a scam to me, and the fact that I have received it several times already from different email addresses and with different bitcoin addresses just screams “Scam!” ---
**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\ **Post date:** [July 19, 2018, 9:46pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/5 "2018-07-19T21:46:47Z")
> [@Musicat](#): > > He does supply one piece of info that would be hard to find out or guess. This is an old password, right? It comes from a hacked site and you changed that password, didn’t you? ---
**Author:** ![TruCelt](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/trucelt/32/523_2.png) [@TruCelt](https://boards.straightdope.com/u/TruCelt)\ **Post date:** [July 19, 2018, 9:49pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/6 "2018-07-19T21:49:20Z")
Send copies here: [FBI cybercrime tipline](https://www.ic3.gov/complaint/default.aspx) ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [July 19, 2018, 10:31pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/7 "2018-07-19T22:31:00Z")
Seems to be common enough; the IT people at the Department of Commerce (whose umbrella I’m under) sent a warning to all employees under their umbrella this morning. The email references this article: [https://www.mirror.co.uk/tech/phishing-scam-knon-sextortion-using-12928730](https://www.mirror.co.uk/tech/phishing-scam-knon-sextortion-using-12928730). ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [July 19, 2018, 10:33pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/8 "2018-07-19T22:33:54Z")
Here’s an excerpt from the email. > [@](#): > > I setup a malware on the 18+ streaming (adult porn) website and do you know what, you visited this site to experience fun (you know what I mean). When you were viewing video clips, your browser initiated operating as a Remote Desktop that has a key logger which gave me accessibility to your display as well as cam. after that, my software program collected every one of your contacts from your Messenger, social networks, and e-mail . Next I made a video. First part displays the video you were watching (you have a fine taste haha . . .), and 2nd part displays the view of your webcam, & it is you. The only porn sites I have visited do not use this name or this password, although in 25 years of Internet use, who knows what was used and what sites were hacked. Does any of his text make sense as a possible operation, like “Browser initiated operating as a Remote Desktop that has a key logger…”? Or is that simply scare ware? A Malware scan of two of my computers shows nothing amiss. First googing turned up nothing, but further googling shows [this as a likely culprit.](https://krypt3ia.wordpress.com/2018/07/16/extortion-phish-your-password-is-xxxx/) ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [July 19, 2018, 10:40pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/9 "2018-07-19T22:40:26Z")
> [@Skywatcher](#): > > The email references this article: [https://www.mirror.co.uk/tech/phishing-scam-knon-sextortion-using-12928730](https://www.mirror.co.uk/tech/phishing-scam-knon-sextortion-using-12928730). Weird, somehow a letter got dropped out of that link. Here’s the correct one: [https://www.mirror.co.uk/tech/phishing-scam-known-sextortion-using-12928730](https://www.mirror.co.uk/tech/phishing-scam-known-sextortion-using-12928730). ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [July 19, 2018, 10:41pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/10 "2018-07-19T22:41:54Z")
I would laff it off except for the password data. Here’s how that might have happened, from the same site I referred to previously: > [@](#): > > ALSO, it seems to be tracking that the passwords that are being cited in the extortion email are from the LinkedIN password dump in 2016. It may in fact be a melange of dumps but it seems since these are being targeted at corporate email accounts it makes sense that the adversary is using this dump cleverly. I dropped LinkedIn about \>5 years ago, but it’s possible that password was used on it. I dropped it not for security reasons, but because it was a great timewaster. Unfortunately, I don’t have a record of my login and password from the old LinkedIn account, but this one is a possibility. ---
**Author:** ![kenobi\_65](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kenobi_65/32/13178_2.png) [@kenobi\_65](https://boards.straightdope.com/u/kenobi_65)\ **Post date:** [July 19, 2018, 11:01pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/11 "2018-07-19T23:01:33Z")
I got pretty much the same email that you did, Musicat, earlier this week. It contained a reference to a password I’d used several years ago, as well. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [July 19, 2018, 11:10pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/12 "2018-07-19T23:10:57Z")
Someone at work got one the other day. Here’s the text. > [@some phisher](#): > > I’m going to cut to the chase. I am aware XXXXXXX is your pass word. Most importantly, I’m aware about your secret and I’ve evidence of this. You don’t know me and no one paid me to investigate you. > > It’s just your misfortune that I came across your bad deeds. In fact, I actually installed a malware on the adult videos (sexually graphic) and you visited this website to have fun (you know what I mean). When you were busy watching video clips, your internet browser started operating as a Rdp (Remote control desktop) having a keylogger which gave me access to your screen and also web camera. Just after that, my software obtained your complete contacts from messenger, facebook, as well as e-mail. > > Next, I put in much more hours than I should’ve looking into your life and created a double display video. 1st part shows the recording you had been watching and second part displays the capture from your cam (its you doing nasty things). > > Honestly, I want to forget about you and allow you to move on with your daily life. And I am about to present you two options that can achieve that. Those two choices are to either ignore this letter, or perhaps pay me $2900. Let us investigate these 2 options in more details. > > Option One is to ignore this email. Let me tell you what is going to happen if you choose this option. I will send out your video to your entire contacts including members of your family, co-workers, and so on. It doesn’t help you avoid the humiliation you and your family will ought to face when friends uncover your dirty details from me. > > Option 2 is to make the payment of $2900. We will name this my “confidentiality tip”. Now let me tell you what happens if you choose this path. Your secret remains your secret. I’ll delete the recording immediately. You move on with your lifetime like nothing like this ever occurred. > > Now you may be thinking, “I will go to the cops”. Without a doubt, I’ve taken steps in order that this e-mail can’t be traced returning to me and it will not stop the evidence from destroying your health. I am not looking to break your bank. I just want to be paid for efforts and time I put in investigating you. Let’s assume you decide to make this all disappear and pay me the confidentiality fee. You will make the payment through Bitcoin (if you don’t know how, search “how to buy bitcoins” in google search) > > Required Amount: $2900 > Receiving Bitcoin Address: \ > (It is case sensitive, so copy and paste it carefully) > > Tell nobody what you will be utilising the Bitcoins for or they may not sell it to you. The task to get bitcoin usually takes a short time so do not put it off. > I’ve a special pixel within this e mail, and now I know that you’ve read through this email. You have one day to make the payment. If I don’t receive the BitCoin, I will send out your video to all your contacts including friends and family, co-workers, and many others. You better come up with an excuse for friends and family before they find out. Nonetheless, if I receive the payment, I’ll destroy the video immediately. It’s a non negotiable one time offer, so kindly don’t ruin my personal time and yours. The clock is ticking. It was funny in it’s blatant over-the-top scare tactics. I contacted Outlook and they shut down the account. ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [July 19, 2018, 11:15pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/13 "2018-07-19T23:15:07Z")
Brian Krebs is the go-to guy for online security and scams. > **[Sextortion Scam Uses Recipient’s Hacked Passwords – Krebs on Security](https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/)** > > Here's a clever new twist on an old email scam that could serve to make the con far more believable. The message purports to have been sent from a hacker who's compromised your computer and used your webcam to record… [INDENT]KrebsOnSecurity heard from three different readers who received a similar email in the past 72 hours. In every case, the recipients said the password referenced in the email’s opening sentence was in fact a password they had previously used at an account online that was tied to their email address. However, all three recipients said the password was close to ten years old, and that none of the passwords cited in the sextortion email they received had been used anytime on their current computers. It is likely that this improved sextortion attempt is at least semi-automated: **My guess is that the perpetrator has created some kind of script that draws directly from the usernames and passwords from a given data breach at a popular Web site that happened more than a decade ago** , and that every victim who had their password compromised as part of that breach is getting this same email at the address used to sign up at that hacked Web site. I suspect that as this scam gets refined even more, perpetrators will begin using more recent and relevant passwords — and perhaps other personal data that can be found online — to convince people that the hacking threat is real. That’s because there are a number of shady password lookup services online that index billions of usernames (i.e. email addresses) and passwords stolen in some of the biggest data breaches to date.[/INDENT] Emphasis added. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [July 19, 2018, 11:16pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/14 "2018-07-19T23:16:51Z")
To sum up what I think I have learned: Multiple data breaches from the past are now stored for scammer uses. This data may contain names and passwords used long ago. Automated scammer programs access these databases and generate extortion emails, claiming to have found your password from a malware injection on an unspecified porn site. This is not true, but since almost everyone has visited a porn site sometime in their life, and might be embarrassed to admit it, this claim has some scare-merit. The claim to have recorded your porn site visits and/or an image of you while doing it is just another bogus scare tactic. If you ignore this email, nothing will happen. I doubt if the scammers want to spend the possibly unrewarding time making other connections from your data. However, if the specified password is one you still use, it would be wise to change it on all sites where it is used. Since no one can count on finding out about a data breach, most of us sign on to many web commercial and other web sites, and a data breach may happen without even the site owner knowing about it, it would be wise to change your passwords everywhere periodically, just in case. Does that sound like a good wrapup? ---
**Author:** ![FoieGrasIsEvil](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/foiegrasisevil/32/16638_2.png) [@FoieGrasIsEvil](https://boards.straightdope.com/u/FoieGrasIsEvil)\ **Post date:** [July 19, 2018, 11:22pm UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/15 "2018-07-19T23:22:48Z")
Too bad there’s no way for you to send this douche an email from a fake gmail account telling him to go fuck himself. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [July 20, 2018, 12:22am UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/16 "2018-07-20T00:22:10Z")
He’s too busy counting his bitcoins to care about that. ---
**Author:** ![Max\_the\_Immortal](https://avatars.discourse-cdn.com/v4/letter/m/6de8d8/32.png) [@Max\_the\_Immortal](https://boards.straightdope.com/u/Max_the_Immortal)\ **Post date:** [July 20, 2018, 12:33am UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/17 "2018-07-20T00:33:21Z")
Tell them to send you the video they claim to have. ---
**Author:** ![Jophiel](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jophiel/32/66_2.png) [@Jophiel](https://boards.straightdope.com/u/Jophiel)\ **Post date:** [July 20, 2018, 12:38am UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/18 "2018-07-20T00:38:26Z")
I like that these rely on the assumption that I’d be horrified if my friends and family were to learn that I sometimes watch some pretty standard porn. Likewise, if I got some random email saying “Watch your brother-in-law jerk off to ‘Horny Stepdaughter seduces her Dad’!!!” I’d delete it with zero interest in viewing that. Or care. ---
**Author:** ![drewder](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@drewder](https://boards.straightdope.com/u/drewder)\ **Post date:** [July 20, 2018, 12:45am UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/19 "2018-07-20T00:45:13Z")
With so many people here getting the same email, I got it too, I wonder if the straight dope message board was hacked. ---
**Author:** ![drewder](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@drewder](https://boards.straightdope.com/u/drewder)\ **Post date:** [July 20, 2018, 12:53am UTC](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228/20 "2018-07-20T00:53:47Z")
Also most webcams are configured so that the light is powered by the same circuit as the camera making it impossible to turn the camera on without the light coming on. This is a safety feature to prevent this sort of thing. [Next page](https://boards.straightdope.com/t/got-a-ransom-note-from-a-bitcoiner/818228.md?page=2)