Weak passwords aren't today's problem, they are tomorrow's...

[jducoeur]

tl;dr: Some old account of Jane's has been hacked; please point it out if you notice anything amiss.

Just got something new: what I can only describe as Blackmail Spam. On the one hand, while the email is desperately trying to look highly customized and threatening, it contains enough nonsense to give away that it's generic spam. (It claims that they recently got this information from a keylogger installed on a porn site, that they hacked our camera and are going to put the images from it online. Yeah, right.)

OTOH, the proof being used in the message looks real -- it includes a password that Jane used to use for unimportant accounts, combined with a plausible login for her. As usual for such things, they are demanding thousands of dollars of blackmail to be paid in bitcoin, blah blah blah.

So something has been hacked -- her credentials were almost certainly stolen from some site she used to use that had poor password security. No idea what, and I'm not desperately worried -- it doesn't appear to be anything I have in my records, and it isn't a login she used for anything important that I'm aware of. But if you see anything strange claiming to come from her, it's probably related, and would be useful for me to know about...

Comments

[fitzw]

This particular scam has been making the rounds, both as email and as physical mail (showing that they have your postal address as well). The information was apparently taken from a data repository site.

[metahacker]

Just got the same email. Based on the password they emailed me...yeah, I'm not too concerned. (It was a password I used to use for sites that shouldn't have been asking for identities at all, circa 10 years ago.) Someone scraped an old list of email addresses/pws from somewhere and is seeing who bites.

Annoying, but a reminder that security is a moving target.

[kiya]

So I got this too, and I didn't see a password in it, and now rereading it (I kept it because it was wacky) I suspect this string of random numbers it starts out with was supposed to be the 'here let me threaten you with your password'.

So that's a thing.

[jducoeur]

If it's the same one, the password in question is usually the Subject line of the email. I've now gotten four versions of it, and they do all clearly include old passwords used on bad websites, so it's really quite clear that it's real. If you've got a random string instead, that suggests that you were using a reasonably good password. (Which should, after all, be pretty random.)

Although all indications are that they are capitalizing on an existing database of passwords from hacks of old data, largely around ten years old. So if you change your passwords regularly, it's less of an issue.