Attention everyone, I was hacked and tried to blackmail me Well, that’s it, there’s a cli…

Attention everyone, I was hacked and tried to blackmail me

Well, that’s it, there’s a clickbait headline, but now to the point 🌝. They really tried to blackmail me

The letter arrived at my university email. The same one that I use exclusively as a login in my personal account as a graduate student. I don't use it like mail. I don’t write letters from her, I don’t read anything. But just in case, I have access to my mailbox

And today a letter arrives there. And supposedly... from the same mail (oh horror, I’m about to die of fear)

I attached the letter itself to this post in the form of a screenshot. It didn’t fit entirely, but there are only Bitcoin wallets below. The meaning of the entire letter can be reduced to a sentence:

I installed a RAT on you, gained access to all devices, stole data, recorded you via webcam in a moment of self-pleasure and now I'm waiting for $800 in Bitcoin

And, probably, if I weren’t a security guard, I would be scared and do all sorts of bullshit in horror. But it just so happens that... I’m a security guy 😄

Let's figure out why such letters are almost always ordinary social engineering (well, of course, with jokes and advice from me). Let's go 🤌

The phrase “I sent an email from your email” usually scares people the most. This is like a guarantee that you have definitely been hacked. Or not?

In many cases, the sender's address can simply be faked. If the email infrastructure is not configured in the best way, the letter may well look like it was sent from your address. But that's not even the joke

Even if an attacker actually gained access to your mailbox, this does not mean that he gained access to your laptop, webcam or phone. These are completely different stories. Account hacking can be an entry point if you yourself click on the link in the message, etc. But no more. Let's move on

I installed RAT

Well, let's say. Will there be evidence of this?

If a person has actually been on my computer for several weeks, he at least knows:

- what is the name of my device
- what files are on it
- what sites do I visit?

But there is nothing in the letter at all. Well, just believe that you have a RAT and send me some money, please 🥺

This is done so that you scare yourself and think up what they might have spied on you. The brain always scares itself better than others

If we talk about how realistic it is to pull off such an attack, then I’ll say right away that it’s realistic. But not as described in the letter

To obtain video from a user's webcam, an attacker first needs to somehow infect the device. And to do this, the user must open a malicious attachment, launch a cracked application, execute shell- some script

This is a different level of attack. And yes, such attacks exist. But using them for the sake of a random person to ask for $800 in bitcoins is, to put it mildly, economically unprofitable

But such letters still work. Because they attack the psychology of the victim. This is just social engineering (I spent a whole year on it at university)

A person reads that he was recorded via a laptop webcam. And then the brain itself begins to do all the work for the attacker. All sorts of questions like “What if this is true?”, “Yesterday I actually watched all sorts of strawberries on my laptop,” etc.

Therefore, such letters have been sent out en masse for many years. It's just effective. People are afraid and pay. Not everyone, but someone will still pay

So I'll give you some advice 🤟

Despite the fact that this particular letter is most likely a social media message, I still recommend closing your laptop or camera when you... well, that's what you're talking about (“touching yourself”). I think you understand what I mean 😄

Not because someone is recording you right now. Just to be on the safe side. There will be less headaches later

Take care of yourself. And remember that in information security, attackers very often first try to hack not a computer, but a person