Wednesday, July 31, 2019

My LinkedIn Password was compromised and I'm getting extortion spam emails 8 years later...

I have a vague memory of when this happened.  It was 2012 according to google and Wikipedia, but it feels more recent than that to me.  Maybe they finally let me know about it more recent that 2012.  At any rate the password I used for LinkedIn was unique to LinkedIn.  I also changed it at some point along the way, probably forced to by LinkedIn themselves.

Over the recent week's I've started getting spam messages like this:

zxcgertajpb@outlook.com (an actual spam address)

Subject: rich : XXXXXX (my old password is here)

i know XXXXXXX is yoŭr passphrăses. Lěts get right to the point.


It goes on to say they have control of my computer and took videos of me doing 'nasty things' etc and they're going to send the video to everyone in my contacts lists unless I send them bitcoin.  It's a curious amount $1497, $1467 or $1117. Always between $1000 and $1500 but never a round number. The spellings and use of  diacritic versions of letters is also prevalent in an attempt to bypass spam filters (didn't fool google). 

The message is pretty well crafted to fool some people.  It uses your name and your actual password from 2012. If you're like most people who use one password a lot of places this would freak you out and you may be tempted to pay up.   In my case, I try to use unique passwords everywhere I can and it was easy for me to see where this password came from and that it wasn't what the password currently is. 

Google/Gmail did exactly what they should have done, they flag the message as dangerous. 

If I hadn't gone into my spam folder out of curiosity I would have been completely shielded from it by Google.  Anyway, I though it was amusing to read and it probably works on a few people.

No comments:

Post a Comment