Is hijacking a webcam after visiting a website a plausible threat?

Question

(I made a throwaway to ask this question, since this situation is pretty embarrassing)

Earlier today I started receiving emails threatening to send embarrassing video of me to all my contacts unless I pay a ransom. When I first saw this message I did briefly panic and consider paying the ransom, but on reflection I'm wondering if this is a plausible threat. I mean, the password they sent as evidence is real, and to my embarrassment I did visit a porn site a week ago because I was bored.

That said, the claimed attack vector seems unlikely to me, and they could have gotten the password from a data breach on an unsecure website (it's a password I use on various forums, not banks or anything). I'm aware of the possibility of keylogging and your webcam being hijacked by a virus, but they're claiming to have done that simply because I visited their website. Is that really possible?

If this is a new attack vector, it seems pretty serious. All an attacker needs is for me to visit a malicious website, not even download anything?

Here is the full email I received:

I know REDACTED is your passphrase. Lets get right to point. You don't know me and you are probably thinking why you are getting this e mail? None has compensated me to check about you.

Well, I actually installed a malware on the xxx streaming (porn) site and guess what, you visited this web site to have fun (you know what I mean). When you were viewing videos, your web browser started out operating as a Remote control Desktop having a keylogger which gave me accessibility to your display and also webcam. Right after that, my software gathered your complete contacts from your Messenger, Facebook, and e-mail account. After that I made a video. 1st part displays the video you were watching (you've got a good taste : )), and next part displays the recording of your cam, yeah it is u.

You have got two different choices. We are going to read up on these possibilities in aspects:

First solution is to skip this message. In this instance, I am going to send out your video to each one of your contacts and then just think concerning the shame that you receive. And as a consequence if you happen to be in a loving relationship, exactly how it will affect?

2nd choice should be to give me $3000. Lets refer to it as a donation. Subsequently, I will straight away erase your video. You will resume your daily routine like this never took place and you would never hear back again from me.

You will make the payment by Bitcoin (if you don't know this, search "how to buy bitcoin" in Google).

BTC Address: 16u9dNXj1WRTu4aEiXREXjD1afqjELXs1S [case-sensitive, copy & paste it]

Should you are wondering about going to the law, okay, this e mail cannot be traced back to me. I have covered my actions. I am also not attempting to demand so much, I wish to be compensated.

You now have one day in order to make the payment. I have a specific pixel in this mail, and now I know that you have read through this e mail. If I don't receive the BitCoins, I will definately send your video to all of your contacts including relatives, colleagues, and so on. However, if I do get paid, I will erase the recording immediately. If you need evidence, reply Yes! then I will send out your video to your 5 friends. This is the non-negotiable offer and thus please do not waste my personal time & yours by responding to this e mail.

Answer 1

Hi this is a scam that has been doing the rounds for a bit now do not worry about it :)

• https://www.cert.govt.nz/businesses-and-individuals/recent-threats/webcam-and-password-blackmail-scam/
• https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/

What has happened is your credentials were leaked in one of the many breaches that occur and scammers are using this personal information to try and make you believe that have embarrassing content.

If you look up your password on https://haveibeenpwned.com/ you will find a breach. Now what the bad guy has done is find a list of email addresses and credentials and is now emailing trying to make a quick buck with no effort.

My advice is change your credentials and ignore it.

Answer 2

This particular email is a scam. Absolutely do not pay the ransom, do not respond, etc. You are safe to completely ignore the threat. Don't be embarrassed for having received it, I got it too!

The attacker has almost certainly gotten your email and password from some old credential dump. This is why it is very important to use a different password on every account. That way, if one password is stolen it can't be used to break in to several of your accounts.

To answer your webcam question directly: Yes, it is possible for a website to activate your webcam. Generally this is done via an API which causes your web browser to ask your consent to turn on the camera, to prevent surreptitious recording.

It is conceivable that a bug or exploit would be found which would allow an attacker to turn on the camera without your consent or knowledge. However, these kinds of major privacy browser bugs are not common and the big browser makers (Google, Microsoft, Apple, Mozilla) would patch such a flaw very quickly once they became aware of it. Therefore, the risk to most computer users is probably small. However, risks like this are why some people choose to cover their webcam with something like a small sticker.

Answer 3

tl;dr- Looks like a silly scam. Sure, their story's not quite physically impossible in a strict sense, but it still makes no sense.

---

If their story were real, the message probably would've looked like this:

Hey, check out the attached video, and this list of your contacts:

1. [name #1]: [email address #1]

2. [name #2]: [email address #2]

3. [name #3]: [email address #3]

4. [name #4]: [email address #4]

5. [...]

Anyway, please send 3,000 USD to this Bitcoin address within [time period]:

• [Bitcoin address]

• [link to website explaining how to use Bitcoin]

, or my automated script will email those people the video.

Except, they provided you with a different piece of evidence,

• I know REDACTED is your passphrase.

, and then threatened you to not ask for evidence of the actual black mail material

• If you need evidence, reply Yes! then I will send out your video to your 5 friends.

. It's not impossible that their story's real. I mean, for all you know, another piece of junk mail you got the same day from someone claiming to want a $5,000 wire transfer as a downpayment on the taxes on the $1,000,000 they want to give you is also real.

But, this appears to be a social-engineering attack. As far as security goes, trying to establish physical impossibility is the wrong tool, because physical impossibility is an incredibly low bar.

In short, yeah, maybe they used some zero-day exploits to hack a porn site's servers and then your computer. But, it's pretty far-fetched and their threat doesn't make any sense even if we assume that that's the case.