-1

Finally, even I got the fabled ransomware emails we've all heard about so much.

First, let's look at the facts before I get to my question:

  1. I use Mozilla Thunderbird as my email client.
  2. I was using at least one VPN (one on the system, possibly another via the browser (Opera)) at the time that the events below transpired.
  3. Recently I revisited a (relatively well known) web forum I was active on many years back. I tried a few different email/pw combinations to log on to the forum. None of them worked - either because the pw was wrong or the account was no longer active.
  4. I tried logging in using different browsers.
  5. So I searched in my mail client for the forum's name (hoping to find some communication from the forum to check which email account I actually used on it) and found a few old emails one of which contained the password (see next point also).
  6. I was on this forum when it was still in its early days - and the then admins thought it was a good idea to send people an email saying your login email/id is xxxxxx and your password is yyyyyy (yes, in plaintext).
  7. I tried the newly discovered old password, and it didn't work.
  8. It wasn't terribly important to visit this forum, at least it wasn't worth the trouble. So I gave up on this and moved on.
  9. When I checked my email this morning, I find this email in the junk folder of a different email id, not the one I used previously for the forum, as mentioned in point 5. The email reads:

I know yyyyyy is your pass. Lets get directly to point. No one has paid me to investigate about you. You may not know me and you are probably wondering why you are getting this email? Well, i actually installed a malware on the X videos (pornographic material) website and guess what, you visited this site to have fun (you know what i mean). While you were watching video clips, your browser started operating as a RDP with a key logger which gave me accessibility to your screen and webcam. after that, my software gathered your complete contacts from your Messenger, Facebook, and e-mail . Next i created a video. 1st part shows the video you were viewing (you've got a fine taste : )), and next part displays the recording of your cam, yeah it is you. There are two choices. Let us take a look at each of these choices in aspects: First solution is to disregard this e-mail. in this instance, i am going to send your very own videotape to each one of your contacts and thus think about regarding the disgrace you will get. Keep in mind should you be in a committed relationship, exactly how it will eventually affect? Second alternative is to pay me USD 969. i will think of it as a donation. in this scenario, i most certainly will immediately delete your video footage. You will carry on your way of life like this never took place and you will never hear back again from me. if you are looking at going to the law, surely, this message cannot be traced back to me. I have covered my moves. i am just not looking to demand so much, i simply prefer to be compensated. email message%}. if i don't get the ‌bi‌tco‌in‌, i will definately send your video to all of your contacts including membe rs of your family, co-workers, and many others. Nonetheless, if i do get paid, i'll erase the video immediately. If you want to have evidence, reply with Yes and i definitely will send your video to your 8 friends. it is a non:negotiable offer, that being said do not waste mine time & yours by responding to this e-mail.

The interesting thing about this email is when I hit Ctrl/Cmd-A, or select the empty space between paragraphs, I can see a lot of other text between the visible paragraphs. So this other text is formatted to be the same color as the background. This other text essentially consists of my email id (sans the @gmail.com part), the password text, and interspersed with random text like jejyzsz, yogdyle, xaue, zsrryzwob, gykucagex. Presumably this is to disguise the email from (spam and other) filters. Or is it something else?

Next, my take on this:

  1. I haven't used that password in ages, so I don't really care.
  2. The webcam on my laptop is always taped over, so I don't really care about what kompromat video they might have on me either.
  3. I won't be replying to them, and will wait/watch if/how they follow up.
  4. The email mentions getting my contacts from Facebook and Messenger, but neither of those are installed on my laptop. So this seems to be an automated operation.

Now, the real questions:

  1. How did they get that old password?
  2. How were they able to relate the two email id's - the one which had received the ancient email containing the password in plain text, and the other email id, which received the ransom message?
  3. Edit/add: **Yesterday I tried to login and later viewed the email containing the plaintext pw and today I receive the ransom mail. (How) are the two events related?? I find the timing a bit suspicious...

Edit/add (after a remark in an answer): the two email id's are very similar. If one is FirstLastXXX the other is FirsLastYYY where XXX and YYY are numbers. But the original email (the one which was used to sign up and which also had received the email containing the pw in plain text) did NOT receive any ransom messages.

The possibilities (as far as my limited imagination goes) are:

1. From the forum's servers
2. From the browser, via an exploit
3. From the VPN servers
4. By hijacking the connection
5. Completely random, but extremely extremely unlikely coincidence. 
6. From the mail client, via an exploit. 
7. Via malware on the local system
8. Compromised ad network server somewhere
9. What else????? 

1, 2, 3, 6, 7 and to some extent also 4 - if any of these are/were compromised, they could have had access to much more than an ancient password.

So what do you think is going on here? I know what I should do, but the question is how could this have happened?

Interesting bits from the mail source:

ARC-Authentication-Results: i=1; mx.google.com;
       spf=neutral (google.com: 31.40.49.135 is neither permitted nor denied by best guess record for domain of ybkisu@fajuxeguz.com) smtp.mailfrom=ybkisu@fajuxeguz.com
Return-Path: <ybkisu@fajuxeguz.com>
Received: from fajuxeguz.com ([31.40.49.135])
        by mx.google.com with SMTP id g4si9835035ywe.174.2019.04.22.10.22.18
        for <MYEMAILIDHERE@gmail.com>;
        Mon, 22 Apr 2019 10:22:20 -0700 (PDT)
Received-SPF: neutral (google.com: 31.40.49.135 is neither permitted nor denied by best guess record for domain of ybkisu@fajuxeguz.com) client-ip=31.40.49.135;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 31.40.49.135 is neither permitted nor denied by best guess record for domain of ybkisu@fajuxeguz.com) smtp.mailfrom=ybkisu@fajuxeguz.com
Received: from unknown (HELO m1.gns.snv.thisdomainl.com) (Mon, 22 Apr 2019 13:07:45 -0400)
    by relay-x.misswldrs.com with LOCAL; Mon, 22 Apr 2019 13:07:45 -0400
Received: from [198.165.237.20] by smtp.doneohx.com with SMTP; Mon, 22 Apr 2019 12:59:11 -0400
Received: from smtp.endend.nl ([187.194.89.225]) by mts.locks.grgtween.net with LOCAL; Mon, 22 Apr 2019 12:57:51 -0400
Message-ID: <D2B7CE6C.89E931D3@fajuxeguz.com>
Date: Mon, 22 Apr 2019 12:57:51 -0400

That IP address translates to a .ru domain. But that doesn't mean a whole lot.

Please do help edit the question/tags, if you feel it necessary.

  • 1
    Yes this false threat using breached passwords has been going on about a year and scammers have been using 'hidden' text in HTML email to (try to) defeat filtering for well over a decade. PS: ransom is when they demand money to give back something of yours, either a person (commonly called a hostage) or property; when they demand money to refrain from doing something damaging, it's extortion, or robbery. – dave_thompson_085 Apr 26 at 6:09
  • Thank you, that's very useful information. But it doesn't help me understand the timing of this scam. Those dumps would've been out for ages, is it a coincidence that 1 day after I view the email containing the password, I get the ransom note? – Yogesch Apr 26 at 6:35
  • Maybe a duplicate but perhaps not really: security.stackexchange.com/questions/195063/… – Anders Apr 26 at 8:52
2
  1. From the forum's servers

Very likely this one. There are lots of password dumps out in the wild and they used on of these. The other options would mean too much effort on their part.

How were they able to relate the two email id's - the one which had received the ancient email containing the password in plain text, and the other email id, which received the ransom message?

You provide no details about these addresses so it is impossible to tell for us how they might be related. But I've seen for example use the same password on similar mails (like similar user part, similar domain part, sometimes just some characters cut off the username ...). They might of course correlate users by used nick names etc but again, nothing is known about your different addresses and how and where they were used.

  • Do these dumps contain email/login + password? The two email id's are similar. If one is FirsTLastXXX the other is FirsLastYYY where XXX and YYY are numbers. But the original email (the one which was used to sign up and which also had received the email containing the pw in plain text) did NOT receive any ransom messages. – Yogesch Apr 26 at 5:59
  • Also, why now? Yesterday I tried logging into the forum and later viewed the email containing that password in plain text, and today I get the ransom note. Isn't the timing a bit suspicious? – Yogesch Apr 26 at 6:36
  • 2
    @Yogesch: While there might be some correlation between your login and the mails it is likely not a causation. The password dumps are simply out there and these kind of phishing mails currently gets send in masses. You likely would have received such a mail even if you did not log into the forum recently. I get these kind of mails a lot. – Steffen Ullrich Apr 26 at 8:26
  • Yesterday I tried to login and later viewed the email containing the plaintext pw and today I receive the ransom email. (How) are the two events related (because those dumps have been out for a long time)?? I find the timing suspicious... I sincerely hope it doesn't mean much (based on the evidence), but in the rare event that it does, may I request to put your paranoid hat on and and re-think just for a moment... There was nothing suspicious about anything previously, so a system compromise seems very unlikely. – Yogesch Apr 26 at 11:14
  • 1
    @Yogesch: I get such mails daily, no matter if I log in somewhere or not. Of course, given that there are practically no real (technical) details on what really happened apart from your observation it is impossible to rule out a causal connection between your login and the mail, only it looks unlikely to me. – Steffen Ullrich Apr 26 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.