Another spam email fraud

[Crackle]

This makes a change from the normal spam emails demanding money because they have hacked your PC and watched you playing naughty videos.

This person is very considerate and is offering to allow the information to be bought rather than sell it to their client.

"Hello, I work as a private investigator.
Our company received an order to hack into your email, phone, cloud, network and to collect intelligence.
We work with hackers from China for tasks like that, and they are the best. But we do have an ethical protocol in place.
After checking on the person, who ordered the hack and investigation on you, I have decided to come forward and offer you to buy the information about that person.
You will also have a report on yourself (including a list of compromised accounts, devices and photos).
Usually, it's not the case, but after reviewing this matter, I see that something illegal is planned against you.
Material we have can easily be used to blackmail you."

It went on giving details about how to pay in bitcoin.
So if you get anything like this in your email don't worry it is just spam, you have not been hacked.

Oh and by the way the email detection software that intercepted this email also reported this.

"The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor."
Mike

[valves4amps]

Hi Mike,
Veiled threats and fear is what they rely on. Thanks for the heads up will watch out for them, non are official with proper authentic letterheads.

Dave.

[peter scott]

I got one recently that included an old password that I was still using for unimportant uses. It too gave a bitcoin address for me to send money that would stop them from broadcasting all those embarrassing photos (that I don't have) to all my contacts.

I subsequently discovered that there are websites that list email addresses that have been part of security breaches where password of other personal info has been leaked.

Here is one that I used: https://haveibeenpwned.com/

Peter

[Nick]

https://haveibeenpwned.com/

That site is run by Troy Hunt, a long standing and highly regarded security professional - he was Microsoft's MVP of the Year a few years ago (MVP=Most Valuable Professional) and is a Microsoft Regional Director. Basically, it's a good and trustworthy site.

If HaveIBeenPwned says you have a compromise, at some point you did. Remember though that many lists are compendiums of previous hacks, so it may be that if you crop up in a recent list, you are still OK.

The old rules still apply: Don't re-use passwords, don't do silly things like share accounts, don't write your passwords down, don't use stupidly simple passwords (try using three words concatenated - easy to remember, e.g. herringwightMouse), change passwords occasionally.

Use a password manager - it's easy - I use LastPass but there are several good ones out there. I do not put the one or two key passwords I have for financial information and my master email account in there, so if in the unlikely event LastPass is compromised, it's not a real problem for me.

[Radio Fixer]

" I do not put the one or two key passwords I have for financial information and my master email account in there, so if in the unlikely event LastPass is compromised, it's not a real problem for me."

So where do you put those? You dont write them down so maybe just in your head? If so, if something dire happens to you, how do your family members get access?

Is a Password Manager any different from an Encrypted text file? I use Kruptos 2 Pro.

thanks Gary

[Mike Watterson]

Have an address book kept securely and never taken out with laptop/phone/tablet. Write site, email, user, pass etc.
Use Firefox / Waterfox etc password manager with a password for all non-financial sites.
Don't use Chrome.
Disable all 3rd party cookies.
Use a script blocker and only unblock enough to make a site work on a per site basis. Only needs done once.
Especially block scripts, remote content etc on Web mail. Avoid it as much as possible. Use an email client and set so there is a local archive of all sent and received email (even possible with IMAP, but IMAP should only be used for shared mail boxes). Email client should have all remote content blocked, should display real URL for a link when you hover and only click on known links and known attachments. Note miscreants may use From addresses/names of people/companies you know, so don't click unexpected links or attachments. Have file endings "on" in windows. Disable macros by default in all Office products.
Block scripts. Beats all AV software.

Don't use the so called "Cloud" to store ANYTHING private or important, only for collaboration.

You only need to learn two passwords, your log in and the Browser password manager. If a business etc, make a copy of the "address book", one in the office safe and one at an offsite location. Possibly a good idea for everyone. A decent size USB HDD is under £50, have multiple ones for backups and keep one off site. The "Cloud" isn't a backup solution. Too slow and insecure. Periodically archive backups because malware/ransomware can have a time delay, like the infamous HP printer driver updates that months later "bricked" non-HP consumables.

If copy / pasting something, and browser open (or it's a phone/tablet that's data enabled), at once do a SECOND copy of something to wipe the clipboard. Malicious browser scripts (any OS) and apps on iOS and Android DO copy and send the clipboard contents. Apple has recently added a feature on iOS that hopefully warns about this. Lots of apps then deleted from the store!

[Radio Fixer]

Wow!! Well, thanks for all that info. Not sure I understand it all and it will take awhile before I tackle much.

Gary

[Nick]

...
Don't use the so called "Cloud" to store ANYTHING private or important, only for collaboration.
...

That's a sweeping and frankly IMHO a FUD (*) statement akin to "don't use banks - people will rob them and steal your money" - authoritative references please. There are plenty of cloud systems that are secure - you need, as in everything, to make choices about the services you use and what you use them for - read the Ts & Cs, do your own research.

Major businesses and governments happily use cloud facilities for highly confidential and business-critical data and, speaking from experience, they have extremely good people continually evaluating and testing these environments. The Information Commissioners Office (ICO) Guidence on the use of cloud computing and their general Guide to Data Protection plus the Federal Information Processing Standards (FIPS) publication 199 are good reads for those interested in this stuff - the ICO's documents are easy reading and "accessible" (even though the 'GDPR as it applies to the UK' explanation section alone is 183 pages long whereas the actual GDPR regulations, EU 2016/679, are only 88 pages long...).

There's a lot of subtlety in usage of the internet in general, specifically in how metadata is gathered and used but if you're sensible, there's no need to be concerned.

One item I really take issue with is the usage of a notepad to write down passwords and accounts. Really? That is a genuine major risk - try recommending that at a RANT, Infosec or similar professional security forum and you'd be laughed off stage. No-one I know of has actually written down passwords for many years (it's sooo last century), and in all the companies I've worked in (some multi$B), writing down passwords is a disciplinary offence. Admittedly, in some of those companies I was the CTO and wrote the rules... but no ITSEC professional would ever condone keeping passwords in plain text anywhere. To paraphrase the late great Douglas Adams, not even in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard'.

One thing I would recommend is turning on Multi-Factor Authentication (MFA) on critical accounts, e.g. banking. MFA is where you don't just need a password - you need something you know (account & password) plus something you have (e.g. a one-time code from SMS or a phone app such as the Google/Microsoft Authenticator) and/or something you are (e.g. a fingerprint or other biometric identifier).

If you use MFA plus multi-word-concatenated passwords for the critical accounts they are easy for you to remember and NEVER write down (**). You can then use a password manager to generate unique passwords for each non-critical site. Decent password managers, e.g. LastPass, automatically erase the clipboard (should you use it for a password) after a few seconds.

It's not complex and it demonstrably works. I have several hundred different passwords, literally 99% of which I don't (and never want to) know - the password manager deals with all that.

Lastly, if you are genuinely worried that Google is homing in on you, consider using the SRWare Iron browser or the Epic browser which are both built from the open-source Chrome/Chromium sources, but don't send anything back to Google. You might also consider using DuckDuckGo as your default search engine - it uses Google's search APIs, so is much the same as searching from Google UK, but it completely anonymises all your traffic and it's source. Both are highly regarded in INFOSEC circles - don't trust me, do your own research!

(*) FUD = Fear, Uncertainty & Doubt
(**) Please, PLEASE just don't go there

[Mike Watterson]

Which Cloud systems are independently audited?
Read "The Register". There are frequent breeches and downtime and data losses from all the major players. It's just someone else's server with a fancier and faster interface than text terminals in 1960s and 1970s.

And SMS is crap and insecure for MFA. They are all doing 2FA authentication badly. Many companies SELL your mobile number or automatically opt you in to marketing. Paypal is now using SMS. It's really lazy and stupid.

[Nick]

Which Cloud systems are independently audited?
Read "The Register".  There are frequent breeches and downtime and data losses from all the major players. It's just someone else's server with a fancier and faster interface than text terminals in 1960s and 1970s.

And SMS is crap and insecure for MFA. They are all doing 2FA authentication badly. Many companies SELL your mobile number or automatically opt you in to marketing. Paypal is now using SMS. It's really lazy and stupid.

Cloud providers are continually audited by their customers and security professionals - my working life has been mainly in financial services and all the businesses I know do their own regular audits (or used a competent security company to do them). The ICO (and all competent authorities) recommend doing your own auditing plus clients often require regular independent audits (environments, pen testing etc.) as part of their own due diligence requirements.

As you obviously know, these environments are very dynamic, so regular (typically annual or semiannual) audits of those services used are always done. It's like water testing a well - you may know on the day of the test the water was fine, but the next night a sheep falls in... That's life really. Or not, if you were the sheep in question...

The "It's just someone else's server" statement is simply wrong (and has been for years). The whole cloud world has moved from just providing virtual servers to providing services, i.e. SaaS (software as a service) - the details of the underlying infrastructure are largely inconsequential and are often dynamically sized. Micro-service architectures now make the concept of dedicated servers seem rather archaic. Data is typically encrypted both in transit and at rest so the service providers have no access to plaintext at all.

Those providers that do just deliver virtual servers, e.g. DigitalOcean (who are excellent) don't complicate matters by offering SaaS - they offer virtual tin and networking in various forms at a very competitive price, typically for developers to create and test their cloud offerings on.

I'm not quite sure what your beef about The Register articles is - no environments can guarantee 100% availability of infrastructure and applications - that's what SLAs are for. You pay more for the additional resources and complexity those extra "9"s require, i.e. basic risk management and cost/benefit analysis. Oh, and backups are always a good plan.

Regarding "Many companies SELL your mobile number or automatically opt you in to marketing" - these actions are completely illegal under GDPR unless you explicitly agree for it to happen. The ICO's Guide to the GDPR is very clear on this (see GDPR Consent) as is the the source legislation - See Articles 4(11), 6(1)(a) 7, 8, 9(2)(a) and Recitals 32, 38, 40, 42, 43, 171. If you know someone who is breaching these regulations, I'd encourage you to report them to the ICO. Can you give a current example?

These are not toothless regulations, they are law in the UK (this is not just EU law, it's British too) and companies have been fined heavily by the ICO for breaches.

Lastly, something I'll agree on - SMS is not great for MFA. But (there's always a "but") it's far better than no MFA. A TOTP/RFC6238 based system such as Google or Microsoft Authenticator is better (plus maybe a biometric), but not always available. Again, sweeping statements such as "They are all doing 2FA authentication badly" are simply incorrect - there are other methods in use apart from SMS.