Hi there,

I have just received this ransomware email:

Quote:

Hello! I'm a member of an international hacker group. As you could probably have guessed, your account [email] was hacked, because I sent message you from it. Now I have access to you accounts! For example, your password for [email] is [password] Within a period from July 7, 2018 to September 23, 2018, you were infected by the virus we've created, through an adult website you've visited. So far, we have access to your messages, social media accounts, and messengers. Moreover, we've gotten full damps of these data. We are aware of your little and big secrets...yeah, you do have them. We saw and recorded your doings on porn websites. Your tastes are so weird, you know.. But the key thing is that sometimes we recorded you with your webcam, syncing the recordings with what you watched! I think you are not interested show this video to your friends, relatives, and your intimate one... Transfer $700 to our Bitcoin wallet: 13DAd45ARMJW6th1cBuY1FwB9beVSzW77R If you don't know about Bitcoin please input in Google "buy BTC". It's really easy. I guarantee that after that, we'll erase all your "data" :) A timer will start once you read this message. You have 48 hours to pay the above-mentioned amount. Your data will be erased once the money are transferred. If they are not, all your messages and videos recorded will be automatically sent to all your contacts found on your devices at the moment of infection. You should always think about your security. We hope this case will teach you to keep secrets. Take care of yourself.

Now, the menace doesn't affect me as I:
* don't visit porn websites
* don't have a (connected) webcam;
* use the email address and password they've found exclusively for Amigaworld.net.

However, they did get the email address (which is not public and, as mentioned, exclusive to Amigaworld.net) and the password right. Now, even if a virus had actually succeeded, as you all know, logging on in here doesn't require typing an email address. So, I wonder: could it be that the website got hacked?

_________________
RETREAM - retro dreams for Amiga, Commodore 64 and PC

@saimo

Seen a few of those.
Turns out I had been on sites that did have a data breach.

Try this -

https://haveibeenpwned.com/

Cheers

_________________
If your nose runs and your feet smell, you're upside down.

@saimo

I got exactly that e-mail just the other day, just google translated which made it look extr ridiculous. I think that if you look at the raw e-mail header you will see that the mail wasn’t actually sent from your address but was made to look that way? Somone just found your mail address sometime, somewhere, just like the regular spam address collctors vacuuming the net for mail addresses to be added to the databases they sell to spammers. I wouldn’t worry too much about this...

@TiredofLife

Don’t make it easy for them spammers by submitting your address to their databases voluntarily, doing all the work for them!

@TRIPOS

I have checked that site out.
Also got it recommended by people who work in that industry.

It's not just his email, they are quoting passwords.

Obviously he needs to change that.
If he only uses it on the one site, no major drama.

Cheers

Last edited by TiredofLife on 01-Oct-2018 at 11:02 PM.

_________________
If your nose runs and your feet smell, you're upside down.

@TRIPOS

The point is not that they used my email address, but that they found it, along with the password, although it was used exclusively for this website - i.e. the email address couldn't have been obtained from any other source. Therefore, I thought I'd warn you all.

_________________
RETREAM - retro dreams for Amiga, Commodore 64 and PC

@saimo

Same here.
Exclusive email and password

Are the passwords stored as plain text??

@thread


https://botcrawl.com/your-account-was-hacked-by-an-international-hacker-group-email-scam/

_________________
PowerMac G5 2,7Ghz - 2GB - Radeon 9650 - MorphOS 3.14
AmigaONE X1000, 2GB, Sapphire Radeon HD 7700
FPGA Replay + DB 68060 at 85Mhz

No security breach and/or E-Mail violation for me, up to now

If they are breaching through amigaworld.net they aren't hacking all the accounts, apparently

_________________
God created Paula so that Allister Brimble and Dave Whittaker could do music

Check my Amiga gameplays (ITA)!

@ K-L all

Quote:

https://botcrawl.com/your-account-was-hacked-by-an-international-hacker-group-email-scam/

The article confirms:

It is likely that they do know your password and if so it is recommended to immediately change your password. If you use the same password for various accounts, change them all. According to reports, your password may have been obtained during a leak (LinkedIn, Adobe, etc.).

BTW, I forgot to mention: I use either Linux or Windows 10. On Windows, neither Windows Defender, nor Avast, nor AVG, nor Avira found any malware trace (I've tried them all just to be safe).

_________________
RETREAM - retro dreams for Amiga, Commodore 64 and PC

@saimo

Quote:

BTW, I forgot to mention: I use either Linux or Windows 10. On Windows, neither Windows Defender, nor Avast, nor AVG, nor Avira found any malware trace (I've tried them all just to be safe).

Your systems are most likely not infected.

How long have you used this password and email address? There is even an old news announcement here on the website about Amigaworld.net having been hacked as early as back in 2012.

@saimo

A security breach might have also happened at that email provider, or even your own computer.

Too many variables I guess. :-\

@ASiegel

Quote:

How long have you used this password and email address? There is even an old news announcement here on the website about Amigaworld.net having been hacked as early as back in 2012.

I can't say when I had changed the email address the last time, but I'm pretty sure I did at least once after 2012. As for the password, I think that, by coincidence, I had changed it a few months ago, so the password they reported was actually the previous one. Still, evidently, they got access to the site records.

Last edited by saimo on 02-Oct-2018 at 11:02 AM.

_________________
RETREAM - retro dreams for Amiga, Commodore 64 and PC

@Turrican3

Quote:

A security breach might have also happened at that email provider,

Nope: the email address I use here is just an alias I "use" precisely and exclusively here, and the mailserver wouldn't know about my Amigaworld.net password anyway.

Quote:

or even your own computer.

I'm pretty sure that is not the case: apart from the aforementioned tests with antivirus programs, I only have a bunch of productivity applications installed, I don't visit obscure websites, I don't download apps/movies/music/etc., I do recognize malicious emails, I don't play games, and so on. Moreover, I don't think that the email address and password associated to my Amigaworld.net account are stored anywhere on my machine.

Last edited by saimo on 02-Oct-2018 at 11:06 AM.

_________________
RETREAM - retro dreams for Amiga, Commodore 64 and PC

@wakido

Quote:

Same here. Exclusive email and password Are the passwords stored as plain text??

Thanks for reporting.


@all

Anyone else?

Last edited by saimo on 02-Oct-2018 at 11:03 AM.

_________________
RETREAM - retro dreams for Amiga, Commodore 64 and PC

@saimo

I'm a bit confused.

From the wording of your first post it seemed to me that hackers had access to your *email* account username/password, but now you say that we're talking about the Amigaworld.net credentials that might have got stolen/acquired by a malicious third party.

They're obviously two very different things: which one are we talking about?

@Turrican3

The email address and password associated to my Amigaworld.net account.

_________________
RETREAM - retro dreams for Amiga, Commodore 64 and PC

@saimo

It may be that there was a breach here. But it is also possible someone you know who you have sent email to from your amigaworld account was trojanized and the bot scrape email accounts.

If you do not know how to read SMTP headers there are sites out there which can do it for you and identify the source. If it is the amigaworld relay then you know there is trouble here.

No matter what it is not harmful to change your password here.

@saimo

So even after you pay them they will still erase your data. Offering to erase it for 700 BT. LOL. Lose everything by that logic. Another FORMAT C: warning.

@AmeegaGuy

Quote:

But it is also possible someone you know who you have sent email to from your amigaworld account was trojanized and the bot scrape email accounts.

No, this is not possible because, again, I never use the email address I have here for anything (the only place in the universe where it appears is in my profile here, and the address is hidden to the public). Moreover, the hackers did have one of my passwords to Amigaworld.net.

_________________
RETREAM - retro dreams for Amiga, Commodore 64 and PC