Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

773M Password ‘Megabreach’ Is Years Old

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 177 posts

Re: 773M Password ‘Megabreach’ Is Years Old

#61

Post by ascar »

sct202 wrote: post #57
ascar wrote: post #18

Since a few weeks ago I receive spam emails threatening me with an old password I no longer use. I wonder if it's related to this collection. It starts with: > I am well aware [old password I think I swapped out everywhere, but definitely in all important places, when I started to use random keepass pws two years ago] is your pass words. Lets get straight to the point. None has compensated me to check about you. You…

I think it's interesting that they're trying to get non-technical people who would fall for this kind of thing to buy bitcoins and then send them. Like the number of people who would believe this, have a thousand dollars on hand, and be able to buy and send bitcoins is probably tiny.

It's an optimization strategy for them between actually getting paid and not getting caught.

Buying bitcoin is actually pretty easy and they help you figure it out in the email as I already commented here https://news.ycombinator.com/item?id=18939713

Re: 773M Password ‘Megabreach’ Is Years Old

#62

Post by FlorianRappl »

ascar wrote: post #18

Since a few weeks ago I receive spam emails threatening me with an old password I no longer use. I wonder if it's related to this collection. It starts with: > I am well aware [old password I think I swapped out everywhere, but definitely in all important places, when I started to use random keepass pws two years ago] is your pass words. Lets get straight to the point. None has compensated me to check about you. You…

Had the same; scary thing is the unknown number of people who will just pay / take everything in that email seriously.

Re: 773M Password ‘Megabreach’ Is Years Old

#64

Post by antjanus »

ascar wrote: post #18

Since a few weeks ago I receive spam emails threatening me with an old password I no longer use. I wonder if it's related to this collection. It starts with: > I am well aware [old password I think I swapped out everywhere, but definitely in all important places, when I started to use random keepass pws two years ago] is your pass words. Lets get straight to the point. None has compensated me to check about you. You…

I got this one as well.

The subject of the email was a previous password I've used and they sent it "from my domain" (not really my domain, you know how it is).

Re: 773M Password ‘Megabreach’ Is Years Old

#65

Post by ceejayoz »

sct202 wrote: post #57
ascar wrote: post #18

Since a few weeks ago I receive spam emails threatening me with an old password I no longer use. I wonder if it's related to this collection. It starts with: > I am well aware [old password I think I swapped out everywhere, but definitely in all important places, when I started to use random keepass pws two years ago] is your pass words. Lets get straight to the point. None has compensated me to check about you. You…

I think it's interesting that they're trying to get non-technical people who would fall for this kind of thing to buy bitcoins and then send them. Like the number of people who would believe this, have a thousand dollars on hand, and be able to buy and send bitcoins is probably tiny.

Some of the ransomware scammers have actual customer service call centers set up. https://www.reuters.com/article/us-usa-cyber-ransomware-idUS...

> Some players in the booming underworld employ graphic artists, call centers and technical support to streamline payment and data recovery, according to security firms that advise businesses on hacking threats.

Re: 773M Password ‘Megabreach’ Is Years Old

#66

Post by calibas »

ascar wrote: post #18

Since a few weeks ago I receive spam emails threatening me with an old password I no longer use. I wonder if it's related to this collection. It starts with: > I am well aware [old password I think I swapped out everywhere, but definitely in all important places, when I started to use random keepass pws two years ago] is your pass words. Lets get straight to the point. None has compensated me to check about you. You…

I just got one with nearly the same wording. "I am aware [old password] is your passphrases. Lets get directly to point..." sent from 202.140.33.240 using the spoofed email address oo@r.com.

The bitcoin address is different: 1ELzee2T9Wd5YPTYhWbWD3xK7xB5tJ94J4

Looks like the scam worked a couple times so far: https://www.blockchain.com/btc/address/1ELzee2T9Wd5YPTYhWbWD...

Re: 773M Password ‘Megabreach’ Is Years Old

#67

Post by ceejayoz »

MarsAscendant wrote: post #27
ascar wrote: post #18

Since a few weeks ago I receive spam emails threatening me with an old password I no longer use. I wonder if it's related to this collection. It starts with: > I am well aware [old password I think I swapped out everywhere, but definitely in all important places, when I started to use random keepass pws two years ago] is your pass words. Lets get straight to the point. None has compensated me to check about you. You…

> recorded watching porn What a damning position to be in, in 2019.

Email a million addresses and you'll wind up hitting a few who've been browsing child porn, or something they'd find highly embarrassing if their parents/spouse/SO found out.

As with other scams that can be initiated at scale, you don't need a 50% conversion rate. 0.01% probably suits just fine.

Re: 773M Password ‘Megabreach’ Is Years Old

#68

Post by albertgoeswoof »

kyoob wrote: post #46
ascar wrote: post #18

Since a few weeks ago I receive spam emails threatening me with an old password I no longer use. I wonder if it's related to this collection. It starts with: > I am well aware [old password I think I swapped out everywhere, but definitely in all important places, when I started to use random keepass pws two years ago] is your pass words. Lets get straight to the point. None has compensated me to check about you. You…

The best defense, just in case one of these cases turns out to be legit, is to send a video of myself watching porn to all my contacts preemptively. Take out their leverage, you know?

One benefit to this approach is that next time it happens you won’t have any contacts left, so you’re covered for the future.

Re: 773M Password ‘Megabreach’ Is Years Old

#69

Post by bdamm »

ascar wrote: post #47
kyoob wrote: post #46

Earlier quoted context omitted.

The best defense, just in case one of these cases turns out to be legit, is to send a video of myself watching porn to all my contacts preemptively. Take out their leverage, you know?

Yea, a double video of you and what you are watching. Select the most degenerate stuff you ever watched. This would be a nightmare for basically anyone.

Personal anecdote; having your most embarrassing moments broadcast widely is good at filtering out all but your real friends. You might even find out some folks are way more understanding than you ever expected.
Post reply on HN