Hacked & threatened with TF password!

[Robin]

be aware these threats pop up sometimes as a web page, stay resident in 'cache' or history so deleting, closing even restsrting has them return. set browsers to delet history and cache on exit an power settings to allow shut down on the power button or close of lappie lid, at least that stops it preventing you doing it via the on screen power off.


My lovely lady used to collect these prank blackmail threats, usually via a 'share this' facetwat clicky. No more problems once treated as above and only looking at facetwat via her phone. The scum behind this crap should be strung up by the goolies and forced to watch the orangeman's rally videos 24/7.

 

[sbu22]

Just a quick comment. Earlier posts attribute the hack to LinkedIn. I've gotten the same a couple of times in the last week. I do not do Facegram, instabook, or any "social media" sites. This is probably more broadly sourced than one particular site. Unless you count TF and a couple of aviation sites.

 

[Delfin]

Just a quick comment. Earlier posts attribute the hack to LinkedIn. I've gotten the same a couple of times in the last week. I do not do Facegram, instabook, or any "social media" sites. This is probably more broadly sourced than one particular site. Unless you count TF and a couple of aviation sites.

If you go to the site I referenced, you can see which site hacks your email or password show up on. I mentioned LinkedIn because it affected 140 million people and happened to be where my email address and an old password were harvested from. The site mentioned tracks a huge number of hacks.

 

[Art]

Seems to be Yahoo based trouble. ????

 

[twistedtree]

The OP thought the spam was based off his TF password. Are the spammers sending you a password that is unique to TF such that you know it came from there? Has our personal info on TF been hacked? Are our passwords stored in clear text in TF?

 

[twistedtree]

Seems to be Yahoo based trouble. ????

Why Yahoo?

 

[Delfin]

Why Yahoo?

I'll try once more. If you go to haveIbeenpwned.com you can see which sites have been hacked that this site tracks and what was hacked. There are hundreds of them. TF is not on their list, but that doesn't mean they haven't been hacked - it just means it may not have been, or hasn't been identified by TF. Regarding Yahoo, that is one of hundreds of sites that have been hacked, but it is small potatoes compared to others.


Yahoo
In July 2012, Yahoo! had their online publishing service "Voices" compromised via a SQL injection attack. The breach resulted in the disclosure of nearly half a million usernames and passwords stored in plain text. The breach showed that of the compromised accounts, a staggering 59% of people who also had accounts in the Sony breach reused their passwords across both services.
Breach date: 11 July 2012
Date added to HIBP: 4 December 2013
Compromised accounts: 453,427
Compromised data: Email addresses, Passwords

 

[boomerang]

The OP thought the spam was based off his TF password. Are the spammers sending you a password that is unique to TF such that you know it came from there? Has our personal info on TF been hacked? Are our passwords stored in clear text in TF?

That's why I posted my event on here. It was the password that I use on this site and a couple of other sites. I'm not suggesting that this site has security concerns. I simply observed the spammer quoted me the password that I use on this site. I'm not bothered too much if someone hacks any of my boating sites but still, it's unsettling that people can invade your privacy to try to make a living.

 

[Art]

That's why I posted my event on here. It was the password that I use on this site and a couple of other sites. I'm not suggesting that this site has security concerns. I simply observed the spammer quoted me the password that I use on this site. I'm not bothered too much if someone hacks any of my boating sites but still, it's unsettling that people can invade your privacy to try to make a living.[/QUOTE]

Err - > Thieve a living, that is, by outright extortion!


Hang em from the yard arm for three days. Then keel haul em... Still alive? Walk the plank is yet on the table!!

 

[Vignette]

Here's an FYI for anyone interested.
I had an experience yesterday that had me wanting to get my hands around the neck of the POS making a living from hacking into peoples accounts & trying to extort money from them. I was looking through my yahoo email spam folder the other day (I've had a yahoo email since I started my business in '98 but the password isn't the one I use on here). The sender greeted me by quoting the password I use on this site ,on The Hull Truth (haven't been there for a while) & the MTOA website. It's not a particularly complicated password (7 characters) because I'm not too concerned about security when it comes to a boating website.
It's a bunch of BS because 1) I haven't been to any porn sites (not saying I've never been but not for many years!) & 2) my web cam has been blocked with a piece of tape since I got the computer (not super paranoid but it does kind of freak me that I *could* be monitored)
Here's a copy & paste of the mail I received, but I've replaced the portion where they showed me my password with asterisks. Not that it really makes a damn because I'd rather you folks knew it instead of the f-heads that hacked it.

Marineinstallations <Aaron@Smith513.edu>
To:
*******
I am well aware ******* of your pass word. Lets get straight to the point. You may not know me and you are probably thinking why you are getting this e-mail? There is no one who has compensated me to check you.

Let me tell you, I placed a software on the 18+ vids (pornography) web site and you know what, you visited this site to have fun (you know what I mean). When you were watching videos, your web browser started functioning as a Remote Desktop having a key logger which provided me access to your display screen as well as web camera. Right after that, my software program obtained your entire contacts from your Messenger, FB, as well as email . Next I created a double video. 1st part shows the video you were viewing (you have a fine taste hahah), and next part displays the recording of your webcam, & it is you.

You got a pair of options. We should look at each of these choices in particulars:

1st alternative is to disregard this e mail. As a result, I most certainly will send out your actual videotape to every bit of your contacts and also just think concerning the awkwardness you will get. And definitely should you be in a romantic relationship, just how it is going to affect?

Next alternative would be to compensate me $2000. I will call it a donation. In this scenario, I most certainly will immediately discard your video footage. You can keep on everyday life like this never took place and you will not hear back again from me.

You'll make the payment through Bitcoin (if you don't know this, search for "how to buy bitcoin" in Google).

BTC Address: 1KcPYrb4YjHgfNpKDHX3g7iGGgECK3RSWh
[CASE SENSITIVE copy & paste it]

In case you are thinking of going to the law enforcement, look, this message cannot be traced back to me. I have covered my actions. I am not trying to demand a huge amount, I would like to be compensated.

You now have one day to make the payment. I have a special pixel within this mail, and right now I know that you have read through this email message. If I don't receive the BitCoins, I will certainly send out your video recording to all of your contacts including relatives, co-workers, and so on. Having said that, if I receive the payment, I will erase the recording right away. If you want proof, reply with Yeah! and I definitely will send your video recording to your 13 contacts. This is the non-negotiable offer, and so please don't waste my time & yours by responding to this email.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

What a bunch of crap, huh? Like I said, I'd like to get my hands around his/her neck. My point is, don't have a panic attack if you receive a mail like this because ,while it sounds convincing, it's probably just another scam.

I received the exact same email extortion attempt. My response to this a-Hole isn’t fit to print here but I felt terrific replying to him in verbiage that I’m sure he didn’t comprehend but it felt good to respond the way I did. Sadly I’m sure he/she has a fair share of success utilizing this technique.

 

[jimisbell]

I have three passwords, not critical, medium and TS. For general run of the mill I use random **** but save it in the computer when Windows10 asks. But I would like to download all those passwords to see just what sites I have been to in the past 5 years. Is there away to recover these from the computer???? Shouldnt be because that would be a security breach in and of itself???

 

[RobertLeatch]

I think it depends on the browser you used. In Chrome they can be seen under Settings/Passwords (and then quick the eye symbol displayed on each password line).

 

[jimisbell]

OK, I use firefox but it is probably something similar

 

[jimisbell]

It worked,but it was too easy. Someone with my laptop could get any passwords,I deleted them all.

 

[ghost]

I responded and asked him If I was wearing a gorilla suit or a French maids outfit. Not really, but at least I’m now looking forward to getting this scam next.

 

[Haetwen]

Onan was the fellow in the Book of Genesis who spilled his seed upon the ground.

 

[High Wire]

The phone scammer robocalls are getting hard to tell from real humans. The voices laugh and chuckle with something like "Wow Archie, you are really hard to reach!"

My response, silence. Then their response to that is canned and not as refined. Hello, Archie, are you still there? Hello, Archie, are you still there? Click. Others are so bad that they don't recognize an answering machine and you only get the tail end of the call.
Something else. Assuming the call goes past the immediate hangup stage, I will never say the word yes on the phone to anyone I do not know. I fear my "yes" can be recorded and applied to questions authorizing bogus charges.

 

[Delfin]

We don't answer our landline anymore, so no issues there. For our mobiles, which are Android, we use an ap call MyCallBot, which very accurately identifies calls as probable spam. Those I ignore.

 

[Bearspirit]

Good info. Thanks for sharing, guys. Interesting that Linkedin is a source for this....probably why I am always suspect of outfits that collect info. For the rest of us, it’s probably just a matter of time. Sorry for your pain.

The source is not necessarily specifically the old LinkedIn hack. These scam emails (collectively and generically called “sextortion” emails in my business) are coming from many sources of stolen passwords and account information which are posted in various places on both the normal Internet and the more shadowy “Dark Web”.

The extortionists are placing a bet that by shocking you with one of your known passwords, the threat that they have hacked your computer, and in many cases threatening to reveal that you have been to naughty web sites that you will pay up. To the average person just using their computer these emails can indeed be frightening, and the bet is that enough people will pay up to make it worth their while. They’re probably right.

The password that they send is probably real, and also probably at least several years old from an ancient website breach. If you’re still using a simple password that’s years old then you’re just waiting to have one or more of your accounts be hacked for real these days.

I highly recommend that people use password management services like Lastpass or Dashlane, or use a free open-source installed program called Keypass (on Windows; there are differently named Keypass compatible variations on Macintosh, iPhone and Android, some free and some not). Do definitely think about longer passwords, too. They don’t have to be complex, because longer and simple/easier to remember beats shorter and stupidly complex any day. Just jam several short words together with one or more numbers, non-alpha characters, and a capital letter somewhere. “Fred’sboatgarage3” is strong enough that only NSA-grade systems can brute force crack it today (anything longer than 12 characters is relatively safe). Much better than the inclined to fail password rules that are still taught by many corporations, creating passwords like “4:xkF9$smQ” or some other unmemorable rot.

There’s a lot more but my thumbs are tired. FYI my day job is as the lead Information Security Engineer for the Incident Response team at a regional hospital here in the currently cold and rainy Upper Left corner of the US. You could say that I’m a paid, professional paranoid and you’d be right. This sort of scam is what I think about all day every day as I try to keep the data and systems of my internal customers safe.

 

[dhays]

I like the suggestion of a password wallet of some kind. I use LastPass in my browsers and also have used eWallet on all platforms for years. I also use Google Authenticate for two factor authentication.

As I mentioned before, I use a system suggested by Delfin for creating passwords that makes them secure and memorable.

 

[Delfin]

LastPass and other similar applications are not without their own issues....

https://www.theguardian.com/technol...se-caution-while-it-fixes-major-vulnerability

 

[Art]

I use one memorable to me fairly long word. A word that few would ever think of and that few would ever use. Then I take and insert numbers in specific locations. Also double or triple letters and/or place caps as needed/desired. Purposeful misspelling portion of the word is another "trick" I use.


Reason I use memorable word to me as a base is because that is always my "root" for a password. And, knowing what alterations I may have used means I will always be able to discern what the password for a certain link is; although if I do forget, I may have to play with the base word's embellishments a bit until correct letters and numbers layout are located. I often take one variation of the root word as a password and substitute it with another variation of same word/password.


This way has for couple decades worked well for me with few "break-ins" by PW thieves! If one location's password gets impinged... I simply reset to my base word with different variations.


For some sites... such as TF... I don't get too flustered regarding need for difficulty of my PW.

 

[crowra]

I second bearspirit's suggestion for a password management system. Lastpass, for example, makes it super easy to have a unique complex password for EVERY website as well as being able to store (encrypted) credit card info, passports, driver's license, etc. And Lastpass can be easily synched between different devices (laptop, tablet, smartphone, etc). Also second dhays' 2FA (2-factor authentication) recommendation. In addition to these, a VPN service like IPVanish should always be used when using public wifi anywhere in the world. If you aren't familiar with a VPN (Virtual Private Network) they are a quick and easy solution to making your computer appear to be coming from a different location. They accomplish this by creating a virtual network that routes all of your devices' network traffic through an encrypted tunnel and out the other side, making it seem to the world that you’re actually in whatever location the VPN server is located. This can help you bypass geographic restrictions, avoid censors, or keep you (relatively) anonymous online.

 

[stubones99]

VPN's

In addition to these, a VPN service like IPVanish should always be used when using public wifi anywhere in the world. If you aren't familiar with a VPN (Virtual Private Network) they are a quick and easy solution to making your computer appear to be coming from a different location. They accomplish this by creating a virtual network that routes all of your devices' network traffic through an encrypted tunnel and out the other side, making it seem to the world that you’re actually in whatever location the VPN server is located. This can help you bypass geographic restrictions, avoid censors, or keep you (relatively) anonymous online.

The problem with a VPN, unless it is one where you control both ends, is that how do you know who is watching the other end? If you were a nefarious type person, offer a low priced VPN and see what your customers send over the VPN. Hand that information to the crooks to go after you or your contacts.

With some knowledge of our governments dirty tricks, I cannot say that I know of a single VPN that I would trust with any secrets. I don't know how you would validate a VPN, since the capture could happen now, and your secrets get out months or years later.

Don't put your secrets on a PC of any type, or don't have secrets.

 

[Delfin]

The problem with a VPN, unless it is one where you control both ends, is that how do you know who is watching the other end? If you were a nefarious type person, offer a low priced VPN and see what your customers send over the VPN. Hand that information to the crooks to go after you or your contacts.

With some knowledge of our governments dirty tricks, I cannot say that I know of a single VPN that I would trust with any secrets. I don't know how you would validate a VPN, since the capture could happen now, and your secrets get out months or years later.

Don't put your secrets on a PC of any type, or don't have secrets.

. The other problem with VPNs, at least for me following a brief experiment with Nordvpn, is they are SLOWWWWWW. Not surprisingly, since they are jamming all traffic through a limited number of servers.

 

[Juggerknot]

Just a quick comment. Earlier posts attribute the hack to LinkedIn. I've gotten the same a couple of times in the last week. I do not do Facegram, instabook, or any "social media" sites. This is probably more broadly sourced than one particular site. Unless you count TF and a couple of aviation sites.

Aviation sites are one of the prime hunting grounds, go where the money is.
Use good current antivirus and malware counter-measures, it's a minefield out here. I use one computer for my recreational surfing, social media etc and have no personal, banking or other sensitive data or shared IPs open to threats. Simple compartmentalization. It's not paranoia if they're really after you

 

[Juggerknot]

. The other problem with VPNs, at least for me following a brief experiment with Nordvpn, is they are SLOWWWWWW. Not surprisingly, since they are jamming all traffic through a limited number of servers.

Tor...

 

[CaptTom]

Lastpass, for example, makes it super easy to have a unique complex password for EVERY website as well as being able to store (encrypted) credit card info, passports, driver's license, etc. And Lastpass can be easily synched between different devices (laptop, tablet, smartphone, etc).

That's exactly what scares me about apps like Lastpass.

My fear is putting all those eggs in one basket. Clearly the servers and networks at Lastpass (and similar companies) are a huge target for hackers.

I'm also skeptical of apps which inject themselves into the guts of the browser to auto-fill passwords. It seems like another vector for attack, a performance hit, and another point of possible failure. Even more so for anything that tries to auto-fill into other applications besides the browser.

I'd like to find a simple app which allowed me to store and retrieve just IDs and passwords in a well-encrypted, local file on my device. I'd be happy to copy and paste them into the web site or app which needed them. Better still if I could move that file to other devices when and how I wanted to.

I don't want my passwords (even encrypted) passing through a third-party server or network, especially one with high visibility like Lastpass. I don't need the app to decide when/how to synchronize my passwords between devices. I don't want to sign on to their system to manage my own.

Every time I try to find an app which meets these requirements, I end up wading through all sorts of marketing claims about how the app will do all the work for me, and I needn't worry about any of the details. When it comes to security, I DO want to know the details!

There's probably an app out there which does exactly what I want, but the marketing folks are making it hard to find.

 

[crowra]

stubones99: I am certainly open to an alternative to a VPN to protect me when using public wifi. As a cyber security professional, it's all about weighing risk and I don't know of anything more secure than using a VPN when using public wifi. Hopefully none of the TF subscribers are conducting illegal activity on the dark web or trying to get around the Great Firewall of China -- those people should worry about government monitoring. I only recommend using a reputable VPN service like ExpressVPN or IPVanish but there are plenty more. For example, ExpressVPN is out of the BVI where there are no data retention laws and they don't keep logs of your activity or connections. Can anyone be bought? Sure.

There are other advantages to VPNs. Say you're in Cuba and want to log into your bank in Melbourne. You can't. But if you use a VPN, you will appear (to your bank) like you are in the US. Likewise for other services like Netflix, Hulu, etc.

Delfin: Agree they can be slow. Try ExpressVPN. They have 2000+ servers with no throttling.

CaptTom: Look at KeePass. If you say, "I would never keep my passwords in the cloud." KeePass is for you.

 

[Boat]

Aviation sites are one of the prime hunting grounds, go where the money is.
Use good current antivirus and malware counter-measures, it's a minefield out here. I use one computer for my recreational surfing, social media etc and have no personal, banking or other sensitive data or shared IPs open to threats. Simple compartmentalization. It's not paranoia if they're really after you

This should be modern common-sense. For instance I use a separate bank account for Paypal, Samsung pay, bank apps, automated payments, online purchases, etc. Don't deposit more than you can afford to lose, it is a gamble.


Some devices aren't built to store data anymore. Should tell you that the system puts your data where "they" want it.


Contracts in performing "arts" sometimes take away an artist's given name. The artist sometimes has no rights to their own given name. Watch what you agree to. You might not even have the right to be referred to as "they".