PLUG-discuss Digest, Vol 166, Issue 13

Wed Apr 24 12:10:20 MST 2019

Thanks everyone. I will ignore it.

Stephen 

> On Apr 24, 2019, at 12:00 PM, <plug-discuss-request at lists.phxlinux.org> <plug-discuss-request at lists.phxlinux.org> wrote:
> 
> Send PLUG-discuss mailing list submissions to
> 	plug-discuss at lists.phxlinux.org
> 
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.phxlinux.org%2Fmailman%2Flistinfo%2Fplug-discuss&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074081645&sdata=%2F8zbVAY9t41txMIBDHHBM7Dp9iGqCspY%2FOJIzmYmrtY%3D&reserved=0
> or, via email, send a message with subject or body 'help' to
> 	plug-discuss-request at lists.phxlinux.org
> 
> You can reach the person managing the list at
> 	plug-discuss-owner at lists.phxlinux.org
> 
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of PLUG-discuss digest..."
> 
> 
> Today's Topics:
> 
>   1. I just got a ransomware email--what to do? (Stephen Elliott)
>   2. Re: I just got a ransomware email--what to do? (Harold Hartley)
>   3. Re: I just got a ransomware email--what to do? (Mike)
>   4. Re: I just got a ransomware email--what to do? (Matt Graham)
>   5. Re: I just got a ransomware email--what to do? (Harold Hartley)
>   6. Re: I just got a ransomware email--what to do? (Eric Oyen)
>   7. Re: I just got a ransomware email--what to do? (Andrew McRobb)
>   8. Re: I just got a ransomware email--what to do? (Andrew McRobb)
> 
> 
> ----------------------------------------------------------------------
> 
> Message: 1
> Date: Tue, 23 Apr 2019 12:32:45 +0000
> From: Stephen Elliott <tnflyfisher at live.com>
> To: "plug-discuss at lists.phxlinux.org"
> 	<plug-discuss at lists.phxlinux.org>
> Subject: I just got a ransomware email--what to do?
> Message-ID:
> 	<MWHPR1601MB1359A54584CF0395FADF7365C9230 at MWHPR1601MB1359.namprd16.prod.outlook.com>
> 	
> Content-Type: text/plain; charset="utf-8"
> 
> I just received an email claiming a hack of my system and threat to send a porn vid to all my contacts if I don’t pay $800 in bitcoin. How can I know if this is a real threat and what can I do about it?
> 
> Stephen
> 
> ------------------------------
> 
> Message: 2
> Date: Wed, 24 Apr 2019 09:19:37 -0400
> From: "Harold Hartley" <wheelie207 at ownmail.net>
> To: plug-discuss at lists.phxlinux.org
> Subject: Re: I just got a ransomware email--what to do?
> Message-ID: <59247f7b-6d43-483f-94fb-d8841f0368c2 at www.fastmail.com>
> Content-Type: text/plain; charset="utf-8"
> 
> Just ignore it. I get those too. It’s because the old hack of people’s info are now for sale on the dark web and it’s old info unless you didn’t change any passwords since these hack were announced.
> 
> On Wed, Apr 24, 2019, at 06:04, Stephen Elliott wrote:
>> I just received an email claiming a hack of my system and threat to send a porn vid to all my contacts if I don’t pay $800 in bitcoin. How can I know if this is a real threat and what can I do about it?
>> 
>> Stephen
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
>> To subscribe, unsubscribe, or to change your mail settings:
>> https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.phxlinux.org%2Fmailman%2Flistinfo%2Fplug-discuss&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074081645&sdata=%2F8zbVAY9t41txMIBDHHBM7Dp9iGqCspY%2FOJIzmYmrtY%3D&reserved=0
> 
> --
> Harold Hartley
> 17632 N. 5th place
> Phoenix, AZ 85022
> wheelie207 at ownmail.net
> 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.phxlinux.org%2Fpipermail%2Fplug-discuss%2Fattachments%2F20190424%2Fbd65bc28%2Fattachment-0001.html&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074081645&sdata=81mZKPKf4BzI%2FTK6%2BZifaMbVn7a0Q6tytncN1rsh9H8%3D&reserved=0>
> 
> ------------------------------
> 
> Message: 3
> Date: Wed, 24 Apr 2019 13:35:55 +0000 (UTC)
> From: Mike <miken38 at aol.com>
> To: plug-discuss at lists.phxlinux.org
> Subject: Re: I just got a ransomware email--what to do?
> Message-ID: <92315868.5015822.1556112955392 at mail.yahoo.com>
> Content-Type: text/plain; charset="utf-8"
> 
> I have ignored identical emails for years. Never a problem. Key is not responding. Have not to date received a follow up or additional communication from the initiator. 
> 
> 
> -----Original Message-----
> From: Harold Hartley <wheelie207 at ownmail.net>
> To: plug-discuss <plug-discuss at lists.phxlinux.org>
> Sent: Wed, Apr 24, 2019 6:27 am
> Subject: Re: I just got a ransomware email--what to do?
> 
> #yiv7641007698 p.yiv7641007698MsoNormal, #yiv7641007698 p.yiv7641007698MsoNoSpacing{margin:0;}Just ignore it. I get those too. It’s because the old hack of people’s info are now for sale on the dark web and it’s old info unless you didn’t change any passwords since these hack were announced.
> On Wed, Apr 24, 2019, at 06:04, Stephen Elliott wrote:
> 
> I just received an email claiming a hack of my system and threat to send a porn vid to all my contacts if I don’t pay $800 in bitcoin. How can I know if this is a real threat and what can I do about it?
> 
> Stephen
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
> To subscribe, unsubscribe, or to change your mail settings:
> https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.phxlinux.org%2Fmailman%2Flistinfo%2Fplug-discuss&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074081645&sdata=%2F8zbVAY9t41txMIBDHHBM7Dp9iGqCspY%2FOJIzmYmrtY%3D&reserved=0
> 
> 
> --
>   Harold Hartley
>   17632 N. 5th place
>   Phoenix, AZ 85022
>   wheelie207 at ownmail.net
> 
> 
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
> To subscribe, unsubscribe, or to change your mail settings:
> https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.phxlinux.org%2Fmailman%2Flistinfo%2Fplug-discuss&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=iIKsSC3ohMaA5TpnQZeiX0nNvw5hS73zGFDh9lg9Wig%3D&reserved=0
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.phxlinux.org%2Fpipermail%2Fplug-discuss%2Fattachments%2F20190424%2Fa4c7b75d%2Fattachment-0001.html&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=43PdzJ9JgqomD3qcUdKRgXgZqsQkXUmdaqs%2F%2FqPONqU%3D&reserved=0>
> 
> ------------------------------
> 
> Message: 4
> Date: Wed, 24 Apr 2019 09:38:22 -0700
> From: Matt Graham <mhgraham at crow202.org>
> To: Main PLUG discussion list <plug-discuss at lists.phxlinux.org>
> Subject: Re: I just got a ransomware email--what to do?
> Message-ID: <6aacd6b1e9c7ee0af88bf3f582e89690 at crow202.org>
> Content-Type: text/plain; charset=UTF-8; format=flowed
> 
>> On Wed, Apr 24, 2019, at 06:04, Stephen Elliott wrote:
>>> I just received an email claiming a hack of my system and threat
>>> to send a porn vid to all my contacts if I don’t pay $800 in
>>> bitcoin. How can I know if this is a real threat and what can I
>>> do about it?
> On 2019-04-24 06:35, Mike wrote:
>> I have ignored identical emails for years. Never a problem. Key is
>> not responding. Have not to date received a follow up or additional
>> communication from the initiator.
> 
> I have been getting these for a while.  They're pretty inept if you 
> take a look at their headers and source.  They claim to have hacked your 
> account, yet the mail doesn't come from your account, but from 
> compromised machines in .br or .ru with a forged From: .  At least a few 
> claim to have a tracking pixel in them, and no tracking pixel is 
> attached.  This is lazy scammers attempting to get easy money from dumb 
> people.
> 
> -- 
> Crow202 Blog: https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fcrow202.org%2Fwordpress&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=cVIWgYycusFEcg1q%2BdavkDYKUhGfdNoxX8VDwAt0hEk%3D&reserved=0
> There is no Darkness in Eternity
> But only Light too dim for us to see.
> 
> 
> ------------------------------
> 
> Message: 5
> Date: Wed, 24 Apr 2019 12:37:45 -0400
> From: "Harold Hartley" <wheelie207 at ownmail.net>
> To: plug-discuss at lists.phxlinux.org
> Subject: Re: I just got a ransomware email--what to do?
> Message-ID: <7ae49fe0-e6b4-4be0-8c06-f34f4848250e at www.fastmail.com>
> Content-Type: text/plain; charset="utf-8"
> 
> The last one I got they tried to prove they got in to my account by typing my old password in the email to me, but I changed that password about 5 years ago so these scammer have old info.
> But there are some that has not changed passwords and will panic and pay them. How stupid.
> 
> On Wed, Apr 24, 2019, at 09:32, Matt Graham wrote:
>>> On Wed, Apr 24, 2019, at 06:04, Stephen Elliott wrote:
>>>> I just received an email claiming a hack of my system and threat
>>>> to send a porn vid to all my contacts if I don’t pay $800 in
>>>> bitcoin. How can I know if this is a real threat and what can I
>>>> do about it?
>> On 2019-04-24 06:35, Mike wrote:
>>> I have ignored identical emails for years. Never a problem. Key is
>>> not responding. Have not to date received a follow up or additional
>>> communication from the initiator.
>> 
>> I have been getting these for a while. They're pretty inept if you 
>> take a look at their headers and source. They claim to have hacked your 
>> account, yet the mail doesn't come from your account, but from 
>> compromised machines in .br or .ru with a forged From: . At least a few 
>> claim to have a tracking pixel in them, and no tracking pixel is 
>> attached. This is lazy scammers attempting to get easy money from dumb 
>> people.
>> 
>> -- 
>> Crow202 Blog: https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fcrow202.org%2Fwordpress&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=cVIWgYycusFEcg1q%2BdavkDYKUhGfdNoxX8VDwAt0hEk%3D&reserved=0
>> There is no Darkness in Eternity
>> But only Light too dim for us to see.
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
>> To subscribe, unsubscribe, or to change your mail settings:
>> https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.phxlinux.org%2Fmailman%2Flistinfo%2Fplug-discuss&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=iIKsSC3ohMaA5TpnQZeiX0nNvw5hS73zGFDh9lg9Wig%3D&reserved=0
> 
> --
> Harold Hartley
> 17632 N. 5th place
> Phoenix, AZ 85022
> wheelie207 at ownmail.net
> 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.phxlinux.org%2Fpipermail%2Fplug-discuss%2Fattachments%2F20190424%2Fe5bfcbea%2Fattachment-0001.html&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=EVZyQPenjT6K3zrylVF3kNMmmoOxaeefbnaZ6zI%2Beww%3D&reserved=0>
> 
> ------------------------------
> 
> Message: 6
> Date: Wed, 24 Apr 2019 10:34:09 -0700
> From: Eric Oyen <eric.oyen at icloud.com>
> To: Main PLUG discussion list <plug-discuss at lists.phxlinux.org>
> Subject: Re: I just got a ransomware email--what to do?
> Message-ID: <EBA099D8-FC49-4C14-B311-1BBF2727BA17 at icloud.com>
> Content-Type: text/plain;	charset=utf-8
> 
> Ignore it. However, I would save off a copy and forward it to the FBI and their computer crimes center. Who knows, they might actually be able to find the people behind this.
> 
> -Eric
> From the central offices of the Technomage guild, crime and punishment detail
> 
> 
>> On Apr 23, 2019, at 5:32 AM, Stephen Elliott <tnflyfisher at live.com> wrote:
>> 
>> I just received an email claiming a hack of my system and threat to send a porn vid to all my contacts if I don’t pay $800 in bitcoin. How can I know if this is a real threat and what can I do about it?
>> 
>> Stephen
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
>> To subscribe, unsubscribe, or to change your mail settings:
>> https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.phxlinux.org%2Fmailman%2Flistinfo%2Fplug-discuss&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=iIKsSC3ohMaA5TpnQZeiX0nNvw5hS73zGFDh9lg9Wig%3D&reserved=0
> 
> 
> 
> ------------------------------
> 
> Message: 7
> Date: Wed, 24 Apr 2019 11:44:21 -0700
> From: Andrew McRobb <andrewmcrobb at gmail.com>
> To: Main PLUG discussion list <plug-discuss at lists.phxlinux.org>
> Subject: Re: I just got a ransomware email--what to do?
> Message-ID:
> 	<CAH1v-qhc8A3AXPZ3F7+hPpr-EcycJ1JDvXuKT8k_tY+X=rZu1A at mail.gmail.com>
> Content-Type: text/plain; charset="utf-8"
> 
> I don't know how Microsoft handles emails, but in Gmail we have a "Show
> Original" option on every email received. That will show every everything
> from domains, IPs, authentication, timestamps. This will give every
> possible detailed needed by someone from the FBI that can use this as a
> good reference point.
> 
> On Wed, Apr 24, 2019 at 10:34 AM Eric Oyen <eric.oyen at icloud.com> wrote:
> 
>> Ignore it. However, I would save off a copy and forward it to the FBI and
>> their computer crimes center. Who knows, they might actually be able to
>> find the people behind this.
>> 
>> -Eric
>> From the central offices of the Technomage guild, crime and punishment
>> detail
>> 
>> 
>>> On Apr 23, 2019, at 5:32 AM, Stephen Elliott <tnflyfisher at live.com>
>> wrote:
>>> 
>>> I just received an email claiming a hack of my system and threat to send
>> a porn vid to all my contacts if I don’t pay $800 in bitcoin. How can I
>> know if this is a real threat and what can I do about it?
>>> 
>>> Stephen
>>> ---------------------------------------------------
>>> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
>>> To subscribe, unsubscribe, or to change your mail settings:
>>> https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.phxlinux.org%2Fmailman%2Flistinfo%2Fplug-discuss&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=iIKsSC3ohMaA5TpnQZeiX0nNvw5hS73zGFDh9lg9Wig%3D&reserved=0
>> 
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
>> To subscribe, unsubscribe, or to change your mail settings:
>> https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.phxlinux.org%2Fmailman%2Flistinfo%2Fplug-discuss&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=iIKsSC3ohMaA5TpnQZeiX0nNvw5hS73zGFDh9lg9Wig%3D&reserved=0
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.phxlinux.org%2Fpipermail%2Fplug-discuss%2Fattachments%2F20190424%2F43981e3d%2Fattachment-0001.html&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=dHNtIiYqIZ1kqdb3LWliUjUYN%2FGEr1YTjcujQE7m1IQ%3D&reserved=0>
> 
> ------------------------------
> 
> Message: 8
> Date: Wed, 24 Apr 2019 11:49:20 -0700
> From: Andrew McRobb <andrewmcrobb at gmail.com>
> To: Main PLUG discussion list <plug-discuss at lists.phxlinux.org>
> Subject: Re: I just got a ransomware email--what to do?
> Message-ID:
> 	<CAH1v-qgLzJJ_puEDVcECT48PMSFHKSfNRn_zr=NDg1HBkWuWpw at mail.gmail.com>
> Content-Type: text/plain; charset="utf-8"
> 
> Forgot to attach this:
> 
> https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.fbi.gov%2Fcontact-us%2F&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=IffLturN6zLEgEeMHCTWndNadoujU3aUQm09jt1u3DU%3D&reserved=0
> 
> On Wed, Apr 24, 2019 at 11:44 AM Andrew McRobb <andrewmcrobb at gmail.com>
> wrote:
> 
>> I don't know how Microsoft handles emails, but in Gmail we have a "Show
>> Original" option on every email received. That will show every everything
>> from domains, IPs, authentication, timestamps. This will give every
>> possible detailed needed by someone from the FBI that can use this as a
>> good reference point.
>> 
>> On Wed, Apr 24, 2019 at 10:34 AM Eric Oyen <eric.oyen at icloud.com> wrote:
>> 
>>> Ignore it. However, I would save off a copy and forward it to the FBI and
>>> their computer crimes center. Who knows, they might actually be able to
>>> find the people behind this.
>>> 
>>> -Eric
>>> From the central offices of the Technomage guild, crime and punishment
>>> detail
>>> 
>>> 
>>>> On Apr 23, 2019, at 5:32 AM, Stephen Elliott <tnflyfisher at live.com>
>>> wrote:
>>>> 
>>>> I just received an email claiming a hack of my system and threat to
>>> send a porn vid to all my contacts if I don’t pay $800 in bitcoin. How can
>>> I know if this is a real threat and what can I do about it?
>>>> 
>>>> Stephen
>>>> ---------------------------------------------------
>>>> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
>>>> To subscribe, unsubscribe, or to change your mail settings:
>>>> https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.phxlinux.org%2Fmailman%2Flistinfo%2Fplug-discuss&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=iIKsSC3ohMaA5TpnQZeiX0nNvw5hS73zGFDh9lg9Wig%3D&reserved=0
>>> 
>>> ---------------------------------------------------
>>> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
>>> To subscribe, unsubscribe, or to change your mail settings:
>>> https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.phxlinux.org%2Fmailman%2Flistinfo%2Fplug-discuss&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=iIKsSC3ohMaA5TpnQZeiX0nNvw5hS73zGFDh9lg9Wig%3D&reserved=0
>> 
>> 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.phxlinux.org%2Fpipermail%2Fplug-discuss%2Fattachments%2F20190424%2F6cecc1a0%2Fattachment-0001.html&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=V8UnNmmwFvz8YeaYMMN67e8JGOuGFd79hE2ZvKpnS6Q%3D&reserved=0>
> 
> ------------------------------
> 
> Subject: Digest Footer
> 
> _______________________________________________
> PLUG-discuss mailing list  -  PLUG-discuss at lists.phxlinux.org
> To subscribe, unsubscribe, or to change your mail settings:
> https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.phxlinux.org%2Fmailman%2Flistinfo%2Fplug-discuss&data=02%7C01%7C%7C4548d97a7b934d82bdc108d6c8e70fba%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636917292074091654&sdata=iIKsSC3ohMaA5TpnQZeiX0nNvw5hS73zGFDh9lg9Wig%3D&reserved=0
> 
> 
> ------------------------------
> 
> End of PLUG-discuss Digest, Vol 166, Issue 13
> *********************************************