If you have watched the news at all recently, you’ll have noticed the increasing frequency in which instances of major hacking has been reported. Higher profile cases involving big businesses and some instances of government systems being hacked have brought this tech issue to the fore. Not to mention the massive Google hack that left millions of Gmail users at risk in a phishing scam in early May.
Now some of the “bad guys” are out to take advantage of the publicity these successful hacks have had. We have seen examples of anonymous emails simply threatening to take over a website and demanding a payout in order to stop the people making the threats from doing so.
A Cazbah client recently received one of these bogus extortion emails, threatening a distributed denial of service (DDOS) attack in 24 hours if they did not pay the ransom fee in bitcoins. There are a dozen reasons why this type of email in particular should not be taken seriously, but the most comical one is that they provide a 24 hour warning. They are most likely not even capable of shutting down the site, and even if they were, giving notice would allow the webmaster to take steps to prevent the attack.
Here is the email in whole:
––––-
Subject: Attention DDOS ATTACK!
We are Anonymous hackers group.
Your site www.XXXX-XXXXXX.com will be DDoS-ed starting in 24 hours if you don’t pay only 0.1 Bitcoins @ 1JBwvB8SDzzwN1xzZTs9xsdQ9oWE9YnYox
Users will not be able to access sites host with you at all.
If you don’t pay in next 24 hours, attack will start, your service going down permanently. Price to stop will increase to 1 BTC and will go up 1 BTC for every day of attack.
If you report this to media and try to get some free publicity by using our name, instead of paying, attack will start permanently and will last for a long time.
This is not a joke.
Our attacks are extremely powerful – over 1 Tbps per second. No cheap protection will help.
Prevent it all with just 0.1 BTC @ 1JBwvB8SDzzwN1xzZTs9xsdQ9oWE9YnYox
Do not reply, we will not read. Pay and we will know its you. AND YOU WILL NEVER AGAIN HEAR FROM US!
Bitcoin is anonymous, nobody will ever know you cooperated.
–––––-
Whenever you receive an email you’re suspicious of, it’s always a good idea to Google the subject or line from the text and the word “scam” or “hack” at the end, and see if anyone else has received the same message. In this case, unsurprisingly, many others had received the same type of personalized email threat.
While the fact that the email is addressed to you may make it seem legitimate, appriver.com found that “the attackers appear to be using Whois data to pinpoint their exact targets. Each message we analyzed was sent to the registrant email listed in the public Whois record for the target domain.”
While it may seem easy to dismiss the email after reading it closely, I imagine that these extortion emails worked on more than a few recipients due to the relatively small ransom requested (0.1 bitcoin translate to ~$255) and the urgency of the timing.
Our advice is to of course not pay the ransom in situations like this, as it isn’t real and will only encourage other attempts in the future. If you receive any emails similar to this that you’re unsure of, it’s never a bad idea to contact your webmaster or Cazbah Internet Marketing Consultant for their take on the matter.