Cybersecurity: Hilarious (to me) Explanation for Attempted Verification Code Fraud

One of the scams that had been around a while was the verification code scam/fraud. To make a long story short, scammers, who cannot get a new account because they had abused their own account, would attempt to trick other people into "verifying" them by entering the victim's phone number when registering a new account, then claim "I'm just verifying you are real, gimme that code you just got". If you do give them that code, you just helped them get a new account to scam from, and now YOUR phone number is associated with them (and that also means you may not be able to register an account later on that service because your phone number's been "used" (and blacklisted due to abuse). 

Today, I just ran into a new spin on this old scam that gave me a chuckle. On reddit's /r/cybersecurity, someone, who may be romance scammed, wrote that someone, who claimed to be in the (US) army, sent her something he claimed to be a STIR verification code, "to verify you exist". 

Clearly, this is a scammer who tried to do the "verification code scam", but this STIR angle is new. 

So what is STIR? It has nothing to do with verification code, at least the type you send via SMS. 

STIR/SHAKEN is a protocol that was being implemented by phone carriers to "authenticate" callers, to combat the spam call problem. Similar to a website using HTTPS instead of regular HTTP, each phone carrier for a business is supposed to link a certificate to the main phone number. So when that caller calls out, the recipient's phone service can look up the certificate, verify it with public key encryption, and thus authenticate that the call did indeed came from that business. STIR is the outbound phase, and SHAKEN is the reverse-lookup/authenticate phase. Once the caller was authenticated, you get a "caller verified" checkmark as your phone receives the actual call. Obviously spammer who spoofed their caller ID cannot pass this authentication, and thus, no checkmark. 

Needless to say, we advise her to drop the scammer like a hot potato. The verification is nonsense and a lie. 

Cybersecurity: No, your email was (probably) NOT hacked, it's (probably) just spam

Over in the subreddit /r/cybersecurityhelp we get one of these daily. This is NOT an exact copy, but the sentiments are the same. 

Help! I got an email sent from my own email address and shows my password! It claims it had tracked me and if I don't send him Bitcoins he'll hack me and ruin me! 

This is unlikely to be real, and it's a case of psychological manipulation, by combining two simple tricks, to make you think he's more powerful than he actually is. 

In other words, it's a case of 2+2=5. 

Photo by Andrey Matveev on Unsplash

Sent from my own email address... No! 

While the email may indeed show "from" as your own email address, it was NOT sent by you. No one hacked your email and use that to send email to yourself. 

What really happened was the "from address" was changed to say YOUR email address instead of the sender's own email address. 

Do you still remember paper letters? That you write your own name and address in the upper left hand corner of the envelope? 

There's nothing stopping you from writing someone else's name and address, is there? Same thing with email. 

Yes, you can say "that's dumb". But you have to remember, email was invented in the 1960s, and the current standard, SMTP, was invented in the 1980s, and extended as ESMTP in 1995. Authentication (i.e. make sure the sender matches FROM) was not a part of the protocol until SMTP AUTH (included in ESMTP) became popular in the 1990s. Adoption of ESMTP is not universal, however. And most email servers do not require ESMTP. 

Please keep in mind that emails transit through the Internet from one SMTP server to another until they reach their respective destinations, accumulating delivery headers in the email itself. And thus, any email (including spam) can be backtraced. Most email clients hide the headers from the user as they are of no use to the end user... until you want to track the true origin of the email. But that is a completely different topic. 

So that email that say its from your own email address? It was (probably) NOT sent by you. Someone merely put your email address in the "From" field. 

What about my password? How did he know about that?

That's actually pretty simple: there are data leaks as different websites got hacked, and the data ended up on the Dark Web.  They contain all sorts of info, from simple email / password pairs to full profiles and possibly more, depending on where the data came from. 

Some security researchers and good samaritans collated all those leaks on the Dark Web and created a website called "haveIbeenpwned.com" where you can enter your email address and see if any data associated with that email was on the Dark Web, and associated with which leak. 

Back to the email... The sender simply got the data (the password in this case) from the Dark Web leak that's associated with your email. 

Add them together, and it's scary to the average citizen

So what do I do? 

Short answer is: nothing. It's just spam. Mark it as spam in your email client. Done. 

You can change all your passwords "just in case". You should do that every 3-6 months anyway. 

Here's the longer explanation: 

You initially panicked, believing the sender of that warning message is a powerful hacker (because he claimed he was), who not only hacked your email inbox to send you a message from it, he obviously knows your password too, demonstrably so. 

But as I've explained above, your email inbox was NOT hacked, and the password came from a public leak list. 

The spammer wanted to scare you into believing 2+2=5.  But the real answer is 4. 

The "warning" or "threat" is just spam email. Indeed, the spammer probably got a whole LIST of email / password pairs (hundreds? thousands) and probably sent the same message (albeit customized with the correct email address and password, in a simple procedure known as templated mail merge) to EVERYBODY on the list. Cost them almost nothing. Someone may be scared enough to send them Bitcoins for real. 

So again, mark it as spam in your email client. Done.  Change your passwords if you want to. 

Takeaway:  Don't believe what random email told you, esp. ones that wants you to pay them. 

Got too much **** email from your friends? Forward them this video

Allegedly by Al Yankovich, this is a beautiful satire

http://videosift.com/video/Stop-Forwarding-that-Crap-to-Me-Al-Yankovic