Unstoppable Scam E-Mail

[Sinistral]

Thought I should post this, as it's the only serious scam message I've ever had which appeared yesterday. I deleted it, and then did a search for some key text on the internet. The worrying aspect is it was sent from my own E-Mail account with my real E-mail Address on it.

None of the security blocks work because you can't stop messages sent by yourself. It was diverted to the Junk Mail folder, but opened in 'read mode' automatically although I selected the Block (Sender or Address) option as usual. Only on viewing it can it be identified as a fake.

I don't use a mobile, and only have a pre-paid dumb job for emergency use which is always switched off. I'm not a member of Facebook or any other forums on principle, apart from SD. I only log in here now and then to post, so view as a guest generally. My Chromebooks can't be infected with spyware, as the latest version of the Google Chrome OS object code is picked up direct from Google & loaded afresh every time any of them is switched on.

My only guess is that Outlook is far from secure, and the scammer has hacked into their Hotmail.Com or Co.UK account database. Apparently this mail has gone worldwide, check out the link below. My hope is nobody else on here gets bothered with it, but it's worth passing on all the details for others who might be.

 

[csl]

I suspect it’s actually sent from outside, it’s just spoofed pretending that it’s your own email.

 

[DavyG]

Happens to me all the time. When my FAC drops through the door with another gun added I tell the missus that it wasn’t me, I must have been hacked.
Me thinks she’s starting to suspect that I might be telling porkies…
DG

 

[Moose67]

 

[long_range_rob]

Happens to me all the time. When my FAC drops through the door with another gun added I tell the missus that it wasn’t me, I must have been hacked.
Me thinks she’s starting to suspect that I might be telling porkies…
DG

So they’ve hacked your cabinet and put the gun in it too. Cunning these hackers.

 

[Firefly]

Thought I should post this, as it's the only serious scam message I've ever had which appeared yesterday. I deleted it, and then did a search for some key text on the internet. The worrying aspect is it was sent from my own E-Mail account with my real E-mail Address on it.

None of the security blocks work because you can't stop messages sent by yourself. It was diverted to the Junk Mail folder, but opened in 'read mode' automatically although I selected the Block (Sender or Address) option as usual. Only on viewing it can it be identified as a fake.

I don't use a mobile, and only have a pre-paid dumb job for emergency use which is always switched off. I'm not a member of Facebook or any other forums on principle, apart from SD. I only log in here now and then to post, so view as a guest generally. My Chromebooks can't be infected with spyware, as the latest version of the Google Chrome OS object code is picked up direct from Google & loaded afresh every time any of them is switched on.

My only guess is that Outlook is far from secure, and the scammer has hacked into their Hotmail.Com or Co.UK account database. Apparently this mail has gone worldwide, check out the link below. My hope is nobody else on here gets bothered with it, but it's worth passing on all the details for others who might be.

If you right click on ‘your’ email address that you believe the email has been sent from ( at the top of the email message). It will reveal the actual address it’s come from.

 

[DavyG]

So they’ve hacked your cabinet and put the gun in it too. Cunning these hackers.

Not only that…they even ordered a bigger cabinet.
DG

 

[Sinistral]

If you right click on ‘your’ email address that you believe the email has been sent from ( at the top of the email message). It will reveal the actual address it’s come from.

Yes I know that thanks, but how have so many valid EM addresses been obtained to send this scam out? My digital footprint is virtually zero compared to most people with mobiles, who are tracked from one mast to the next.
All my browsing is 'anonymised' through secure search engines which mask the DNS, IP Address, Location, User Agent, and anything identifiable. There aren't any 'Contacts' at all within my Hotmail account, as these are kept in a separate encrypted file outside Outlook. I wasn't concerned in the slightest about the threats in the message, but still puzzled about where they got my account address from to send it in the first place.

 

[trickie]

Hackers harvest email address from companies then sell then on in the dark web, its not a new thing tbo.

 

[Essex stalker]

There is a website that you can use to check if your email address has been hacked and appears on the black web etc. you go to the following site

Have I Been Pwned: Check if your email has been compromised in a data breach

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

and then type in your email address

 

[Morkai]

C'mon now.

People complain about lack of commonsense in today's age, this sort of stuff is the new commonsense.

You have to get yourself up to speed with the internet, we've all had long enough to get to grips with it.

 

[Stalker62]

You have to get yourself up to speed with the internet, we've all had long enough to get to grips with it.

Rude.

Not everyone is good with a coujputer

 

[Sinistral]

There is a website that you can use to check if your email address has been hacked and appears on the black web etc. you go to the following site

Have I Been Pwned: Check if your email has been compromised in a data breach

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

and then type in your email address

Thanks for the link, results below.
Guess I'm done for, for eternity.



Oh no — pwned!
Pwned in 1 data breaches and found no pastes (subscribe to search sensitive breaches)


Guntrader logo
Guntrader: In July 2021, the United Kingdom based website Guntrader suffered a data breach that exposed 112k unique email addresses. Extensive personal information was also exposed including names, phone numbers, geolocation data, IP addresses and various physical address attributes (cities for all users, complete addresses for some). Passwords stored as bcrypt hashes were also exposed.

Compromised data: Browser user agent details, Email addresses, Geographic locations, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Salutations

 

[Morkai]

Rude.

Not everyone is good with a coujputer

My dad can find anything he wants on YT but claims he cant use ebay or amazon shopping...

Maybe I am biased as I grew up as a teenager in the 90s.

 

[wytonpjs]

My dad can find anything he wants on YT but claims he cant use ebay or amazon shopping...

Maybe I am biased as I grew up as a teenager in the 90s.

I was a teenager at the beginning of the 70s

Frankly I do consider myself reasonably computer literate but am currently suffering from a tsunami of spoof phishing emails after being asked to help a known GUTG venison customer recover his FB account on Monday morning - NEVER again! They are all highly plausible and 90% are spookily accurate enough to raise doubt in my mind. Then last night, I received another telling me that I was infected by PEGASUS and to handover Bitcoins or else. I don't flatter myself that I have been targeted by hostile agents using PEGASUS but this barrage of scam emails is endemic! I wonder whether anyone has a realistic estimate of just what the proportion of fake to genuine emails being sent across the world actually is - I suspect the answer is truly frightening.................

 

[The Grouse]

Most email providers are truly shocking at blocking spam and phishing emails. I gave up and put a dedicated spam filter service in front, in this case SpamHero.

I've had quite literally hundreds of similar messages to OP’s in the same day. The joy is I don't have to see them.

Below is a graph of my clean/spam since July 2022. Spikes are usually related to botnets kicking in. Overall in that period it blocked over 37K spam emails. Extrapolate that over the worlds' population, quite a figure.

 

[zambezi]

agents using PEGASUS

Pegasus and its android counterpart, Chrysaor are "zero day" exploits which are more prevalent in the wild now than ever before.

Either can be inserted on your mobile device via SMS. [or, more covertly, via the SAT browser embedded in the proprietary modem]

Amnesty International have produced the MVT tool to establish whether such a breach of your mobile has occurred:

iOS Forensic Methodology - Mobile Verification Toolkit

Mobile Verification Toolkit Documentation

docs.mvt.re

 

[zambezi]

has hacked into

The reality is that black hats never quit looking for ways to access your private data. And in that mix are state actors.

Too few people apply even basic home network security, firewall rules, strong password regimes, hack-resistant wifi protocols, regular bios and OS patch updates on PC and mobile, etc.

Having a solid approach in all areas will impede trivial access to your data.

Once those are ticked, now consider the best way to mitigate Intel's ME [out-of-band management of your PC and the data on it] which is embedded in one or more roms on the motherboard. Some "starters for ten" with one of Intel's own ME deactivation suggestion first. Note that ME actually runs in firmware quite separate from the OS, so serious bids to neuter this back door probably need to find a way of partially or completely flashing those roms. At very minimum, boot into bios and disable "AMT" permanently.

INTEL-SA-00075 Detection and Mitigation Tool

Windows tool for unprovisioning AMT on systems vulnerable to the issue described in Intel-SA-00075

www.intel.com

Researchers Find a Way to Disable Much-Hated Intel ME Component Courtesy of the NSA

Researchers from Positive Technologies — a provider of enterprise security solutions — have found a way to disable the Intel Management Engine (ME), a much-hated component of Intel CPUs.

www.bleepingcomputer.com

GitHub - mostav02/Remove_IntelME_FPT: A guide for disabling Intel Management Engine using FPT on PCH SPI

A guide for disabling Intel Management Engine using FPT on PCH SPI - mostav02/Remove_IntelME_FPT

github.com

 

[wytonpjs]

Pegasus and its android counterpart, Chrysaor are "zero day" exploits which are more prevalent in the wild now than ever before.

Either can be inserted on your mobile device via SMS. [or, more covertly, via the SAT browser embedded in the proprietary modem]

Amnesty International have produced the MVT tool to establish whether such a breach of your mobile has occurred:

iOS Forensic Methodology - Mobile Verification Toolkit

Mobile Verification Toolkit Documentation

docs.mvt.re

But, even for someone reasonably tech savvy, this tool needs software/skills I simply do not possess and cost of getting a "professional" involved are daunting..............

 

[zambezi]

At very minimum, boot into bios and disable "AMT" permanently.

Research today reveals that toggling the AMT bit in bios to disable IME is really just chocolate fireguard territory.

Intel Management Engine has these properties:

• It runs its own OS [minix] at level 0 which means access all areas...including network...all the time...and to all your data...even when device is "turned off"

I requested that the ME did not run using the AMT bit set "permanently" in bios and then interrogated the ME status. Turns out the Intel spyware remains hale and hearty and running just fine:



Interestingly, Intel can and do disable IME on hardware supplied to US military and three-letter agencies because those entities know the backdoor risks: