Journal Entries By Tag: #internet

(Page 1 of 2)

Assorted journal entries with the tag #internet.

Hacked - Extortion Wall of Shame

TL;DR — I've received even more emails telling me that I've been hacked. Since I still don't believe their empty threats, I'm posting their bitcoin addresses.

👓 2 minutes

Since my last few posts about script-kiddies and the fake extortions they try to commit, I’ve received upwards of 50 such emails, each with a different bitcoin address, and many with slight differences in text, style, or form, but all basically the same: an email from myself (gasp) claiming that I have been hacked, that some nondescript OS or “device” I own has some magical virus installed on it, and that, if I don’t pay the hacker a ransom in bitcoin, my life will be ruined.

However, I know from past experience that these messages are little more than spam, sent out en masse in hopes that they can rope in some poor sucker who falls for this. I know most of these are bogus from the beginning because the email I use for my phone is completely unrelated to the ones that keep receiving these messages. Other times, the email will make vague references to programs I don’t even have installed, again betraying their carbon-copied nature. In truth, I have never paid ransom, even though I’ve personally received dozens of these messages, and my life has yet to be ruined by these lamers.

So, as a public service, I have included the bitcoin addresses for these script-kiddies, in hopes that some other would-be victim finds this page (possibly through a web search) and learns that they, too, can ignore this BS.

All addresses listed here have been reprinted as they were received.

====== BEGIN WALL OF SHAME ======
====== UPDATED: 2024-01-02 ======
1MQj3F Sm2kcent MBiDfNZj AMP4VYf QRriC
12aJgkbT9o zAZnVwiKDg76 FNpS6FcCeVvS

======= END WALL OF SHAME =======

Again, if you received an ominous email about your device being hacked and it uses one of these bitcoin addresses, just know that I received one of those messages, too, and I never paid. Since I’m still here, posting this, obviously none of their doomsday prophecies came to pass - no mass email to my contacts, no embarassing footage, no ruined life… and no hacked device.

Hacked!? Again!?

TL;DR — I've received some more emails telling me that I've been hacked. Since I still don't believe them, I thought I'd make fun of another one instead.

👓 3 minutes

Since my last post about script-kiddies using spam to try and commit fake extortion, I’ve recevived plenty of other threatenting emails from lamers, so here’s another one from the (spam) vault:

From: [redacted-address]
To: [redacted-address]
Subject: Security Warning. Third party accessed to [redacted-address].


I’m is very good coder.

Just not much of a writer, apparently.

I am known by my nickname finn29.

Look, man - I’ve known The Finn since 1984. And you, sir, are not The Finn.

I hacked this mailbox more than six months ago,
through it I infected your operating system with a virus (trojan) created by me and have been spying for you a very long time.

Somehow, I find this hard to believe.

I understand it is hard to believe, but you can check it yourself.
I’m sent this e-mail from your account. Try it yourself.

No, “you’re” didn’t send this email from my account. In fact, if I had to guess, you tried to send it from your parents’ basement (which I have the IP for, by the way), but my SPF rules caught it, flagged it, and dumped it into my spam folder. As they should have.

Even if you changed the password after that - it does not matter, my virus intercepted all the caching data on your computer
and automatically saved access for me.

I think you’ve been watching too much CSI: Cyber.

I have access to all your accounts, social networks, email, browsing history.
Accordingly, I have the data of all your contacts, files from your computer, photos and videos.

Oh noes, all of the contacts stored on my computer? What is this, 1998?

I was most struck by the intimate content sites that you occasionally visit.
You have a very wild imagination, I tell you!

I do, actually, but not in the way you want.

During your pastime and entertainment there, I took screenshot through the camera of your device, synchronizing with what you are watching.
Oh my god! You are so funny and excited!

I don’t even know what to say to that.

I think that you do not want all your contacts to get these files, right?
If you are of the same opinion, then I think that $643 is quite a fair price to destroy the dirt I created.

$600 to erase the pictures and videos you don’t have? What a bargain!

Send the above amount on my BTC wallet (bitcoin): 19kXyFbvetft819v4QV5g9vzrjwNqRtvgA
As soon as the above amount is received, I guarantee that the data will be deleted, I do not need it.

Well, you seem trustworthy, so I’m sure I can believe your “guarantee”.

Otherwise, these files and history of visiting sites will get all your contacts from your device.
Also, I’ll send to everyone your contact access to your email and access logs, I have carefully saved it!

I’ve spent the last 10 minutes trying to figure out what he’s saying here, but I just can’t make sense of it.

Since reading this letter you have 48 hours!
After your reading this message, I’ll receive an automatic notification that you have seen the letter.

Doubtful, since it’s now been 96 hours since you sent the message, and my contacts still haven’t received anything from you. I mean, me. Whatever.

I hope I taught you a good lesson.
Do not be so nonchalant, please visit only to proven resources, and don’t enter your passwords anywhere!
Good luck!

Indeed, you have taught me a lesson: how not to extort money from someone.


TL;DR — I recently received an email telling me that I've been hacked. Since I don't believe it, I thought I'd make fun of it instead.

👓 6 minutes

A couple of weeks ago, I was lucky enough to receive an #email telling me how one of my email accounts (and the devices associated with it) had been hacked. What’s more, this email appeared to be “From” the hacked accounts, a feat designed to help me understand just how serious of a threat this hacker is.

And I do understand - they’re a joke.

Now, I am not disrespecting “real” #hackers , the kind who are perfectly capable of destroying my bank account, doxxing my children, and generally ruining my life, so please, don’t take this as some kind of a challenge. Instead, I’m disrespecting a “script kiddie”, someone who can’t actually hack, and instead spends their time trying to fake it by scaring people who don’t understand the shiny magic boxes we commonly call computers (or, more generally, “devices”).

If you really wanna be a fake hacker, this book will tell you how!

Unfortunately for this lamer, I do understand these magic boxes enough to call their bluff, and have decided to post their weak-sauce attempt at extortion here (along with some commentary of my own). Although I’ve redacted the addresses that I received these messages from, I’ve kept most of the actual text of the messages intact, in hopes that someone searching for this text may come across this post and save themselves a truly unnecessary extortion payment.

The Email

From: [redacted-address]
To: [redacted-address]
Subject: [redacted-address] - this account has been hacked! Change all your passwords!



I have bad news for you.


19/07/2018 - on this day I hacked your operating system and got full access to your account [redacted-address]

Oh, noes! You hacked my operating system to get access to my email address?

Wait, how does that work?

It is useless to change the password, my malware intercepts it every time.

Wow, that’s some magical malware.

How it was:
In the software of the router to which you were connected that day, there was a vulnerability.
I first hacked this router and placed my malicious code on it.
When you entered in the Internet, my trojan was installed on the operating system of your device.

After that, I made a full dump of your disk (I have all your address book, history of viewing sites, all files, phone numbers and addresses of all your contacts).

I’ve always wondered how it was, so thanks for telling me.

By the way, I like how you use the generic term “device” - that must make it easier to mass-send bogus emails like this. I mean, which device associated with this email did you hack?

I only ask because… well, let’s not ruin the fun yet. 😉

A month ago, I wanted to lock your device and ask for a small amount of money to unlock.
But I looked at the sites that you regularly visit, and came to the big delight of your favorite resources.
I’m talking about sites for adults.

I want to say - you are a big, big pervert. You have unbridled fantasy!!!

You know, I used to play bass for Unbridled Fantasy back in high school.

After that, an idea came to my mind.
I made a screenshot of the intimate website where you have fun (you know what it is about, right?).
After that, I made a screenshot of your joys (using the camera of your device) and joined all together.
It turned out beautifully, do not doubt.

Both my favorite intimate website and my “joys”, together in one picture? I gotta see this!

By the way, thanks for telling me how beautiful my “joys” look, it’s not often that I get a complement like that.

I am strongly belive that you would not like to show these pictures to your relatives, friends or colleagues.

And I am strongly belive that you’re not much of a writer. Or a hacker.

I think $741 is a very small amount for my silence.
Besides, I spent a lot of time on you!

OK, this just got weird.

I accept money only in Bitcoins.
My BTC wallet: 1H9bS7Zb6LEANLkM8yiF8EsoGEtMEeLFvC

But, what if I don’t know to replenish a Bitcoin wallet?

You do not know how to replenish a Bitcoin wallet?
In any search engine write “how to send money to btc wallet”.
It’s easier than send money to a credit card!

I don’t know, send money to a credit card is pretty easy.

For payment you have a little more than two days (exactly 50 hours).
Do not worry, the timer will start at the moment when you open this letter. Yes, yes … it has already started!

After payment, my virus and dirty photos with you self-destruct automatically.
Narrative, if I do not receive the specified amount from you, then your device will be blocked, and all your contacts will receive a photos with your “joys”.

Well, it’s been over a week since I opened the “letter” (approximately 168 hours, by my math), and so far, no “joys”.

I want you to be prudent.

  • Do not try to find and destroy my virus! (All your data is already uploaded to a remote server)
  • Do not try to contact me (this is not feasible, I sent you an email from your account)
  • Various security services will not help you; formatting a disk or destroying a device will not help either, since your data is already on a remote server.

Yeah, here’s the thing about the email you “sent”: you didn’t actually send it, you just tried to send it (and you didn’t even bother to hide the source IP!), but my email handling rules caught it, flagged it, and dumped it into my #spam folder, which is why it took me over a week to notice it.

P.S. I guarantee you that I will not disturb you again after payment, as you are not my single victim.
This is a hacker code of honor.

Well, you sure seem trustworthy, so I’m sure I can believe your “guarantee”. And your haxx0r “code of honor”.

From now on, I advise you to use good antiviruses and update them regularly (several times a day)!

Don’t be mad at me, everyone has their own work.

Sure, if by “work” you mean “scaring technophobes from your parents’ basement”.


Bite me, lamer.

The Truth

Now, you may be asking yourself, “how does he know that his devices haven’t actually been hacked?” Well, in addition to all of the reasons raised above, there is one more I neglected to mention: the email account that this master haxx0r allegedly compromised isn’t even associated with any devices. It’s just a email address, plain and simple, and isn’t used for logging into any application or device anywhere on the #internet . What’s more, I’ve been sending out and posting resumes with this address for a few weeks now, and suspect that this is how this wannabe got their hands on it.

So, in the end, how can one try and minimize their exposure to hacking threats (especially fake ones)? Well, IANAHOSE, but these are some of the ways that I do it:

  • For years, I’ve tried to diversify my accounts, using different emails for different sites, and keeping those email addresses separate from the accounts I use on actual devices.
    • To make this work, I had to buy a domain name (which costs about $10 / year) and setup a catch-all (or “wildcard”) address. That way, I can use anything I want for the “local-part” of the email address (aka the portion before the “@” symbol), and I’ll still get it at my main address (which I don’t typically share).
  • Likewise, I diversify my passwords, using a different password for each site / device. The easiest way to do this is with a good password manager.
  • I also try to keep good backups, so if my devices do get hacked, I can wipe and restore them (relatively) easily.
  • Finally, as alluded to above, I have Sender Policy Framework (SPF) rules setup to work with my domain, which helps to prevent others from sending unauthorized emails from an account I own.

Always try to remember: No matter how scary an email may look, don’t believe everything that you read. Many (if not most) are from fakers just like this one, and are nothing more than poorly-weaponized spam. And, just like with regular spam, the only proper (and safe) way to react is to ignore it completely.

Failing Me Softly with SPF

TL;DR — The joys of the Sender Policy Framework and the (apparent) difficulties of implementing it correctly.

👓 3 minutes

About a year ago, I started receiving some fairly odd email messages: some originating from my own domain (, and many originating from my own email address!

Most of these emails were obvious spam (or were themselves the product of spam, such as failure messages from external domains where the spam had been sent), and I started panicking: had I been hacked?

As I dug into the issue, I discovered that no, I hadn’t been hacked, but that my domain was just blindly accepting requests to send email. That’s when I first learned about SPF (Sender Policy Framework), “an open standard specifying a technical method to prevent sender address forgery.” Basically, to use SPF, I (as the domain owner) simply had to add a single TXT record to my domain information that indicated what servers could actually send email from my domain, and all others would be rejected. So, after fiddling around with the format for a while, I found my hosts’s recommended record (name changed to protect the innocent):

v=spf1 a mx ~all

Needless to say, I added it to my domain record, and bam – overnight, nearly all of the spam stopped flowing.

So, I went about my merry way, figuring I had solved the issue. I even added this record to the other domains that I own, since it had worked so well with the first one.

But it turns out that I was wrong.

Although I stopped receiving messages the messages from myself, every now and then I’d get a failure notice about an email coming from one of my domains being unsendable. When I’d get these, I’d think, “huh, I thought I fixed that,” and then I’d forget about it and move on to something else.

Then, just the other day, I received an email from me, to (another) me, telling me that I had a voicemail from an international number (it even helpfully suggested that “You might want to check it when you get a chance.”). And I thought, “wait a minute, didn’t I already fix this?”.

So, this time, rather than forgetting about it, I actually took a moment to look at the header, and that’s when I saw this (again, name changed):

softfail ( domain of transitioning
  does not designate as permitted sender)

So, I went back to the SPF site again, and that’s when I learned that the server could not only reply with “pass” and “fail”, but a whole cornucopia of messages:

Received-SPF: softfail ( domain of transitioning does not designate as permitted sender)

Received-SPF: neutral ( is neither permitted
   nor denied by domain of

Received-SPF: none ( domain of does
   not designate permitted sender hosts)

Received-SPF: permerror -extension:foo ( domain of uses mechanism not recognized by this client)

Received-SPF: temperror ( error in processing during
   lookup of DNS timeout)

The next obvious question is “why?” (well, that and “what the hell does transitioning mean?”).

It turns out that my host either misinterpreted the SPF spec, or tried to protect their users from themselves. Apparently, the presence of the tilde (“~”) in a record indicates that the domain is in transition to SPF - it’s designed for large email providers and corporations to let them start transitioning to SPF without forcing hard failures on every email that originates from an unlisted server (the idea is that the email owner would collect these softfails, verify the IPs are valid, and then add them to the SPF record). Oops.

Fortunately, I now knew what to do to fix the problem: replace the tilde with a dash (“-”):

v=spf1 a mx -all

A few hours later, problem solved, and no more spam from my domain (so far).

Based on my reading, I’m not the only one that made this mistake, and since SPF has been around for a few years (and is implemented, in some for or another, on most corporate domains), I can only imagine how many other domains using an incomplete / incorrect implementation of it (based on the number of F*-buddy requests and Canadian pharmaceutical offers I still get, I’d imagine that number to be fairly high).

So, if you own one or more domains, please do everyone a favor and implement SPF for your email. And if you aren’t using a ton of different mail servers (wherein you might not be able to list them all in your TXT record), skip the tilde and go straight for the dash.

The internet will thank you for it.

RSS & Atom Making a Comeback?

👓 less than 1 minute

Baldur Bjarnason thinks he knows why RSS and Atom have come back into vogue, powering both Apple News and Facebook Instant Articles after years of disuse:

There’s one thing that’s very different this time around for RSS and Atom and it’s the reason why this time it might be different. Back then ‘just the HTML, no CSS, JS, or Flash’ meant nothing more than rich text with images.

Now, ‘just the HTML’ means rich text, video, audio, SVG, and more. While at the same time ‘HTML with CSS and JS’ has come to mean slow loading websites full of annoying ads and broken functionality (i.e. scroll-jacking).

It’s that last point (again) that’s the most important, IMHO, but it’s also the one that seems to be falling on deaf ears.