<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">You can ask to meet at a discreet location and let them hand you the thumb drive as you hand them the untraceable gift cards. :-)<br>
<br>
Funny thread – I just reported a bogus “Your Office 365 account has expired” email to GoDaddy abuse last week as all signs suggested it came from a newly updated domain there. First time I’ve sent to an abuse address in quite a while.
<br>
<br>
That email purported to come from <blah>.<blah>.<blah>.prod.outlook.com but had 10.x.x.x addresses for those names. Unfortunately, legitimate Office 365 mail originates from a plethora of such *.prod.outlook.com names none of which are resolvable so there’s
no way to confirm a real name from a fake one such as those (2) seen in this email. The fact it displayed 10.x.x.x addresses was telling but the most obvious tell was embedded in the headers was a domain name that has nothing to do with Microsoft.<br>
<br>
Maybe next person that reports they got one of the emails about “we know where you’ve been surfing” I’ll ask to give me a list of sites they remember to see if they do in true BOFH fashion.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Ale <ale-bounces@ale.org> <b>On Behalf Of </b>Jim Kinney via Ale<br>
<b>Sent:</b> Monday, March 25, 2019 7:46 AM<br>
<b>To:</b> dev null zero two <dev.null.02@gmail.com>; Atlanta Linux Enthusiasts <ale@ale.org>; dev null zero two via Ale <ale@ale.org>; Alex Carver <agcarver+ale@acarver.net><br>
<b>Subject:</b> Re: [ale] Those "You've been hacked" emails<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Those lying scumbags. Won't tell me what video I was watching. Won't even send teaser of what they claim to have. Just keep demanding money. Like I'm gonna pay upfront without knowing what I'm getting.<o:p></o:p></p>
<div>
<p class="MsoNormal">On March 25, 2019 12:00:44 AM EDT, dev null zero two via Ale <<a href="mailto:ale@ale.org">ale@ale.org</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">I meant to direct my reply to OP, sorry.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mon, Mar 25, 2019 at 12:00 AM Alex Carver <<a href="mailto:agcarver%2Bale@acarver.net">agcarver+ale@acarver.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-bottom:12.0pt">Right, that's why it's a "hacked machine" :)<br>
<br>
On 2019-03-24 20:58, dev null zero two wrote:<br>
> 99% chance it's sent from a compromised server.<br>
> <br>
> On Sun, Mar 24, 2019 at 11:56 PM Alex Carver via Ale <<a href="mailto:ale@ale.org" target="_blank">ale@ale.org</a>> wrote:<br>
> <br>
>> I got a raft of them sent to my personal server from various hacked<br>
>> machines. A bunch in Brazil, one at Digital Ocean, another at Amazon<br>
>> EC2. In my case they always wrote the from and to to be the same<br>
>> address so I added another ACL to the mail server to block anything that<br>
>> came from the outside and claimed to be from me and to me. It all went<br>
>> away after that.<br>
>><br>
>> Of course these started showing up long after I had already been<br>
>> blocking entire netblocks for abuse (hundreds of relay attempts per<br>
>> minute) so I may have already been ignoring some sources.<br>
>><br>
>> On 2019-03-24 19:39, Ben Coleman via Ale wrote:<br>
>>> I'm sure you've gotten them - those emails claiming that they've hacked<br>
>>> you, and have video evidence of you activities while you're (ehem)<br>
>>> interacting with certain sites, and that this evidence can all go away<br>
>>> if you'll only deposit a certain amount of money into their bitcoin<br>
>>> account. The latest tack they've been taking is to combine your email<br>
>>> with those caches of passwords from various exploits so they can appear<br>
>>> to know your passwords (yeah, one I used 10 years ago).<br>
>>><br>
>>> But what I didn't realize was how inexperienced (at least some of) these<br>
>>> guys are at the actual spamming game. On a whim, I popped up the<br>
>>> headers for one of these (I've been amused before on how, for example,<br>
>>> some of these claim to have included a 'tracking pixel' on what is<br>
>>> actually a text/plain email). To my surprise, there was but one<br>
>>> Received header. Straight from their server to mine (well, they did try<br>
>>> to spoof the HELO to look like it was an outlook mail server, but if you<br>
>>> know anything about Received headers, you know to ignore that). No<br>
>>> obfuscation of the headers at all. And it was in the network of a VPS<br>
>>> vendor. Now, it's possible that someone's had their VPS hacked, but<br>
>>> since this whole faux extortion thing is really script-kiddie level<br>
>>> stuff, it wouldn't surprise me if someone was stupid enough to send this<br>
>>> stuff out from their own VPS.<br>
>>><br>
>>> I felt transported back to the early 2000s when it was actually useful<br>
>>> to read Received headers, figure out where an email came from (even if<br>
>>> the spammer tried to inject bogus Received headers), and report it to<br>
>>> their ISP, with results (usually the spammer account shut down - I've<br>
>>> got my share of "positive" results, including one from Afterburner (for<br>
>>> those who remember him)). Those days pretty much went away when the<br>
>>> spammers joined up with the botnet crowd.<br>
>>><br>
>>> So, I sent off a report to the VPS vendor's abuse account. And went and<br>
>>> found another that originated off of an Amazon EC2 and shot off a report<br>
>>> to Amazon's abuse account. Don't know yet if this will do any good.<br>
>>> But if any other ALEers have a nostalgic spot for the early<br>
>>> antispamming days, this may be a place where you can play again.<br>
>>><br>
>>> Ben<br>
>>><br>
>>><br>
>>> _______________________________________________<br>
>>> Ale mailing list<br>
>>> <a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br>
>>> <a href="https://mail.ale.org/mailman/listinfo/ale" target="_blank">https://mail.ale.org/mailman/listinfo/ale</a><br>
>>> See JOBS, ANNOUNCE and SCHOOLS lists at<br>
>>> <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
>>><br>
>><br>
>> _______________________________________________<br>
>> Ale mailing list<br>
>> <a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br>
>> <a href="https://mail.ale.org/mailman/listinfo/ale" target="_blank">https://mail.ale.org/mailman/listinfo/ale</a><br>
>> See JOBS, ANNOUNCE and SCHOOLS lists at<br>
>> <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
>><o:p></o:p></p>
</blockquote>
</div>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<p class="MsoNormal">Sent from my mobile. Please excuse the brevity, spelling, and punctuation.<o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br>
-- <br>
Sent from my Android device with K-9 Mail. All tyopes are thumb related and reflect authenticity.<o:p></o:p></p>
</div>
</body>
</html>