Extorting money from Ashley Madison customers is actually pretty easy


In the wake of the recent Ashley Madison e-mail dump, some customers have gotten demand e-mails like this one.

So that begs the question: does it work? In the words of Omar Little, “Oh, indeed.”

As Toshiro Nishimura, a security researcher with Cloudmark, concluded in a blog post earlier this week, “this extortion campaign could have yielded a worthwhile sum for very little effort.”

The message demands a rather specific amount of bitcoins—1.05, or $243 at current exchange rates—and has the victim send them to a newly-created wallet. All the blackmailer (who calls him or herself “Barton”) had to do was download the Ashley Madison data, extract the email addresses, generate a Bitcoin address for each victim, send out the e-mails, and Bob’s your uncle.

So, Nishimura and his colleagues did something rather clever: they simply searched the blockchain for that specific amount.

As he wrote:

Specifically, we found 67 suspicious transactions totalling 70.35 BTC or approximately 15814 USD within the extortion time frame of approximately 4 days paying 1.05 BTC to addresses, with no previous activity, and with 2 or fewer transaction outputs. All suspicious address we found are attached below. (We conservatively restricted ourselves to ordinary transactions with 2 or less outputs, thus excluding those which were less likely to be simple one-to-one payments.)

To put this in perspective, in the three months prior to 8/22/2015 when we first started seeing the extortion emails, we saw a total of 67 transactions matching the above pattern at a rate of approximately 5.3 per 100,000 transactions, versus 8.9 during the extortion period.

In other words, because there were approximately 40 percent more Bitcoin transactions that fulfilled those criteria, they concluded that those are likely ones that paid the 1.05 bitcoins, for a total of about $6,400.

Of course, there’s no guarantee that the former Ashley Madison customers won’t be exposed anyway, even after paying.

Article source: ArsSec http://arstechnica.com/business/2015/09/extorting-money-from-ashley-madison-customers-is-actually-pretty-easy/