I have been receiving lots of emails saying that I've been hacked to my GitHub email addresses.

Hello,

I am a spyware software developer. Your account has been hacked by me in the summer of 2018.

I understand that it is hard to believe, but here is my evidence (I sent you this email from your account).

The hacking was carried out using a hardware vulnerability through which you went online (Cisco router, vulnerability CVE-2018-0296).

I went around the security system in the router, installed an exploit there. When you went online, my exploit downloaded my malicious code (rootkit) to your device. This is driver software, I constantly updated it, so your antivirus is silent all time.

Since then I have been following you (I can connect to your device via the VNC protocol). That is, I can see absolutely everything that you do, view and download your files and any data to yourself. I also have access to the camera on your device, and I periodically take photos and videos with you.

At the moment, I have harvested a solid dirt... on you... I saved all your email and chats from your messangers. I also saved the entire history of the sites you visit.

I note that it is useless to change the passwords. My malware update passwords from your accounts every times.

I know what you like hard funs (adult sites). Oh, yes .. I'm know your secret life, which you are hiding from everyone. Oh my God, what are your like... I saw THIS ... Oh, you dirty naughty person ... :)

I took photos and videos of your most passionate funs with adult content, and synchronized them in real time with the image of your camera. Believe it turned out very high quality!

So, to the business! I'm sure you don't want to show these files and visiting history to all your contacts.

Transfer $995 to my Bitcoin cryptocurrency wallet: ??????????????????????????????????

My system automatically recognizes the translation. As soon as the specified amount is received, all your data will be destroyed from my server, and the rootkit will be automatically removed from your system. Do not worry, I really will delete everything, since I am 'working' with many people who have fallen into your position. You will only have to inform your provider about the vulnerabilities in the router so that other hackers will not use it.

Since opening this letter you have 48 hours. If funds not will be received, after the specified time has elapsed, the disk of your device will be formatted, and from my server will automatically send email and sms to all your contacts with compromising material.

I advise you to remain prudent and not engage in nonsense (all files on my server).

Good luck!

The emails are both To and From my email addresses, but the Return-Path is to Aaron@Smith???.edu, where the ??? is three numbers. The emails are all the same expect for the servers that the emails went through and crypto wallet public keys.

Wanting to collate the servers and the wallet keys, I decided to run some grep action on the emails. My emails are stored in a Maildir format, so it is nice and easy for me to find the emails and extract the servers from the headers using the Return-Path email address as the search term.

$ grep -h 'Received: from' `grep -l Smith....edu *`

The email content is however Base64 encoded, so it is a little harder to extract. I ended up combining the power of grep and Node to extract the Base64 from the email files, decode them and then extract the public key

# DQpIZW... is the start of the Base64 block
grep -h -A1000 'DQpIZWxsbywNCj' `grep -l Smith....edu *` | grep -v '^--' > ~/emails.b64

The script file to extract out the keys

const fs = require('fs');

// Read the Base64 strings from the file
const file = fs.readFileSync('emails.b64').toString();

// Split on the double newline that splits the base64 strings
parts = file.split('\n\n');

const keys = [];
parts.forEach((string) => {
  // Remove the newlines in the Base64 string, the make it into a Buffer
  const match = Buffer.from(string.replace(/\n/g, ''), 'base64')
      .toString('ascii') // Convert it back into a string
      .match(/cryptocurrency wallet: (.{34})[\r\s]/); // Match on the wallet string

  // If there is a match (there were some extra blank lines), print it out
  if (match && keys.indexOf(match[1]) === -1) {
    keys.push(match[1]);
  }
});
console.log(keys);