Jason Glassberg: Why you need to talk to your kids about ‘sextortion’

If you are a parent, please take note. You need to talk to your kids about “sextortion.” Not in a few months, not in a few years, but now. Right now.

Sextortion is a crime that is now sweeping the web, from organized criminal groups operating overseas to cyber-bullies at the local high school. As teenagers and children increasingly use online photo sharing accounts, social media, email and webcam chats, they are at a greater risk of being victimized.

A recent case in Washington illustrates the risk. A high school student in Lewis County pleaded guilty to an “elaborate sextortion scheme,” in which he created a fake female profile online in order to trick his fellow students into sending revealing images of themselves. Once he had the images, he then threatened to expose them to their family and friends.

In February, “Megyn Kelly Today” highlighted an even more drastic case: a college student named Jake Curtis, who took his own life after a five-day ordeal with a sextortionist.

The FBI defines sextortion as “a serious crime that occurs when someone threatens to distribute your private and sensitive material if you don’t provide them images of a sexual nature, sexual favors, or money,” and while the federal government doesn’t track this crime specifically (it does track general online extortion, which surpassed 17,000 cases in 2016), the number of publicly reported cases of sextortion-related suicides appears to be increasing significantly.

For those who may be tempted to think that sextortion only happens to people who do risky things like “sexting,” think again. Sextortion is a crime that can happen to anyone, regardless of age, gender or behavior.

There are several reasons why this threat is getting worse.

Top on the list is a new technology that allows for realistic face-swapping in videos. Known as “Deepfakes,” these videos (enabled by online tools like FakeApp) are becoming popular on the web, and we’ve already seen this technology used to create a number of fake pornographic videos that replaced the faces of adult actors with those of Hollywood stars. The potential for abuse here is huge, and it is only a matter of time before Deepfakes are used for teenage cyber-bullying, harassment and cyber-stalking.

Financially motivated cyber-blackmailing also appears to be increasing, with scammers using a variety of techniques.

One of these is a two-part phishing email, which first sends a link to a pornographic website and then, when the link is clicked, follows up with a second email that blackmails the person for watching it. The scammers also claim to have used malware to record them through the webcam. Unless the person sends a Bitcoin payment, the scammers will send the material to all of the victim’s contacts, or so they claim.

Ransomware is also getting darker. Instead of just locking up the person’s files until they pay a ransom, one version called “Karo” threatens to post all discovered photos from the victim’s computer (especially those of a private nature) to the internet.

“Catfishing” is another ongoing threat, as scammers will impersonate a teenage girl or boy, or an adult man or woman, in order to bait the other person into sharing explicit photos or videos of themselves. Once they do, the scammer threatens to expose them unless they share more explicit photos or pay a fee.

In some cases, however, sextortion is done simply for the “lulz” (hacker term meaning “for fun”), and remote access Trojans (RATs) that hijack webcams are a popular type of malware in underground forums on the Dark Web.

At the same time, any time a teenager or child stores photos in an online account like Facebook, Instagram, Snapchat, Apple Photos, etc., can be vulnerable to hacking if the password is weak and two-factor authentication isn’t enabled.

When it comes to sextortion, one of the most important things any parent can do is to talk to their children about the risks and how to cope with it if it occurs. Kids need to know that their life won’t end just because of an embarrassing photo leak online. Additionally, kids need to be protected from these online predators. Use strong, unique passwords to protect their online accounts and change all settings to “private.” Stick a piece of tape over their webcams. Turn off geolocation data on their mobile devices. Make sure all of their devices have a strong antivirus with anti-phishing support installed. Use a web filter to block illicit content from reaching them. Lastly, consider monitoring their online behavior with a tool like Qustodio.

Jason Glassberg, co-founder of Casaba Security (www.casaba.com), is an ‘ethical hacker’ in Redmond, Washington, who works for corporations, banks and government agencies. He is a former cybersecurity executive for Ernst & Young and Lehman Brothers.