[ISN] How spyware on rental PCs captured users' most intimate moments

From: InfoSec News <alerts_at_private>
Date: Wed, 19 Dec 2012 00:57:50 -0600 (CST)

By Dan Goodin
Ars Technica
Dec 18 2012

On the second-to-last Monday of 2010, Brian Byrd was playing video poker 
on his Dell Inspiron laptop when someone knocked on the door of his home 
in Casper, Wyoming. The visitor, who drove a truck from the local 
Aaron's rent-to-own store that furnished the PC five months earlier, 
said the 25-year-old Byrd was behind in his payments and demanded he pay 
up at once. He then brandished a picture that was about to cause a 
national privacy uproar.

The image showed Byrd on his home couch using the very laptop in 
question to play online poker. The employee was also privy to a 
screenshot of the website Byrd's PC was displaying the moment the photo 
was surreptitiously taken, along with keystrokes he was entering while 
visiting a website. When Byrd demanded an explanation, the employee, 
identified in a police report as 24-year-old Christopher Mendoza, said 
he wasn't supposed to answer. But he went on to disclose that the PC 
contained software that allowed Aaron's employees to track its physical 
location and remotely activate its webcam and capture screenshots and 
keystrokes. Mendoza, according to court records, left the premises after 
Byrd produced a copy of a receipt showing the laptop had been paid for 
in full on October 1.

After Byrd discussed the encounter with his wife Crystal, the couple 
recalled several recent occasions in which the computer had exhibited 
odd behavior. For the past three weeks or so, they told a police 
investigator, the laptop displayed a mysterious screen that prompted 
them for their name, address, phone number, and other details. More 
troubling was the light next to the webcam that was inexplicably 
illuminated even when neither of the Byrds was shooting video or photos. 
The couple soon realized that for more than a month, someone had been 
using the laptop to remotely spy on them. Nowhere in the terms of the 
rental agreement the Byrds signed was there any mention that the machine 
could be remotely monitored.

Adding to the couple's outrage was the recollection from two days 
earlier, on one of the occasions when Crystal saw the mysterious light. 
About to take a shower, she had been wearing just her underwear when she 
decided to quickly hop online to check her college course grades.


Visit the InfoSec News Security Bookstore
Best Selling Security Books and More!
Received on Tue Dec 18 2012 - 22:57:50 PST

This archive was generated by hypermail 2.2.0 : Tue Dec 18 2012 - 23:02:44 PST