Risk
7/2/2013
11:17 AM
50%
50%

Feds Arrest Alleged Romney Tax Return Hacker

"Dr Evil" demanded $1 million in Bitcoins to prevent release of Mitt Romney's tax returns during the 2012 election season.

The U.S. Secret Service has arrested Michael Mancil Brown, 34, on charges of attempting to extort former Republican presidential candidate Mitt Romney and his wife, Ann Romney.

Brown was indicted last week by a federal grand jury in Nashville, Tenn., on six counts each of extortion and wire fraud. According to a statement released by the Justice Department, "Brown devised a scheme to defraud Romney, the accounting firm of PricewaterhouseCoopers LLP and others by falsely claiming that he had gained access to the PricewaterhouseCoopers internal computer network and had stolen tax documents for Romney and his wife, Ann D. Romney, for tax years prior to 2010."

The related extortion demand was publicly posted to Pastebin on Sept. 2, 2012. "Romney's 1040 tax returns were taken from the PWC office 8/25/2012 by gaining access to the third floor via a gentleman working on the 3rd floor of the building," according to the "Romney 1040 Collection" demand. The post said that Romney's personal tax records had been copied, and that a copy of the returns -- stored on a flash drive -- together with a copy of the demands had been dropped off at local Democratic and GOP offices.

[ Want to join the cast of CSI: Cyberspace? Learn 7 tips on How To ID Malware Attackers. ]

The group said it would release the files by Sept. 28, 2013, unless it received $1 million in Bitcoin currency. Later, the group claimed to have found a buyer for the information.

In a FAQ published after the demands were posted, the group said that it was adopting the "Dr Evil" moniker bestowed on it in relation to the demand for $1 million in Bitcoins. "We never considered a name before, we thought it was kind of lame to even need a name, but it sticks," it said. "We will roll with it."

The Justice Department said that the claim that the returns had been stolen from PwC was false.

According to Nashville NBC affiliate WSMV, Secret Service agents raided Brown's house on Sept. 14, 2012, using a search warrant that had been issued the previous day, and seized multiple devices, including computers, tablets and storage peripherals.

Brown said that one of items on the search warrant was a grainy picture of a cat that had also been found on a flash drive used to submit the ransom demands. Brown said his daughter reported that the cat belonged to a family friend whose computer Brown said he'd repaired four years prior. He said agents then seized equipment from the family friend's house the same day.

Brown told WSMV that it was the second time his house had been raided by the Secret Service. In 2009, he said, agents searched his house in relation to the theft of encrypted data relating to 1,000 Farm Bureau customers. No charges were filed against him in that case.

The alleged extortion scam is a reminder of how, throughout the 2012 Presidential race, Romney refused to release his pre-2010 tax returns, despite charges that his money had been invested offshore, and phrases such as "Cayman Islands" and "Swiss Bank account" entered the presidential primary lexicon for the first time in history, reported The Huffington Post.

The Romney incident appeared to be the first-known demand for Bitcoins as part of an extortion attempt. Since then, however, Bitcoins have been tapped by online crime gangs looking for a way to shake down clients and receive money in an anonymous and untraceable manner. Last week, for example, a gang calling itself "1 & 0 Logic Security Group" demanded 1 Bitcoin -- as of Tuesday, worth about $92 -- in lieu of launching a distributed denial of service (DDoS) attack against the free speech and cryptography archive Cryptome.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9605
Published: 2015-09-04
WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webup...

CVE-2015-5612
Published: 2015-09-04
Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.

CVE-2015-5688
Published: 2015-09-04
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.

CVE-2015-6807
Published: 2015-09-04
Cross-site scripting (XSS) vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer mass contact" permission to inject arbitrary web script or HTML via a category label.

CVE-2015-6808
Published: 2015-09-04
Cross-site scripting (XSS) vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.