Risk
7/2/2013
11:17 AM
50%
50%

Feds Arrest Alleged Romney Tax Return Hacker

"Dr Evil" demanded $1 million in Bitcoins to prevent release of Mitt Romney's tax returns during the 2012 election season.

The U.S. Secret Service has arrested Michael Mancil Brown, 34, on charges of attempting to extort former Republican presidential candidate Mitt Romney and his wife, Ann Romney.

Brown was indicted last week by a federal grand jury in Nashville, Tenn., on six counts each of extortion and wire fraud. According to a statement released by the Justice Department, "Brown devised a scheme to defraud Romney, the accounting firm of PricewaterhouseCoopers LLP and others by falsely claiming that he had gained access to the PricewaterhouseCoopers internal computer network and had stolen tax documents for Romney and his wife, Ann D. Romney, for tax years prior to 2010."

The related extortion demand was publicly posted to Pastebin on Sept. 2, 2012. "Romney's 1040 tax returns were taken from the PWC office 8/25/2012 by gaining access to the third floor via a gentleman working on the 3rd floor of the building," according to the "Romney 1040 Collection" demand. The post said that Romney's personal tax records had been copied, and that a copy of the returns -- stored on a flash drive -- together with a copy of the demands had been dropped off at local Democratic and GOP offices.

[ Want to join the cast of CSI: Cyberspace? Learn 7 tips on How To ID Malware Attackers. ]

The group said it would release the files by Sept. 28, 2013, unless it received $1 million in Bitcoin currency. Later, the group claimed to have found a buyer for the information.

In a FAQ published after the demands were posted, the group said that it was adopting the "Dr Evil" moniker bestowed on it in relation to the demand for $1 million in Bitcoins. "We never considered a name before, we thought it was kind of lame to even need a name, but it sticks," it said. "We will roll with it."

The Justice Department said that the claim that the returns had been stolen from PwC was false.

According to Nashville NBC affiliate WSMV, Secret Service agents raided Brown's house on Sept. 14, 2012, using a search warrant that had been issued the previous day, and seized multiple devices, including computers, tablets and storage peripherals.

Brown said that one of items on the search warrant was a grainy picture of a cat that had also been found on a flash drive used to submit the ransom demands. Brown said his daughter reported that the cat belonged to a family friend whose computer Brown said he'd repaired four years prior. He said agents then seized equipment from the family friend's house the same day.

Brown told WSMV that it was the second time his house had been raided by the Secret Service. In 2009, he said, agents searched his house in relation to the theft of encrypted data relating to 1,000 Farm Bureau customers. No charges were filed against him in that case.

The alleged extortion scam is a reminder of how, throughout the 2012 Presidential race, Romney refused to release his pre-2010 tax returns, despite charges that his money had been invested offshore, and phrases such as "Cayman Islands" and "Swiss Bank account" entered the presidential primary lexicon for the first time in history, reported The Huffington Post.

The Romney incident appeared to be the first-known demand for Bitcoins as part of an extortion attempt. Since then, however, Bitcoins have been tapped by online crime gangs looking for a way to shake down clients and receive money in an anonymous and untraceable manner. Last week, for example, a gang calling itself "1 & 0 Logic Security Group" demanded 1 Bitcoin -- as of Tuesday, worth about $92 -- in lieu of launching a distributed denial of service (DDoS) attack against the free speech and cryptography archive Cryptome.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7266
Published: 2015-02-01
Algorithmic complexity vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x through 3.1.2 allows remote attackers to cause a denial of service (CPU consumption) via vectors that trigger colliding hash-table keys. NOTE: this vulnerability exists because of an incomplete fix for CVE-2...

CVE-2014-7269
Published: 2015-02-01
ASUS JAPAN RT-AC87U routers with firmware 3.0.0.4.378.3754 and earlier, RT-AC68U routers with firmware 3.0.0.4.376.3715 and earlier, RT-AC56S routers with firmware 3.0.0.4.376.3715 and earlier, RT-N66U routers with firmware 3.0.0.4.376.3715 and earlier, and RT-N56U routers with firmware 3.0.0.4.376....

CVE-2014-7270
Published: 2015-02-01
Cross-site request forgery (CSRF) vulnerability on ASUS JAPAN RT-AC87U routers with firmware 3.0.0.4.378.3754 and earlier, RT-AC68U routers with firmware 3.0.0.4.376.3715 and earlier, RT-AC56S routers with firmware 3.0.0.4.376.3715 and earlier, RT-N66U routers with firmware 3.0.0.4.376.3715 and earl...

CVE-2014-8630
Published: 2015-02-01
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shel...

CVE-2014-9200
Published: 2015-02-01
Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modbus Communication Library 2.2.6 and earlier, CANopen Communication Library 1.0.2 and earlier, EtherNet/IP Communication Library 1.0.0 and earlier, EM X8...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.