Risk
7/2/2013
11:17 AM
50%
50%

Feds Arrest Alleged Romney Tax Return Hacker

"Dr Evil" demanded $1 million in Bitcoins to prevent release of Mitt Romney's tax returns during the 2012 election season.

The U.S. Secret Service has arrested Michael Mancil Brown, 34, on charges of attempting to extort former Republican presidential candidate Mitt Romney and his wife, Ann Romney.

Brown was indicted last week by a federal grand jury in Nashville, Tenn., on six counts each of extortion and wire fraud. According to a statement released by the Justice Department, "Brown devised a scheme to defraud Romney, the accounting firm of PricewaterhouseCoopers LLP and others by falsely claiming that he had gained access to the PricewaterhouseCoopers internal computer network and had stolen tax documents for Romney and his wife, Ann D. Romney, for tax years prior to 2010."

The related extortion demand was publicly posted to Pastebin on Sept. 2, 2012. "Romney's 1040 tax returns were taken from the PWC office 8/25/2012 by gaining access to the third floor via a gentleman working on the 3rd floor of the building," according to the "Romney 1040 Collection" demand. The post said that Romney's personal tax records had been copied, and that a copy of the returns -- stored on a flash drive -- together with a copy of the demands had been dropped off at local Democratic and GOP offices.

[ Want to join the cast of CSI: Cyberspace? Learn 7 tips on How To ID Malware Attackers. ]

The group said it would release the files by Sept. 28, 2013, unless it received $1 million in Bitcoin currency. Later, the group claimed to have found a buyer for the information.

In a FAQ published after the demands were posted, the group said that it was adopting the "Dr Evil" moniker bestowed on it in relation to the demand for $1 million in Bitcoins. "We never considered a name before, we thought it was kind of lame to even need a name, but it sticks," it said. "We will roll with it."

The Justice Department said that the claim that the returns had been stolen from PwC was false.

According to Nashville NBC affiliate WSMV, Secret Service agents raided Brown's house on Sept. 14, 2012, using a search warrant that had been issued the previous day, and seized multiple devices, including computers, tablets and storage peripherals.

Brown said that one of items on the search warrant was a grainy picture of a cat that had also been found on a flash drive used to submit the ransom demands. Brown said his daughter reported that the cat belonged to a family friend whose computer Brown said he'd repaired four years prior. He said agents then seized equipment from the family friend's house the same day.

Brown told WSMV that it was the second time his house had been raided by the Secret Service. In 2009, he said, agents searched his house in relation to the theft of encrypted data relating to 1,000 Farm Bureau customers. No charges were filed against him in that case.

The alleged extortion scam is a reminder of how, throughout the 2012 Presidential race, Romney refused to release his pre-2010 tax returns, despite charges that his money had been invested offshore, and phrases such as "Cayman Islands" and "Swiss Bank account" entered the presidential primary lexicon for the first time in history, reported The Huffington Post.

The Romney incident appeared to be the first-known demand for Bitcoins as part of an extortion attempt. Since then, however, Bitcoins have been tapped by online crime gangs looking for a way to shake down clients and receive money in an anonymous and untraceable manner. Last week, for example, a gang calling itself "1 & 0 Logic Security Group" demanded 1 Bitcoin -- as of Tuesday, worth about $92 -- in lieu of launching a distributed denial of service (DDoS) attack against the free speech and cryptography archive Cryptome.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8917
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media A...

CVE-2014-8920
Published: 2015-01-28
Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 5R4, 6.1, and 7.1 on Windows allows local users to gain privileges via unspecified vectors.

CVE-2015-0235
Published: 2015-01-28
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

CVE-2015-0312
Published: 2015-01-28
Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16.0.0.296 on Windows and OS X and before 11.2.202.440 on Linux allows attackers to execute arbitrary code via unspecified vectors.

CVE-2015-0581
Published: 2015-01-28
The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related t...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If youíre a security professional, youíve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.