Risk
7/2/2013
11:17 AM
Connect Directly
RSS
E-Mail
50%
50%

Feds Arrest Alleged Romney Tax Return Hacker

"Dr Evil" demanded $1 million in Bitcoins to prevent release of Mitt Romney's tax returns during the 2012 election season.

The U.S. Secret Service has arrested Michael Mancil Brown, 34, on charges of attempting to extort former Republican presidential candidate Mitt Romney and his wife, Ann Romney.

Brown was indicted last week by a federal grand jury in Nashville, Tenn., on six counts each of extortion and wire fraud. According to a statement released by the Justice Department, "Brown devised a scheme to defraud Romney, the accounting firm of PricewaterhouseCoopers LLP and others by falsely claiming that he had gained access to the PricewaterhouseCoopers internal computer network and had stolen tax documents for Romney and his wife, Ann D. Romney, for tax years prior to 2010."

The related extortion demand was publicly posted to Pastebin on Sept. 2, 2012. "Romney's 1040 tax returns were taken from the PWC office 8/25/2012 by gaining access to the third floor via a gentleman working on the 3rd floor of the building," according to the "Romney 1040 Collection" demand. The post said that Romney's personal tax records had been copied, and that a copy of the returns -- stored on a flash drive -- together with a copy of the demands had been dropped off at local Democratic and GOP offices.

[ Want to join the cast of CSI: Cyberspace? Learn 7 tips on How To ID Malware Attackers. ]

The group said it would release the files by Sept. 28, 2013, unless it received $1 million in Bitcoin currency. Later, the group claimed to have found a buyer for the information.

In a FAQ published after the demands were posted, the group said that it was adopting the "Dr Evil" moniker bestowed on it in relation to the demand for $1 million in Bitcoins. "We never considered a name before, we thought it was kind of lame to even need a name, but it sticks," it said. "We will roll with it."

The Justice Department said that the claim that the returns had been stolen from PwC was false.

According to Nashville NBC affiliate WSMV, Secret Service agents raided Brown's house on Sept. 14, 2012, using a search warrant that had been issued the previous day, and seized multiple devices, including computers, tablets and storage peripherals.

Brown said that one of items on the search warrant was a grainy picture of a cat that had also been found on a flash drive used to submit the ransom demands. Brown said his daughter reported that the cat belonged to a family friend whose computer Brown said he'd repaired four years prior. He said agents then seized equipment from the family friend's house the same day.

Brown told WSMV that it was the second time his house had been raided by the Secret Service. In 2009, he said, agents searched his house in relation to the theft of encrypted data relating to 1,000 Farm Bureau customers. No charges were filed against him in that case.

The alleged extortion scam is a reminder of how, throughout the 2012 Presidential race, Romney refused to release his pre-2010 tax returns, despite charges that his money had been invested offshore, and phrases such as "Cayman Islands" and "Swiss Bank account" entered the presidential primary lexicon for the first time in history, reported The Huffington Post.

The Romney incident appeared to be the first-known demand for Bitcoins as part of an extortion attempt. Since then, however, Bitcoins have been tapped by online crime gangs looking for a way to shake down clients and receive money in an anonymous and untraceable manner. Last week, for example, a gang calling itself "1 & 0 Logic Security Group" demanded 1 Bitcoin -- as of Tuesday, worth about $92 -- in lieu of launching a distributed denial of service (DDoS) attack against the free speech and cryptography archive Cryptome.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2970
Published: 2014-07-31
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5139. Reason: This candidate is a duplicate of CVE-2014-5139, and has also been used to refer to an unrelated topic that is currently outside the scope of CVE. This unrelated topic is a LibreSSL code change adding functionality ...

CVE-2014-0914
Published: 2014-07-30
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 6.x and 7.x through 7.5.0.6, Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 6.2 through 6.2.8 for Tivoli IT Asset Management f...

CVE-2014-0915
Published: 2014-07-30
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2.8...

CVE-2014-0947
Published: 2014-07-30
Unspecified vulnerability in the server in IBM Rational Software Architect Design Manager 4.0.6 allows remote authenticated users to execute arbitrary code via a crafted update site.

CVE-2014-0948
Published: 2014-07-30
Unspecified vulnerability in IBM Rational Software Architect Design Manager and Rational Rhapsody Design Manager 3.x and 4.x before 4.0.7 allows remote authenticated users to execute arbitrary code via a crafted ZIP archive.

Best of the Web
Dark Reading Radio