11:17 AM

Feds Arrest Alleged Romney Tax Return Hacker

"Dr Evil" demanded $1 million in Bitcoins to prevent release of Mitt Romney's tax returns during the 2012 election season.

The U.S. Secret Service has arrested Michael Mancil Brown, 34, on charges of attempting to extort former Republican presidential candidate Mitt Romney and his wife, Ann Romney.

Brown was indicted last week by a federal grand jury in Nashville, Tenn., on six counts each of extortion and wire fraud. According to a statement released by the Justice Department, "Brown devised a scheme to defraud Romney, the accounting firm of PricewaterhouseCoopers LLP and others by falsely claiming that he had gained access to the PricewaterhouseCoopers internal computer network and had stolen tax documents for Romney and his wife, Ann D. Romney, for tax years prior to 2010."

The related extortion demand was publicly posted to Pastebin on Sept. 2, 2012. "Romney's 1040 tax returns were taken from the PWC office 8/25/2012 by gaining access to the third floor via a gentleman working on the 3rd floor of the building," according to the "Romney 1040 Collection" demand. The post said that Romney's personal tax records had been copied, and that a copy of the returns -- stored on a flash drive -- together with a copy of the demands had been dropped off at local Democratic and GOP offices.

[ Want to join the cast of CSI: Cyberspace? Learn 7 tips on How To ID Malware Attackers. ]

The group said it would release the files by Sept. 28, 2013, unless it received $1 million in Bitcoin currency. Later, the group claimed to have found a buyer for the information.

In a FAQ published after the demands were posted, the group said that it was adopting the "Dr Evil" moniker bestowed on it in relation to the demand for $1 million in Bitcoins. "We never considered a name before, we thought it was kind of lame to even need a name, but it sticks," it said. "We will roll with it."

The Justice Department said that the claim that the returns had been stolen from PwC was false.

According to Nashville NBC affiliate WSMV, Secret Service agents raided Brown's house on Sept. 14, 2012, using a search warrant that had been issued the previous day, and seized multiple devices, including computers, tablets and storage peripherals.

Brown said that one of items on the search warrant was a grainy picture of a cat that had also been found on a flash drive used to submit the ransom demands. Brown said his daughter reported that the cat belonged to a family friend whose computer Brown said he'd repaired four years prior. He said agents then seized equipment from the family friend's house the same day.

Brown told WSMV that it was the second time his house had been raided by the Secret Service. In 2009, he said, agents searched his house in relation to the theft of encrypted data relating to 1,000 Farm Bureau customers. No charges were filed against him in that case.

The alleged extortion scam is a reminder of how, throughout the 2012 Presidential race, Romney refused to release his pre-2010 tax returns, despite charges that his money had been invested offshore, and phrases such as "Cayman Islands" and "Swiss Bank account" entered the presidential primary lexicon for the first time in history, reported The Huffington Post.

The Romney incident appeared to be the first-known demand for Bitcoins as part of an extortion attempt. Since then, however, Bitcoins have been tapped by online crime gangs looking for a way to shake down clients and receive money in an anonymous and untraceable manner. Last week, for example, a gang calling itself "1 & 0 Logic Security Group" demanded 1 Bitcoin -- as of Tuesday, worth about $92 -- in lieu of launching a distributed denial of service (DDoS) attack against the free speech and cryptography archive Cryptome.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio