Feeds

Guilty plea in Kinko's keystroke caper

Raked in 450 online banking passwords

  • alert
  • submit to reddit

The Essential Guide to IT Transformation

If you used a computer at a Kinko's in New York City last year, or the year before, there's a good chance that JuJu Jiang was watching.

The 25-year-old Queens resident pleaded guilty in federal court in New York last week to two counts of computer fraud and one charge of unauthorized possession of access codes for a scheme in which he planted a copy of the commercial keyboard sniffing program Invisible KeyLogger Stealth on computers at thirteen Kinko's stores sprinkled around Manhattan.

For nearly two years ending last December, Jiang's makeshift surveillance net raked in over 450 online banking passwords and user names from hapless Kinko's customers, according to the plea. He would use victims' financial information to open new accounts under their names, and then siphon money from their legitimate accounts into the new, fraudulent ones.

According to court records, the caper began unraveling last October, when Jiang had the bad luck to use a stolen GoToMyPC account to remotely control a victim's home computer while the victim was sitting in front of it. The victim, unnamed in court filings, watched as the PC's cursor began moving of its own accord, riffling through files, opening a browser window, and then establishing an account with online money transfer site Neteller.com under the victim's name. The victim had logged into the machine through GoToMyPC from a Kinko's on Seventh Avenue a few days earlier.

GoToMyPC's access logs captured Jiang's IP address, and after a brief investigation, the U.S. Secret Service raided the apartment Jiang shared with his mother in Queens. They seized books on hacking, a laptop computer and four desktop machines from Jiang's bedroom. Under questioning, Jiang, admitted sniffing passwords and usernames from Kinko's machines and selling them over the Internet, according to a Secret Service affidavit filed in the case.

Two months later, while free on bail, Jiang got caught planting another keyboard sniffer at a Kinko's on West 40th Street in New York.

The plea is silent on how much Jiang made from the scam, and prosecutor Joseph DeMarco said he couldn't answer questions about the case. The only financial losses that Jiang admitted to last week were $5,000 in "damage" caused to Kinko's computers by his installation of the surveillance software -- a stipulation that satisfies the minimum statutory requirement for a computer fraud conviction. Jiang also pleaded guilty to two criminal copyright violations for auctioning Microsoft software that was not meant for resale.

Jiang's attorney, Louis Freeman, told a judge that his client was undergoing a psychiatric evaluation, and that Freeman plans to use the results to ask for a reduced sentence. Reached by telephone, the lawyer declined to elaborate.

A Kinko's spokesperson said the company tries to make customers aware of the risks of entering personal information and data on publicly accessible machines, but would not discuss what security measures they take, or comment on whether the company made any changes as a result of the Jiang case. At least some Kinko's stores have warning placards next to every public workstation.

Last year, Kinko's security measures became an issue in the pre-trial arguments in the Zacarias Moussaoui terrorism prosecution. Defense attorneys sought information on Moussaoui's 2001 use of a public access PC at a Minnesota Kinko's store, but were foiled by what the FBI said was Kinko's national policy of completely reimaging public access machines on a weekly basis. It's not clear how that policy squares with Jiang's success; one possible explanation is that Jiang visited the 13 Kinko's frequently enough to retrieve the stored keystrokes before they were wiped out, and then re-installed his loggers afterwards.

Sold by San Francisco-based Amecisco for about $100 a copy, Invisible KeyLogger Stealth is a kernel mode keyboard sniffer that hooks Windows system calls to prevent users from seeing the program. Some anti-spyware products -- like Spydex's Advanced Anti- Keylogger -- can detect IKS through its growing keystroke logfile.

In an e-mailed statement, Amecisco's director Leon Yan said the company strongly condemns illegal use of its surveillance software. "Our intended audiences are authorized system administrators and parents," Yan wrote. "And I can give you examples after examples of parents [who] wisely used this tool to help with their children."

Jiang is in custody at New York's Metropolitan Correctional Center pending sentencing. A sentencing date has not been set.

© SecurityFocus logo

Related stories

Keylogging student charged with massive ID fraud
Mafia boss jailed in FBI keyboard bugging case
FBI chief Mueller lied to Senate about key-logging

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.