Feeds

Guilty plea in Kinko's keystroke caper

Raked in 450 online banking passwords

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

If you used a computer at a Kinko's in New York City last year, or the year before, there's a good chance that JuJu Jiang was watching.

The 25-year-old Queens resident pleaded guilty in federal court in New York last week to two counts of computer fraud and one charge of unauthorized possession of access codes for a scheme in which he planted a copy of the commercial keyboard sniffing program Invisible KeyLogger Stealth on computers at thirteen Kinko's stores sprinkled around Manhattan.

For nearly two years ending last December, Jiang's makeshift surveillance net raked in over 450 online banking passwords and user names from hapless Kinko's customers, according to the plea. He would use victims' financial information to open new accounts under their names, and then siphon money from their legitimate accounts into the new, fraudulent ones.

According to court records, the caper began unraveling last October, when Jiang had the bad luck to use a stolen GoToMyPC account to remotely control a victim's home computer while the victim was sitting in front of it. The victim, unnamed in court filings, watched as the PC's cursor began moving of its own accord, riffling through files, opening a browser window, and then establishing an account with online money transfer site Neteller.com under the victim's name. The victim had logged into the machine through GoToMyPC from a Kinko's on Seventh Avenue a few days earlier.

GoToMyPC's access logs captured Jiang's IP address, and after a brief investigation, the U.S. Secret Service raided the apartment Jiang shared with his mother in Queens. They seized books on hacking, a laptop computer and four desktop machines from Jiang's bedroom. Under questioning, Jiang, admitted sniffing passwords and usernames from Kinko's machines and selling them over the Internet, according to a Secret Service affidavit filed in the case.

Two months later, while free on bail, Jiang got caught planting another keyboard sniffer at a Kinko's on West 40th Street in New York.

The plea is silent on how much Jiang made from the scam, and prosecutor Joseph DeMarco said he couldn't answer questions about the case. The only financial losses that Jiang admitted to last week were $5,000 in "damage" caused to Kinko's computers by his installation of the surveillance software -- a stipulation that satisfies the minimum statutory requirement for a computer fraud conviction. Jiang also pleaded guilty to two criminal copyright violations for auctioning Microsoft software that was not meant for resale.

Jiang's attorney, Louis Freeman, told a judge that his client was undergoing a psychiatric evaluation, and that Freeman plans to use the results to ask for a reduced sentence. Reached by telephone, the lawyer declined to elaborate.

A Kinko's spokesperson said the company tries to make customers aware of the risks of entering personal information and data on publicly accessible machines, but would not discuss what security measures they take, or comment on whether the company made any changes as a result of the Jiang case. At least some Kinko's stores have warning placards next to every public workstation.

Last year, Kinko's security measures became an issue in the pre-trial arguments in the Zacarias Moussaoui terrorism prosecution. Defense attorneys sought information on Moussaoui's 2001 use of a public access PC at a Minnesota Kinko's store, but were foiled by what the FBI said was Kinko's national policy of completely reimaging public access machines on a weekly basis. It's not clear how that policy squares with Jiang's success; one possible explanation is that Jiang visited the 13 Kinko's frequently enough to retrieve the stored keystrokes before they were wiped out, and then re-installed his loggers afterwards.

Sold by San Francisco-based Amecisco for about $100 a copy, Invisible KeyLogger Stealth is a kernel mode keyboard sniffer that hooks Windows system calls to prevent users from seeing the program. Some anti-spyware products -- like Spydex's Advanced Anti- Keylogger -- can detect IKS through its growing keystroke logfile.

In an e-mailed statement, Amecisco's director Leon Yan said the company strongly condemns illegal use of its surveillance software. "Our intended audiences are authorized system administrators and parents," Yan wrote. "And I can give you examples after examples of parents [who] wisely used this tool to help with their children."

Jiang is in custody at New York's Metropolitan Correctional Center pending sentencing. A sentencing date has not been set.

© SecurityFocus logo

Related stories

Keylogging student charged with massive ID fraud
Mafia boss jailed in FBI keyboard bugging case
FBI chief Mueller lied to Senate about key-logging

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.