PC rental store hid secret spy hardware in laptop, suit says
Keystrokes, screen shots, webcam pics tapped
A Wyoming couple has filed a federal lawsuit claiming a computer they purchased came with secret spying hardware that allowed the seller to monitor their every move.
According to the complaint, Brian and Crystal Byrd first learned of the snoop device when they received a visit at home from a manager of the local Aaron's rent-to-own store falsely claiming they hadn't made required payments on their Dell Inspiron laptop. During the conversation, manager Christopher Mendoza said he had a photo of Mr. Byrd using the computer and as proof showed a picture that had been taken remotely using an off-the-shelf device called PC Rental Agent.
“When Brian Byrd demanded that Mendoza explain how Mendoza had obtained an unauthorized photograph, Mendoza responded that he was not supposed to disclose that Aaron's had the photograph,” the complaint, filed on Tuesday in US District Court in Pittsburgh, Pennsylvania, alleged.
The suit, which seeks class-action status so other Aaron's customers may also be represented, names parent company Aaron's Inc. of Atlanta, the independently owned Casper Wyoming, Aaron's franchise, and DesignerWare, the North East, Pennsylvania company alleged to have made and sold PC Rental Agent.
“Unbeknownst to Plaintiffs and the members of the class, and without their authorization, defendants have been spying on the activities of plaintiffs and class members through the use of the PC Rental Agent device and/or similar software and/or devices which were designed to, and in fact did, access, intercept, transmit, use and/or disclose electronic communication,” the complaint stated. “These spying devices and/or spying software were installed and enabled surreptitiously without the consent of plaintiffs or class members.”
In a press release, Aaron's rejected the allegations.
“The Company believes that none of its over 1,140 company-operated stores have used the product developed or provided by PC Rental Agent or DesignerWare LLC, the two vendors named in the lawsuit, and neither vendor is approved or have done any business with Aaron's, Inc.,” the company said. “Aaron's, Inc. respects its customers' privacy and has not authorized any of its corporate stores to install software that can activate a customer's webcam, capture screenshots, or track keystrokes.”
DesignerWare representatives didn't respond to an email and phone call seeking comment for this article. Representatives of the franchise couldn't be reached.
According to the suit, the PC Rental Agent device can't easily be removed from computers because it “is soldered into the motherboard and/or is part of the Intel chipset.” It can be deactivated only with the wave of a wand that isn't available to the public.
After the Byrd's complained to police, investigators spoke with a DesignerWare employee, who allegedly said the device allowed store employees to capture screen shots, keystrokes, and webcam pictures without the customer's knowledge. According to the suit, PC Rental Agent transmitted the data to systems operated by DesignerWare, which in turn made it available to Aaron's representatives throughout the country.
“While law enforcement was conducting its investigation at the Casper Aaron's store, it is further believed that a law enforcement officer observed an unauthorized photograph of another Aaron's customer, and was told that Aaron's regularly received emails from DesignerWare with unauthorized photographs and other communications taken of customers and authorized users through the use of the PC Rental Agent,” the complaint alleged.
The allegations in many ways resemble claims made last year that laptops issued by a suburban Philadelphia school secretly snapped thousands of pictures students in their homes, sometimes while they were sleeping or only partially clothed. The images, estimated to be 58,000, were captured by administrative software called LANrev, which was installed on the MacBooks that the Lower Merion School District gave to its students.
More than 400 images were secretly taken of a single high school student named Blake Robbins, who sued for invasion of privacy.
Tuesday's complaint against Aaron's and DesignerWare seeks damages under the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act. The 19-page complaint is here. ®
COMMENTS
Can anyone at El Reg...
PLEASE find out what the hell this device is, is it using SMM, AMT or some other Intel technology as alleged and is it really that hard to remove?
I thought that too
I also thought, to paraphrase....
'He's making it up as he goes along'
I doubt there is any motherboard mod involved. Possiby tie ins to the management function in some lan cards but those machines are normally Broadcom chips. More likeley its some clueless oik misunderstanding whats going on. Its a shame as TBH the company is in the wrong, but if he insists on this line he may well loose just on the basis of it being proven to be bollocks :(
Oh, And soldered to the motherboard = impossible to remove? Hmm, better recall all those laptops repairs I've done and tell the owners they were impossible.
Hang 'em high
If this is true, the company concerned deserve a severe roasting or worse. I'm not too impressed with the developers either ; there can't be any legitimate reason for such capabilities to be installed in devices for the use of a private company, so they are on dodgy ground selling the stuff.
And as AC 05:03 says, can anyone shed some light on the technology used? Very interesting if there are specific capabilities built into the chipset/motherboard.
Easy Installation
I don't know about you but easily installation (as advertised on the DesignerWares website) and soldering stuff to the motherboard in a laptop (so very little spare space) doesn't really go hand in hand.
I bet this is just software running on a hidden partition, if it can restore Windows (another claim for the website) then it must have access to reasonably significant amount of storage which again points to hidden partitions.
If it is just software running in a seperate partition to the OS, then a simple reform of the primary disk should clean it out.
