Feeds

PC rental store hid secret spy hardware in laptop, suit says

Keystrokes, screen shots, webcam pics tapped

Secure remote control for conventional and virtual desktops

A Wyoming couple has filed a federal lawsuit claiming a computer they purchased came with secret spying hardware that allowed the seller to monitor their every move.

According to the complaint, Brian and Crystal Byrd first learned of the snoop device when they received a visit at home from a manager of the local Aaron's rent-to-own store falsely claiming they hadn't made required payments on their Dell Inspiron laptop. During the conversation, manager Christopher Mendoza said he had a photo of Mr. Byrd using the computer and as proof showed a picture that had been taken remotely using an off-the-shelf device called PC Rental Agent.

“When Brian Byrd demanded that Mendoza explain how Mendoza had obtained an unauthorized photograph, Mendoza responded that he was not supposed to disclose that Aaron's had the photograph,” the complaint, filed on Tuesday in US District Court in Pittsburgh, Pennsylvania, alleged.

The suit, which seeks class-action status so other Aaron's customers may also be represented, names parent company Aaron's Inc. of Atlanta, the independently owned Casper Wyoming, Aaron's franchise, and DesignerWare, the North East, Pennsylvania company alleged to have made and sold PC Rental Agent.

“Unbeknownst to Plaintiffs and the members of the class, and without their authorization, defendants have been spying on the activities of plaintiffs and class members through the use of the PC Rental Agent device and/or similar software and/or devices which were designed to, and in fact did, access, intercept, transmit, use and/or disclose electronic communication,” the complaint stated. “These spying devices and/or spying software were installed and enabled surreptitiously without the consent of plaintiffs or class members.”

In a press release, Aaron's rejected the allegations.

“The Company believes that none of its over 1,140 company-operated stores have used the product developed or provided by PC Rental Agent or DesignerWare LLC, the two vendors named in the lawsuit, and neither vendor is approved or have done any business with Aaron's, Inc.,” the company said. “Aaron's, Inc. respects its customers' privacy and has not authorized any of its corporate stores to install software that can activate a customer's webcam, capture screenshots, or track keystrokes.”

DesignerWare representatives didn't respond to an email and phone call seeking comment for this article. Representatives of the franchise couldn't be reached.

According to the suit, the PC Rental Agent device can't easily be removed from computers because it “is soldered into the motherboard and/or is part of the Intel chipset.” It can be deactivated only with the wave of a wand that isn't available to the public.

After the Byrd's complained to police, investigators spoke with a DesignerWare employee, who allegedly said the device allowed store employees to capture screen shots, keystrokes, and webcam pictures without the customer's knowledge. According to the suit, PC Rental Agent transmitted the data to systems operated by DesignerWare, which in turn made it available to Aaron's representatives throughout the country.

“While law enforcement was conducting its investigation at the Casper Aaron's store, it is further believed that a law enforcement officer observed an unauthorized photograph of another Aaron's customer, and was told that Aaron's regularly received emails from DesignerWare with unauthorized photographs and other communications taken of customers and authorized users through the use of the PC Rental Agent,” the complaint alleged.

The allegations in many ways resemble claims made last year that laptops issued by a suburban Philadelphia school secretly snapped thousands of pictures students in their homes, sometimes while they were sleeping or only partially clothed. The images, estimated to be 58,000, were captured by administrative software called LANrev, which was installed on the MacBooks that the Lower Merion School District gave to its students.

More than 400 images were secretly taken of a single high school student named Blake Robbins, who sued for invasion of privacy.

Tuesday's complaint against Aaron's and DesignerWare seeks damages under the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act. The 19-page complaint is here. ®

Providing a secure and efficient Helpdesk

More from The Register

next story
TEEN RAMPAGE: Kids in iPhone 6 'Will it bend' YouTube 'prank'
iPhones bent in Norwich? As if the place wasn't weird enough
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
iPAD-FONDLING fanboi sparks SECURITY ALERT at Sydney airport
Breaches screening rules cos Apple SCREEN ROOLZ, ok?
Crouching tiger, FAST ASLEEP dragon: Smugglers can't shift iPhone 6s
China's grey market reports 'sluggish' sales of Apple mobe
A moment of brilliance? UPnP for Internet of Stuff lightbulbs
Thus doth tech of future illuminate present, etc
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
The British Museum plonks digital bricks on world of Minecraft
Institution confirms it's cool with joining the blocky universe
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.