Feeds

Spamford Wallace charged for hacking 500,000 Facebookers

Forbidden login at 10,000 feet

Website security in corporate America

One of the first figures to plaster the internet with millions of spam messages before being driven underground has been criminally charged for hacking some 500,000 Facebook accounts, stealing their personal information, and sending 27 million unwanted advertisements.

Sanford Wallace, now 43, first figured out a way to evade Facebook's spam filters and then employed a script that automatically logged in to the accounts he had compromised and retrieve a list of all the users' friends, according to an indictment filed Thursday in federal court in San Jose, California. He then allegedly posted junk messages on each of the friends' Facebook wall.

When people clicked on a link in the message, they were directed to a website that phished their name, and account credentials, prosecutors said. He allegedly carried out the scheme in just five months, starting in November 2008.

“Wallace continued his spamming scheme by storing the information provided by Facebook users, such as email addresses and passwords,” the indictment stated. “Wallace then used the user's email address and password to log into Facebook in order to continue to send spam messages.”

The indictment comes almost two years after Facebook was awarded $711m in damages from Wallace after suing him over the alleged scam. He faced a similar lawsuit from MySpace that in 2008 resulted in a $230m judgement. It's doubtful the company has recovered a dime of either judgement.

Wallace surrendered to FBI agents in Las Vegas on Thursday. He made his initial appearance in court a little while later and was released on $100,000 bail. He was ordered not to access Facebook or MySpace.

The indictment charges Wallace with six counts of fraud and two counts of intentional damage to a protected computer. He was also charged with two counts of criminal contempt for logging in to Facebook after the federal judge in the civil action brought by the site ordered him not to. One of the forbidden logins occurred while Wallace was aboard a Virgin Airlines flight from Las Vegas to New York.

If convicted, he faces a maximum of three years in prison and a $250,000 fine for each fraud count and 10 years and a $250,000 fine for each intentional damage count. Penalties for the contempt charges are up to the judge.

A PDF of the indictment is here. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Blood-crazed Microsoft axes Trustworthy Computing Group
Security be not a dirty word, me Satya. But crevice, bigod...
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.