How spyware on rental PCs captured users’ most intimate moments

Enlarge / As Brian Byrd played poker using a PC purchased from an Aaron's rent-to-own store, PC Rental Agent surreptitiously captured this screen shot. It is one of hundreds of thousands of images siphoned by the software.

On the second-to-last Monday of 2010, Brian Byrd was playing video poker on his Dell Inspiron laptop when someone knocked on the door of his home in Casper, Wyoming. The visitor, who drove a truck from the local Aaron's rent-to-own store that furnished the PC five months earlier, said the 25-year-old Byrd was behind in his payments and demanded he pay up at once. He then brandished a picture that was about to cause a national privacy uproar.

The image showed Byrd on his home couch using the very laptop in question to play online poker. The employee was also privy to a screenshot of the website Byrd's PC was displaying the moment the photo was surreptitiously taken, along with keystrokes he was entering while visiting a website. When Byrd demanded an explanation, the employee, identified in a police report as 24-year-old Christopher Mendoza, said he wasn't supposed to answer. But he went on to disclose that the PC contained software that allowed Aaron's employees to track its physical location and remotely activate its webcam and capture screenshots and keystrokes. Mendoza, according to court records, left the premises after Byrd produced a copy of a receipt showing the laptop had been paid for in full on October 1.

After Byrd discussed the encounter with his wife Crystal, the couple recalled several recent occasions in which the computer had exhibited odd behavior. For the past three weeks or so, they told a police investigator, the laptop displayed a mysterious screen that prompted them for their name, address, phone number, and other details. More troubling was the light next to the webcam that was inexplicably illuminated even when neither of the Byrds was shooting video or photos. The couple soon realized that for more than a month, someone had been using the laptop to remotely spy on them. Nowhere in the terms of the rental agreement the Byrds signed was there any mention that the machine could be remotely monitored.

Read 49 remaining paragraphs | Comments