Cryptolocker Ransomware Being Described As ‘The Perfect Crime’

BOSTON (CBS) — It is being called the perfect crime and it has law enforcement around the globe baffled.
It all starts with a simple email.
“They are scared and they are angry. It is a real terrible experience for them.”
Joe Ruthaford is talking about computer users who mistakenly launched a potent internet phishing scheme.
He recently saw one of those ravaged computers in his Beacon Hill repair shop.
“It is extremely damaging. It is one of the worst ones.”
It’s called cryptolocker ransomware.
Kevin Swindon is with the FBI in Boston.
“I would think about this particular type of malware as what would happen if your computer was destroyed,” Swindon said.
In the past 90 days, thousands of people worldwide have opened a seemingly innocuous link to track a holiday package. Suddenly, all the files on their computer are encrypted.
Joan Goodchild is the editor of “CSO,” Chief Security Officer magazine based in Framingham.
“This is a criminal operation. They are holding your folders and files ransom. We call this ransomware because that is exactly what it is. You need to pay in order to have access to them once again.”
And that is exactly what happened last month at the Swansea Police Department.
Cryptolocker ransomware took over the department’s entire computer system and the police were forced to pay a $750 ransom to get back control.
As the ransomware takes over your computer, a countdown clock appears and shows victims how long they have to pay up. That means purchasing a key, or software, to reverse the process. And victims must do that using the online virtual currency known as bitcoins.
“Once you have purchased a bitcoin, then the transaction that you use that bitcoin in is encrypted, and therefore you cannot trace it,” explained Goodchild.
Swindon says it appears to be the perfect crime.
The FBI tells WBZ-TV they are very worried about this spreading in 2014.
The scheme could be the work of organized gangs overseas. So far, no one has been caught

3 Questions: Randolph Kirchain on the spread of electronic waste - MIT News Office

3 Questions: Randolph Kirchain on the spread of electronic waste - MIT News Office

AT&T to disclose government requests for customer data

Following Verizon's decision to tell the public how many government requests for customer data it gets, AT&T now says that it, too, is planning a transparency report.


AT&T has joined Verizon Communications in publishing a report that details how many surveillance requests it gets from law enforcement.
The company announced Friday that it will begin publishing a semiannual report offering details of requests it has received from law enforcement. This comes one day after Verizon announced a similar plan. AT&T and Verizon have each come under pressure from shareholders to disclose to their customers how many requests they get a year.

These reports will include information about the total number of law-enforcement data requests they receive from governments in criminal cases including the number of subpoenas, court orders, and warrants. And they will also disclose the total number of customers affected by these requests. The first report will include information for 2013.
What the reports will not do is disclose information that the government prohibits it from disclosing. For example, the company is legally prohibited from detailing requests from National Security Letters or FISA warrants.
These announcements from AT&T and Verizon come days after a federal judge ruled that a US National Security Agency surveillance program that collects phone record metadata on all US citizens is likely unconstitutional.
The lawsuit was filed after it became public in June that the NSA had been collecting records of millions of phone calls made in the US under a top-secret Foreign Intelligence Surveillance Court order. The information came to light in documents leaked by former NSA contractor Edward Snowden.

Google releases Android Device Manager app

With the Android Device Manager app, you can erase a stolen phone remotely.

(Credit: Google)


Google today released a mobile app for its Android Device Manager service. Available for free in the Google Play store, the app lets users manage and secure an Android tablet or phone associated with their Google account from another Android device (running Gingerbread and up).

The app gives access to all Android Device Manager features, including locating a tablet or phone on a map, resetting its lock code, and erasing it completely. Just note that your missing device must be connected to the cellular network or to Wi-Fi for it to perform the commands.
Though Google released Android Device Manager in August, the initial lack of a corresponding mobile app meant that anyone with a missing handset could lock it down only through the Android Device Manager site. With this release, however, Google now has a solution comparable to Apple's Find My iPhone app.

Alleged 'revenge porn' Web site operator arrested in California

The man allegedly created a site where sexually explicit photographs of individuals were posted without their approval and then allegedly extorted money from victims for removal of images.

A San Diego man accused of running a "revenge porn" Web site that illegally posted more than 10,000 sexually explicit photographs of individuals without their permission has been arrested, the California attorney general's office said.
Kevin Christopher Bollaert, 27, was arrested Tuesday and charged with 31 felony counts of conspiracy, identity theft, and extortion, Attorney General Kamala D. Harris said Tuesday in a statement.
"This website published intimate photos of unsuspecting victims and turned their public humiliation and betrayal into a commodity with the potential to devastate lives," Harris said.
In December 2012, Bollaert created the Web site ugotposted.com, which allowed users to anonymously post private photographs containing nude and explicit images of individuals without their permission, prosecutors allege in court documents. However, the site required uploaded images be accompanied by the subject's full name, address, age, and social media profiles, according to the criminal complaint (PDF).
Victims wanting their images and information removed from the site were directed to a second Web site Bollaert created called changemyreputation.com, where they could pay $250 to $350 to have their information removed, according to court documents. Between December 2012 and September 2013, Bollaert collected more than $10,000 from victims wishing to have their images and information removed from ugotposted.com, prosecutors allege.
According to the arrest warrant (PDF), one alleged victim said she was afraid to return to work because of harassment resulting from her name and Facebook information being posted on ugotposted.com. In one of several testimonials included in the warrant, a woman identified as Jane Doe No. 6 wrote in an e-mail to the site:

"PLEASE HELP! I am scared for my life! People are calling my work place and they obtained that information through this site! I did not give permission for anyone to put up those pictures or my personal information. I have contacted the police but these pictures need to come down! Please!

Others told of being harassed by strangers after their images appeared on the site, forcing them to close their social network accounts and change phone numbers.

Bollaert allegedly told investigators that he routinely received about 100 e-mails per day from people requesting that content be removed from his site. And he allegedly received about $900 a month from the site's victims via a PayPal account. But after PayPal limited his access to the account in May, he allegedly instructed the victims to pay with Amazon gift cards.
"Yeah, I realize like this is not a good situation," Bollaert told authorities, according to the arrest warrant. "I feel bad about the whole thing and like I just don't want to do it anymore. I mean I know a lot of people are getting screwed over like on the site. Like their lives are getting ruined."
"At the beginning, it was fun and entertaining, but now it's just like ruining my life," he told investigators.
Bollaert, who is being held on $50,000 bail, faces unspecified prison time and fines if convicted. California Gov. Jerry Brown in October signed a bill that promises up to six months in jail and a $1,000 fine for people "convicted of illegally distributing private images with the intent to harass or annoy." However, Bollaert is charged with felonies related to obtaining personal identifying information for unlawful purposes, including the intent to annoy or harass.