PC rental store hid secret spy hardware in laptop, suit says
Keystrokes, screen shots, webcam pics tapped
A Wyoming couple has filed a federal lawsuit claiming a computer they purchased came with secret spying hardware that allowed the seller to monitor their every move.
According to the complaint, Brian and Crystal Byrd first learned of the snoop device when they received a visit at home from a manager of the local Aaron's rent-to-own store falsely claiming they hadn't made required payments on their Dell Inspiron laptop. During the conversation, manager Christopher Mendoza said he had a photo of Mr. Byrd using the computer and as proof showed a picture that had been taken remotely using an off-the-shelf device called PC Rental Agent.
“When Brian Byrd demanded that Mendoza explain how Mendoza had obtained an unauthorized photograph, Mendoza responded that he was not supposed to disclose that Aaron's had the photograph,” the complaint, filed on Tuesday in US District Court in Pittsburgh, Pennsylvania, alleged.
The suit, which seeks class-action status so other Aaron's customers may also be represented, names parent company Aaron's Inc. of Atlanta, the independently owned Casper Wyoming, Aaron's franchise, and DesignerWare, the North East, Pennsylvania company alleged to have made and sold PC Rental Agent.
“Unbeknownst to Plaintiffs and the members of the class, and without their authorization, defendants have been spying on the activities of plaintiffs and class members through the use of the PC Rental Agent device and/or similar software and/or devices which were designed to, and in fact did, access, intercept, transmit, use and/or disclose electronic communication,” the complaint stated. “These spying devices and/or spying software were installed and enabled surreptitiously without the consent of plaintiffs or class members.”
In a press release, Aaron's rejected the allegations.
“The Company believes that none of its over 1,140 company-operated stores have used the product developed or provided by PC Rental Agent or DesignerWare LLC, the two vendors named in the lawsuit, and neither vendor is approved or have done any business with Aaron's, Inc.,” the company said. “Aaron's, Inc. respects its customers' privacy and has not authorized any of its corporate stores to install software that can activate a customer's webcam, capture screenshots, or track keystrokes.”
DesignerWare representatives didn't respond to an email and phone call seeking comment for this article. Representatives of the franchise couldn't be reached.
According to the suit, the PC Rental Agent device can't easily be removed from computers because it “is soldered into the motherboard and/or is part of the Intel chipset.” It can be deactivated only with the wave of a wand that isn't available to the public.
After the Byrd's complained to police, investigators spoke with a DesignerWare employee, who allegedly said the device allowed store employees to capture screen shots, keystrokes, and webcam pictures without the customer's knowledge. According to the suit, PC Rental Agent transmitted the data to systems operated by DesignerWare, which in turn made it available to Aaron's representatives throughout the country.
“While law enforcement was conducting its investigation at the Casper Aaron's store, it is further believed that a law enforcement officer observed an unauthorized photograph of another Aaron's customer, and was told that Aaron's regularly received emails from DesignerWare with unauthorized photographs and other communications taken of customers and authorized users through the use of the PC Rental Agent,” the complaint alleged.
The allegations in many ways resemble claims made last year that laptops issued by a suburban Philadelphia school secretly snapped thousands of pictures students in their homes, sometimes while they were sleeping or only partially clothed. The images, estimated to be 58,000, were captured by administrative software called LANrev, which was installed on the MacBooks that the Lower Merion School District gave to its students.
More than 400 images were secretly taken of a single high school student named Blake Robbins, who sued for invasion of privacy.
Tuesday's complaint against Aaron's and DesignerWare seeks damages under the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act. The 19-page complaint is here. ®
- Black Hat
- Common Vulnerability Scoring System
- Cybersecurity and Infrastructure Security Agency
- Cybersecurity Information Sharing Act
- Data Breach
- Data Protection
- Data Theft
- Digital certificate
- Identity Theft
- Kenna Security
- Palo Alto Networks
- Privacy Sandbox
- Quantum Computing
- Trusted Platform Module
- Zero trust
- ZX Spectrum