Slashdot Mirror
Student Hacker Faces 10 Years in Prison For Spyware That Hit 16,000 Computers (vice.com)
An anonymous reader quotes Motherboard:
A 21-year-old from Virginia plead guilty on Friday to writing and selling custom spyware designed to monitor a victim's keystrokes. Zachary Shames, from Great Falls, Virginia, wrote a keylogger, malware designed to record every keystroke on a computer, and sold it to more than 3,000 people who infected more than 16,000 victims with it, according to a press release from the U.S. Department of Justice.
Shames, who appears to be a student at James Madison University, developed the first version of the spyware while he was still a high school student in 2013, "and continued to modify and market the illegal product from his college dorm room," according to the feds... While the feds only vaguely referred to it as "some malicious keylogger software," it appears the spyware was actually called "Limitless Keylogger Pro," according to evidence found by a security researcher who asked to remain anonymous... According to what appears to be Shames Linkedin page, he was an intern for the defense contractor Northrop Grumman from May 2015 until August 2016.
The Department of Justice announced that he'll be sentenced on June 16, and faces a maximum of 10 years in prison.
Shames, who appears to be a student at James Madison University, developed the first version of the spyware while he was still a high school student in 2013, "and continued to modify and market the illegal product from his college dorm room," according to the feds... While the feds only vaguely referred to it as "some malicious keylogger software," it appears the spyware was actually called "Limitless Keylogger Pro," according to evidence found by a security researcher who asked to remain anonymous... According to what appears to be Shames Linkedin page, he was an intern for the defense contractor Northrop Grumman from May 2015 until August 2016.
The Department of Justice announced that he'll be sentenced on June 16, and faces a maximum of 10 years in prison.
Heavy-handed over-reaction. 10 years?! Unless this was self-spreading malware, the issue here is that kid a) talked to feds b) couldn't afford decent lawyer.
Write an input debugger with logging instead.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
I'm curious what aspect of this was illegal. The keylogging itself isn't illegal. If someone buys and installs keylogger software on devices they own, that's not illegal. If someone installs software of that kind on someone else's device, without the owner's permission, then the person who did the installation broke the law. Not the author of the software.
Both articles are vague in that regard, but one states,
intentionally cause damage without authorization
,
Which may mean the software had the capability to erase files or do something harmful besides capturing data.
Unless the software actively multiplied and installed itself without permission somehow, it would seem to me that the customers are (in some specific cases) the guilty parties.
Better known as 318230.
How is that all that different from web sites that monitor every mouse movement, key stroke, and web site that you visit?
Presumably because they can't monitor your mouse movements and key strokes when you're on another site that isn't theirs.
Yahoo is welcome to monitor your mouse movements and key strokes when you're on Yahoo, but If Yahoo could monitor your mouse movements and key strokes when you were on CNN or Google, then there would be a problem, no?
Just cruising through this digital world at 33 1/3 rpm...
Surely a stern talk and a 100 hours of community service would be a saner approach? He didn't do anything other than sell a tool, and while it's dubious where and who he sold it, he hasn't actually committed a crime yet, and it's not like a keylogger doesn't have legitimate purposes, nor is it illegal to possess one. Fucking over some kid for the rest of his life, in an environment where he's almost certain to repeat an offence, and turning him into a perpetual lifelong drain on the public, is not the answer - for either us or him. Yet another demonstration of my country's collective idocacy...
"Set a man a fire, he'll be warm for the rest of the night. Set a man afire, he'll be warm for the rest of his life."
From on or about August 2013 through on or about March 17,2015, in the Eastern District of Virginia and elsewhere, the defendant, ZACHARY LEE SHAMES, knowingly and intentionally aided and abetted the commission of computer intrusions, in violation of 18U.S.C. ÂÂ 1030(a)(5)(A) and 2. In particular, attimes listed above, in the Eastern District of Virginia andelsewhere, SHAMES designed, marketed and sold certain malicious keylogger software, knowing that the software was going tobeused to knowingly cause the transmission ofa program, information, code, or command, and as a result of such conduct, intentionally cause damage without authorization to 10 or more protected computers during any one year period.
(All in violation of Title 18,United States Code, Section 1030(a)(5)(A) and 2)
https://regmedia.co.uk/2017/01...
So what he plead guilty to was developing the software and then knowingly selling it people who would be breaking the law. If he had marketed it toward the general public instead of marketing to crackers it would of not been a problem. For example I can sell and train people in lock picking all I want, however if someone comes up to me and says they want to break into a house with type X lock and want training and tools and I sell it to them then I am in trouble.