Aaron's stores allegedly put spyware in their rental laptops in 48 states.
PC Rental Agent was designed to streamline the administration of computers offered by rent-to-own stores, which sell or rent furniture, appliances, and other merchandise to consumers, often in exchange for weekly payments until they are paid off. By default, the program includes functionality that allows store employees to wipe PC hard drives at the press of a key. The feature is used to permanently remove confidential data left by one customer before the machine is given to a new customer. PC Rental Agent also includes a "kill switch" that allows computers to be remotely disabled. Store managers can invoke the switch in the event that the machine is stolen or a customer fails to make payments as promised. Activating the feature makes the PCs unusable, in theory creating an incentive for delinquent end users to pay up.
The program included yet another feature: a backdoor that allowed a store manager to remotely install a powerful spyware module that can surreptitiously track the location of the PC, collect pictures every two minutes of whoever was in front of the PC's built-in webcam, and capture keystrokes along with screenshots of whatever was being displayed on their monitors. When activated, this so-called "Detective Mode" operated at various levels. The first siphoned a screenshot and 30 characters worth of key strokes every two minutes for an hour. It then used DesignerWare servers to attach the data to e-mails that were sent to a designated manager—dubbed the "master account holder" in Designerware parlance—at the RTO store that issued the machine.
A second level collected a screenshot and keystrokes every two minutes until a command was issued for the collection to stop. A third level worked the same as Level 2, except that it snapped a picture of whoever happened to be in view of a PC's built-in webcam. It also displayed a fake software registration screen that prompted end users for personal information. Detective Mode had been updated in September, 2011 to make it possible to pinpoint a PC's geographic location by collecting the machine's IP address and the names of nearby wireless networks.
According to court records, a training manual DesignerWare provided its customers contained an admonition that said: "Caution, using Level#3 (prompting of the webcam) may alert the user because most webcams have a light that will flash briefly when activated. Also, prompting for information may make them suspicious. Therefore, it is best to try the less intrusive methods first (Level# 1 & 2)."
Nowhere in the manual is there any advice that the customers should be notified that PC Rental Agent can be augmented to surreptitiously spy on whoever is using the PC.
No one claims to know how many PCs were monitored by PC Rental Agent. In the six months prior to the May 2011 filing of the complaint—which is all the data DesignerWare officials claim to have—the firm received requests to install Detective Mode on 650 computers leased by stores owned by Aaron's Inc., according to sworn testimony provided in the case. That's about 0.6 percent of the 92,000 Aaron's PCs that used the software. The figures don't include PC Rental Agent-equipped machines leased by other companies or that used the software in the previous five-and-a-half years that it was available. In all, about 500 individual Aaron's stores in 48 states licensed the program.
The idea for PC Rental Agent came during a road trip DesignerWare cofounder TimKelly took in the mid 2000s with his then-college-age son, Ashton, and Koller. As the trio was en route to Oktoberfest celebrations in Milwaukee, they discussed a $750 laptop one of their stores had recently lost after a customer skipped out after making just one $20 payment on it. It was a scenario that was all too common. Kelly's business was averaging one-and-a-half stolen computers each month.
During its earliest incarnations, the program provided little more than a kill switch to render a computer useless in the event that a customer held on to it without making payments as promised. But to Kelly's chagrin, the software didn't stem the rate of PC losses. Rather than return the disabled machines, delinquent customers would merely throw them out or reinstall the operating system. To actually recover pilfered machines, Kelly devised what he characterized in court testimony as a "standalone separate program that gets installed when a computer gets reported stolen." The resulting Detective Mode module was introduced in 2007 or 2008 and operated at a single level that took a screenshot and recorded keystrokes every two minutes.
Over time, Detective Mode acquired additional capabilities, but from the outset, Kelly has steadfastly maintained it was designed solely as a means for rent-to-own store owners to retrieve their property after it was stolen. To prevent abuse, Kelly said, a PC Rental Agent license permitted the module to be used only in the event that a machine was stolen. As a further safeguard, a single store manager—designated as a loss prevention officer—could activate the monitoring module only after completing a form on the DesignerWare website certifying there was a theft.
"It was a highly restricted program that was only built, installed, and activated by a company's Loss Prevention Officer (LPO) to determine where and who was using the computer so it could be recovered," Kelly wrote in a series of e-mails to Ars Technica. "Information showed that if a rental dealer would lock a computer (parking meter) after it was reported stolen, it would often be thrown away because the individual knew they reported it stolen and did not want to get caught.
Unfortunately, the FTC somehow ruled that this person that was in possession of stolen property was some sort of consumer. That an owner somehow was doing something wrong when the person that rented it was attempting to steal the computer and they were not allowed to recover their property (try that with Hertz)."
When I asked Kelly if it was fair to characterize PC Rental Agent as containing a backdoor that allowed monitoring capabilities to be installed without the end users' knowledge, he said no.
"If you were a user you signed the Addendum and rental contract therefore you acknowledge in writing," he explained. "Secondly, the software uses a disclosure screen that informs you and you must agree to it before using the computer."
http://arstechnica.com/security/2012/12/how-spyware-on-rental-pcs-captured-users-most-intimate-moments/2/