Boy says thefts taught victims a lesson, police say

[InfoSec News <isn () c4i org>]

http://www.jsonline.com/news/metro/mar02/31664.asp

By JAMAAL ABDUL-ALIM
of the Journal Sentinel staff
Last Updated: March 31, 2002

Using an "underground" computer program to steal Internet account
information from about 200 people, a 16-year-old Cudahy boy bought
everything from a marijuana bong to computer equipment and Air Jordan
shoes, court records allege.

And now, a juvenile delinquency petition states, the boy says his
victims should thank him because he was "teaching them a lesson."

"People are really dumb," the boy, who claims he scored 135 on an IQ
test when he was 10 years old, told investigators who seized his
computer at his home in the 4500 block of S. Nicholson Ave.

But despite his apparent intellectual brightness, the boy told police
his mind has been getting dim lately because he regularly gets stoned
on drugs.

"I got stupid, probably because of the drugs," the boy told police. He
also told investigators he had been committing similar crimes since
age 12 but had gotten greedy lately.

According to a juvenile delinquency petition, which charges the boy
with two felony counts of misappropriation of personal identification:

The boy told police he had acquired an "underground program" capable
of obtaining the e-mail addresses of people who visit America Online
chat rooms.

The program would then send e-mails on an AOL letterhead telling
customers that their billing information had been deleted due to a
"system problem" and that to continue enjoying AOL, they must provide
their credit card information. The message directs recipients to a
another Web site, where they were to enter the information.

"We cannot link you for security reasons," read the message, sent
under the fictitious name Alex Page.

Apparently, many AOL users fell for the scam.

The boy - who set up his computer to run the program while he was
sleeping - told police he created many sites where people ultimately
recorded personal information, including addresses, phone numbers,
passwords, screen names, information from two credit cards, account
numbers, PIN numbers, expiration dates and credit card dollar limits.

The information would then be forwarded to the boy's Yahoo! e-mail
account, from which he would periodically access the data.

The boy told police he was particularly busy at the scheme the past
two months and had gotten about 150 to 200 accounts and would obtain
10 to 15 credit card numbers a day.

He told investigators it was easy because people are "dumb."

"I was teaching them a lesson," the boy told investigators. "They
should thank me."

According to the petition, the boy used other people's credit cards to
buy:

* A $300 water pipe commonly used for smoking marijuana.

* A computer monitor and speakers worth $500 and a $200 computer
  scanner purchased from AOL "shop direct."

* Two $70 scales.

* A pair of Air Jordan athletic shoes.

* A DVD player.

* A video camera and battery pack worth $153.

Police said the total value of all the items purchased was $1,643.

Apparently, the boy contemplated what he would do if investigators
ever caught on to his web of deceit.

Investigators found his computer's central processing unit removed and
propped against the wall in his bedroom. The boy told investigators
the reason was so that he could destroy the hard drive before police
retrieved it.

The boy told investigators how to enter the Internet sites he used to
commit his crimes.

The petition does not detail how investigators became aware of the
boy's scheme, but it does indicate that records are being subpoenaed
from AOL and Yahoo!

Among the people who fell for the boy's deceit were several
individuals from California, court records state.

One of those customers told police that the message the boy sent
appeared legitimate.

The boy - expected to enter a plea in the case this week - has been
placed at an area shelter and was ordered to have no contact with
computers while his case is pending.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY
of the mail.