Law enforcement authorities in the United States on Friday indicted and arrested two individuals suspected of developing, marketing and selling a piece of software designed to enable unauthorized access to protected content stored on the image and video hosting website Photobucket.
According to the indictment, Brandon Bourret, 39, of Colorado Springs, Colorado and Athanasios Andrianakis, 26, of Sunnyvale, California have been accused of conspiring to commit computer fraud and abuse, access device fraud, identification document fraud, and wire fraud.
Photobucket allows users to protect albums containing private content by marking them “private” or “password protected.” Bourret and Andrianakis are said to have developed a tool, dubbed “Photofucket,” that allowed them to access images and videos stored in private or password-protected albums.
The suspects allegedly used the application between July 12, 2012 and July 1, 2014 to circumvent Photobucket privacy mechanisms and access private images and videos. Authorities say Bourret and Andrianakis accessed password-protected albums by obtaining guest passwords. They used the guest passwords to access the protected information, and they also provided the guest passwords to customers of the Photofucket app.
Investigators obtained emails in which the suspects discussed the tool and ways of improving it. They also obtained details on money transfers made between the men, and payments made by their customers.
“Unauthorized access into a secure computer system is a serious federal crime,” said Special Agent in Charge Thomas Ravenelle for the Denver Division of the FBI. “The arrest of Brandon Bourret and his co-conspirator reflects the FBI’s commitment to investigate those who undertake activities such as this with the intent to harm a company and its customers.”
Bourret and Andrianakis face up to five years in prison and a $250,000 fine for the conspiracy charge, up to five years in prison and a $250,000 fine for the computer fraud charge, and up to ten years in prison and a $250,000 fine for each of the two access device fraud counts.
Related: Former US Govt Employee ‘Tried to Sell Nuclear Secrets’
Related: Canadian Hacker Arrested for Spying Through Webcams
Related: Alleged Creator of Svpeng Android Malware Arrested in Russia