Mirai Hackers' Sentence Includes No Jail Time

[steven36]

The trio behind Mirai sentenced to probation and public service in return for cooperation with law enforcement and researchers.

 

Paras Jha

 

Three men charged with creating and managing the Mirai botnet have pleaded guilty to conspiracy to violate the Computer Fraud & Abuse Act and have been sentenced to a five-year period of probation and 2,500 hours of community service. They also have been ordered to pay restitution in the amount of $127,000 and have voluntarily abandoned significant amounts of cryptocurrency seized during the course of the investigation.

 

Paras Jha, 22, of Fanwood, N.J.; Josiah White, 21, of Washington, Pa.; and Dalton Norman, 22, of Metairie, La., were sentenced after cooperating extensively with the FBI. As part of their sentences, the three must continue to cooperate with the FBI, law enforcement, and researchers on cybercrime and cybersecurity matters. According to court documents, the defendants have provided assistance that substantially contributed to active complex cybercrime investigations and broader defensive efforts by both law enforcement and cybersecurity researchers.

 

Jha and Norman also pleaded guilty to the same charge in relation to the Clickfraud botnet. The defendants' involvement with Mirai ended in the fall of 2016, when Jha posted the source code for Mirai on a criminal forum. Noting the defendant's relative youth, Jeffery Peterson, special agent in charge of FBI's Anchorage Field Office, said, "This case demonstrates our commitment to hold criminals accountable while encouraging offenders to choose a different path to apply their skills."

Read more here.

 

Source

 

[steven36]

Hackers Behind the Botnet That Broke the Internet Are Basically Cops Now

 

The three architects of the Mirai botnet just wanted to devise a scheme to make some money in the competitive business of hosting Minecraft servers. The weapon they built ended up showing the world how dangerous DDoS attacks can be. Now, their lives have taken another unexpected turn as the U.S. Justice Department has given them a pass and some work to do.

 

On Tuesday, Josiah White, Paras Jha, and Dalton Norman were sentenced by a federal judge in Alaska to serve five years of probation. The three men, who are all 20-21 years old, pleaded guilty to participating in various ways in the creation and dissemination of the Mirai botnet. The decision came after a recommendation from the Justice Department that they be given a reduced sentence in return for their “extensive and exceptional” cooperation with authorities. In addition to keeping their noses clean for five years, they’ll also have to serve 2,500 hours of community service. That doesn’t necessarily mean that they’ll be picking up garbage. Instead, the community service is being defined “to include continued work with the FBI on cybercrime and cybersecurity matters,” as the DOJ requested.

 

In 2016, the three men were all underachievers who wanted to make a buck hosting players of the popular video game Minecraft. Players flock to various servers that host the game and offer different perks and play styles. For example, one server might stipulate that players building together in a shared world can’t destroy one another’s creations. Wired reported on the origins of Mirai last year and spoke with Elliott Peterson, the FBI special agent who took the lead on the case. Peterson told the publication that it’s common to see a successful Minecraft host pull in $100,000 worth of fees in a month.

 

With so much money on the line, sometimes hosts will engage in cyberattacks like distributed denial-of-service attacks (DDoS) that take control of a huge number of machines and direct them to a competitor’s server. The attack overwhelms the servers bandwidth and slows it to a crawl or renders it unusable. “We see so many attacks on Minecraft,” Peterson told Wired. “I’d be more surprised sometimes if I didn’t see a Minecraft connection in a DDoS case.”

 

Josiah White was identified as the author of the source code that became Mirai in his plea deal last year. He and his co-conspirators wanted to undermine a tool that protects many Minecraft servers from DDoS attacks, but they found that Mirai was way more powerful than they thought. They used the botnet for their own criminal activities and leased it to others. But as things heated up, they released it into the wild on a hacker forum—the idea being that the more people who had the code, the less likely it would be for authorities to pin it on them.

 

That didn’t work out. But it did ensure that the botnet made it into the hands of other cybercriminals who’ve used it for many devastating attacks in the last two years, including the incident that took down the DNS service Dyn in October of 2016. Reddit, Twitter, the PlayStation Network, and many other major sites went down. The East Coast of the U.S. experienced widespread outages, as did other regions around the world as hundreds of thousands of bots swarmed and overwhelmed Dyn’s defenses. According to the FBI, cybercriminals are still adapting Mirai as security professionals scramble to keep up.

 

In its sentencing recommendation, the DOJ said that the men began cooperating with law enforcement before they were even charged. It gave vague outlines of the help they’ve provided for around a dozen cases. According to the document, they’ve logged about 1,000 hours working to prevent other DDoS attacks as well as participating in other activities. They’ve built a program to help the FBI track the private keys for cryptocurrencies and it appears they’ve been doing undercover work online and traveling abroad.

 

The FBI has struggled to recruit hackers for years, and enlisting criminals after they’ve been caught has been a common approach since hacking first became illegal. It’s unclear how skilled the Mirai guys are in reality. “These kids are super smart, but they didn’t do anything high level—they just had a good idea,” one FBI agent told Wired last year. Marcus Hutchins, a security expert who is currently on bail after being charged with hacking-related crimes last year, wrote on Twitter that he was unsure what to think of the Mirai creator’s sentencing. “It’s definitely the right move,” he wrote, “but the idea that the FBI uses people for their skills rather than as informants seems like PR fluff.”

 

Source