Skip to main content

Creators of Botnet That Crashed the Web Plead Guilty

By Christopher Coble, Esq. on December 15, 2017 | Last updated on March 21, 2019

The protection racket is an old criminal enterprise, consisting of extorting money from people or businesses to keep them safe. Safe from whom? Well, from you of course.

And it turns out you can teach an old crime new tricks. Paras Jha and Josiah White ran a company that specialized in mitigating DDoS attacks (when multiple computer systems flood the bandwidth of a targeted system, shutting it down). The two also created the Mirai botnet and, as Brian Krebs put it, "[l]ike firemen getting paid to put out the fires they started," targeted organizations with DDoS attacks in order to boost their clientele. Jha, White, and co-conspirator Dalton Norman pleaded guilty to federal computer crime charges this week, after their botnet shut down large swaths of the internet last year.

Racket Attacks

As Verge reported, the Mirai botnet didn't so much target vulnerable computers as much as their attached devices:

Mirai took down huge portions of the web last year when it overloaded domain registration service provider Dyn with malicious traffic requests. Mirai compromised more than 100,000 devices, including IP cameras and DVR boards from Chinese electronic company Hangzhou Xiongmai. These parts came with a default username and password. Users weren't required to change that combo. After Mirai's source code was publicly released, more than 400,000 devices were compromised.

That last part might be the most insidious -- Jha and White not only used the botnet to extort targeted organizations for their services, they leased it out to other attackers and then Jha posted the source code on a criminal forum, where it was used in a variety of subsequent attacks.

Bitcoin for Botnets

Jha, White, and Norman all pleaded guilty to conspiracy to violate the Computer Fraud & Abuse Act; Jha and Norman pleaded guilty to an additional conspiracy charge; and Jha pleaded guilty to actual violations of the Act for an attack that targeted Rutgers University. Although they have yet to be sentenced, Verge reports that Jha and White have agreed to turn over some ill-gotten bitcoin from the scheme: 13 for Jha (worth about $225,000) and 33 for White (worth about $500,000).

Even in virtual currency, crime don't pay.

Related Resources:

Copied to clipboard