8 ms·

Charges And Pleas In Computer Crime Cases Involving Significant Cyber Attacks

93 points by meri_dian 9y ago

deleted 9y ago
[deleted]
drefanzor 9y ago
Last few lines state how assistance was provided by various regional and international agencies, and then goes on to list google, coinbase, cloudflare, etc. Interesting.
- gtirloni 9y ago
  Isn't that normal, desired and expected?
- paxy 9y ago
  Coinbase is the surprising one to me, since it is the only one on the list that operates at the application rather than network level. And there's no mention of bitcoin theft anywhere in the report, just DDOS.
  - meri_dian 9y ago
    He probably held his Bitcoin on coinbase.
  - sophacles 9y ago
    Bitcoin payments in DDOS for hire, or extortion (as in we'll stop if you pay us). If they cashed out via coinbase, the authorities can find out who profited via the paper trail created.
pm90 9y ago
Looks like HN effectively DDOS'd justice.gov
drefanzor 9y ago
They should have thanked Brian Krebs, though. To be honest. Didn't he call out Jha long before anyone else knew?
- ryanlol 9y ago
  Krebs almost never knows anything before "anyone else". Before the public or other journos, sure.
  - tptacek 9y ago
    Obviously "anyone else" is hyperbolic, but whatever shade you want to throw at Krebs, he is serious about the job of investigative journalism for information security in a way literally nobody else in the industry seems to be.
    - ryanlol 9y ago
      Why do you think I'm trying to throw shade at Krebs? His journalism is excellent. I just know that the FBI isn't so incompetent that they didn't already know who these guys were before Krebs wrote his article, enough people surrounding Mirai were already very familiar to them.
      - tptacek 9y ago
        Sorry, it's a message board, tone is sometimes hard to tell! I apologize for jumping to the wrong conclusion.
- meri_dian 9y ago
  He did, in this article published in January 2017: https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/ https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-m... It's a great read.
  - Sniffnoy 9y ago
    Interestingly, in addition to Paras Jha and Josiah White, the justice department's announcment mentions a guilty plea from Dalton Norman, who isn't mentioned in Krebs's article. I wonder what the story there is?
pacaro 9y ago
English grammar and orthography are weird and funky, but given that the title is summarized anyway, can we change “has plead” to “has pleaded” or “pleads”
- meri_dian 9y ago
  Sure, that sounds better
nick_g 9y ago
An unfortunate reason to see a former university classmate of mine in the news. It always feels strange to see this story come up every so often. I was never a friend of Jha's, nor was I every really close to him, but I remember him exactly as his attorney described him: "Paras Jha is a brilliant young man whose intellect and technical skills far exceeded his emotional maturity." Jha was not the only former classmate of mine whom I felt lacked emotional maturity, and it is harrowing to imagine how a command of technology can give anyone the power to do something like this if he chose. Jha intentionally used his skills to inconvenience those around him and he was able to do a great deal of harm to the world at large. While technology makes us better suited to solve problems and help those less fortunate, it also amplifies an individual's ability to do harm. Intentional malice aside, all of us have the ability to greatly effect the world around us. It is imperative that we consider the impact of our actions. While I was a student at Rutgers, there was no mandatory ethics class for computer science, nor do I remember a class on ethics for computer scientists being offered.
- pm90 9y ago
  I don't buy your insinuation that he was just a brilliant mind who was immature enough to inconvenience others. I'm reading through https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/ https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-m... and Jha's actions sound like a real criminal. Yes criminal: he was using his technical prowess to bring down minecraft servers and steal customers, effectively running an online protection racket. I know this sounds harsh but: I'm glad he has been charged with this law and I really really want this guy to be behind bars and think for a long time about what he did. Hopefully it will seriously discourage others from doing the same stuff he did. On a slightly related note: I can't help but think how this dude could have had a highly successful career in computer security. But he chose to be a criminal. Why?
  - nick_g 9y ago
    It wasn't my intention to detract from the fact that his actions were criminal
  - ganoushoreilly 9y ago
dmix 9y ago
It said he got fined $250k for damages his hack caused...Ive always been curious how these fines work. Will he be paying that back after he’s out of jail and employed? Does he have a monthly payment depending on his income? Or can the equivalent be worked out in some type of community service or more jail time? I ask because the guy is only 21 and now a felon...
- slededit 9y ago
  They can garnish his wages after a small livable wage is achieved. Basically it will be almost impossible to ever get out of subsistence living. With his skill he may actually have a chance after a decade or two.
  - dmix 9y ago
    Wow, the implications of that are quite interesting. The effects of his sentencing can technically last for decades after he is out of jail. Funny how you never hear much about that in these trials... But agreed being a convicted hacker won’t prevent him from being employed. Even by the government...
    - daxorid 9y ago
      It's pretty standard fare when it comes to the career ambitions of prosecutors. One of the "better" cases is that of Stephen Watt, who was hit with such insane restitution and fines ($170MM) that he will never escape poverty. For writing code. Not hacking, not exploiting systems or keylogging (someone else did that), not even intending his code to be used for these purposes. Just writing the code. Federal prosecutors and judges are horrible, unfathomably evil people.
      - rayiner 9y ago
        > For writing code. Not hacking, not exploiting systems or keylogging (someone else did that), not even intending his code to be used for these purposes. Just writing the code. That's quite a misrepresentation of the situation: https://www.wired.com/2009/12/stephen-watt https://www.wired.com/2009/12/stephen-watt. > Stephen Watt, a 25-year-old former Morgan Stanley software engineer, pleaded guilty last December to creating a custom sniffing program dubbed “blabla” that Gonzalez and other hackers used to siphon millions of credit and debit card numbers from TJX's network. The breach cost TJX $200 million, according to its 2009 SEC filing. > Prosecutors never alleged that Watt received money for the software he wrote, or directly profited from the hacks. But they brandished more than 300 pages of chats the two friends exchanged that belied Watt's stated ignorance. > As Gonzalez and his accomplices hacked target after target, he sent Watt links to news stories describing a tidal wave of debit fraud spreading around the world. It's like saying "oh, I just made a timer circuit for my friend who I knew was blowing up buildings." Note: the $170 million isn't a "fine." It's restitution. Those are two different things. A fine is used to punish bad conduct. Restitution is used to make a victim whole. Conduct that isn't that "bad" can nonetheless result in huge restitution if it resulted in large damages to the victim. Don't do stuff that can result in huge damages if you don't want to be on the hook for them.
alexschnapp 9y ago
I personally know Paras. Brilliant guy, really fun to hang out with, and learned a lot of technical knowledge from him. He was my go-to guy (like a lot of other people in the class) to help me fix the programming problems that I can't fix quickly. I think he hacked the school for the lolz.I dont think he even thought it would be this serious when he did it, with feds and possibly jail time. He probably just wanted to see what he could do. Even finding out about his involvement in Mirai today, it still doesnt change what I think about his character, or his ethics. Knowing this now, I think he'll become very successful very soon.
- tedivm 9y ago
  That's horribly disappointing. The man hacked thousands of devices and used them to launch DDoSes. He attacked competing minecraft services to steal customers and generate a profit. His botnet was also used to attack Brian Krebs (security researcher) and Dyn. This isn't up for despute- although Paras originally denied involvement in the botnet this plea agreement and his confession prove that he is both a liar and a criminal. He may end up being a successful person in the long wrong, but that doesn't make him an ethical person.
  - alexschnapp 9y ago
    Yeah he hacked minecraft services to generate a profit when he was 19 or 20, I wish I could do that when I was 19. I dont think I would have known better at the time either. He's as responsible of taking down Dyn as Mikhail Kalashnikov is responsible for all the people killed by the ak-47. He simply open sourced a tool for other people to use however they like. He took the plea to reduce the sentence and the legal expense.
    - russelldc 9y ago
      When you were 19/20, you didn't realize creating a botnet to take down competing businesses would be illegal?
      - 9y ago

93 points by meri_dian 9y ago

deleted 9y ago

[deleted]

Last few lines state how assistance was provided by various regional and international agencies, and then goes on to list google, coinbase, cloudflare, etc. Interesting.

gtirloni 9y ago
Isn't that normal, desired and expected?
paxy 9y ago
Coinbase is the surprising one to me, since it is the only one on the list that operates at the application rather than network level. And there's no mention of bitcoin theft anywhere in the report, just DDOS.
- meri_dian 9y ago
  He probably held his Bitcoin on coinbase.
- sophacles 9y ago
  Bitcoin payments in DDOS for hire, or extortion (as in we'll stop if you pay us). If they cashed out via coinbase, the authorities can find out who profited via the paper trail created.

pm90 9y ago

Looks like HN effectively DDOS'd justice.gov

drefanzor 9y ago

They should have thanked Brian Krebs, though. To be honest. Didn't he call out Jha long before anyone else knew?

ryanlol 9y ago
Krebs almost never knows anything before "anyone else". Before the public or other journos, sure.
- tptacek 9y ago
  Obviously "anyone else" is hyperbolic, but whatever shade you want to throw at Krebs, he is serious about the job of investigative journalism for information security in a way literally nobody else in the industry seems to be.
  - ryanlol 9y ago
    Why do you think I'm trying to throw shade at Krebs? His journalism is excellent. I just know that the FBI isn't so incompetent that they didn't already know who these guys were before Krebs wrote his article, enough people surrounding Mirai were already very familiar to them.
    - tptacek 9y ago
      Sorry, it's a message board, tone is sometimes hard to tell! I apologize for jumping to the wrong conclusion.
meri_dian 9y ago
He did, in this article published in January 2017: https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/ https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-m... It's a great read.
- Sniffnoy 9y ago
  Interestingly, in addition to Paras Jha and Josiah White, the justice department's announcment mentions a guilty plea from Dalton Norman, who isn't mentioned in Krebs's article. I wonder what the story there is?

pacaro 9y ago

English grammar and orthography are weird and funky, but given that the title is summarized anyway, can we change “has plead” to “has pleaded” or “pleads”

meri_dian 9y ago
Sure, that sounds better

nick_g 9y ago

An unfortunate reason to see a former university classmate of mine in the news. It always feels strange to see this story come up every so often. I was never a friend of Jha's, nor was I every really close to him, but I remember him exactly as his attorney described him: "Paras Jha is a brilliant young man whose intellect and technical skills far exceeded his emotional maturity." Jha was not the only former classmate of mine whom I felt lacked emotional maturity, and it is harrowing to imagine how a command of technology can give anyone the power to do something like this if he chose. Jha intentionally used his skills to inconvenience those around him and he was able to do a great deal of harm to the world at large. While technology makes us better suited to solve problems and help those less fortunate, it also amplifies an individual's ability to do harm. Intentional malice aside, all of us have the ability to greatly effect the world around us. It is imperative that we consider the impact of our actions. While I was a student at Rutgers, there was no mandatory ethics class for computer science, nor do I remember a class on ethics for computer scientists being offered.

pm90 9y ago
I don't buy your insinuation that he was just a brilliant mind who was immature enough to inconvenience others. I'm reading through https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/ https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-m... and Jha's actions sound like a real criminal. Yes criminal: he was using his technical prowess to bring down minecraft servers and steal customers, effectively running an online protection racket. I know this sounds harsh but: I'm glad he has been charged with this law and I really really want this guy to be behind bars and think for a long time about what he did. Hopefully it will seriously discourage others from doing the same stuff he did. On a slightly related note: I can't help but think how this dude could have had a highly successful career in computer security. But he chose to be a criminal. Why?
- nick_g 9y ago
  It wasn't my intention to detract from the fact that his actions were criminal
- ganoushoreilly 9y ago

dmix 9y ago

It said he got fined $250k for damages his hack caused...Ive always been curious how these fines work. Will he be paying that back after he’s out of jail and employed? Does he have a monthly payment depending on his income? Or can the equivalent be worked out in some type of community service or more jail time? I ask because the guy is only 21 and now a felon...

slededit 9y ago
They can garnish his wages after a small livable wage is achieved. Basically it will be almost impossible to ever get out of subsistence living. With his skill he may actually have a chance after a decade or two.
- dmix 9y ago
  Wow, the implications of that are quite interesting. The effects of his sentencing can technically last for decades after he is out of jail. Funny how you never hear much about that in these trials... But agreed being a convicted hacker won’t prevent him from being employed. Even by the government...
  - daxorid 9y ago
    It's pretty standard fare when it comes to the career ambitions of prosecutors. One of the "better" cases is that of Stephen Watt, who was hit with such insane restitution and fines ($170MM) that he will never escape poverty. For writing code. Not hacking, not exploiting systems or keylogging (someone else did that), not even intending his code to be used for these purposes. Just writing the code. Federal prosecutors and judges are horrible, unfathomably evil people.
    - rayiner 9y ago
      > For writing code. Not hacking, not exploiting systems or keylogging (someone else did that), not even intending his code to be used for these purposes. Just writing the code. That's quite a misrepresentation of the situation: https://www.wired.com/2009/12/stephen-watt https://www.wired.com/2009/12/stephen-watt. > Stephen Watt, a 25-year-old former Morgan Stanley software engineer, pleaded guilty last December to creating a custom sniffing program dubbed “blabla” that Gonzalez and other hackers used to siphon millions of credit and debit card numbers from TJX's network. The breach cost TJX $200 million, according to its 2009 SEC filing. > Prosecutors never alleged that Watt received money for the software he wrote, or directly profited from the hacks. But they brandished more than 300 pages of chats the two friends exchanged that belied Watt's stated ignorance. > As Gonzalez and his accomplices hacked target after target, he sent Watt links to news stories describing a tidal wave of debit fraud spreading around the world. It's like saying "oh, I just made a timer circuit for my friend who I knew was blowing up buildings." Note: the $170 million isn't a "fine." It's restitution. Those are two different things. A fine is used to punish bad conduct. Restitution is used to make a victim whole. Conduct that isn't that "bad" can nonetheless result in huge restitution if it resulted in large damages to the victim. Don't do stuff that can result in huge damages if you don't want to be on the hook for them.

alexschnapp 9y ago

I personally know Paras. Brilliant guy, really fun to hang out with, and learned a lot of technical knowledge from him. He was my go-to guy (like a lot of other people in the class) to help me fix the programming problems that I can't fix quickly. I think he hacked the school for the lolz.I dont think he even thought it would be this serious when he did it, with feds and possibly jail time. He probably just wanted to see what he could do. Even finding out about his involvement in Mirai today, it still doesnt change what I think about his character, or his ethics. Knowing this now, I think he'll become very successful very soon.

tedivm 9y ago
That's horribly disappointing. The man hacked thousands of devices and used them to launch DDoSes. He attacked competing minecraft services to steal customers and generate a profit. His botnet was also used to attack Brian Krebs (security researcher) and Dyn. This isn't up for despute- although Paras originally denied involvement in the botnet this plea agreement and his confession prove that he is both a liar and a criminal. He may end up being a successful person in the long wrong, but that doesn't make him an ethical person.
- alexschnapp 9y ago
  Yeah he hacked minecraft services to generate a profit when he was 19 or 20, I wish I could do that when I was 19. I dont think I would have known better at the time either. He's as responsible of taking down Dyn as Mikhail Kalashnikov is responsible for all the people killed by the ak-47. He simply open sourced a tool for other people to use however they like. He took the plea to reduce the sentence and the legal expense.
  - russelldc 9y ago
    When you were 19/20, you didn't realize creating a botnet to take down competing businesses would be illegal?
    - 9y ago