No-one responsible for computer security should forget what happened in October 2016.

The Mirai botnet launched an attack on the internet, the scale of which had never been seen before.

By unleashing a massive distributed denial-of-service (DDoS) attack on DNS service company Dyn, Mirai managed to knock out significant chunks of the internet – making it impossible for most users to reach popular sites such as Amazon, Reddit, Netflix, Twitter, Soundcloud, Spotify, Etsy and Github.

All too often we hear about how online criminals are able to hide their tracks online, and escape prosecution. Well, for once we have some good news.

US authorities have unsealed details of a guilty plea by 21-year-old Paras Jha from Fanwood, New Jersey, who has admitted creating the Mirai botnet by commandeering hundreds of thousands of vulnerable IoT devices, without the knowledge or permission of their owners, in order to:

  • launch powerful DDoS attacks
  • rent the botnet to third-parties in exchange for payment
  • use the botnet to extort protection money from companies not wishing to be targeted by an attack.

Jha and his co-conspirators used both known and previously undisclosed vulnerabilities to gain admin rights to victims’ IoT devices, and ended up with an army of close to 500,000 compromised CCTV cameras, DVRs, and routers at their beck and call.

As BBC News reports, Jha has yet to be sentenced, but faces up to 10 years in jail. Two of Jha’s co-conspirators have also pleaded guilty – Josiah White, from Washington, Pennsylvania, and Dalton Norman from Metairie, Louisiana. Both could receive sentences of up to five years in prison.

Security blogger Brian Krebs explains that Jha and White co-founded a company called of Protraf Solutions LLC, a company that initially provided anti-DDoS services to Minecraft servers. In order to drum up business, Jha (Read more...)