Slashdot Mirror
Mirai IoT Botnet Co-Authors Plead Guilty (krebsonsecurity.com)
Three hackers responsible for creating the massive Mirai botnet that knocked large swathes of the internet offline last year have pleaded guilty. Brian Krebs reports: The U.S. Justice Department on Tuesday unsealed the guilty pleas of two men (Editor's note: three men) first identified in January 2017 by KrebsOnSecurity as the likely co-authors of Mirai, a malware strain that remotely enslaves so-called "Internet of Things" devices such as security cameras, routers, and digital video recorders for use in large scale attacks designed to knock Web sites and entire networks offline (including multiple major attacks against this site). Entering guilty pleas for their roles in developing and using Mirai are 21-year-old Paras Jha from Fanwood, N.J. and Josiah White, 20, from Washington, Pennsylvania. Jha and White were co-founders of Protraf Solutions LLC, a company that specialized in mitigating large-scale DDoS attacks. Like firemen getting paid to put out the fires they started, Jha and White would target organizations with DDoS attacks and then either extort them for money to call off the attacks, or try to sell those companies services they claimed could uniquely help fend off the attacks. Editor's note: The story was updated to note that three men have pleaded guilty. -- not two as described in some reports.
It's an old attack, with a son breaking windows and father repairing them. However, since they did it on Internet, maybe they can patent it and make the rest of the scum pay the licensing fees?
You know, when someone's smart fridge starts popping up messages saying it needs to install Windows 10 platinum version and they need to call the Microsoft support number to help them fix it then maaaaaybe they should have just bought one that makes food cold. Is it really the author's fault completely or is the the fault of consumers buying smart-everything.
This sounds like the car glass repair guy driving around the neighborhood shooting car windows with his BB gun as a way to generate business. Or the tire store that slashes tires.
EXCEPT IT'S ON THE INTERNET!!!! BRILLIANT!!!!
They will have some plea deal and will be actively recruited by hedge funds, high frequency traders and banks. This level of criminal thinking is a highly sought after in those circles. They will properly trained on how to do it under the protection of these firms with big team of lawyers and lobbyists.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I would agree that the CFAA is massively abused, but this is probably one of the few cases where its use was warranted. Sure the manufactures were using woefully lax security, but these guys still (presumably) knowingly entered someone elses property for the purposes of misusing it. If you forgot to lock your door you'd still expect a stranger who made themselves at home (using your computer for ID theft, raiding the fridge, etc) after you left for work to be prosecuted right? Of course in this case the manufacturers should also be held to some kind of account, perhaps via lawsuit from all of the effected websites/data centers and governmental regulation.
Where theire going...
Did you just combine "their" and "there" trying to arrive at "they're"? You didn't get theire.
at my frrelance Learn what mistakes into a sling unless use the sling.
In Soviet Russia, grammar parses you.
What they did would like me making botnets with host/domain name based C&C's to spur use of APK Hosts File Engine 10++ 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ so more people would use it (I never would in the 1st place, I am not out to make "$" from it but rather to live up to Charlie Chaplin's great speech's idea https://www.youtube.com/watch?v=w8HdOHrc3OQ/ which I found VERY inspiring ala the "++" I use that came from there pretty much)...
* That's the PRICE PAID for being greedy - you WILL be caught & busted for it, inevitably (unless you're a BIG NAME politician or extremely wealthy already that is)...
APK
P.S.=> Some people... apk
I'm serious.
1) human lives aren't precious. There are more than 7 billion of us. 7 billion of anything is usually too much. We can spare some, particularly bad ones.
2) let's understand and acknowledge how vital and critical the internet is to today's world. They attacked that infrastructure in a way that is hard to refute.
Let the punishment fit the crime.
-Styopa
What they did would be like me making botnets with host/domain name based C&C's to spur use of APK Hosts File Engine 10++ 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ so folks'd use it (I never would in the 1st place, I am not out to make "$" from it but rather to live up to Charlie Chaplin's great speech's idea https://www.youtube.com/watch?v=w8HdOHrc3OQ/ which I found VERY inspiring ala the "++" I use that came from there pretty much)...
* That's the PRICE PAID for being greedy - you WILL be caught & busted for it, inevitably (unless you're a BIG NAME politician or extremely wealthy already that is)...
APK
P.S.=> Some people... apk
What the fuck did you just type?
I understand CFAA runs rampant and is abused everywhere
These guys deliberately pushed malicious code onto devices that didn't belong to them. Fuck them, they belong in jail. This is one of the few times where the law did exactly what it needs to do.
at what point does the company who deployed to production a shitty product with a shitty default password assume responsibility?
Negligence and poor craftsmanship are not usually crimes. Like it or not, that's how it is. But they can get you sued.
Unsecured devices with no authentication or widely-known default passwords definitely qualify as negligence. There are security principles that address this situation, and they are older than I am.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Correct, and we saw the result above.
Someone convicted of armed robbery is not allowed to own a gun again. These ass hats should be prohibited from EVER having a computer! Maybe making a living with a shovel would be a warning to others. Now sue them for loss of productivity.
And spit on their shoes too!!!11!
Yay for state sponsored anal rape! Yay for coerced false confession! Three cheers for the American Gulag!
Sometimes the bots fuck up.