Three men who assembled a formidable internet weapon out of hundreds of thousands of hacked home routers avoided lengthy prison terms at sentencing Tuesday, after federal prosecutors credited them with helping mitigate other attacks after they were caught.
Paras Jha, Josiah White, and Dalton Norman will all serve five years of probation for creating and deploying “Mirai,” a groundbreaking piece of malware that in 2016 delivered punishing torrents of junk traffic to several U.S.-based hosting companies. U.S. District Judge Timothy M. Burgess also ordered them to pay $127,000 in restitution and perform 2,500 hours of community service, during a sentencing hearing in Anchorage, Alaska, where the case was investigated and prosecuted.
Mirai was the first large-scale botnet to exploit rampant security holes in the so-called internet of things, an industry term for the growing mass of smart televisions, surveillance cameras, video recorders, refrigerators, thermostats, and other devices attached to the internet. Too many of these devices, security experts warn, are shipping with glaring vulnerabilities such as simple software bugs or default passwords—the kind of security holes that were squeezed out of desktop computers by improved engineering and two decades of bitter experience on a hostile net.
ADVERTISEMENT
The malware was a long-distance collaboration between Jha, now 22, who was then an undergraduate student at Rutgers University in New Jersey, and Norman and White in Metairie, Louisiana, and Washington, Pennsylvania, respectively.
When Jha was 18, he operated a Minecraft server that was hit with a common type of internet vandalism called a distributed denial of service (DDoS) attack, in which compromised computers scattered around the internet are made to simultaneously bombard a target with traffic. DDoS has been common in online gaming for years, and it’s become particularly nettlesome around Minecraft, where black-hat players use low-grade DDoS as a form of cheating or bullying, and professional server operators routinely face larger versions of the attack at the hands of unethical competitors.
Jha was “a very immature 18-year-old college student” at the time, according to a filing by his lawyer, and after his server got hit, he started launching DDoS attacks himself. Later, he began a DDoS mitigation company called Protrafto and staged more attacks against Minecraft servers to drive business his way.
Eventually another Minecraft player challenged him to create a better botnet, and he rose to the challenge. His friend Norman, now 22, focused on finding new vulnerabilities in IoT devices, and White, now 21, wrote the scanner that would scour the internet for vulnerable equipment and infect it. Jha coded the command-and-control channel. “Although the coding was not particularly complex, the results were significant,” wrote his lawyer, Robert Stahl.
The devices would operate like normal until receiving a command from the botmasters, then they would attack in unison. The three men rented slices of Mirai to other people looking to stage attacks, and at one point they directed the botnet to launch a record-breaking deluge at the website of independent journalist Brian Krebs, after he published a report naming Jha as one of Mirai’s creators.
The defendants launched Mirai in the summer of 2016 and dropped the project that October, when the virtual blueprints for the malware appeared on a hacker forum, allowing anyone to easily create their own version. The next month, another hacker group launched a Mirai variant that targeted internet-connected surveillance cameras.
Federal sentencing guidelines recommended a sentence of 18 to 24 months for White and 30 to 37 months for Jha and Norman, who subsequently collaborated on another botnet devoted to click fraud. But in a series of uncommon court filings, prosecutor Adam Alexander asked the court to deduct 85 percent off their sentences to reflect the “exceptional and extensive cooperation” the men provided the government after they were caught. The probation office recommended no jail time at all.
As described by Alexander, the Mirai defendants became valuable assets to the FBI, working with the small cyber squad at the Anchorage field office. The squad has carved out a niche in botnet investigations under supervisory agent William Walton, a 10-year bureau veteran. Most recently, they busted a 20-year-old Washington man named Kenneth Currin Schuchman for allegedly launching the improved version of Mirai known as Satori, which has infected at least 500,000 routers.
The defendants also collaborated with other FBI field offices and outside security researchers, and helped hosting firms and online gaming companies improve their defenses, the government says. Last December, a time when attacks customarily spike, their efforts contributed to ”significantly fewer large or targeted DDoS attacks during the Christmas 2017 holiday period,” the prosecutor wrote.
In addition to saving Christmas, the trio performed coding projects for the FBI—one was a user-friendly program to help agents rifle through seized cryptocurrency wallets. On another occasion they provided “expert assistance to a private researcher” investigating a state-sponsored hacking operation. And they helped the FBI identify and warn victims of the Russian-made Kelihos botnet after the bureau dismantled that network last year.
“The defendants have advanced computer skills and, through years of criminal activity and academic pursuit, developed expertise in botnets and denial of service attacks,” wrote Alexander. “The FBI... worked closely with the defendants to apply those skills in novel ways to benefit the Government.
“All three have significant employment and educational prospects should they choose to take advantage of them rather than continuing to engage in criminal activity.”
