Attacks/Breaches

9/19/2018
02:30 PM
50%
50%

Mirai Hackers' Sentence Includes No Jail Time

The trio behind Mirai sentenced to probation and public service in return for cooperation with law enforcement and researchers.

Three men charged with creating and managing the Mirai botnet have pleaded guilty to conspiracy to violate the Computer Fraud & Abuse Act and have been sentenced to a five-year period of probation and 2,500 hours of community service. They also have been ordered to pay restitution in the amount of $127,000 and have voluntarily abandoned significant amounts of cryptocurrency seized during the course of the investigation.

Paras Jha, 22, of Fanwood, N.J.; Josiah White, 21, of Washington, Pa.; and Dalton Norman, 22, of Metairie, La., were sentenced after cooperating extensively with the FBI. As part of their sentences, the three must continue to cooperate with the FBI, law enforcement, and researchers on cybercrime and cybersecurity matters. According to court documents, the defendants have provided assistance that substantially contributed to active complex cybercrime investigations and broader defensive efforts by both law enforcement and cybersecurity researchers.

Jha and Norman also pleaded guilty to the same charge in relation to the Clickfraud botnet. The defendants' involvement with Mirai ended in the fall of 2016, when Jha posted the source code for Mirai on a criminal forum. Noting the defendant's relative youth, Jeffery Peterson, special agent in charge of FBI's Anchorage Field Office, said, "This case demonstrates our commitment to hold criminals accountable while encouraging offenders to choose a different path to apply their skills."

Read more here.

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jcavery
100%
0%
jcavery,
User Rank: Moderator
9/20/2018 | 9:08:05 AM
Re: Slap on the Wrist
I agree with you wfish, I am tired of seeing the bad guys thrust into the spotlight only to become heroes and write books about their "dark past" and make even more money later on as "bad guys turned good". What about the people who never had to break the law to know they were good at what they do? We need to be careful with how we are handling these types of people as you said, it only encourages future generations and makes them conifdent that even if they get caught, they can just flip and work the other angle and still get paid. Criminals aren't the only ones who understand how botnets work.
wfishburne
100%
0%
wfishburne,
User Rank: Strategist
9/19/2018 | 4:54:22 PM
Slap on the Wrist
I don't care how much help they gave the government. No "assistance" they give will provide restitution to the victims of their malware. All this does is encoruage more malware authors since they have the "Get Out of Jail Free" card of working for the FBI. These guys will also get high paying security jobs for their attacks on other people's equipment, when hard working white hats have to bust their asses to get them. It's so frustrating. There is no justice for the victims when the criminals face no real punishment. Thanks Justice Department, now everybody loses.
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: So now we are monitoring the monitor?
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20145
PUBLISHED: 2018-12-13
Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specified an acl_file, then the acl file was being ignored.
CVE-2018-12076
PUBLISHED: 2018-12-13
A vulnerability in the UPC bar code of the Avanti Markets MarketCard could allow an unauthenticated, local attacker to access funds within the customer's MarketCard balance, and also could lead to Customer Information Disclosure. The vulnerability is due to lack of proper validation of the UPC bar c...
CVE-2018-18922
PUBLISHED: 2018-12-13
add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.
CVE-2018-18923
PUBLISHED: 2018-12-13
AbiSoft Ticketly 1.0 is affected by multiple SQL Injection vulnerabilities through the parameters name, category_id and description in action/addproject.php; kind_id, priority_id, project_id, status_id and title in action/addticket.php; and kind_id and status_id in reports.php.
CVE-2018-19039
PUBLISHED: 2018-12-13
Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.