US Bot Herder Admits Infecting 250K Machines

AceCaseOR writes "In Los Angeles criminal court, security consultant John Schiefer, 26, has admitted infecting the systems of his clients with viruses to form a botnet containing a maximum of 250,000 systems. Schiefer used his zombies to steal users' PayPal usernames and passwords to make unauthorized purchases, as well as to install adware on their computers without their consent. Schiefer agreed to plead guilty to four felony charges of accessing protected computers to commit fraud, disclosing illegally intercepted electronic communications, wire fraud, and bank fraud. He will be sentenced Dec. 3 and faces up to 60 years in prison and a fine of $1.75 million."

A better article, names companies involved, etc.

[trolltalk.com]

http://www.scamfraudalert.com/f142/john-kenneth-schiefer-botmaster-aka-acid-acidstorm-pleads-guilty-10692/ [scamfraudalert.com]

1. He was employed at a Los Angeles-based security firm known as 3G Communications,
2. The malware contained a sniffing feature that siphoned PayPal credentials from Protected Store, a section of Windows that stores passwords users have opted to have saved. Although Pstore, as the Windows feature is often called, encrypts the information before storing it, Schiefer's malware was able to read it, presumably by escalating its Windows privileges.
3. On one occasion, in December 2005, he moved money out of a Suffolk National Bank account to buy undisclosed domain names from a registrar by the name of Dynadot
4. Schiefer also used the botnet to collect more than $19,000 in commissions from a Dutch company called Simpel Internet for installing its adware on end users' machines without their permission.

Re:broken justice?

[Kopiok]

Well, from what I know what happens, the Prosecution gives a sentencing offer and the defendant will agree to plead guilty in order to accept the sentence. Either that or I watched too much Law and Order.

Re:broken justice?

[RenderSeven]

I guess he can always appeal, right?

You cant appeal a guilty plea.

RTFA

[Anonymous Coward]

It says the dude is facing 60 years.. i dont think you can turn 60 years into 30 months in ANY scenario.

Re:Crime and Punishment

[despisethesun]

Extrapolating ludicrously, could a european citizen not subject to capital punishment be indicted by an america where their internet-based crime warrants the death penalty?

It's worth noting that most countries without the death penalty will not extradite you to a country with the death penalty if you're facing that punishment when you get there. They generally require assurances that you will face life without parole if convicted instead.

Re:What about Sony

[Kjella]

If he gets a fine this large and jail time for infecting 0.25 million computers, where's the appropriate sentence for Sony for knowingly infecting millions of computers with the rootkit on their CDs?

Ah, you can just hear the angry raving mob forming, ready to burn down Sony headquarters.

four felony charges of accessing protected computers to commit fraud, disclosing illegally intercepted electronic communications, wire fraud, and bank fraud.

Maybe when Sony has actually committed anything like this? The only charge that has the slightest whiff of relevance is that the rootkit CDs may be be considered fraudulent, but to legally charge Sony with fraud they must gain some benefit through fraud, and I don't see what that could be. Yes, they should have been slapped under some sort of hacking law but this is comparing apples and oranges.

Re:Crime and Punishment

[AceCaseOR]

Murder is already a capital crime in a number of US states. People are already being executed in many countries for crimes other than murder. Drug trafficking, serious sexual offences, could it be a relatively a small step for internet crimes to escalate into capital territory?

I'm going to say this isn't very likely. At least in the US, people are only executed for crimes where they cause direct physical harm to another person (generally murder and occasionally rape). For other offences you generally get a life sentence, or defacto life sentence (say 135 years in the clink).

Security Fix has an exclusive interview

[tsu doh nimh]

from the story:....Schiefer said he and his friends spread the bot programs mainly over AOL Instant Messenger (AIM). By using malicious "spreader" programs such as Niteaim and AIM Exploiter, Schiefer and his co-conspirators spammed out messages inviting recipients to click on a link. Anyone who took the bait had a "Trojan horse" program downloaded to their machine, an invader that then tried to fetch the malicious bot program." Read more at this link here [washingtonpost.com].

Yet another article with an "exclusive interview"

[Anonymous Coward]

This blog, Security Fix, in the washington post has additional info based on an "exclusive interview",
http://blog.washingtonpost.com/securityfix/2007/11/security_pro_admits_to_hijacki.html?nav=rss_blog [washingtonpost.com]

From the article: The poor guy saw the light in early January 2006.

"Ever since then, I've been more trying to create a positive thing and trying to prevent crap like this happening," he said. "I kind of saw the error of my ways and decided I'd had enough."

Re:A better article, names companies involved, etc

[Anonymous Coward]

Holy crap! 3G has the IT security contract over here in Afghanistan (where I am stationed). This is so not good.