Texas Man Pleads Guilty To Building Botnet-For-Hire 95
Julie188 writes "A Mesquite, Texas, man is set to plead guilty to training his 22,000-PC botnet on a local ISP — just to show off its firepower to a potential customer. David Anthony Edwards will plead guilty to charges that he and another man, Thomas James Frederick Smith, built a custom botnet, called Nettick, which they then tried to sell to cybercriminals at the rate of US$0.15 per infected computer, according to court documents."
Counts (Score:4, Funny)
I hope they get charged with 1 count per infected PC - and screw concurrent sentencing.
Re: (Score:3, Interesting)
Re: (Score:2)
Why not Goldman-Sachs? If that can get the fuckers thrown in jail, I'm all for it!
Re: (Score:2)
Because being Goldman-Sachs guarantees a slap on the wrist? They have a nearly endless supply of lesser management pawns to absorb all blame and they make significantly more money being crooked than any fine might cost them.
It's like fining a a company 20 000 for dumping toxic waste that would have cost them 100 000 to get rid of legally.
Re:Counts (Score:4, Interesting)
They have a nearly endless supply of lesser management pawns to absorb all blame
Ooooh, that brings to mind a phrase which, if it hasn't been coined, should be.
"Ablative managment": The layers and layers of expendable mid-level cannon fodder with enough responsibility to absorb blame, enough purported independence to support plausible deniability for their superiors, and enough commodity interchangeable to be easily and cheaply ejected and replaced. Used to shield the precious core of Board Members, CxOs, Senior VPs from PR or legal flamage.
Re: (Score:1)
Re: (Score:2)
Yeah, this is interesting. I really haven't heard of it happening to many times but going after the clients at least those in the US is a great idea.
Re: (Score:2, Interesting)
"Both men face a maximum of five years in prison and a $250,000 fine on one count of conspiring to cause damage to a protected computer and to commit fraud."
To bad there weren't some PC's compromised in Maricopa County Arizona. If so they should be sent over to that Sheriff Joe Arpaio and be on the chain gang for the whole 5 years. Yes I know it's voluntary (last I heard), but have a special one for some offenders. Or better yet have other states grow a backbone and have chain gangs set up in northern co
Re:Counts (Score:5, Insightful)
So the one count they're charged with is for invading a corporate computer. And the thousands of individual citizens' PCs they compromised are ignored. Somehow, I'm not surprised.
Re: (Score:3, Interesting)
It's actually a little ironic. I used to know some botnet herders (around 10-11 years ago) who didn't use their bots for malicious purposes at all, or very seldomly at least. They would actively scan PCs and patch holes - sometimes by downloading Windows updates - and remove competing botnets and viruses. A lot of it tended to be automated, but some of it was genuinely manual labor.
It wasn't their main attraction of course, but the net gain was (sometimes) an overall benefit. A few of the better trojans (Ag
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:3, Insightful)
So the one count they're charged with is for invading a corporate computer. And the thousands of individual citizens' PCs they compromised are ignored. Somehow, I'm not surprised.
I don't think it's as clear cut as that. It's much easier to get evidence of 5,000 infections from a handful of sysadmins saying "We spent X hours cleaning up Y PCs as a result of this particular piece of malware" than it is to get 5,000 individuals to.
Re: (Score:2)
So the one count they're charged with is for invading a corporate computer . And the thousands of individual citizens' PCs they compromised are ignored. Somehow, I'm not surprised.
Which one is easier to gather evidence from?
Re:Counts (Score:5, Informative)
It's not exactly rocket science for either of them. For the target, you need to look at logs. For the zombies, you need to look for the bot software. Hell, if they've cracked the control software for the bot network (which it sounds like they have), it's a hell of a lot easier to gather evidence for the zombies.
Re: (Score:2)
So the one count they're charged with is for invading a corporate computer. And the thousands of individual citizens' PCs they compromised are ignored. Somehow, I'm not surprised.
Umm. Because the home PC's could be anywhere on Earth and they don't have resources to them track down, contact the owners, get them to file complaints and pursue 22,000 individual minor hacking claims?
Re: (Score:1)
I'm all for the chaingangs patching the roads. It takes 3 state/county supervisors to watch 5 state/ road crew workers screw off here. Nothing ever gets done. Private contractors work the city so only traffic watch them screw off. If we gotta feed and house these prisoners and it costs more in taxes all the time, then we need some work out of them.
Re: (Score:1)
Good idea! Unions have raised the costs of goods and services for everyone more than any Democratic tax hike I can recall. Convict powered road repair could under bid them all. A fleet of shovels can cost less than 1 road grader to 0perate. It's a green solution too.
Re:Counts (Score:4, Interesting)
Or better yet have other states grow a backbone and have chain gangs set up in northern cold states in the US patching pot holes!!
Fairfax chain gangs fill gaps for cash-strapped DOT
By Derek Kravitz
Washington Post Staff Writer
Monday, April 26, 2010
The vest-wearing, lawn-mower-pushing members of Fairfax County's modern chain gang don't look like jail inmates. Well-disciplined landscapers, yes. Orderly weed-whackers, perhaps. But not convicts. There are no chains, no handcuffs, no black-and-white striped jumpsuits. Just a handful of suntanned men wearing uniforms.
But take a closer look, and you'll see the tell-tale signs that these aren't your normal grass cutters -- the faded gang tattoos, the jail-issued plastic ID bracelets, the armed sheriff's deputy patrolling nearby. Still, confusion is inevitable. "We get a lot of people asking us for business cards, and we have to point to our sheriff's office logo and say, 'Sorry,' " said Sheriff's Deputy Michael Pence, as he watched a handful of inmates mow grass on a recent Friday near a county office building in McLean.
Re:Counts (Score:5, Interesting)
22000 machines, if each one got the mission done. There will be 22000 infected machines. If the guy is sentenced
for 1 day each. He will be away for over 60 years.
Re: (Score:1)
Re: (Score:2)
It apparently was a proof of concept only; limited (for whatever reason) to a single ISP. No reason why he shouldn't be able to scale up the operation to millions of infected computers.
Re:Counts (Score:4, Informative)
You misunderstood. He used the botnet to attack one ISP, the PCs could be anywhere.
Re: (Score:1)
OK, give me a break, I spotted the typo after I had hit the "submit" button...
Re: (Score:3, Insightful)
"screw concurrent sentencing."
Concurrent sentencing is actually "sentence nullification" and should be banned.
Re: (Score:3, Informative)
Concurrent sentencing prevents sending you to jail for 300 years for parking tickets.
Re: (Score:2)
I disagree, the number of individual crimes that proof can be found for IMO has little bearing on the appropriate sentance. Does it really matter whether the cops happen to find ten of a burglers burgulries or just a couple?
Plus there is the issue of where someone commits one act but that act happens to fit the definition of multiple crimes.
Plus it saves the system a lot of resources because the criminal is unlikely to appeal and will often ask for further crimes the police didn't know about to be taken in
Re: (Score:2)
It's hilarious to see how incompetent some of them are on the black hat forums.
"How to install? The instructions don't say." (standard-issue PHP web app that even has a handy "install wizard")
"OK I installed the botnet controller, now how do I infect PCs?"
"how do i use this to make many?"
$3300.00 (Score:5, Funny)
At just .15 per bot, this confirms that the economic downturn has affected the bot trade as well.
No stimulus package in sight. I'm holding on to my bots till the rebound.
Re: (Score:3, Funny)
At just .15 per bot, this confirms that the economic downturn has affected the bot trade as well.
No stimulus package in sight. I'm holding on to my bots till the rebound.
My botsfrommumbi(trademark pending) are .0275 per bot. So don't hold your breath.
Re:$3300.00 (Score:4, Interesting)
A $3000 transaction; for that he ran the risk of a $250,000 fine. Not worth it, find an honest way to make that money.
Re:$3300.00 (Score:4, Informative)
It's fairly easy.
You need:
1. A controlling server. Preferably located in some country ending in -stan or some other country where law enforcement laughs at interpol when they ask for aid.
2. An infector and sheepifyer trojan. Trivial to code.
3. A few million sheep. For pointers, see facebook&twitter.
Additionally it is wise to create your trojan in such a way that you (and only you) can update it and redirect it to some other control server should yours get shut down for some odd reason. Make sure that you create a good enough challenge/response or be prepared for someone else to harvest your infections.
Re: (Score:1)
2.1 Something with flashing words, kittens or cows, and a link to 'send to my friends now!!!' spreads itself easy easy.
Hey let's write our own botnet, buddy :)
Re: (Score:3, Insightful)
Re: (Score:2)
Already happening. It's still possible to track down the originating controller.
Shutting such a botnet down is somewhere between trivial and impossible. It all depends on whether you can break their key before they change it. Since the network accepts control commands from anywhere, you "only" need to crack open its key.
Re: (Score:1)
Re: (Score:2)
Consider an architecture where bots act on any command they receive with an appropriate signature (assume decent quality public/private key crypto such that a crypto crack is not an option) and retransmit any command they see to all their peers.
How would you go about finding the original injection point of a command packet bearing in mind that most of the links won't be logging packet contents?
Re: (Score:2)
All I can say is that it is possible, given time and the necessary infrastructure.
Re: (Score:1)
Re: (Score:2)
Have all the commands cryptographically signed; it doesn't matter where a message is coming from as long as it has the right signature.
And have the cryptographically signed commands posted on Slashdot as AC postings. Have the bots scan the most recent Slashdot stories at -1 for their commands.
Re: (Score:2)
MOD ME UP OR I PWN J00!
*(SJKHCI&^HSKJNSIU&S(QJSJSQ)NSQJBN
Re: (Score:1)
Re: (Score:2)
And to make it even easier, I recall articles on /. that there are ready-to-use "diy" trojan kits on the market to make it even easier.
Re: (Score:3, Insightful)
I don't really recommend using those kits. Few of them allow you to keep your precious bots all for yourself. ;)
Seriously, what do you expect? You're buying (closed source) software to install backdoors in someone else's computer from a ... well, let's say not too reputable company. Do you really expect them to let you keep the bots? Be honest!
Re: (Score:2)
You sound like a man that knows how to do this from experience. Wooo......
Re: (Score:2)
From the other side of the game, yes. But I guess I'm not giving away any secrets by telling that. I also don't know why it's Informative. It's pretty common knowledge when you have at least a passing interest in botnet. Besides, the setup outlined above is soooo '07...
Re: (Score:2)
I don't know why it would be informative either maybe interesting would be better but then again Facebook and Twitter are so 2010.
I also think Facebook is going to be the #1 exploit of 2010. Do you know any good jokes about Facebook?
Re: (Score:3, Insightful)
He could probably have sold it a hundred times to a hundred different buyers.
$0.15 Per? (Score:4, Insightful)
That's, like, US $3300 for the lot. He's not going to get much hookers and blow outta that.
If he did any programming at all to develop the exploit, then his wages are in the basement. (Probably right next to his 'office'.) Once you factor in the time it would have taken to propagate, test and market the botnet, this guy stood to earning the merest pittance.
Then again, he was stupid enough to turn the thing on his own ISP, so we shouldn't marvel too much over his lack of business acumen.
Re:$0.15 Per? (Score:5, Interesting)
What's to stop him from leasing use of the botnet to multiple cyber-criminals now that he's built it up? I mean, the initial sale is just a little bit, but suppose the market for the botnet is more than just one organization, or suppose he charges by the day?
I'm not really a professional botnet organizer, so I have no idea how plausible this is.
Re: (Score:3, Interesting)
Maybe the $0.15 was a loss leader to help build up a reputation in his desired market segment, then you can up prices once you have a reputation for a solid reliable product.
Re: (Score:2)
Re: (Score:1)
In Odessa Texas you own botnet!
Re: (Score:2, Funny)
Attack the Rebels' computers, Admiral Biet.
Ah they broke rule #1 of cybercrime (Score:3, Insightful)
Re: (Score:2)
Seems to be working pretty well for some [slashdot.org].
Re: (Score:1)
The US is where the bots are located, not (necessarily) the guy running them.
Botnet vs Hack (Score:3, Interesting)
Re: (Score:2)
Forgive me if I am less than impressed, 30 minutes with a compiler and a few lines of code. Not like they pulled of some amazing feat, what is impressive is that they got caught.
Re: (Score:2, Informative)
$0.15 == 15 cents.
You need to carry the one...
Verizon reference (Score:3, Funny)
http://www.youtube.com/watch?v=D2isSJKntbg [youtube.com]
According to Verizon rep, 0.002 dollar = 0.002 cent. So your parent is right.
Re: (Score:1)
Yeah, I have a question... (Score:5, Funny)
Have you grown up yet?
Obligatory free software rant (Score:2)
Another clear example of why crime is WRONG (Score:2)
The attempted sales price (U$0.15/machine, would presumably be negotiated down 0.10-0.12) is ~100x less than users would pay to not be infected, and about 1000x less than it will take to remove the malware. Any person who buys and uses the botnet will generate similar economics.
This is an obvious clear loss to humanity -- the crooks gain _very_ much less than the damage they cause. A negative sum game.
The same might be said of Goldman-Sachs: even without the front-running and counter-dealing, they mispri
Fire up the barbie! (Score:2)
That should be the punishment -- fry, fry, fry. I know what the smoker should be.
That has to be a record of some sort (Score:2)
I mean, like 3 first names.
Oh,wait...
Re: (Score:2)
Man, using their full names like that? It's as if their crimes were equivalent to presidential assassination or serial killing.