The Justice Department announced today the guilty pleas in three cybercrime cases. In the District of Alaska, defendants pleaded guilty to creating and operating two botnets, which targeted ‘Internet of Things’ (IoT) devices, and in the District of New Jersey, one of the defendants also pleaded guilty to launching a cyber attack on the Rutgers University computer network.
On Dec. 8, Paras Jha, 21, of Fanwood, New Jersey; Josiah White, 20, of Washington, Pennsylvania; and Dalton Norman, 21, of Metairie, Louisiana, pleaded guilty to criminal Informations in the District of Alaska charging them each with conspiracy to violate the Computer Fraud Abuse Act in operating the Mirai Botnet. In the summer and fall of 2016, White, Jha, and Norman created a powerful botnet a collection of computers infected with malicious software and controlled as a group without the knowledge or permission of the computers owners. The Mirai Botnet targeted IoT devices non-traditional computing devices that were connected to the Internet, including wireless cameras, routers, and digital video recorders.
The defendants attempted to discover both known and previously undisclosed vulnerabilities that allowed them to surreptitiously attain control over the victim devices for the purpose of forcing the devices to participate in the Mirai Botnet. At its peak, Mirai consisted of hundreds of thousands of compromised devices. The defendants used the botnet to conduct a number of powerful distributed denial-of-service, or DDOS attacks, which occur when multiple computers, acting in unison, flood the Internet connection of a targeted computer or computers. The defendants involvement with the original Mirai variant ended in the fall of 2016, when Jha posted the source code for Mirai on a criminal forum. Since then, other criminal actors have used Mirai variants in a variety of other attacks. (Source: U.S. Department of Justice)