News Stay informed about the latest enterprise technology news and product updates.

Mirai creators and operators plead guilty to federal charges

The Department of Justice announced guilty pleas from the three Mirai creators and operators behind the massive worldwide botnet DDoS attacks in 2016.

The three men accused of creating and operating the Mirai botnet have pleaded guilty to federal charges.

The Department of Justice announced Wednesday it had unsealed the guilty pleas of Paras Jha, age 21, of Fanwood, N.J.; Josiah White, 20, of Washington, Pa.; and Dalton Norman, 21, of Metairie, La., on charges of "conspiracy to violate the Computer Fraud and Abuse Act in operating the Mirai botnet."  

According to the DoJ, the three Mirai creators built the botnet during the summer and fall of 2016 before unleashing the first wave of Mirai attacks, which at its peak was generating DDoS attacks from hundreds of thousands of vulnerable IoT devices.

"The defendants used the botnet to conduct a number of powerful distributed denial-of-service, or 'DDoS' attacks, which occur when multiple computers, acting in unison, flood the internet connection of a targeted computer or computers," the DoJ wrote in a statement. "The defendants' involvement with the original Mirai variant ended in the fall of 2016, when Jha posted the source code for Mirai on a criminal forum. Since then, other criminal actors have used Mirai variants in a variety of other attacks."

Jha and Norman were separately charged with and pleaded guilty to infecting more than 100,000 devices between December 2016 and February 2017 with "malicious software," but did not specifically attribute these attacks to Mirai. The DoJ announcement accused the Mirai creators with making a botnet "used primarily in advertising fraud, including 'click fraud' ... for the purpose of artificially generating revenue," and it is unclear if this botnet was separate from Mirai or not.

"Our world has become increasingly digital, and increasingly complex," U.S. Attorney Bryan D. Schroder said in the DoJ statement. "Cybercriminals are not concerned with borders between states or nations, but should be on notice that they will be held accountable in Alaska when they victimize Alaskans in order to perpetrate criminal schemes. The U.S. Attorney's Office, along with our partners at the FBI and Department of Justice's Computer Crime and Intellectual Property Section, are committed to finding these criminals, interrupting their networks, and holding them accountable."

Jha alone also pleaded guilty to a series of attacks against the Rutgers University network -- where Jha was a student -- between November 2014 and September 2016.

Mirai creator attribution

Early reports following the Mirai botnet attacks, including the Dyn DDoS incident, attempted to attribute the attack to nation-state actors and foreign adversaries. However, in January 2017 Brian Krebs, cybersecurity journalist and investigator, identified Jha and White as likely being the Mirai creators. It is unclear how his investigation played a part in the DoJ charges. Krebs was one of the first known victims of the Mirai DDoS attacks.

Lesley Carhart, security incident response team lead at Motorola Solutions, said on Twitter that this case against the Mirai creators should be a moment to realize "attribution is complex."

Dig Deeper on Information security laws, investigations and ethics

PRO+

Content

Find more PRO+ content and other member only offers, here.

Join the conversation

1 comment

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

How has your organization set up security against botnets and DDoS attacks?
Cancel

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly.com

Close