This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--1457021584-891051517-1191829753=:15225
Content-Type: TEXT/PLAIN; CHARSET=UTF-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-ID:  

http://www.theregister.co.uk/2007/10/04/bot_herder_profile/ 

By Dan Goodin in San Francisco
4th October 2007

Late in the evening of February 13, Paul and Robin Laudanski were 
planning the following day's Valentine's celebration when they received 
word that CastleCops, the volunteer security website they run, was under 
assault.

At its peak, the five-day attack flooded CastleCops with close to 1 
gigabyte of data every second. The distributed-denial-of-service deluge 
was so severe that the husband-and-wife team were forced to take their 
site offline 15 minutes after it started. It also knocked CastleCops' 
webhost offline for two days, causing more than $160,000 worth of damage 
to the company and its customers.

"We were planning on having a family Valentine's event," said Paul 
Laudanski, who along with Robin was forced to spend the next several 
days migrating to a new hosting provider. "Then, of course, the DDoS 
started, which ruined those plans."

The attack, according to federal prosecutors, was the handiwork of Greg 
C. King, a 21-year-old California resident who at one point maintained a 
7,000-node botnet. On Monday, he was publicly charged with four counts 
of illegal hacking, charges that carry a maximum penalty of 40 years in 
prison and a $1m fine.

King has pleaded not guilty, and he reiterated his claims of innocence 
in a telephone interview with The Register. He said he was released on 
$25,000 bond and is under orders not to use computers outside of his 
job, which he declined to identify.

The indictment comes three weeks after a yearly report from Arbor 
Networks found for the first time that internet service providers rated 
botnets as the top operational threat to their infrastructure.


Revenge of the King

While more and more of today's cyber criminals are driven by financial 
gain, King's four-year DDoS spree was motivated by revenge for perceived 
slights, according to court documents and interviews. King's need to 
lash out ran so deep that his crippling attacks continued even after 
federal authorities raided his parents' Fairfield, California home in 
2004, prosecutors allege. Even a conviction for attempted armed robbery, 
for which King served seven months jail time earlier this year, didn't 
weaken his resolve.

King "just continued on and on and on and on," said Tami Quiring, owner 
of KillaNet Technologies, a British Columbia-based website for high 
school students preparing for careers in online media. "He would make 
appearances on IRC and just taunt the kids and threaten them and post 
links to some really disgusting porn sites."

Quiring says one of her first brushes with King dated back to 2003, 
before the suspect had even turned 18. A chat server she maintained was 
subjected to a smurf attack, a particularly powerful type of DDoS that 
bounces spoofed ping requests off thousands of vulnerable routers and, 
in the process, significantly amplifies the amount of traffic directed 
at a victim. As a result, she said, she was forced to pull the plug on 
her site.

Over the years, Quiring says, she tried all kinds of evasive maneuvers. 
She repeatedly changed servers. She blacklisted his IP address. She and 
her employees engaged him in chat dialogs. None of it had any effect. 
She said the attacks continued through last year, when a site she set up 
to host a large video game tournament was taken offline, preventing 
Nvidia, ATI and other partners from accessing the site at a crucial 
moment.

"We withstood attacks that took Yahoo! down," Quiring said. "For a long 
time, our servers were locked up like Fort Knox."


The SilenZ Treatment

A key element in the vengeance allegedly meted out by King was 
acknowledgment from his victims that they were being punished. And as a 
result, he took few steps to cover his tracks. He frequently taunted his 
victims in chat rooms before and during his attacks, and on several of 
those occasions, he dropped hints about his real-life identity, 
according to court documents.

He went by the same handful of online monikers, including SilenZ, 
SilenZ420 and Gregk707, and he also used the same several email 
addresses - including gregk707@yahoo.com and silenz420@gmail.com - to 
establish accounts on the systems he attacked. He frequently used his 
parents' SBC DSL line to log in to the accounts and read email. He was 
partial to using the passwords "1fuckhead" and "1fuckhead1" on many of 
those accounts.

"My good friend's ISP shut him over this fucking post," a user by the 
name of SilenZ wrote in a CastleCops forum shortly before the February 
13 attack began. "I have the right to be angry. If you edit my post once 
more, you will be sorry."

SilenZ was banned from the boards at 10:40 that night. About four 
minutes later, the DDoS started.


Alias: The Belgian Bean Farmer

According to CastleCops logs, the SilenZ account was activated by 
someone who used the email address silenz420@gmail.com and the MD5 value 
for his password matched the encryption string for "1fuckhead." 
CastleCops located the command and control for the offending botnet to 
an IP address that resolved to the domain name beanfarmer.be, a site 
that is registered to a Greg King, according to DNS records.

Previous IP addresses for the domain resolved to SBC IP addresses 
beginning with "71.132," the same initial digits for addresses 
frequently assigned to King when he was using his parents' DSL service.

Beginning in August of 2004, according to court documents, someone using 
the name Greg began a series of chats via IRC with people responsible 
for running Myg0t, which bills itself as an online gaming authority. 
Greg said he was responsible for prior attacks on the Myg0t website and 
then announced he would initiate new attacks on Myg0t's IRC board as 
well.

Eventually, Greg said he would suspend the DDoS assault if officials 
posted an apology for "Myg0t being the asses we are." Greg listed his 
email address as gregk707@yahoo.com. 


Big Mac, Filet-O-Fish, Quarter Pounder, Botnet

After authorities seized King's computers in December 2004, he began 
using computers at the Solano County Library and a Best Buy store. 
According to evidence Quiring provided authorities, six of the attacks 
on KillaNet were carried out by someone accessing the library computers.

Someone using the alias SilenZ who chatted via MSN messenger with a 
KillaNet administrator later admitted to using McDonald's for an 
internet connection, then began discussing the FBI raid on his parents' 
house.

"I denied dong the attacks but told them where my botnets were," 
according to a log of the session. "I dont see what they expect, not 
like i robbed their house, i just took their server offline for a few 
hrs."

The web is also rife with posts, some of them abusive, from an 
individual who goes by the handle gregk707. This thread from the 
Fairfield High School AP Calculus Homepage, for example, contains a 
comment that repeats itself 13 times.

"My ip does happen to be logged, And u wont do shit," the May, 2005 post 
reads. "Can u ban me from posting? NOPE and do u know why? BECAUSE IT IS 
DYNAMIC, anytime i get off the internet it changes. SO ALL I HAVE TO SAY 
IS FUCK YOU HAVE A NICE DAY."


Herd Mentality

King acknowledged to The Reg that several years ago he maintained a 
botnet, which he says he stole after discovering the command and control 
center used by a bot herder. While the zombie network originally 
contained about 30,000 nodes, he only managed to take control of 
somewhere between 7,000 and 12,000 of them, he said. He surrendered the 
botnet when authorities searched his parents house in 2004, he said.

He confirmed that the email address gregk707@yahoo.com is his and also 
admitted to using the computers at the Solano County Library and Best 
Buy. But he declined to say exactly what he did with them, under advice 
from his attorney. He also declined to say if he's ever carried out a 
DDoS attack or discuss specific allegations contained in court 
documents.

"A lot of this was so long ago, I don't even remember it," he said.

Indeed, many of the alleged attacks occurred more than three years ago. 
But with signs that botnet herding and other types of cybercrime are 
only getting worse - the FBI, for example, recently logged its millionth 
bot-infected IP address - federal law enforcers want to send a message 
that online miscreants will be sought out and prosecuted.

"What bot herders or potential bot herders need to worry about is that 
even years after they do a DDoS attack they may wind up under arrest, 
long after they thought it was all over," said Matthew Segal, the 
assistant US attorney who is prosecuting King. "We do this to deter this 
kind of conduct and also because we believe in retributive justice." =C2=AE

If you have tips, story ideas or inside scuttlebutt about this or any 
other security-related story, please send them to Dan Goodin using this 
link [1].

[1] http://forms.theregister.co.uk/mail_author/?story_url=/2007/10/04/bot_herder_profile/ 


--1457021584-891051517-1191829753=:15225
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

__________________________________________________________________      
CSI 2007 is the only conference that delivers a business-focused
overview of enterprise security. It will convene 1,500+ delegates,
80 exhibitors and features 100+ sessions/seminars providing a
roadmap for integrating policies and procedures with new tools
and techniques.  Register now for savings on conference fees   
and/or free exhibits admission. - www.csiannual.com 

--1457021584-891051517-1191829753=:15225--