Fergie's Tech Blog

Thursday, March 05, 2009

Botnet Hacker Gets Four Years - UPDATE

A Los Angeles man was sentenced late Wednesday in federal court to four years in prison after pleading guilty last year to infecting as many as 250,000 computers and stealing thousands of peoples' identities and hijacking their bank accounts.

The Los Angeles authorities said John Schiefer, 27, was the nation's first defendant to plead guilty to wiretapping charges [.pdf] in connection to using botnets.

Schiefer, who went by the online handle "acidstorm," faced as many as 60 years in prison and acknowledged using a botnet to remotely control computers across the United States. Once in control of the computers, the authorities said [.pdf], his spybot malware allowed him to intercept computer communications. He mined usernames and passwords on accounts such as PayPal and made purchases totaling thousands of dollars without consent.

The authorities said he worked by day as an information security consultant with 3G Communications.

The defendant was among eight individuals indicted or successfully prosecuted in a crack down on black hat hackers who use armies of zombie computers to commit financial fraud, attack web sites with floods of traffic and send spam. The crimes at issue involved more than $20 million in losses, according to the FBI.

More here.

UPDATE: 16:54 PST: Rafe Needleman writes over on C|Net News that Mr. Schiefer is currently working at Mahalo until his incarceration begins. -ferg

Friday, November 09, 2007

Botmaster Cops to Four Felonies - UPDATE

Dan Goodin writes on The Register:

An American computer security consultant has agreed to plead guilty to four felony counts related to a series of schemes that used botnets to steal PayPal and online banking identities of Windows users and install malware on more than 250,000 machines.

John Kenneth Schiefer, 26, of Los Angeles, faces a maximum sentence of 60 years in federal prison and a fine of $1.75m, according to documents filed Friday in federal court. He pleaded guilty to accessing protected computers to conduct fraud, disclosing illegally intercepted electronic communications, wire fraud and bank fraud.

Schiefer, who went by names such as "Acid" and "Acidstorm," has long been a fixture in underground hacking circles. He sometimes adorned his instant message handles with phrases such as "remember the name or feel the pain" and "crime pays, and it also has an excellent benefits package." He was employed at a Los Angeles-based security firm known as 3G Communications, where he sometimes carried out his crimes, according to court documents.

The plea agreement caps an investigation involving the FBI that began in 2005, said Assistant US Attorney Mark Krause. He declined to say if charges would be filed against several conspirators mentioned in court documents, who went by names including "revolt," "Harr0," "butthead," "pr1me" and "dynamic". The case is the first time a crime related to botnets has been charged under US wiretap statutes.