In recent Information Security news, The Wall Street Journal reported on the upcoming trial of an alleged botnet master. The trial is in progress now.
It is not often that we get a look at the details of a computer security breach, but in this case at least some details are in the docket of the Eastern District of NY. I have downloaded the original complaint of US v. Gasperini here. The accusations include violations of the Computer Fraud and Abuse Act, Wire Fraud, Conspiracy to Commit Wire Fraud, and Conspiracy to Commit Money Laundering. All of these acts were allegedly undertaken in a click-fraud scheme. If you want to understand the details of these accusations, I uploaded the judge’s jury directions here.
The defendant allegedly hacked into QNAP NAS devices using the Shellshock vulnerability and downloaded click-fraud software. This is a network device that many people will not patch regularly. Unfortunately, the court transcripts don’t describe how he got past firewall security.
How did the government find out about this? Apparently from an informant, “CS-1”. The fraud scheme was carried out using a “target” website which ran ads from victim companies. Payments based on clicks were then made to the defendant, according to the government.
The defendant’s prospective expert testimony gives some ideas on how he will challenge the government’s case. Given the complexity of the Internet advertising business and the tracking and verification techniques, is it reasonable that this fraud could be carried out? They are also going to testify as to the details of the scripts used and forensic examination of servers.
It will be interesting to see the outcome of this jury case; maybe next week. In the meantime, patch your servers!
Book an Appointment for Cybersecurity Issues
Request an appointment with Dr. Fred Scholl. We will discuss any cybersecurity issues you have.
