Three hackers have pleaded guilty for creating the infamous Mirai botnet, an army of infected computers that has been assaulting internet services across the world.
Last week, Paras Jha and Dalton Norman, both 21, as well as 20-year-old Josiah White signed plea agreements with a US district court in Alaska. On Tuesday, the documents were unsealed.
The three hackers jointly developed the source code behind Mirai, and expanded its capabilities to infect IoT devices including home internet routers, according to US investigators. "Over 300,000 devices ultimately became part of the Mirai botnet," court documents said.
Of the three, Jha appears to be the lead mastermind; he developed the computer code behind the Mirai malware starting in July 2016. In August, he and his co-conspirators then began spreading the malware to create a botnet, or an army of enslaved computers.
The goal was to use the botnet to launch massive distributed denial-of-service (DDoS) attacks to shut down the targeted websites. Jha and his co-conspirators sought to launch these attacks against business competitors. They also rented the botnet to other hackers in exchange for payment.
Although DDoS attacks are nothing new, the Mirai botnet demonstrates new levels of firepower that can cripple web services. Jha and his co-conspirators also designed the malware to rapidly spread by exploiting previously unknown vulnerabilities in IoT devices.
In September, Jha publicly posted Mirai's source code online, giving hackers across the world access to the malware. A few weeks later, scammers used that source code to launch a major DDoS attack that disrupted internet access across the US.
Jha posted the source code to "create plausible deniability" in the event law enforcement ever found the Mirai source code on his computer, according to US investigators. But his ties to the Mirai botnet were revealed in January 2017 by security reporter Brian Krebs.
Mirai was not Jha's only exploit. He was a student at Rutgers University, and on Wednesday, he also pleaded guilty to hacking the university's network, and taking down a web portal faculty and students used to deliver school assignments.
Jha and his co-conspirators also created a second botnet designed to engage in clickfraud. The infected computers visited websites and repeatedly clicked on banner ads to generate revenue at the expense of advertising companies. The scheme was quite profitable, generating 100 bitcoins, or $180,000 back in January.
Jha faces ten to five years in prison for the computer crimes he committed.
Despite the guilty pleas, the Mirai botnet live on. Because the source code is publicly available, other hackers have taken the code, or learned from it, to power their own schemes. US authorities are urging the public to keep their IoT devices secure by installing the latest security patches to prevent malware-related botnets from infecting them.