Texas Man Pleads Guilty To Bot Network For Hire


Another botnet herder bites the dust, the latest news in the malware arena is about David Anthony Edwards from Texas who has admitted he and his accomplice had offered tailor made malware and DDoS attacks for rent.

22,000 zombies is a reasonable number of bots for a herder to control on their own, and assuming they are all on broadband connections, could generate enough network noise to saturate most connections.

A Texas man has agreed to plead guilty to charges he trained a botnet on a popular internet service provider so he could demonstrate custom-made malware to a potential customer.

David Anthony Edwards of Mesquite, Texas admitted that in August 2006 he and alleged accomplice Thomas James Frederick Smith unleashed a flood of data on ThePlanet.com to demonstrate the effectiveness of bot software they called Nettick, according to court documents. The men allegedly told one purchaser they had 22,000 zombie machines under their control and would sell them for 15 cents apiece in minimum batches of 5,000.

Smith, most recently of Parris Island, South Carolina, has pleaded not guilty to the charges. A trial is scheduled to begin May 17.

Even though he has admitted to wrong-doing he has pleaded not guilty to the charges, I guess we’ll have to wait for the trial in May to see what actually happens and if he is sentenced. Seen as though it’s not a trumped up terrorism charge I personally think he’ll get off without a huge sentence.

Perhaps a hefty fine and a couple of years ‘suspended sentence’.

In a plea agreement signed by Edwards, he also said that he and Smith breached servers operated by webhost, T35.net. They then extracted password files and made hundreds of thousands of user IDs and access codes available online, the document, filed in US District Court in Dallas, stated. The pair went on to deface the website, Edwards added.

According to an indictment, they also rebuked T35 admins with the words “How are all the users going to be compensated?”

Edwards, who went by the online handle Z00k, said the costs to T35.net were between $5,000 and $10,000. He is scheduled to enter his plea in court on Thursday. He faces a maximum of five years in prison, a $250,000 fine, and he will be required to pay restitution to the victims. ®

It seems like they got up to some other dodgy business too hacking and defacing a webhost – that’s not really a great way to keep yourself low-profile. They should take some lessons from the Eastern European bot herders who stay completely off the grid.

Anyway it seems like the legal system is starting to catch up with these kind of ‘underground’ business schemes and slowly but surely shutting them down.

Sadly the fact remains, the bad guys are always one step ahead of the good guys.

Source: The Register

Posted in: Legal Issues, Malware

, , , ,


Latest Posts:


zBang - Privileged Account Threat Detection Tool zBang – Privileged Account Threat Detection Tool
zBang is a risk assessment tool for Privileged Account Threat Detection on a scanned network, organizations & red teams can use it to identify attack vectors
Memhunter - Automated Memory Resident Malware Detection Memhunter – Automated Memory Resident Malware Detection
Memhunter is an Automated Memory Resident Malware Detection tool for the hunting of memory resident malware at scale, improving threat hunter analysis process.
Sandcastle - AWS S3 Bucket Enumeration Tool Sandcastle – AWS S3 Bucket Enumeration Tool
Sandcastle is an Amazon AWS S3 Bucket Enumeration Tool, formerly known as bucketCrawler. The script takes a target's name as the stem argument (e.g. shopify).
Astra - API Automated Security Testing For REST Astra – API Automated Security Testing For REST
Astra is a Python-based tool for API Automated Security Testing, REST API penetration testing is complex due to continuous changes in existing APIs.
Judas DNS - Nameserver DNS Poisoning Attack Tool Judas DNS – Nameserver DNS Poisoning Attack Tool
Judas DNS is a Nameserver DNS Poisoning Attack Tool which functions as a DNS proxy server built to be deployed in place of a taken over nameserver to perform targeted exploitation.
dsniff Download - Tools for Network Auditing & Password Sniffing dsniff Download – Tools for Network Auditing & Password Sniffing
Dsniff download is a collection of tools for network auditing & penetration testing. Dsniff, filesnarf, mailsnarf, msgsnarf, URLsnarf, and WebSpy passively monitor a network


5 Responses to Texas Man Pleads Guilty To Bot Network For Hire

  1. s3rg3770 April 29, 2010 at 12:47 pm #

    t35.net’s server suffer of symlink() vuln. Every site’s config files (PHP) is readable by your hosted site with the simple function PHP symlink(). Or bypass the OPEN DIR RESTRICTION with symlink bypass. I think this is a bad VULN for HOSTING company. Too much company suffers for this.

  2. CBRP1R8 April 29, 2010 at 2:12 pm #

    Take one down, 20 more pop up in their place….its a “lucrative” business…

  3. droope April 29, 2010 at 8:39 pm #

    @s3rg3770: that’s really interesting stuff. thanks, I didn’t know about that vuln.

  4. mamat May 3, 2010 at 3:38 am #

    @s3rg3770, you’re from darkc0de aren’t you? What happened to the site?

  5. s3rg3770 May 10, 2010 at 9:48 pm #

    @mamat
    Yep, i was on darkc0de before darkc0de died. I don’t know what’s happen, hope nothing like FBI problem… :)