Feeds

UK teenager accused of ‘electronic sabotage’ against US port

Houston, we have a problem

  • alert
  • submit to reddit

Securing Web Applications Made Simple and Scalable

A British teenager allegedly brought down the Internet systems of a major US port while attempting to extract revenge on a fellow IRC user, a court heard today.

Aaron Caffrey, 19, allegedly slowed systems at the port of Houston in Texas to a crawl as the result of an attack actually aimed at a fellow chat-room user, called Bokkie. Bokkie’s anti-American remarks days after the 9/11 terrorist attacks annoyed the British teenager so much that he allegedly sought to take out her Net connection using an attack tool he had created.

Caffrey, of Saftesbury, Dorset, pleaded not guilty to the single charge of unauthorised modifications of a computer contrary to Section 3 of the Computer Misuse Act 1990 at the start of his trial today.

Collateral damage

Prosecutor Paul Addison said the port of Houston’s systems were one of an unknown number of intermediary server systems used in the PING flood attack Caffrey allegedly initiated in the early hours of September 21 2001 (UK time).

The court heard extracts from an IRC conversation during which Caffrey (or someone using his AaronX nick-name) argued with Bokkie, a South African 17 year-old then living in the US, over her remarks that Americans were arrogant or "Almighty". Caffrey took particular exception to these remarks because he was in love with an American girl, called Jessica, at the time.

Caffrey had christened his computer Jessica and references to his affection for the girl were found in text strings within a DDoS attack tool, allegedly created by Caffrey, which investigators ultimately recovered from his computer. Computer logs from the Port of Houston enabled police to trace the attack back to a computer in Caffrey’s Dorset home. He was arrested by UK police in January 2002.

Caffrey denies creating the attack tool (named in court as IIS Unicode Exploiter – PING DDoS tool, coded by Aaron) or launching the attack. He maintains that evidence against him was planted on his machine by an attacker who used an unspecified Trojan to gain control of his PC and launch the assault. Addison said the prosecution will call expert witnesses to disprove these claims.

Electronic sabotage

The court heard that an attack launched against the Port of Houston’s Web systems on the evening of September 20 (Central Standard Time) affected the performance of its entire network. As a result data (tides, water depths and weather) to help pilots navigate through the harbour and by shipping companies became inaccessible.

Addison said that the attack "could have had catastrophic repercussions for those reliant on the computer in the Port of Houston", the world’s eighth-busiest maritime facility.

Although no injury or damage was caused, Caffrey’s actions still amount to a form of "electronic sabotage", Addison told the jury.

The court heard that the Port suffered a similar DDoS attack in August 2001 for which a US citizen has already been convicted. Caffrey is not suspected of involvement in that attack.

The case against Caffrey is one of the first times a computer crime prosecution has been put before a jury in the UK. In most such cases, the accused enters a guilty plea or (more infrequently) the prosecution abandons its case long before reaching this stage.

Caffrey suffers from Asperger's Syndrome - a mild form of autism – which impairs his ability to concentrate over extended periods, among other thing. As a result of his medical condition, Judge Loraine Smith allowed Caffrey to sit next to his lawyers and scheduled frequent breaks in the proceedings.

The case, which is scheduled to last for three days, continues. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.