Feeds

UK teenager accused of ‘electronic sabotage’ against US port

Houston, we have a problem

  • alert
  • submit to reddit

SANS - Survey on application security programs

A British teenager allegedly brought down the Internet systems of a major US port while attempting to extract revenge on a fellow IRC user, a court heard today.

Aaron Caffrey, 19, allegedly slowed systems at the port of Houston in Texas to a crawl as the result of an attack actually aimed at a fellow chat-room user, called Bokkie. Bokkie’s anti-American remarks days after the 9/11 terrorist attacks annoyed the British teenager so much that he allegedly sought to take out her Net connection using an attack tool he had created.

Caffrey, of Saftesbury, Dorset, pleaded not guilty to the single charge of unauthorised modifications of a computer contrary to Section 3 of the Computer Misuse Act 1990 at the start of his trial today.

Collateral damage

Prosecutor Paul Addison said the port of Houston’s systems were one of an unknown number of intermediary server systems used in the PING flood attack Caffrey allegedly initiated in the early hours of September 21 2001 (UK time).

The court heard extracts from an IRC conversation during which Caffrey (or someone using his AaronX nick-name) argued with Bokkie, a South African 17 year-old then living in the US, over her remarks that Americans were arrogant or "Almighty". Caffrey took particular exception to these remarks because he was in love with an American girl, called Jessica, at the time.

Caffrey had christened his computer Jessica and references to his affection for the girl were found in text strings within a DDoS attack tool, allegedly created by Caffrey, which investigators ultimately recovered from his computer. Computer logs from the Port of Houston enabled police to trace the attack back to a computer in Caffrey’s Dorset home. He was arrested by UK police in January 2002.

Caffrey denies creating the attack tool (named in court as IIS Unicode Exploiter – PING DDoS tool, coded by Aaron) or launching the attack. He maintains that evidence against him was planted on his machine by an attacker who used an unspecified Trojan to gain control of his PC and launch the assault. Addison said the prosecution will call expert witnesses to disprove these claims.

Electronic sabotage

The court heard that an attack launched against the Port of Houston’s Web systems on the evening of September 20 (Central Standard Time) affected the performance of its entire network. As a result data (tides, water depths and weather) to help pilots navigate through the harbour and by shipping companies became inaccessible.

Addison said that the attack "could have had catastrophic repercussions for those reliant on the computer in the Port of Houston", the world’s eighth-busiest maritime facility.

Although no injury or damage was caused, Caffrey’s actions still amount to a form of "electronic sabotage", Addison told the jury.

The court heard that the Port suffered a similar DDoS attack in August 2001 for which a US citizen has already been convicted. Caffrey is not suspected of involvement in that attack.

The case against Caffrey is one of the first times a computer crime prosecution has been put before a jury in the UK. In most such cases, the accused enters a guilty plea or (more infrequently) the prosecution abandons its case long before reaching this stage.

Caffrey suffers from Asperger's Syndrome - a mild form of autism – which impairs his ability to concentrate over extended periods, among other thing. As a result of his medical condition, Judge Loraine Smith allowed Caffrey to sit next to his lawyers and scheduled frequent breaks in the proceedings.

The case, which is scheduled to last for three days, continues. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.