Original URL: https://www.theregister.com/2008/05/08/downfall_of_botnet_master_sobe_owns/
I Was A Teenage Bot Master
The Confessions of SoBe Owns
Posted in Channel, 8th May 2008 19:18 GMT
Exclusive One day in May 2005, a 16-year-old hacker named SoBe opened his front door to find a swarm of FBI agents descending on his family's three-story house in Boca Raton, Florida. With an arm and leg in casts from a recent motorcycle accident, one agent grabbed his good arm while others seized thousands of dollars worth of computers, video game consoles and other electronics. His parents looked on.
At that moment, some 2,700 miles away, in the Los Angeles suburb of Downey, California, the FBI was serving a separate search warrant on Jeanson James Ancheta, SoBe's 20-year-old employer and hacking mentor. It was the second time in six months Ancheta had been raided by the FBI - a clear sign, had either bothered to notice, that their year-long botnet spree was unravelling.
SoBe, a few weeks before the raid
But instead of abandoning the venture after the first raid, or at least laying low for a while, SoBe and Ancheta, according to court documents, continued hijacking hundreds of thousands of PCs that they would then corral into massive networks and infect with adware. So great was SoBe's sense of impunity he continued the scheme even after Ancheta was arrested a few months later and charged with 17 felonies related to the hijacking of almost 400,000 PCs, some of them belonging to the US Department of Defense.
"That's why I love this age, its all computers heh," SoBe wrote in early December 2005, a month after Ancheta's arrest, during an online chat. "All these companys have websites, etc. Its just funny going somewhere like Target, or Sprint then coming home and rooting there servers out of boredom. Makes some people feel like they can do anything." (Misspellings and grammatical errors are his.)
SoBe's adrenalin-fueled days of fast money were slowly coming to an end. His downfall started shortly after he and Ancheta launched their botnet venture, when some clumsy mistakes attracted the attention of federal investigators. It continued as their homes were raided, and shortly after that, when the feds seized more than $38,000 earmarked as SoBe's cut of the botnet profits. Then in May 2006, SoBe was shocked when he learned Ancheta received 57 months in prison after pleading guilty to four counts of fraud related to the scheme.
His undoing was completed in February, seven months after SoBe turned 18, when he pleaded guilty to two counts of juvenile delinquency related to his use of botnets.
SoBe - who also went under the names SoBe Owns, PwnZ0r, SerlissMc and vapidz - admitted to infecting computers belonging to the Defense Information Security Agency and Sandia National Laboratories. He was sentenced today in a closed-door hearing. Although the actual sentence is confidential because SoBe was a juvenile at time of the crimes, his plea agreement contemplated a prison term of 12 to 18 months.
Notes from the Internet Underground
In November, 2005, just a few days after Ancheta was indicted, SoBe began an internet correspondence with me that continued until a few weeks before he pleaded guilty. The result was more than 80 pages of single-spaced transcripts that provided a sometimes-candid, behind-the-scenes account of his botnet caper and the investigation that ultimately shut it down.
The conversations revealed a youth of above-average intelligence who nonetheless quit school after the eighth grade. With an abundance of time on his hands and little adult supervision, he thrived on the excitement of a life dominated by World of Warcraft, fast motorcycles and computer hacking. The Register is not identifying him because his crimes took place while he was a minor.
Read on to learn how SoBe and Resilient met
The son of a landscaper father and a mother who taught middle school, SoBe came of age in Boca Raton, an affluent town about an hour's drive North of Miami made up mostly of older retirees. After quitting school, he spent much of his days coding in C++ and frequenting IRC channels related to hacking. It was in a now-defunct channel called #bottalk that he met Ancheta, who typically went under the moniker Resilient.
"He stood out from all the other people basically because he didnt bullshit people," SoBe recalled. "Most people you meet in the bot scene will claim they have xxxxx amount of bots but they dont and they lie about everything."
Unlike the others, Resilient had proof that he had sizable botnets under his control.
"You can't really lie about that when you take screenshots proving you have well over 70k," SoBe said. "It's hard to fake hundreds of exploit messages with unique IP addresses and a picture of him in a channel with 60,000 users."
SoBe was also drawn to Ancheta's social flair as demonstrated, among other things, by a MySpace profile that was packed with photos of his souped-up BMW and passel of photogenic friends. "He isnt like your average computer nerd," SoBe explained. "He actually goes outside, has fun, partys."
Not all their hacking was business related. The two were part of a posse that defaced websites by compromising, or "rooting," vulnerable servers. They took great pride in their mischievous exploits, which they documented with graffiti they left behind. The screenshot below, from the recently closed Zone-h.org website, documented the digital scribbling they left one site.
SoBe and Resilient were here
But by and large, SoBe and Ancheta's relationship was about making money. When they first met, Ancheta's business model was in the midst of a major overhaul. He had been renting out his bots in a channel titled #botz4sale, but despite brisk demand, he hadn't been able to bring in the kind of money he hoped for. (According to fees tracked by prosecutors, it was less than $3,000, although the true fee was probably higher.)
Ancheta recruited SoBe to help him launch a new scheme installing adware on Ancheta's fleet of compromised machines and using them to generate pay-for-click affiliate fees from companies such as Gamma Entertainment, which ran a program called GammaCash; and CDT, which offered a program called LOUDcash. The new revenue model was an instant success.
"It's easy like slicing cheese," Ancheta typed, to which SoBe responded: "I just hope this [LOUDcash] stuff lasts a while so I don't have to get a job right away." In about a year, investigators tracked more than $58,000 in revenue from the scheme.
Next page: That Unstoppable Feeling
That Unstoppable Feeling
They felt unstoppable, SoBe said. Even after Ancheta's home was raided, in December 2004, and FBI agents confiscated his computer, "he was back online within a day" and the two continued their botnet activities. He felt the same invulnerability after Ancheta was locked up.
"It doesn't matter," SoBe insisted in the days immediately following his arrest. "James can get off, and go back to doing it and in under a month he will be making 3x what he made and be able to cover his tracks much better."
SoBe and Ancheta didn't know it immediately following the raids, but thanks to several slip-ups, they had been under the watchful eye of FBI agents, who were quietly building a case against the two hackers. The first mistake was Ancheta's brazen advertisements on #bots4sale, an act that moved him to the top of investigators' to-do list.
"Up to then, we hadn't seen anything as blatant," FBI agent Ken McGuire said in a 2006 interview. "Anybody who's blatant enough to advertise in internet message boards that you have botnets to sell is someone you want to clear off."
Not long afterwards, the pair came to the attention of investigators again, this time because of software bugs in rxbot, the package the two had appropriated and modified to build their bot empire. To keep the botnet growing, their zombie machines automatically looked for new machines on nearby networks to compromise. But as it turned out, their software was a little too aggressive.
Jeanson James Ancheta
"If it scanned its own subnet, its possible it would keep going and scan out of its subnet, potentially scanning a DoD network," SoBe explained. According to court documents, that's exactly what happened. SoBe and Ancheta's software ended up infiltrating machines belonging to the China Lake Navel Air Facility, the Defense Information Security Agency and Sandia National Labs.
"A lot of good evidence came from the military computers," McGuire said. "It was an excellent break in the case because it permitted us further analysis."
Douche Bags and Backdoors
For their part, SoBe and Ancheta didn't seem to grasp the severity of their error at the time. In August 2004, an associate warned Ancheta by IRC chat to be sure "to filter out shit though like .gov and .mils" when his malware sought new victims. But two months later, when SoBe told Ancheta "hey btw there are gov/mil on the box if you want to get rid of them," Ancheta responded "rofl," according to court documents.
Another big blunder was SoBe's decision to lease a server using his real name and address. The pair used such boxes to host web servers and an IRC daemon that each of their bots reported to. By changing the topic in the IRC channels, they could cause the zombies to connect to other servers under their control and install any software they happened to host there. SoBe said he used his real identity "since i still dont approve of fraud."
SoBe was also convinced that investigators were able to infiltrate his botnet through a secret backdoor that had been built into their IRC daemon. He had gotten the program from Jonathan Hall, a hacker who in 2004 was charged - but never convicted - in a separate botnet investigation dubbed Operation Cyberslam.
The "server was in my name and [investigators] had a backdoor to gain oper status thx to some douchebags not telling us about it," SoBe complained bitterly.
In an interview, Hall said he viewed the source code for the daemon and had indeed spotted a backdoor. "It was plain as day," he said. The program was originally designed by Lee Graham Walker, another defendant in Operation Cyberslam, and over several years it went through multiple modifications, both by him and others, who used it as means to conduct secure communications over IRC.
Eventually, another hacker made additional changes to make it suitable for bot herding, but before she did, she "backdoored the hell out of" it, Hall said. As a result, anyone who knew about the secret feature could gain access by typing "/system foo foo," "/system bar bar," or any similar combination.
It remains unclear if the FBI ever learned of the backdoor and used it in their investigation. And ultimately, it probably doesn't matter: SoBe and Ancheta left tracks in enough places that they would almost certainly have been caught either way.
Next page: SoBe finds the seduction of exploit-writing too powerful to pass up
Less Than Resilient
That their arrest and prosecution was inevitable was obvious to just about anyone familiar with the facts of the case, but for SoBe, the pill was just too bitter to swallow. In the immediate weeks after Ancheta's arrest, SoBe continued to maintain the case was so much grandstanding by a desperate and ineffectual agency.
"I think resilient is going to get off with nothing served," he said three weeks after Ancheta was indicted. "Probation at max."
His nonchalance was fueled by a combination of confidence in the superiority of their tactics and a warped belief that their commandeering of hundreds of thousands of PCs was perfectly acceptable, or in any case, no different than the way most online businesses behaved.
"Google toolbar is basically the same thing zangocash and loudcash toolbars are," he explained. "Me and james just changed it so it installed automatically. Take AOL AIM for instance, they sneak tons of shit into there installers. You think your installing aim but you get aol and toolbars and other stuff. I dont know why, but i really don't mind installing spyware on peoples computers."
SoBe was also fond of discussing his continuing work developing malware. "I've been working on a new worm," he proudly proclaimed in late November of 2005, just a few weeks after his friend was arrested. Once it took hold of a user's machine, it sent every buddy listed in AOL Instant Messenger a message containing a link to a silent installer.
"I mean if one of your good friends youve known for a while sends you an im. Hey look at this picture. Would you click on it? Most people click it without thinking twice. Its an endless possibilities of ways to make money. EVERY SINGLE bot you are getting, is from the USA. that is major money."
Boredom Breeds Bots
Over the next several months, SoBe seemed to have trouble figuring out how to pass the considerable amount of time he had on his hands. He had been warned by the feds that despite his age, he wasn't immune from prosecution and his chances of getting pinched would increase if he didn't walk away from his botnet activities.
"I feel myself slowly slipping from the bots etc," he said a couple months after Ancheta was arrested. "Moving more towards real life pretty much. motorcycles a lot funner." SoBe also spent time on Shadowserver.org, a network of volunteers dedicated to shutting down organized cybercrime, where he gave details about ways he and Ancheta had perpetrated their crimes.
Besides taking fast rides on his dirt bike, SoBe's other non-hacking pastimes included partying and downloading and watching movies and TV shows. On New Year's Eve, he said he attended a party that he didn't remember leaving.
"I woke up the next morning in my bed 10 miles away from the party I was at," he said. "How I made it up 2 flights of stars though, i dont know."
Before he blacked out at the party, SoBe recalled a "typical crackhead looking guy with no shirt on and he was bleeding" after pulling a knife on someone around the corner and demanding a eighth of an ounce of cocaine. The person around the corner ended up stealing the knife away and cutting his would-be assailant.
SoBe's beloved dirt bike
"That's one thing I'll never understand, people robbing each other over a dime bag of weed and such," SoBe said.
But even as he tried to turn away from illegal hacking, SoBe found the seduction of illegal hacking too powerful to give up for good. In February 2006, after an extended spell of rain, he declared: "im pretty bored, weather has sucked lately, only done like 50 miles of riding in 3 days now. gonna start on a new bot."
Asked repeatedly over more than two years why he didn't apply his considerable energy to white-hat endeavors, SoBe said that was never something he saw himself doing. "To get a job like that, you need degrees, etc, all of that takes time," he explained. The money he and Ancheta generated, by contrast, "was nearly instant". Beyond that, he said, tracking miscreants for a security firm wouldn't provide the kind of thrill he got from being the miscreant himself.
Last page: The Botnet Victims Fund - Resilient 'coerced' to work 37.5-hour week at $1.15/hour
The Botnet Victims Fund
Ancheta's 57-month sentence immediately rocked chat rooms where SoBe and other would-be botherders spent time. Because the federal system generally doesn't award time off for good behavior, it meant Ancheta would have spent roughly one-fifth of his life behind bars by the time he was released. This came as a severe shock to SoBe.
"Everyone thinks its retarded pretty much," said SoBe. "But its not going to stop anyone from doing bots. i think at most he shouldve faced a fine, probation, etc not be sentenced to jail for stupid shit that didnt hurt anyone if you think about it."
Even then, SoBe was having a hard time accepting that he might have to walk away permanently from a line of work he had found so easy and lucrative. "there are people still making what james made in 6 months in one month, for a year straight," he said. "they will never be caught." He continued: "me and james wouldnt be in this situation if he never opened #botz4sale," wallpapering over the substantial role he played in his own demise.
While SoBe spent the next year-and-half agonizing over the prospect of being indicted, Ancheta sat behind bars, first in a federal facility in California and eventually at the Federal Correctional Institution in Allenwood, Pennsylvania.
It was precisely the kind of routine SoBe dreaded. It called for Ancheta to work 37.5 hours a week at just $1.15 per hour doing manual labor. Worse - from Ancheta's perspective anyway - was a requirement that 50 per cent of his income be subtracted from his paycheck and paid as restitution to some of his botnet victims under something dubbed IFRP, or inmate financial responsibility program.
My house was raided and all I got was this receipt
"In light of the fact that defendant is being coerced and extorted to acquiesce into the (IFRP) Program which is a core judicial function that is 'only' delegated to the sentencing court, defendant requests of the court to allow him to set a scheduling payment with the court upon his release," Ancheta argued in a petition he filed in December on his own behalf. Ancheta argued that while he was incarcerated, he should only pay $25 every three months toward the more than $14,000 he was required to pay in restitution.
US District Judge Gary Klausner, the same jurist who sentenced Ancheta to nearly five years in prison, was largely unmoved by the arguments. Klausner ordered Ancheta to pay 40 per cent of his earnings while he is in prison.
Run For The Border?
Despite claims that he had been close to Ancheta, SoBe remained unaware of his friend's new life behind bars because he never bothered to send him a letter. Instead, SoBe, the youngest of three teenage kids, continued to live at home with his parents. My correspondence with him remained largely dormant until he received word that feds were close to indicting a botnet confederate who went by the name Acid.
"Time for me to pack up and go to mexico or something," SoBe said last August. "If they got him to talk about other people he could easily put away dozens and those dozens lead to more."
In November, after getting a link to a story reporting that Acid, who in real life was 26-year-old John Kenneth Schiefer, agreed to plead guilty to four felonies connected to botnets, he was verbally upset.
"Dynamic what a fag," SoBe said, referring to another online alias Schiefer used. "I hope he gets jail time. I just linked that to a friend and hes like 'DUDE FUCK I CONTROLL ALL OF HIS SHIT WTF.' Oh well time to go buy a new hd."
Within a month, SoBe said federal prosecutors told him he was going to be charged and suggested he plead guilty. SoBe's attorney made arrangements for him to fly to Los Angeles to be arraigned rather than being arrested in Florida and flown out by the FBI. Three months later, SoBe pleaded guilty to criminal charges.
By then, SoBe's parents had, at long last, canceled his internet connection, so his thoughts during the final weeks leading up to his sentencing are unknown. According to an older brother, SoBe spent his days taking classes to prepare for the General Educational Development tests, in keeping with his settlement agreement with prosecutors.
But if one of his last conversations is any guide, SoBe had grown tired of wondering if he was going to be charged.
"At least ill know if its finally over," he said. "they told me like 2 years ago i was being indicted then never said anything after that so i sort of figured it was coming. it sucks, but i guess i have to pay for shit i did when i was a kid." ®