[ISN] Eighteen months for 'White Hat' Hacker

From: InfoSec News (isnat_private)
Date: Mon May 21 2001 - 22:12:14 PDT

  • Next message: InfoSec News: "[ISN] Cross post. Krystalia UD cancer team."

    By Kevin Poulsen
    May 21, 2001 7:00 PM PT
    San Jose, Calf.--Computer security researcher and former FBI informant
    Max Butler was sentenced Monday to 18 months in prison for launching
    an Internet worm that crawled through hundreds of military and defense
    contractor computers over a few days in 1998.
    In handing down the sentence, federal judge James Ware rejected
    defense attorney Jennifer Granick's argument that the Air Force, and
    other victims of the worm, improperly calculated their financial
    losses from the hack. The judge also declined to give Butler credit
    for his brief stint as an undercover FBI informant, during which he
    infiltrated a gang of hackers that had penetrated 3Com's corporate
    phone network.
    But the judge refused prosecutor Ross Nadel's request that Butler be
    immediately taken into custody in the courtroom, and allowed the
    hacker to remain free on bail until June 25th, when he's scheduled to
    report to prison. With credit for good behavior, Butler will be
    eligible for assignment to a community halfway house as early as April
    of next year, and will be released in mid-October 2002. He'll then
    serve three years of supervised release during which, under a special
    order, Butler will be barred from accessing the Internet without
    permission of his probation officer. Ware also ordered Butler to pay
    $60,000 in restitution.
    A consultant who specializes in performing penetration tests on
    corporate networks, the 28-year-old remained well regarded in computer
    security circles even after his March, 2000 indictment. Butler is
    known for his expertise in intrusion detection: the science of
    automatically analyzing Internet traffic for "signatures" indicative
    of an attack, and he created arachnids, a popular open source catalog
    of attack signatures that forms part of an overall public resource at
    Butler, known as "Max Vision" to friends and associates, crossed the
    line in June of 1998, at a time when much of the Internet was still
    vulnerable to a hole that had been discovered months earlier in a
    ubiquitous piece of software called the BIND "named" domain server.
    The hacker group ADM published a computer program capable of spreading
    through vulnerable systems automatically. Butler launched a special
    strain of the worm that penetrated systems, but also automatically
    closed the BIND hole as it spread, forestalling attacks from other
    Tall and soft-spoken, wearing a blazer and rumpled cargo pants, the
    hacker apologetically told Judge Ware that he got caught up in the
    need to close a serious security hole.
    "I got swept up," said Butler. "It's hard to explain the feelings of
    someone who's gotten caught up in the computer security field... I
    felt at the time that I was in a race. That if I went in and closed
    the holes quickly, I could do it before people with more malicious
    intentions could use them."
    Butler did not address why he left malevolent features from the ADM
    worm in his own program, including one that created a secret back door
    on every system it penetrated.
    "What I did was reprehensible," Butler told the court. "I've hurt my
    reputation in the computer security field. I've hurt my family and
    Judge Ware emphasized the need to deter other hackers. "There's a need
    for those who would follow your footsteps to know that this can result
    in incarceration," said Ware.
    ISN is hosted by SecurityFocus.com
    To unsubscribe email isn-unsubscribeat_private

    This archive was generated by hypermail 2b30 : Mon May 21 2001 - 23:06:28 PDT