427 Botnet fm qxd

www.syngress.com
20
Chapter 1 • Botnets: A Call to Action
427_Bot_01.qxd 1/8/07 11:53 AM Page 20

---

Farid Essebar
Farid Essebar, 18, of Morocco, is the author of the Zotob worm. Essebar is
facing charges in Morrocco that he released the Zotob worm that crippled
the world’s banks and medical companies.
Christopher Maxwell
Botnets can cause unintended damage.This was the case with Christopher
Maxwell, aka “donttrip,
”
20, of Vacaville, California. According to the DOJ
press release announcing his conviction, in January 2005, as his botnet
searched for additional computers to compromise, it infected the computer
network at Northwest Hospital in Seattle.The increase in computer traffic as
the botnet scanned the system interrupted normal hospital computer commu-
nications.These disruptions affected the hospital’s systems in numerous ways:
Doors to the operating rooms did not open, pagers did not work, and com-
puters in the intensive care unit shut down. According to the DOJ press
release (www.usdoj.gov/criminal/cybercrime/maxwellPlea.htm), Maxwell
pled guilty to “conspiracy to intentionally cause damage to a protected com-
puter and to commit computer fraud,” and “intentionally causing or intending
to cause damage to a protected co-conspirators created the botnet with over
one million clients to fraudulently obtain commission income from installing
adware on computers without the owners’ permission.The government esti-
mates that Maxwell and friends earned approximately $100,000 from this
venture. Maxwell’s bot damaged 400 DoD computers at Germany’s
Department of Defense (DoD). He was ordered to pay the hospital and the
DoD restitution in the amount of $252,000 and sentenced to 37 months in
federal prison.
Jeffrey Parson
In August of 2003, Jeffrey Parson released a variation of the Blaster Worm,
which infected 48,000 computers worldwide. According to a U.S. Department
of Justice press release (www.usdoj.gov/criminal/cybercrime/parsonSent.htm),
“Parson admitted that he created his worm by modifying the original MS
Blaster worm and adding a mechanism that allowed him to have complete
access to certain infected computers. Parson then infected approximately fifty
computers that he had previously hijacked with his worm. From those fifty