We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
 

Yahoo nemesis Mafiaboy vows to fight malware

On the morning of February 7, 2000, a teenage hacker hit Yahoo with a DoS arrack of such speed and intensity that he knocked the web's second most popular site offline.

A few months later, 15 year-old Michael Calce was watching "Goodfellas" at a friend's house in the suburbs of Montreal when he got a 3am call on his mobile phone.

His father was on the line. "They're here," he said.

Calce knew right away what that meant. He had already talked to a lawyer after warning his father, weeks earlier, that he'd knocked offline a string of high profile websites - Amazon, Dell, CNN - and his attacks had been widely covered in the press.

Although the late-night visit by the Royal Canadian Mounted Police was not a surprise, Calce said his mind was racing as he walked out to a street corner to wait for a police cruiser to swing by and arrest him. What was going to happen? Would he go to jail?

Calce, who was known at the time only by his online moniker, Mafiaboy, eventually pleaded guilty to criminal hacking charges. He served time in a group home where he was allowed to attend school and a part-time job, but was otherwise in essence locked in his room. He couldn't use computers and, isolated from friends and family, he "almost hit a state of depression", he said in an interview this week - one of his first since his arrest eight years ago.

"It changed me completely," he said of his time in detention. "I started to think about how I could help society rather than be a detriment."

To hear Calce tell it, it's easy to see what got him into the world of criminal hacking: the power.

At nine-and-a-half years old he was knocked offline by someone he'd annoyed while hanging out in an AOL chatroom looking for pirated software. "I was amazed that somebody was able to do that," he said.

Intrigued, he soon learned how to do the same to others, a practice called "punting".

Three years later, when his best friend was killed in a winter car accident, Calce said he became a darker, more isolated kid.

"It definitely fuelled me to not really care about what was going on in the real world," he said.

At 15, he had moved from AOL's chat rooms to the EFnet Internet Relay Chat (IRC) network where he learned some very nasty tricks indeed.

On the day he knocked Yahoo offline, Calce estimates that he had hacked into perhaps 40 percent of the major universities in the United States, using attack code that he picked up online.

His bag of tricks included attacks for Solaris, HP-UX and the Linux operating systems. The BIND (Berkeley Internet Name Domain) software used to manage the internet's Domain Name System was also a favourite target.

To hit Yahoo, he used a denial of service (DoS) attack, sending the online portal's web servers a stream of useless information and forcing them to constantly respond, using up precious network bandwidth.

He took denial of service attack code written by a hacker named Sinkhole and developed a way to remotely train all of his approximately 200 university networks on the same target simultaneously, he said.

Soon Yahoo was offline.

"I really couldn't believe it at first," Calce remembered. "Did I get lucky with that attack, or was my network really that powerful?"

"This is why I continued with my attacks. I thought Yahoo might have been a fluke" he added.

Over at Yahoo, nobody seemed to think that luck was involved.

"It was horrible," said Jeremiah Grossman, who worked in Yahoo's security department at the time. "It worked quite well; it knocked down one of the most stable sites on the web."

Grossman, now CTO at White Hat Security, said he still uses Calce's Yahoo attack as a point of reference when he needs to talk about what kind of bandwidth it takes to knock a site offline.

Denial of service attacks may soon be in the news again, security experts say.

Last week researchers Robert Lee and Jack Louis of security vendor Outpost24 said they discovered a major flaw in the Internet's TCP/IP protocol that could allow an attacker to take out a major website without first building up the massive network of attacking machines that Calce needed for his crimes.

Calce said one thing is certain: Mafiaboy won't be involved in any new computer attacks. Today he works as a legitimate security consultant and he's on a book tour this week, having published a tell-all story documenting his criminal career and offering advice on how people can protect themselves from, well, people like him on the internet.

He wants to help protect regular computer users, he said, because they've now replaced universities and corporations as the major targets of attack. And, clearly, he wants to dispel the notion that he was a know-nothing "script kiddie" who used other people's software to wreak havoc on the internet.

"I want to let everybody know that I acknowledge what I did was wrong," he said. "I just want to share my knowledge with people."

Visit Security Advisor for the latest internet threat news, FREE net threat email newsletters, and internet security product reviews

Visit Broadband Advisor for the latest internet news, reviews, tips & tricks

IDG UK Sites

LG G3 release date, price, specs and new features 2014

IDG UK Sites

iPhone 5s review: why the iPhone 5s is still the best phone you can buy in 2014

IDG UK Sites

PCs vs consoles: PCs still pwn when it comes to gaming (and everything else)

IDG UK Sites

NAB 2014: Affordable 4K cameras, boundary-pushing plug-ins & drone domination