United States of America v. Ancheta (U.S. vs. Ancheta, 06-051 (C.D. Cal.)) is the name of a lawsuit against Jeanson James Ancheta of Downey, California by the U.S. Government and was handled by the United States District Court for the Central District of California. This is the first botnet related prosecution in U.S history.
Case summary
Ancheta violated the prohibited acts of accessing and transmitting malware with the intent and consequence of disrupting interstate and foreign commerce. The case was the first prosecution in the United States of America where an individual was sentenced to prison for profiting from the use of botnets that were used maliciously to launch destructive denial of service attacks and sending of large quantities of spam across the internet. The 57-month prison sentence for Ancheta was the longest in history for a defendant who has spread malware.
Ancheta pleaded guilty to conspiring to violate to the Computer Fraud and Abuse Act causing damage to computers used by the federal government of the United States in national defence and accessing a protected computer without authorization for the purpose of commit various types of fraud. Between the dates of June 25, 2004 and September 15, 2004 in Los Angeles county Ancheta and others knowingly conspired to violate , and of US Code. This refers to knowingly causing the transmission of a program, information, code or command and as a result of such conduct cause damage without authorization to a computer used in interstate and foreign commerce and communication and cause loss during a one-year period aggregating at least $5000 in value. Secondly Acheta and others conspired to violate , , and of US Code. This refers to access without authorization a computer used in interstate and foreign commerce and communication, and intentionally intimate the transmission from and through that computer multiple commercial electronic email messages that affect interstate and foreign commerce. Finally Ancheta was charged for laundering of monetary instruments under and faced criminal forfeiture under and .
Case technical details
Internet bots and botnets
Jeanson James Ancheta at the time of this crime was a 20-year-old high school drop-out. He found the rxbot software online and decided that he was going to use it to create a botnet army. Once established, he set up a website where he would rent his computer zombies to hackers so that they could employ them to fulfill whatever malicious job they had planned. Ancheta used at least one computer system at his place of residence and accessed the Internet from a dial up telephone line to configure and command the botnet and conduct any business communication. A co-conspirator residing in Boca Raton, Florida referred to as SoBE was also involved, as he had previous experience launching computer attacks.
An internet bot is a program that infects a computer and enables remote control of that computer. A security vulnerability in the computer system is exploited by the hacker in order to install and run the malware; in this case a worm. The program installs itself and is set up to run as a background process or daemon which remains undetectable to the computer user. The infected computer is often referred to as a zombie computer and was what Ancheta depended on as the building block of his botnet army. Ancheta engaged these computers to function in unison in a network formation; this is referred to as a botnet and the controller is called the bot herder. Ancheta's primary purpose of engaging large numbers of computers was to amplify the attack and reduce the time taken to execute it. Their greatest value is they provide a relatively high level of anonymity.
In 2005, the Federal Trade Commission in conjunction with 35 government agencies organized an initiative to encourage Internet service providers to actively monitor, identify and quarantine customers whose computers appeared to have been compromised, transformed into zombies, or appear to be under the remote control of hackers. One of the largest botnet implementations around that time (2005) was found by Dutch Police where a botnet of over 1.5 million computers was under a crime ring's control. These zombie computers were often employed as a response to anti-spam laws and spam filtering. Spammers started hiring virus writers and hackers to help them architect armies of zombie computers to send spam email from unsuspecting users' computers around the world. In February 2012, the Federal Communications Commission unveiled yet another plan that calls on Internet service providers to take specific steps to combat online threats from botnets.