Mirai botnet maker must pay university $8.6 million in damages

Paras Jha, one of the creators of the Mirai botnet, has been sentenced to six months’ house arrest in the United States, to pay $8.6 million in damages, 2,500 hours of community service and five years’ probation.

The verdict was announced last Friday. Jha has been found guilty of violating the Computer Fraud & Abuse Act. Jha co-founded the infamous Mirai botnet with Josiah White and Dalton Norman. That consisted of hundreds of thousands of poorly secured IoT devices and routers that were used to carry out DDOs attacks. The group targeted Rutgers University, among others, where Jha was a student.

With the attacks, Jha wanted to prevent registrations for a course in which he wanted to participate and thus postpone an exam. The $8.6 million are the calculated costs that the university has had to incur to recover from the attacks. Other websites were also targeted, such as that of security expert Brian Krebs, who in response conducted an investigation and tracked down the perpetrators. However, the botnet’s original purpose was to make Minecraft servers hard to reach in order to make the defendants’ server more interesting and profitable, according to a very comprehensive Wired piece from last year.

In an attempt to lead authorities astray, the botnet’s creators also put its source code online, resulting in multiple copies of the botnet, which were causing problems until recently.

The ruling comes in addition to a previous Alaska state court ruling that also ordered Jha to receive five years’ probation, 2,500 hours of community service, pay $127,000 in damages and give up “a large amount of cryptocurrencies.” That case revolved around developing the botnet, and this standalone case concerns the attacks on the university.