Fanwood Computer Hacker Who Launched Attacks On Rutgers Sentenced

FANWOOD, NJ — A computer hacker from Fanwood man was ordered to pay $8.6 million in restitution and serve six months of home incarceration for launching a cyber-attack on the Rutgers University computer network, U.S. Attorney Craig Carpenito announced Friday.

Paras Jha, 22, previously pleaded guilty before U.S. District Judge Michael Shipp to violating the Computer Fraud & Abuse Act. Judge Shipp imposed the sentence today in Trenton federal court.

Between November 2014 and September 2016, Jha executed attacks where multiple computers acting in unison flood the Internet connection of a targeted computer or computers, According to documents filed in this and other cases and statements made in court.

Jha’s attacks effectively shut down Rutgers University’s central authentication server, which maintained, among other things, the gateway portal through which staff, faculty, and students delivered assignments and assessments, according to the report.

Some of the attacks allowed Jha to take Rutgers' system offline for multiple consecutive periods, causing damage to Rutgers University, its faculty, and its students, according to the report.

On Dec. 8, 2017, Jha along with Josiah White, 21, of Washington, Pennsylvania, and Dalton Norman, 22, of Metairie, Louisiana, also pleaded guilty to criminal informations in the District of Alaska charging them each with conspiracy to violate the Computer Fraud & Abuse Act in operating the Mirai Botnet.

Jha and Norman also pleaded guilty to criminal informations in the District of Alaska charging each with conspiracy to violate the Computer Fraud & Abuse Act.

The trio reportedly created a powerful botnet – a collection of computers infected with malicious software and controlled as a group without the knowledge or permission of the computers’ owners. It allegedly targeted devices that have been connected to the Internet, including wireless cameras, routers, and digital video recorders.

This would allow the trio to attain administrative or high-level access to victim devices for the purpose of forcing the devices to participate in the Mirai Botnet, according to the report.

The Mirai Botnet had hundreds of thousands of compromised devices which were then used primarily in advertising fraud, including “clickfraud,” a type of Internet-based scheme that utilizes “clicks,” or the accessing of URLs and similar web content, for the purpose of artificially generating revenue, according to the report.

Shipp also sentenced Jha to five years of supervised release and ordered him to perform 2,500 hours of community service.

On Sept. 18, all three defendants were sentenced in federal court in Alaska to serve a five-year period of probation, 2,500 hours of community service, ordered to pay restitution in the amount of $127,000, and have voluntarily abandoned significant amounts of cryptocurrency seized during the course of the investigation.

For additional information on cybersecurity best practices for IoT devices, click here.

(Image via Shutterstock)

Have a news tip? Email alexis.tarrazi@patch.com.

Get Patch breaking news alerts sent right to your phone with our new app. Download here.