Creator of Nugache Worm Reaches Plea Agreement

By Jeremy Kirk

June 30, 2008 — IDG News Service —

The teenage creator of a botnet who used a clever worm to infect PCs and then steal users' personal data has agreed to a plea deal with federal prosecutors in California.

Jason Michael Milmont, of Cheyenne, Wyoming, is expected to plead guilty to one count of accessing protected computers to conduct fraud.

In return, prosecutors with U.S. District Court for the Central District of California will only press for the "low end" of a potential five-year maximum sentence and US$250,000 fine, according to court documents posted the Web site of Milmont's hometown newspaper.

Milmont's scheme is perhaps most notable for the use of a P-to-P (peer-to-peer) protocol to control his botnet, a technique that makes tracing much more difficult for security analysts and law enforcement.

Milmont created what's known as the Nugache worm. He wrapped the worm into Limewire, a P-to-P file-sharing application, and duped victims into downloading the tampered program.

Once a PC was infected, the Nugache worm would then send spam to everyone on a person's AOL Instant Messenger contacts list. The spam included links to fake Web sites Milmont created mimicking MySpace or the Photobucket photo-sharing site. If a user went to the spoofed site, the user would be asked to download a file.

The file was the Nugache worm, which if downloaded and uncompressed, would then start spamming again. Prosecutors estimate that Milmont's botnet comprised 5,000 to 15,000 computers at a time. The botnet was also used to carry out denial-of-service attacks, including one against an online business in southern California.

But Milmont kept updating the malware. The third version had a keylogging function that was capable of collecting form data from Internet Explorer of the computers he controlled. He then perpetuated identity fraud, collecting credit-card numbers and ordering goods.

Milmont also bought phone numbers with Cheyenne area codes from Skype with pilfered credit-card numbers. Those numbers were used to order goods online, which went to a vacant residence in Cheyenne, federal prosecutors said.

As part of the plea deal, Milmont must pay $73,866.36 in restitution.

Comments

Share [+]

Digg This

SlashDot

TOOLS

Comments

Digg This

SlashDot

CENTER OF EXCELLENCE

Security

» New 2008 Report: Outbound Email and Data Loss Prevention in Today's Enterprise
Email, blogging and mobile devices are important business tools, but they expose enterprises to legal, financial and regulatory risks.

» Regulations Shift Focus on Outbound Email Security
Outbound email is essential to running any business today — allowing us to share information, work with partners and even interact with customers.

» Messaging Security Goes Virtual
When it comes to technology investments, virtualization demonstrates drop-dead-obvious ROI.

» Encryption Made Easy: The Advantages of Identity Based Encryption
Growing regulations are pressuring enterprises to find effective, affordable and easy email encryption solutions.

» The Great Email Security Debate: Appliances, SaaS, or Virtual?
Today, there are many ways to approach email security — the question is: what deployment model is right for you?

Center sponsored by