65. Mafiaboy vs the world

Time for another episode of Flashback. Tracks from the past. In the 80s and 90s we had modems, games, cool computers and it was the golden age of the demo scene. But we had no concept of IT security. It simply did not exist. In the year 2000, a Canadian teenager brought the big parts of the internet to a halt. He was 15.

Fandam, Brotherhood. In the fall of 2019, Swedish podcast, It-säkerhetspodden, run by me and collaborator Mattias Jadeskjöld, we met with Michael Calce, who is forever known to the world as MafiaBoy. On the 7th of February 2000, in the tail end of what we today note as the retro era, he took down eBay, CNN and Amazon.But the story starts much earlier. My journey started out at a really young age. I was six years old when I got my first computer. And I was nine years old when I accessed the internet for the first time. And I was quickly exposed to this community of hackers. I found it on my journey when I was looking for pirated software. And as it turns out, hackers ran the distribution of this pirated software.So I wanted to gain quicker access to it and I decided at this point that I should become a hacker. And I joined on an IRC network of EFNet, which is Internet Relay Chat. And there was tens of thousands of hackers and I devoted my time to becoming the number one hacker.

The Kuro, a new generation. It is a sure thing that any computer nerd remember his or her first computer. Michael Kelsey has fond memories of what became the start of his journey into computing. What an amazing feeling. Honestly, I remember like it was like yesterday. My dad put the box in front of me and he said, here you figure it out. And I couldn't wait. I plugged it in, powered it on.I heard all the beeping noises and churning sounds and after it booted in the system just sat there and it was waiting for me to input a command and that's when I realized at that very moment I am the master of this device.

Yeah, that was not intentional or planned but at a certain point I wanted to buy video games and pieces of software for my system and I wasn't sure if my dad was gonna give me his credit card especially since a lot of video games and software were expensiveSo I needed to find a way to illegally download this stuff which was known as Warez back in the day which was pirated software and I couldn't, I found it but I couldn't get immediate access to it. I would ask the automated bot to give me the program that I wanted or the game that I wanted but it would put me in a huge queue order and I was on a 14.4k modem so I wasn't gonna get this gamer software that I wanted for very long time.And when I realized that hackers were the ones distributing it, that's when I decided I'm gonna go into the dark side. Okay, laugh at his pronunciation of wheres all you want. But you know, he's Canadian, so what about that,

of Unlimited, Autumn Secrets. Technical challenges are interesting, but social engineering, the craft of making people do your bidding, was something he learned at the age of nine. His first target was America Online, formerly QuantumLink. So when I was on America Online for the first time, was actually given to me as a 30-day free trial period.And again, same issue, wasn't sure if my dad was going to give me his credit card to stay online and reinstate the AOL internet service. So I needed to find a way to continue online without paying for it. That's when I had access to a program known as AOL, which granted me the ability to simply appear as an administrator to other AOL users. Because the administrators on America Online, their name was in a different color.capable to throw people off AOL. Right, in the same program there was the ability to punt a user which would basically sever their internet connection to AOL. And I think that was my first actual interest in hacking and kind of having that power and capability. So I needed to find a way to stay online and I used this administrative capability to fool other users.convincing them that I was an administrator to give me their login and password.

Dark Halo, Liquid Light. Eventually, he decided to become a true hacker and joined one of the many Russian hacker groups out there. So in the late 90s, when I was a part of a really well-known elite Russian hacker group that went by the name of TNT Force, when I joined them, I became under fire by denial of service attacks by other hackers.that were trying to take out me and other members. The TNT group, they recruited you, right? Yeah, they recruited me at the age of 12. Did they know that? No, nobody knew anybody's age online. To be fair, even in the private channel of TNT, like two of the main members were literally from Russia and I didn't understand half of the things that they were saying because it was broken English and we're mixed with Russian and...So it was an interesting experience but I had access to some of the brightest minds in the world in terms of technology.

KO-0X, time flies. It was in this hacker group, Michael Kelsey, known as Mafia Boy, learned a new tool of destruction. So when I joined them, I again, became the focus fire of the other hacker groups and other hackers. And denial of service was really potent style of attack used at this point in time. And so I decided to start using DDoS attacks against my competition.Now the problem was when I wanted to launch a large scale attack, nobody was able to do so because we had limited resources and our actual physical computer was a Pentium 133 or something similar. So I needed to find a way and create a concept that would solve this problem. That's when I decided to hack into 30,000 plus networks and combine them all into one network.and created a massive, probably the world's first ever, denial of service botnet.

Extreme and a tune it's called lost love its version 3.5. Good to know By this time he was already far into black hat territory And he knew how to install malware on others computers Yeah, so I used a variation of several programs the main one that I used for The majority of my attacks were my own creationAnd I used a co-author which went by the name of Sinkhole, who was a hacker from another group that wasn't a rival to us, but he was a very close friend of mine. And I also sampled some other programs that were being created in the space. There was one known as Statue-Draught, which means barbed wire in German. So I sampled with other people's technology and software that they were creating, but...the program that I created was the most effective.

Gemini over rebels, bleeps and bloops. Yeah, the titles made me laugh. So the target's done. He really hit the big ones. Yeah, Yahoo, eBay, CNN, Dell, Amazon. And no one was onto you, like you didn't at the beginning. I was the... You know, I fell victim to my own ego at this point. Right.I was young, was 15 years old, you know, and I started boasting to other hackers in the community that I was the one responsible for these attacks and the FBI started to catch up on that. By the time, wasn't it so that there were very little protection on sites for DDoS attacks? Absolutely. It was more of a lot of it came down to certain packet types. There was packet filters in place and it was alsoWhen look at a giant like Yahoo, the amount of bandwidth that they had available to them in comparison to everyone else is literally scary. So you needed massive amounts of bandwidth. But even to this day, there's, you know, I mean, there's obviously cloud flare. have solutions and stuff, but denial of service will always remain potent.

Fridge and Space Justice Wolf. Imagine turning on the TV and seeing the world in panic over something you did. And if you think Mr. Kelsey didn't figure this was his doing, think again. I knew it was me, trust me. Pretty much crapped my pants at that point. You know, being a 15 year old kid and sitting on a couch and watching live TV.and watching the former president of the United States, Bill Clinton, go live on TV and convene the first ever cybersecurity summit based on what you did, that's a lot to digest. Yes. It's big difference between a normal 15 year old practice. Yeah, some of my friends would have fun on Halloween throwing a egg at a house or a toilet paper in a tree.And I was shutting down major e-commerce sites.

So when they actually came to place the arrest I don't know if it was strategy on their part or they just made a mistake because I know they were monitoring my house. How did you know that? Because so there's a provider that provides all the internet well the majority of the internet in the TV in my area which was known as Bell.like based after Alexander Graham Bell who created the telephone. that's our basically they have pretty much a monopoly. There's only one other company that competes with them. Anyways, they were always at the end of my street in plain view. I could see them and they were there every day all night. And the truth is, is like if your internet or your TV went down in that, in that timeframe, like they would take like a week to come fix it.And here they were every single day, every night in front of my house. So I mean, it's pretty obvious. It's like they say, it's not paranoia if they're really out to get you. That's exactly accurate.

Megas of brainwave tracks, Bilbo's road song. What ever came out of this? According to Wikipedia, the US Federal Bureau of Investigation and the Royal Canadian Mounted Police, they first noticed Kelsey when he started claiming in IRC chatrooms that he was responsible for the attacks.He then became the chief suspect when he claimed to have brought down Dell's website. Kelsey initially denied responsibility but later pleaded guilty to most of the charges brought against him. His lawyer insisted the child had only run unsupervised tests to help design an improved firewall.whereas trial records indicate the youth showed no remorse and had expressed desire to move to Italy for its lax computer crime laws. The Montreal Youth Court sentenced him on September 12, 2001, to eight months of open custody, one year of probation, restricted use of the internet and a small fine.

Well, there is one more question. Has Michael learned anything? Since the attacks, I devoted my life to raising awareness around this topic and I authored a book that discusses my story and I use sort of that platform to help companies, individuals and governments. Good to know. He now works as an advisor to HP.And that's all I got for you today on this podcast. Thanks for listening, this is DJ Daemon even signing off. In a week another episode will be available. Please go to rk.radio for the latest on the station.