This article is more than 1 year old
Brit teen who unleashed 'biggest ever distributed denial-of-service blast' walks free from court
Spamhaus was smashed by 300Gbps DNS reflection gun
An 18-year-old Brit dubbed a hacker-for-hire has been spared jail after launching crippling denial-of-service attacks against anti-spam outfit Spamhaus.
At one point, the assault in early 2013 reached 300Gbps, somewhat straining the London Internet Exchange (LINX) and other interconnects.
Seth Nolan-Mcdonagh, of Stockwell, south-west London, pleaded guilty in December to blasting Spamhaus off the internet as well as admitting charges of money laundering and the possession of 924 indecent images of children.
The teen, who used the online nickname Narko, also pocketed £70,000 ($108,580) for knocking services offline, and was caught with 1,000 credit card numbers.
El Reg has learned that the defendant pleaded guilty to the following offences: two counts of an unauthorised/reckless act with intent to impair computer operation; to possess/control article for use in fraud; to conceal/disguise/convert/transfer/removed criminal property; and making indecent photograph or pseudo-photograph of a child.
Nolan-Mcdonagh was sentenced at Southwark Crown Court on Friday this week, and was ordered to carry out 240 hours of unpaid work. He avoided a stretch behind bars after the court heard the teen suffered from a mental illness at the time of the web assaults, had dropped out of school and shunned his family, but had later showed "complete and genuine remorse."
"I said at the outset that these crimes were and are serious and indeed that is so," said Judge Jeffrey Pegden in summing up the case.
"Your persistent distributed denial-of-service attack was so sophisticated and unprecedented in scope they had a worldwide effect. As The Times newspaper said at the time, they almost broke the internet. Many of those were attacked for financial gain, and plain it is to me that you received very significant payments for those attacks."
Nolan-Mcdonagh was 16 when he was cuffed in April 2013, just weeks after firing off a string of distributed denial-of-service (DDoS) attacks that taxed the world's internet exchanges and services. Officers from the UK's National Crime Agency led an investigation that resulted in Nolan-Mcdonagh's arrest.
The kid was prosecuted at London's Camberwell Green Youth Court, but he was referred to the adult crown court for sentencing. Other arrests were made during the probe, one of which has resulted in a separate prosecution in the Netherlands, so it's clear that Nolan-Mcdonagh did not act alone. Nolan-Mcdonagh was just 13 when he joined a crew of hackers bent on taking down websites.
"We fully appreciate the difficult predicament with which the sentencing judge was faced, and hope that anyone considering similar attacks will take heed of his remarks, that in any other circumstances such criminality would have resulted in a custodial sentence," said Richard Cox, chief information officer at Spamhaus.
The attacks aimed at Spamhaus – and the content distribution network CloudFlare it hired to protect it – ultimately affected the operation of the internet's arteries, we're told. DNS reflection techniques were used to unleash a tsunami of network traffic against Spamhaus. The peak flow of junk packets – 300 gigabits per second – was said to be the biggest-ever DDoS at the time. Despite this massive volume, the attack failed to break the internet's backbone, contrary to many media reports. ®