Paras Jha

Background

Paras Jha is a computer scientist from Fanwood, New Jersey, who enrolled at Rutgers University around 2015. He displayed early skill in programming languages including C#, Java, Golang, C, C++, and PHP, and was active on hacking forums such as Hack Forums under various pseudonyms, including "dreadiscool." Jha co-founded ProTraf Solutions, a company that marketed itself as a DDoS protection and mitigation service, together with fellow student Josiah White.

Creation of Mirai

In the summer of 2016, Jha, along with Josiah White and Dalton Norman, developed the Mirai malware, which scanned the internet for insecure Internet-of-Things devices such as routers, DVRs, and IP cameras, logging into them using default or weak factory credentials to conscript them into a botnet capable of launching massive distributed denial-of-service (DDoS) attacks. The malware was initially built to give the trio an advantage in a Minecraft server hosting and DDoS-for-hire/protection racket: they would attack rival Minecraft servers and hosting providers, then sell their own DDoS protection services to victims. Jha operated online under the alias "Anna-senpai," a name drawn from the anime series "Mirai Nikki," which he had watched.

The Dyn attack and public release of the source code

In September and October 2016, Mirai was used to launch some of the largest DDoS attacks recorded up to that time, including an attack against the website of security journalist Brian Krebs and, on October 21, 2016, a major attack on Dyn, a company providing Domain Name System (DNS) services, which caused widespread outages for sites including Twitter, Netflix, Reddit, and others across parts of the United States. Shortly before the Dyn attack, the source code for Mirai was posted publicly on Hack Forums under the Anna-senpai alias, a move investigators believe was intended to make it harder to trace the botnet back to its original authors as more attackers began operating copies of it.

Attacks on Rutgers University

Separately from Mirai, Jha was linked to a series of disruptive DDoS attacks against Rutgers University's network between 2014 and 2016, timed to coincide with events such as course registration and exams. The attacker, using aliases including "og_richard_stallman" and "exfocus," taunted university administrators online and mocked the school's cybersecurity spending. The attacks forced Rutgers to spend hundreds of thousands of dollars on outside consultants and additional security measures.

Identification and investigation

Journalist Brian Krebs, whose own website had been hit by a record-setting Mirai attack, published an investigative report in January 2017 identifying Paras Jha as the likely person behind the "Anna-senpai" alias, based on technical writing style, forum activity, and connections to ProTraf Solutions and Rutgers University. Jha initially denied the allegations publicly. The FBI's investigation, aided by this reporting, ultimately tied Jha, White, and Norman to both the Mirai botnet and a related click-fraud scheme that used compromised devices to generate fraudulent advertising revenue.

Guilty plea and sentencing

On December 13, 2017, Jha pleaded guilty in federal court in Alaska to charges related to the Mirai botnet, alongside co-defendants Josiah White and Dalton Norman, including conspiracy to violate the Computer Fraud and Abuse Act. Jha separately pleaded guilty to charges in the District of New Jersey stemming from the Rutgers University attacks. As part of their plea agreements, the three defendants cooperated extensively with FBI investigations into other cybercrime cases. On October 26, 2018, Jha was sentenced by the U.S. District Court for the District of New Jersey to six months of home incarceration, 2,500 hours of community service, and was ordered to pay $8.6 million in restitution to Rutgers University; he avoided a lengthier prison sentence in significant part due to his cooperation with authorities.

Legacy

The Mirai botnet and its public source code release are widely regarded as a turning point in Internet-of-Things security, exposing how large numbers of poorly secured consumer devices could be weaponized into some of the most powerful DDoS botnets ever seen. Variants and descendants of the Mirai codebase have continued to be used by other threat actors in the years since, and the case is frequently cited in discussions of IoT security policy, default-credential vulnerabilities, and the legal treatment of young hackers who cooperate with law enforcement after being caught.

Timeline

• 2015Paras Jha enrolls at Rutgers University and co-founds ProTraf Solutions, a DDoS mitigation company, with Josiah White.
• 2014First in a series of DDoS attacks attributed to Jha begins disrupting Rutgers University's network, recurring through 2016.
• 2016-08Jha, Josiah White, and Dalton Norman develop the Mirai malware to gain an advantage in a Minecraft server DDoS-for-hire and protection scheme.
• 2016-09-20A Mirai-powered botnet launches a record-setting DDoS attack against the website of security journalist Brian Krebs.
• 2016-10-01The Mirai source code is publicly posted on Hack Forums under the alias "Anna-senpai."
• 2016-10-21A large-scale Mirai botnet attack against DNS provider Dyn disrupts access to major websites including Twitter, Netflix, and Reddit across parts of the United States.
• 2017-01-17Journalist Brian Krebs publishes an investigation publicly identifying Paras Jha as the likely author behind the "Anna-senpai" alias.
• 2017-12-13Jha pleads guilty in federal court in Alaska to Mirai-related computer crime charges alongside Josiah White and Dalton Norman, and separately pleads guilty to charges related to the Rutgers University attacks in New Jersey.
• 2018-10-26Jha is sentenced to six months of home incarceration, 2,500 hours of community service, and ordered to pay $8.6 million in restitution for the Rutgers attacks.