Teen Hacker's Offer To Help Leads To Felony Charges

[InfoSec News <isn () c4i org>]

http://www.newsbytes.com/news/02/175190.html

By Brian McWilliams, Newsbytes
OVERLAND PARK, KANSAS, U.S.A.,
13 Mar 2002, 2:30 PM CST
 
A Kansas teenager who the FBI says hacked a California city's Web site
and then offered to secure it was charged Thursday with 11 felony
counts of computer crime.

Matthew T. Kroeker, 18, allegedly used the nickname "Artech" while
defacing more than 50 Web sites in 2000.
 
Among Artech's suspected victims are sites operated by the U.S.  
Department of Transportation and Department of Labor, and the Internet
home page of the City of Stockton, Calif.

Webmaster Cathy Sloan said that the Stockton homepage was replaced in
June 2000 with one that simply said "Tard."

Shortly thereafter, Sloan received an e-mail from someone identifying
himself as "Matt" who took credit for the defacement and offered to
help her secure the site in exchange for a laptop computer.

"I immediately called the local police and we decided I should play
along with him while our tech guys were trying to trace where his
e-mails were coming from," said Sloan, who said that the FBI took over
the case when it determined Kroeker was from out of state.

As part of the ruse, Sloan said she exchanged 90 e-mails with Kroeker
over the course of several weeks..After gaining his confidence, she
told Kroeker that the city would bring him in as a volunteer to work
on the Stockton Web site and give him a laptop, but that he first
needed to complete an application form.

"He sent us his name and address and all sorts of other information,"  
Sloan said. "The next thing I knew, he was arrested at home in July by
FBI agents dressed up as UPS delivery men."

Kroker's attorney, Kevin P. Moriarity, said that Kroeker was 16 when
the arrest occurred, and that he cooperated fully with law enforcement
officials.

FBI agents took a statement from Kroeker and confiscated his
computers, but no charges were filed against the boy, Moriarity said.

"The FBI told his parents he didn't need an attorney and they didn't
need to worry about anything else. His family assumed it was all over
with," said Moriarity.

Kroeker has not defaced any sites since the arrest in 2000, and
subsequently completed high school and is enrolled in a community
college, Moriarty said.

"He wasn't very mature at the time but he took responsibility and
altered his behavior. They couldn't have asked for a better outcome,
so this is very unfortunate that this happened now," he said.

Artech signed his Feb. 15, 2000 defacement of the Department of
Transportation's information services site with the words, "Artech -
America's biggest screw up!"

Kroeker, who turned 18 on Jan. 30, will not face federal hacking
charges, but state prosecutors said they will seek to try him as an
adult under Kansas' computer crime statutes.

"We're vehemently opposed to that. We hope that when the state reviews
all the facts they will agree that it will be fundamentally unfair to
pursue this case on the adult level," said Moriarity.

The FBI and Kansas prosecutors were not immediately available for
comment.

Brian Martin, one of the operators of the Attrition.org security
information site, said that Artech apparently was conflicted over his
status in the hacking ranks.

Several of his defacements included the statement, "Artech supports
d2sk," which Artech said stands for "death to script kiddies,
according to copies of the defaced pages archived by Attrition.

Yet in an interview with ZDnet in February 2000, Artech admitted to
using "script kiddie" methods and said he would "rather be a script
kiddie than use some mad skill and take down an unknown Web site."

"Script kiddies" is a pejorative term used by hackers to describe
young hackers who rely on tools created by more skilled hackers.

Martin said that Attrition warned Artech that his methods could land
him in jail. In July 2000, Attrition notified Artech that the site
would not mirror his new defacements because they suspected him of
staging attacks on sites operated by friends.

"It was obvious that his goal was merely to gain status and get his
name on the mirror," said Martin.

A partial archive of Artech's defacements is at
http://defaced.alldas.org/?attacker=Artech

Artech's government site defacements are mirrored at
http://www.attrition.org/mirror/attrition/gov.html



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY
of the mail.