Teenage Hacker 16 Makes 400000 But Faces Jail

Adam Mudd, a teenage computer hacker who made £400,000 by selling a virus used in 1.7 million hacking attacks is facing jail

A teenage computer hacker who pocketed nearly £400,000 by selling a virus which was used in 1.7 million hacking attacks is facing jail.

Adam Mudd, now 20, sold access to the Titanium Stresser tool which let users crash websites and computers by flooding them with data.

He developed the distributed denial of service, or DDoS, software from his bedroom, and started selling it to criminals when he was at school aged 16.

Mudd raked in nearly £400,000 by the time he was 18 by selling the programme to cyber criminals between September 2013 and March 2015.

He received a total of £240,153.66 and 249.81 bitcoins - worth an overall £386,079.

Using the username themuddfamily, he also carried out nearly 600 attacks himself against 181 victims.

One attack on his college was so large it may have hit the University of Cambridge, the Old Bailey heard.

Mudd admitted computer hacking and money laundering last October.

At his sentencing hearing today, the court heard the Titanium Stresser programme had 112,298 registered users.

The 1.7million attacks were carried out against more than 650,000 victims - of which just over 52,000 were in the UK.

Victims included Xbox Live users, and players of the computer games Runescape and Minecraft.

Runescape was targeted 25,000 times - 1.4 per cent of the total attacks.

Victims included Xbox Live users, and players of the computer games Runescape and Minecraft

In the last four years, the company that owns the game has spent nearly £6million in attempting mitigate from DDoS attacks, the court heard.

Jonathan Polnay, prosecuting, said: 'I am not trying to suggest those are all from the defendant.'

But he added: 'Every attack that took place in January 2015 came from Titanium Stressor.

'The specific cost of the loss in revenue from the January attacks was £184,000.'

Mudd carried out 594 attacks by himself, including four on his college in 2014 - and the loss was 'incalculable', the court heard. runescape servers

Mr Polnay said: 'On each occasion, the attack caused the entire college network to go down, on one occasion for half of the day.

Final decision on Rupert Murdoch's controversial proposed... Feds will CHARGE Wikileaks founder Julian Assange seven...

'The cost in man hours to investigate and resolve the issue is around £2,000.

'The loss in terms of work and productivity is incalculable, because no one can work in the whole college while the network had been taken down.

'The 16th of September attack was so large it is likely to have affected a further 70 schools and higher education establishments, including the Universities of Cambridge, Essex and East Anglia as well as local and district councils.'

The attacks were carried out across the world, including the US, Brazil, Australia and Europe.

Mr Polnay said: 'Where there are computers, there have been attacks.

The attacks were carried out across the world, including the US, Brazil, Australia and Europe

'Almost every major city in the world.'

Turning to the money laundering, Mr Polnay said: 'This is a young man who lived at home. This is not a lavish lifestyle case.

'This is about status. The money making is almost by the by. It, to some extent, provides a measure of the seriousness of it. The money is an indicator of how much has been carried out.'

PayPal blocked people from using it for TitaniumStresser payments, but to get around this, 328 separate PayPal accounts were created using fake details.

Mr Polnay said: 'The defendant also used sophisticated techniques to disguise the source of the funds he was receiving, including peer blocking and the use of other websites as payment gateways.

'On one occasion, the defendant falsely arranged for a legitimate website to be linked to the TitaniumStresser so PayPal would wrongly refuse to accept payments from them.'

Investigators looked at Mudd's Skype chats, which showed he knew his programme was being used for the attacks, the prosecutor said.

After one user complained someone was using it for attacks, he replied 'I don't care', Mr Polnay said.

Mudd was arrested on March 3 2015 while he was in his bedroom on his computer.

He was taken to Stevenage Police Station, and made a prepared statement in which he admitted creating the tool but denied being involved in crime.

In a later interview in September 2015, Mudd said the tool started as 'Titanium Booter' and was meant as a 'legitimate stressing tool' for people to stress test their own servers.

The prosecutor said: 'He stated that he renamed it to Titanium Stresser as an attempt to relegitimise it after it had become a DDoS service.

'He stated that it very quickly became a for hire DDoS service that became out of his control but that by mid-2013 he accepts that he was willingly running the Titanium Stresser as a DDoS service.

'He did give explanations to everything and admitted that he was effectively money laundering.'

Mudd admitted doing unauthorised acts with intent to impair the operation of a computer, a charge of making, supplying or offering to supply the Titanium Stresser programme, and concealing criminal property.

Prosecutor Mr Polnay highlighted psychiatric and psychological reports on Mudd which revealed he had Asperger's Syndrome.

He said it was a mitigating feature in terms of the impact of prison and his culpability for the crime.

But he asserted that evidence from Skype chat suggested Mudd was 'well aware what he was doing was illegal and wrong'.

Mudd was supported by his mother and father, who sat in the well of the court.

PayPal blocked people from using it for TitaniumStresser payments, but to get around this, 328 separate PayPal accounts were created using fake details (stock image)

The court heard the defendant lacked social interaction outside his family and suffered from anxiety.

Mitigating, Mr Cooper said Mudd had been 'sucked into' the cyber world of online gaming and become 'lost in an alternate reality' after withdrawing from school due to bullying.

He said Mudd, who was expelled from college, had been offline for two years, which was a form of punishment for any computer-obsessed teenager.

Mudd, who was described as 'bright and high functioning', now understood what he did was wrong but at the time he lacked empathy due to his autistic condition, the court heard.

Mr Cooper said: 'This was an unhappy period for Mr Mudd during which he suffered greatly.

'This is someone seeking friendship and status within the gaming community.'

Among his online peers there was an 'element of bravado and showmanship', he added.

Judge Topolski asked defence barrister Ben Cooper for more information about what the money transfer to Mudd's father's bank account was about.

But he added: 'Overall, I am prepared to sentence your client on the basis this was not the purpose of his criminality.

'It is not acquisitive in a financial sense. What he was seeking to acquire was his position in his world - status.'

The judge said he would adjourn sentencing until Tuesday, April 25.