Brit behind Titanium Stresser DDoS malware sent to chokey

A Hertfordshire man has been jailed for two years after netting nearly £400,000 from the malware he wrote as a 15-year-old student.

Adam Mudd, now 20, was sentenced to two years in a young offenders’ institute this afternoon. He had pleaded guilty to two charges under the Computer Misuse Act and one charge of concealing criminal property.

The Old Bailey heard how Mudd, of Toms Lane, Kings Langley, Hertfordshire, carried out 595 DDoS attacks against 181 IP addresses, including his own college, West Herts College, having written Titanium Stresser all those years ago.

He went on to rent the use of the malware to anyone who cared to pay for it. His prices, according to court reporters from the Central News Agency, ranged between $3 for up to 100 seconds per month to 30,000 seconds over five years for £309.99, echoing popular as-a-service cloud pricing models.

Mudd had even offered free 60-second DDoS attacks in a “try before you buy” scheme.

In total, he was paid more than £386,000 – mostly in US dollars through Paypal but also including 249.81 Bitcoins – by people using Titanium Stresser. The autistic teenager went to huge lengths to evade Paypal’s attempts to shut him down, setting up no fewer than 328 separate accounts, each using fake details.

“The defendant also used sophisticated techniques to disguise the source of the funds he was receiving, including peer blocking and the use of other websites as payment gateways. Attempts were also made to block PayPal from accessing the sites,” said Crown prosecutor Jonathan Polnay QC.

It was keeping a log of the DDoS attacks that helped the police’s Eastern Region Special Operations Unit’s (Regional Cyber Crime Unit track Mudd down. He had a total of 112,298 registered users who carried out 1,738,828 attacks between them against 666,532 IP addresses. Jagex, the company behind MMORPG Runescape, reportedly spent £6m trying to fend off Titanium Stresser attacks. Mudd himself attacked the site 593 times.

As we noted when he pleaded guilty in November last year, Mudd’s work became the basis of the Lizard Stresser, as used by hacking crew Lizard Squad to take down Xbox Live and the Playstation networks during Christmas 2014.

Mudd initially claimed that he had created Titanium Stressor for stress testing Minecraft servers and that it had got out of hand. He later admitted its true purpose. Ben Cooper, his defence barrister, blamed his behaviour on the relentless bullying he had suffered at school as a result of his Asperger’s Syndrome.

“He was looking to form friendships in the community which he couldn’t do in real life, but he was very successful in doing it in the online community,” Cooper told the Old Bailey on Mudd’s behalf.

Mudd’s sentencing was delayed from the original December date to allow the defence to prepare reports into his autism – and for the prosecution to assess how much damage Titanium Stresser had done.

Judge Michael Topolski, QC, said in his sentencing remarks:

“It’s probably of little comfort to the victims of crime like this that the person responsible may not be motivated by money but by revenge, bravado, a wish to feel big, important or impressive.”

He added:

“I’m satisfied that, [not] withstanding the defendant’s condition, he knew full well he was committing serious crime and that in doing so he was taking a risk with his liberty.”

Detective Inspector Martin Peters of ERSOU’s Regional Cyber Crime Unit said in a statement issued when Mudd was originally found guilty: “Adam Mudd’s case is a regrettable one, because this young man clearly has a lot of skill, but he has been utilising that talent for personal gain at the expense of others.”

Under current British sentencing laws Mudd will spend one year behind bars and the second year of his sentence out on licence. ®