Teenage hacker who caused global chaos offered bulk buy deals to cyber criminals

A teenager's computer hacking business caused global chaos, cost millions of pounds, and even affected the life of Cambridge University, a British court has heard.

Adam Mudd was just 16 years old when he created his Titanium Stresser programme, which was used to carry out more than 1.7 million attacks on various websites.

He raked in more than £386,000 worth of US dollars and Bitcoins from selling the programme to cyber criminals across the world.

The Old Bailey heard that the student, who lived at home with his parents, was more interested in "status" than the money.

But prosecutor Jonathan Polnay said the effect of his hacking programme was truly global, saying: "Where there are computers there are attacks, almost every major city in the world, with hot spots in France, Paris, around the UK."

Mudd has previously admitted his money-making scheme and appeared at the Old Bailey ahead of his sentencing.

The court heard how the defendant, now aged 20, carried out 594 of the distributed denial of service (DDoS) attacks himself, against 181 IP addresses, between December 2013 and March 2015.

He has admitted security breaches against his college while he was studying computer science.

The attacks on West Herts College brought down the network and cost about £2,000 to investigate but caused "incalculable" damage to work and productivity, the Old Bailey heard.

Mr Polnay said: "This was not a white hat, friendly test to see what was going on."

On one occasion in 2014, the college hacking affected 70 more schools and colleges, including Cambridge University and the universities of Essex and East Anglia as well as local councils.

Mr Polnay said there were more than 112,000 registered users of Mudd's programme who hacked over 666,000 IP addresses. Of those, nearly 53,000 were in the UK.

Among the targets was the fantasy game RuneScape, which had 25,000 attacks.

It cost its owner company £6 million to try to defend itself against DDoS attacks with a revenue loss of £184,000.

Other hacking targets included Minecraft, Xbox Live, and the computer gamers' communications tool TeamSpeak.

The court heard Mudd created Titanium Stresser in September 2013 using a fake name and address in Manchester.

Until September 2015, 16 different computer servers were used to host the TitaniumStresser.net site, the court was told.

The source code for the programme was found in Mudd's computer and listed "the muddfamily" as its founder or owner in the administrator records.

Mudd offered a variety of payment plans to his customers, who had to log in with a username and password.

He offered discounts for bulk purchases of up to $309.99 USD for 30,000 seconds over five years as well as a refer a friend scheme.

But Mr Polnay said: "This is a young man who lived at home. This is not a lavish lifestyle case.

"The motivation around this we tend to agree is about status. The money-making is by the by."

When he was arrested in March 2015, Mudd was in his bedroom on his computer which he refused to unlock before his father intervened.

In police interview, he admitted Titanium Stresser was for DDoS and explained how he avoided PayPal scrutiny as he money laundered his ill-gotten gains.

Mudd has pleaded guilty to one count of doing unauthorised acts with intent to impair the operation of computers, one count of making, supplying or offering to supply an article for use in an offence contrary to the Computer Misuse Act, and one count of concealing criminal property.

Mudd, from Kings Langley, Hertfordshire, is due to be sentenced on a later date.

Judge Michael Topolski QC said the case was of "importance and seriousness" and not to be rushed to judgment.

Mr Polnay said some user payments into PayPal accounts flowed to Mudd, according to an analysis.

There were 48 payments totalling $18,770 into the bank account of the defendant's father, Anthony Mudd, before being transferred on, he said.

The prosecutor asked for a confiscation hearing to be put off until September 22 to deal with proceeds of crime.

Mr Polnay also highlighted psychiatric and psychological reports on Mudd which revealed he had Asperger's Syndrome.

He said it was a mitigating feature in terms of the impact of prison and his culpability for the crime.

But he asserted that the evidence from Skype chat suggested Mudd was "well aware what he was doing was illegal and wrong".

Mudd was supported by his mother and father, who sat in the well of the court.

The court heard the defendant lacked social interaction outside his family and suffered from anxiety.

Judge Topolski asked defence barrister Ben Cooper for more information about what the money transfer to Mudd's father's bank account was about.

But he added: "Overall, I am prepared to sentence your client on the basis this was not the purpose of his criminality.

"It is not acquisitive in a financial sense. What he was seeking to acquire was his position in his world - status."

The judge said he would adjourn sentencing until Tuesday, April 25.

Mitigating, Mr Cooper said Mudd had been "sucked into" the cyber world of online gaming and become "lost in an alternate reality" after withdrawing from school due to bullying.

He said Mudd, who was expelled from college, had been offline for two years, which was a form of punishment for any computer-obsessed teenager.

Mudd, who was described as "bright and high functioning", now understood what he did was wrong but at the time he lacked empathy due to his autistic condition, the court heard.

Mr Cooper said: "This was an unhappy period for Mr Mudd during which he suffered greatly.

"This is someone seeking friendship and status within the gaming community."

Among his online peers there was an "element of bravado and showmanship", he added.

Since being expelled from college and while on bail, Mudd had worked long hours for low pay as a kitchen porter, the court heard.

Mr Cooper highlighted a probation report as he argued for a suspended sentence.

He pointed out the defendant was a low risk of committing more crime and at the heart of his actions was the "emotional void of his private life".

But Judge Topolski raised his role to protect the public from cyber crime and deter others.

He said: "I have a duty to the public who are worried about this, threatened by this, damaged by this all the time... It's terrifying."

Most Read in Business

World Markets