3 Face Hacking Charges in AZ, CA

Monday, September 26, 2011 @ 11:09 AM gHale

An Arizona man is facing charges of stealing data from Sony Pictures Entertainment earlier this year, and two others are looking at charges of participating in a denial-of-service (DoS) attack that temporarily shut down Santa Cruz County servers late last year.

A federal grand jury indicted Cody Andrew Kretsinger, 23, of Phoenix on charges of conspiracy and unauthorized impairment of a protected computer, the FBI said. Kretsinger was not immediately available for comment.

UK Police Bust Hackers
Attackers Prey on Small Organizations
Accused LulzSec Hacker Out on Bail
Busted: FBI Takes On Hackers
Zero Day: UK Cops Bust Hacker

Separately, Christopher Doyon, 47, of Mountain View, Calif., appeared before Magistrate Judge Howard Lloyd in U.S. District Court for the Northern District of California in San Jose, according to the U.S. Department of Justice. Lloyd ordered that a bail study and set a court appearance for September 29 at 1:30 p.m. PT.

Doyon, who investigators said uses the alias “Commander X,” and Joshua John Covelli, 26, of Fairborn, Ohio, are facing charges of conspiracy to cause intentional damage to a protected computer, causing intentional damage to a protected computer, and aiding and abetting by participating in a distributed DoS attack on Santa Cruz County servers December 16, 2010, shutting down the Web site. Officials issued a criminal summons for Covelli, aka “Absolem” or “Toxic,” to appear before Magistrate Paul Grewal in San Jose November 1.

In the Sony case, Kretsinger used proxy services via the hidemyass.com site, designed to offer anonymous Internet access, to probe Sony Pictures Entertainment’s computer systems in May, according to the indictment unsealed in U.S. District Court in Los Angeles last week.

Kretsinger and other co-conspirators looked for vulnerabilities and exploited them by means of a SQL injection attack between May 27 and June 2, the indictment said. They then compromised the Sony system, making “tens of thousands of requests for confidential data,” and released the information from Sony on a public Web site and on Twitter, according to the indictment.

Kretsinger permanently erased the hard drive of the computer he used to conduct the attack, the indictment said. He faces up to 15 years in prison if convicted.

He used the hacker handle “recursion” and officials believe he is a member of the LulzSec hacker group.

The LulzSec group, believed to be a spinoff of the Anonymous group of online activists, had bragged about breaking into Sony Pictures’ system, posting a statement on Pastebin on June 2 and proof of their attack. “We recently broke into SonyPictures.com and compromised over 1,000,000 users’ personal information, including passwords, email addresses, home addresses, dates of birth, and all Sony opt-in data associated with their accounts,” the statement said. “Among other things, we also compromised all admin details of Sony Pictures (including passwords) along with 75,000 ‘music codes’ and 3.5 million ‘music coupons.'”

A week later, Sony said personally identifiable information of 37,500 customers suffered exposure in the breach. The breach was one of a series of attacks targeting Sony and its affiliate sites globally that started in May following a legal spat Sony had with a hacker who had modified his Sony PlayStation 3.

In the San Jose cases, the indictments said the attack on Santa Cruz County servers came from the People’s Liberation Front (PLF), which is associated with the Anonymous group. After the city enacted a law restricting camping in city limits, protesters occupied the courthouse premises and several ended up charged with misdemeanors, the Justice Department said. In retaliation, the PLF organized the DoS attack, the statement said.

Covelli is also separately under indictment in U.S. District Court for the Northern District for allegedly participating in a distributed DoS attack on PayPal in December 2010. His next court appearance in that case is set for November 1 at 9 a.m. PT before Judge Lowell D. Jensen in San Jose. Neither Doyon nor Covelli was immediately available for comment.

Leave a Reply

You must be logged in to post a comment.