Dennis Moran (computer criminal)
Middlesex County, Massachusetts, United States
|Died||April 14, 2013 (30–31)
Berkeley, California, United States
|12 months in jail with 3 months suspended as well as ordered to pay $15,000 USD in restitution.|
|Conviction(s)||4 counts of Class A misdemeanor unauthorized access of a computer|
Dennis M. Moran (1982–April 14, 2013), also known by his alias Coolio, was an American computer hacker from Wolfeboro, New Hampshire, who was accused in February 2000 of a series of denial-of-service attacks that shut down some of the most popular websites on the Internet. He was later arrested and pled guilty to defacing the websites of DARE and RSA Security, as well as unauthorized access of the U.S. Army and Air Force computer systems at four military bases.
On February 7, 2000, a smurf attack generating over 1 gigabit per second of ICMP traffic was launched against Yahoo!'s routers, causing their websites to be inaccessible to the world for hours. In a message sent to the CERT, Yahoo! network engineer Jan B. Koum stated that the attackers were "above your average script kiddie" and "knew about our topology and planned this large scale attack in advance."
Shortly thereafter, Stanford University's computer security administrator David Brumley began monitoring Internet Relay Chat (IRC) traffic on irc.stanford.edu, which was then a public server on the EFnet IRC network. He discovered discussions about the attack on Yahoo! taking place which led him to believe members of an IRC channel had information about the source of the attacks, and he contacted the FBI to give them transcripts of the IRC chat.
Over the following week a series of equally crippling denial-of-service attacks affected many other major internet sites including eBay, Amazon.com, E*TRADE, and Buy.com. A security consultant named Joel de la Garza also began investigating the IRC channel and while he was in the channel, RSA Security's website was redirected to a hacked web server in Colombia with a defaced copy of their home page. The defacement included a reference to David Brumley's nickname on IRC, as he had joined the channel by then in an attempt to gather more information from Moran. De la Garza witnessed this live show of criminal activity and later reported about it to the media. On March 5, 2000, the FBI raided Moran's house and seized his computers. Despite the incriminating chat transcripts and possession of the contents of his computers, Moran was not charged with any crime by federal prosecutors.
After having so much attention drawn to him, and de la Garza's account of Moran being responsible for defacing RSA's website, the FBI investigated Moran's connections to other website defacements. Eventually they passed this evidence on to the New Hampshire Attorney General's office and Moran was charged as an adult with 7 counts of Class A felony unauthorized access of a computer. One year later, on March 9, 2001, he pled guilty to 4 counts of misdemeanor unauthorized access of a computer and was sentenced to 12 months in jail with 3 months suspended as well as ordered to pay $15,000 USD in restitution. His arrest took place in Wolfeboro, New Hampshire.
Moran died of a heroin overdose on April 14, 2013, aged 30, in Berkeley California, news of which was posted on the drug discussion website bluelight.org. Members of the forum described him as popular and intelligent, though one suggested he had been contemplating suicide.
- "Hacker sentenced, must program jail computers". USA Today. 6 February 2002 Updated 05:22 PM ET. Retrieved August 23, 2008. Check date values in:
- Bob Sullivan (March 9, 2000). "'Coolio' arrested for defacing site". News.com. Retrieved August 23, 2008.
- Brian McWilliams (February 11, 2000). "Yahoo!: Attackers Knew Our Weaknesses". InternetNews. Retrieved August 1, 2008.
New information released by Yahoo! suggests some of the denial of service attacks on Web sites over the past week may have come from sophisticated attackers with knowledge of each site's network.
- "FBI investigation swamped with tips, continue to seek Midwest 'Coolio'". CNN News. February 16, 2000 Web posted at: 12:34 p.m. EST (1734 GMT). Retrieved August 1, 2008. Check date values in:
- "Tracking Web site attacker requires persistence, technology and luck". CNN News. February 25, 2000. Retrieved August 1, 2008.
- "RIP Coolio". bluelight.org. April 16, 2013. Retrieved April 22, 2013.