8/19/2019 FBI New Haven Field Office

1/2

FBI New Haven Field Office – Computer Analysis and Response Team:

Tracin! a Computer Intruder

Facts

> In the header information the 'From' address was dierent when compared

to the 'Reply-To' address

> This was being passed through a hosting site called hosting4u.net

> FI traced the owner of the I! address of hosting site to "ommuniTech#et

> $isco%ered that site hosted an e-mail spoo&ng site to hide sender identity

> "ourt order to otmail.com for information on boatingct(hotmail.com

FBI's Top three National Security priorities

!rotect the )nited *tates from terrorist attac+s

 To counter foreign intelligence operations against the )nited *tates

!rotect the )nited *tates against cyber-based attac+s and high

technology crimes

Additional Information

- boatingct(hotmail.com account belonged to,

 ason *mith #ame changed to protect I$/

0ocation - 0os-1ngeles2 "1

from I! - 35.35.63.75

I! source, *eoul2 8orea

Registration $ate, 37 1pril2 355

day prior to e-mail being sent/

FI *eal curtosy of

https,99pbs.twimg.com9pro&le:images9;5

8/19/2019 FBI New Haven Field Office

2/2

> FI noticed a suspicious string B..9..9..9..9..9..9..9..9B

> 1fter research2 it was found that the string allowed an eploit on the

Ceb*tore software which oating"T.com was using for their store

> FI noti&ed oating"T.com of this eploit and the patch a%ailable released

< months prior/ to & %ulnerabilities

> I!'s from %arious countries were used to access the order log &les of

oating"T.com using this %ulnerability

#ore Di$$in$

> "ombining the details from otmail and oating"T.com logs it was found

that a proy ser%er in "alifornia was used to access the Borders.logB &les

> The I! address of proy ser%er was registered to Road Runner in erndon2

Dirginia

> *ubseEuent court orders were &led for that location and the results foundwere,

-*ubscriber, *tudent at )ni%ersity of 1+ron

CASE S%VED

Carrant Issued

> FI in "onnecticut drafted a warrant for student in @hio and sent to local

unit

> FI found student in a frat house and the computer partially disassembled

> 1fter inter%iewing the student admitted to hac+ing oating"T.com

> FI reco%ered bro+en unreadable/ master dri%e as well as readable sla%edri%e

> @n sla%e dri%e data was found pro%ing intrusion into oating"T.com

- une 72 3553 the student entered guilty plea

- Title )* "ode 575 a4/

- *entenced to, 3-months in prison and G352555 in restitution

- *er%ed only