Main Page | Bracing for Cyberwar | Hacking Primer | Scenes from the 'Hacker Underground' | Hacking: Two Viewpoints | Timeline | Gallery | News Archive | Discussion | Related Sites

'Coolio' denies February attacks; LAPD plans charges

March 3, 2000
Web posted at: 11:12 a.m. EST (1612 GMT)

In this story: Using computers since he was 3 Hacker message: 'owned by coolio' RELATED STORIES, SITES

By D. Ian Hopper
CNN Interactive Technology Editor

(CNN) - A 17-year-old New Hampshire resident on Friday denied responsibility to the FBI for last month's attacks on major Web sites, but police are planning state charges for the defacement of some other sites.

Dennis F. Moran, who uses the handle "Coolio," admitted that while he has defaced Web sites -- including one of RSA Security, a leading e-commerce encryption company -- he says he did not start the denial of service attacks on Amazon.com, Yahoo!, E*Trade, CNN.com and others. Those attacks denied public access to the sites for several hours each, causing several million dollars in lost revenue, according to the companies.

	ALSO
Defaced version of RSA Security Courtesy of Attrition.org

Several security experts have identified Moran as responsible for the attacks, based on evidence from logs at Stanford University, chat transcripts, and other data. A compromised Stanford University computer was one of the systems used in the attack on Yahoo!, the first company to be hit in the string of attacks.

"He didn't realize I was joking," said Moran of the overheard conversation on Internet Relay Chat. Moran spoke to the Associated Press on Friday.

Moran said the FBI interviewed him twice about two weeks ago.

"At the end, it seemed to me like they realized I'm innocent, but I'm not so sure," he said.

Sources close to the investigation say that they are not close to an arrest and do not yet have evidence to prove that Moran was responsible in some of the attacks.

RESOURCES Check here to see how a denial of service attack works.    ALSO Reno, Freeh: Hacker search riddled with difficulties Denial of service hackers take on new targets Justice Department wants more funds to fight cyber crime TIME: Classic Hackers Decry Heavy-Handed Upstarts Net execs to meet with Clinton     MESSAGE BOARD  Insurgency on the Internet  Cyber-terrorism

The Los Angeles Police Department is also involved in the investigation. In November, the department's D.A.R.E. anti-drug Web site was defaced. The police traced the attack to Moran, according to a police department spokesman.

Moran may face charges for the Dare.org defacement as early as next week, according to Det. Michael Brausam of the department's Financial Crimes Unit.

Pending a discussion today in New Hampshire about whether the teen will be charged there, charges will be filed in California because of the physical location of the Dare.org server. Moran will be charged with unauthorized access and felony vandalism, Brausam told CNN.com.

Moran could face probation, monetary restitution, or even time in juvenile hall because of his age. Dare.org initially estimates its losses at $18,000.

The figure is so high because of Dare.org's downtime, which led to lost contributions. The site also had to be moved to another hosting service, which could not ensure the site's security. Brausam declined to name the service provider.

Brausam has been hunting Moran since December, he said. However, because of conflicting jurisdictions and his status as a minor, the LAPD couldn't get a search warrant executed until recently.

"This kid's sharp," Brausam said of Moran. "I would guess he could get into a high percentage of Web sites. He's very good." Brausam added that Moran has the ability to write his own hacking tools, rather than using the ready-made scripts easily found on the Internet.

After the youth's residence was searched Wednesday, he told investigators he has been using computers since he was 3 years old and spends about 16 hours a day on the Internet, Officer Joe Buscaino of the LAPD said.

Moran and his father, also named Dennis, came to the door of their apartment in downtown Wolfeboro as the father was leaving for work Friday morning. The son has long black hair and was dressed in slacks and an open shirt. He showed off a room that was almost too messy to enter.

Buscaino said Moran told the FBI he had hacked into 100 Web sites. Friday, he acknowledged breaking into three -- the anti-drug site in Los Angeles, a U.S. Commerce Department site for the Chemical Weapons Convention agreement, and RSA Security's site.

Bracing for Cyberwar Hacking Primer Hacking: Two Views Timeline Gallery Discussion TIME: Counterhacking 101 Related Sites

The CWC site contained a threat to the President, which got the Secret Service involved in the case. According to the LAPD, however, they backed out when they found that the suspect was a minor.

On February 13, "Coolio" redirected visitors to RSA's Web site -- which proclaims itself "the most trusted name in e-security" -- to another hacked computer at a university in South America. There, a nearly duplicate hoax site proclaimed: "Trust us with your data! Praise Allah!"

The hacker left the message "owned by coolio," and derided RSA's earlier announcement that it had developed a countermeasure to the types of attacks suffered a week earlier at major commercial Web sites.

The defaced site also left a reference to an RSA product designed to stop denial of service attacks, the type of attack made against e-commerce Web sites in February. That was a taunt against RSA Security and some of the investigators hunting Moran, said Kroll O'Gara security expert Joel de la Garza.

De la Garza has been working with Stanford University to identify the original attacker of the Yahoo! Web site. It is believed that some of the later attacks were done by copycats, but De la Garza still believes that Moran is responsible for the original attacks.

Dennis Moran Sr. said he was shocked when FBI agents first came to his door.

"This happens in the movies, not in real life," he said.

Divorced for years, Moran Sr. lives with his son and two daughters, ages 13 and 15. Though the boy dropped out of high school, he has already earned an equivalency diploma -- ahead of his classmates.

A friend of Moran's who requested anonymity told CNN.com that Moran is intelligent and cocky and that he and his friends regularly drink cough syrup to get high. He also said that Moran defaces Web sites for reasons common to most kids his age -- for fun and notoriety -- and adds that Moran tends to "blow up at the smallest detail." He has been known to flood people for hours - keeping them from writing or seeing anything in a chat -- just because they made fun of him.

The family lives on two floors of a well-kept clapboard building in Wolfeboro. The picturesque town of about 5,000 is on the shore of New Hampshire's largest lake, Winnipesaukee, and bills itself as America's oldest resort.

The Associated Press contributed to this report.

FBI smokes out "Coolio" in computer attacks probe
March 2, 2000
Net crime does pay for cops
February 24, 2000
Avoiding future denial-of-service attacks
February 23, 2000
FBI investigation swamped with tips, continue to seek Midwest 'Coolio'
February 16, 2000
The coming privacy divide
February 24, 2000
Internet2 team seeks speedy apps
February 24, 2000
Insufficient computer security threatens doing business online
February 23, 2000

FBI Home Page
RSA Security Inc.
Stanford University
National Infrastructure Protection Center: CyberNotes
HNN - HackerNewsNetwork

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.