Microsoft hacker avoids jail for multiple cyberattacks

A County Antrim man has been given a suspended sentence for his role in a series of cyber attacks when he was a teenager.

Aaron Sterritt, 24, of Brookfield Gardens, Ahoghill, was given a 26-month sentence suspended for three years when he appeared at Antrim Crown Court.

The allegations related to a series of distributed denial of service (DDoS) attacks in 2016 against Flowplay, Microsoft (Xbox Live), Rockstar Games, Tumblr and the Ottawa Catholic School Board.

Judge Roseanne McCormick KC told the defendant that any further offenses would land him in prison.

A distributed denial of service (DDoS) attack is an attempt to take a website offline by flooding it with internet traffic.

They have the ability to take entire sites offline and are usually performed by automated robots or programs.

To the average user, it appears that the page has simply stopped displaying content.

For businesses, this could mean that the online systems they depend on become unresponsive and may not be able to perform time-critical actions.

Attacks often involve analyzing how a website works before launching an attack.

Past victims include British Airways, the BBC and the Irish National Lottery.

The 24-year-old was also accused of refusing to reveal passwords for his laptop, hard drives and iPhone between December 2017 and June 2020.

The court heard he was linked to the charges through communications, activity on his devices and a speech forensics examiner who was able to link him to YouTube videos.

Judge Roseanne McCormick KC said an aggravating factor in the case was that most of the offenses were committed while the defendant was on bail for a similar incident.

In 2015, when he was just 15 years old, Aaron Sterritt was arrested for his role in the hacking of telecommunications giant TalkTalk.

The fallout from the attack cost the company £77 million.

A pre-sentence report outlined how Sterritt was diagnosed with ADHD and autism as a child and how he faced problems in his home life.

The court heard he has a low likelihood of re-offending and has completed a cyber awareness programme.

Judge McCormick KC said she was “aware of the fact that this is a young offender who has particular problems in his life.

“And remember most of them were committed when he was a child.

She also took into account that the case had been in court for a long time and the defendant had used that time to “improve”.

Judge McCormick said the offenses were “very damaging” and “easily crossed the custodial line”.

However, there were exceptional circumstances – his guilty plea, the amount of time the case had been “hanging over his head” and his low chance of reoffending – led her to suspend the sentence.

After the sentencing, the Police of Northern Ireland said the case required two investigations – one by the PSNI and the other by the National Crime Agency.

Detective Chief Inspector Paul Woods said the cyber attacks in 2016 were “massive” and affected websites and services in the US.

“Aaron Sterritt, a teenager at the time, was one of the suspects and the only one of the group from Northern Ireland.

“The [PSNI] the investigation focused on Sterritt’s role in developing malicious software used to attack networks of vulnerable computer systems worldwide.

“Another version of the malware developed by Sterritt exploited device vulnerabilities to mine the Ethereum cryptocurrency.”

Steve Laval from the NCA’s National Cyber ​​Crime Unit added: “DDoS attacks can have devastating consequences for victims and have become an attractive base crime for criminals like Aaron Sterritt who need little technical knowledge.”