::Trend Micro Threat Resource Center::

23 April 2009

Company hires hacker kid, kid keeps hacking

The seventeen-year-old hacker who gave Twitter a busy weekend earlier in the month was subsequently hired by hosting company exqSoft Solutions, a reward that may have inspired further bad behavior.

"Bad" behavior, in cases like this one might be subjective. Judging from the stream of tweets at exqSoft CEO and founder Travis Rowland, who hired the infamous "mikeyy" (Michael Mooney), he's had to do a lot of justifying.

Shortly after the first mikeyy worm hit Twitter, Rowland implored Biz Stone on Mooney's behalf, hoping Twitter wouldn't sue and saying Mooney did Twitter a favor. Mikeyy himself said the point of his hacking was to alert Twitter, not to do any harm.

Originally Mooney said he hijacked Twitter accounts out of boredom, and stopped because he was getting too much attention. A few days and a job offer later, someone at least calling himself mikeyy was hijacking accounts again and sending messages to Oprah, Ellen Degeneres, and Ashton Kucther, among others. One hijacked tweet proclaimed Twitter should be paying him now.

One tweet said, "Twitter, this sucks! Fix your coding."

And the tweets just kept on going. On Saturday, Mikeyy had hacked into several accounts and was tweeting a standup routine, jokes to the effect of: "If you are born ugly blame your parents, if you died ugly blame your doctor. Womp. mikeyy."

On Twitter, Mikeyy's new boss was quick disavow his company's involvement in the new variant of the mikeyy worm. One particular tweet has that nice I've-created-a-monster ring to it:

"Was just informed new Mikeyy is spamming my website all over Twitter, I did not ask him to do that and can't get a hold of him right now."

That was Friday, and by yesterday, Rowland was defending his hire again saying, Mooney hadn't used "any of the Twitter admin sessions he farmed" to gain complete backend access to Twitter.

Security firm Sophos' Graham Cluley is highly critical of the hire. On the company's blog, Cluley noted that while Mooney proved there was a problem with Twitter, he also proved he was irresponsible. The responsible thing to do is not exploit flaws and cause panic, but to inform Twitter and work with them to fix it.

"ExqSoft Solutions are in effect encouraging other youngsters to behave like irresponsible idiots," wrote Cluley. "The last thing we want is a wave of other kids exploiting software and websites, in the hope that they might be rewarded with a job offer."

And when feds are publicly looking to hire hackers, that's hard logic to argue with.