Mafiaboy grows up: A hacker seeks redemption

Notorious hacker brought down Yahoo, Amazon, Dell and CNN sites in 2000

The Internet attack took Yahoo Inc. engineers by surprise. It came so fast and with such intensity that Yahoo, then the Web's second most-popular destination, was knocked offline for about three hours.

That was on the morning of Feb. 7, 2000. A few months later, 15-year-old Michael Calce was watching Goodfellas at a friend's house in the suburbs of Montreal when he got a 3 a.m. call on his cell phone.

His father was on the line. "They're here," he said.

Calce knew right away what that meant. He had already talked to a lawyer after warning his father, weeks earlier, that he'd knocked offline a string of high profile Web sites -- Amazon, Dell, CNN -- and his attacks had been widely covered in the press.

The former hacker 'Mafiaboy' Michael Calce
The former hacker 'Mafiaboy' Michael Calce is now a legitimate security consultant

Although the late-night visit by the Royal Canadian Mounted Police was not a surprise, Calce said his mind was racing as he walked out to a street corner to wait for a police cruiser to swing by and for a police officer to arrest him. What was going to happen? Would he go to jail?

Calce, who was known at the time only by his online moniker, "Mafiaboy," eventually pleaded guilty to criminal hacking charges. He served time in a group home where he was allowed to attend school and hold a part-time job but was otherwise essentially locked in his room. Calce couldn't use computers, and isolated from friends and family, he "almost hit a state of depression," he said in an interview this week, one of his first since his arrest eight years ago.

"It changed me completely," he said of his time in detention. "I started to think about how I could help society rather than be a detriment."

To hear Calce tell it, it's easy to see what got him into the world of criminal hacking: the power.

At nine and a half years old, he was knocked offline by someone he'd annoyed while hanging out in an AOL chat room looking for pirated software. "I was amazed that somebody was able to do that," he said.

Intrigued, he soon learned how to do the same to others, a practice called "punting."

Three years later, when his best friend was killed in a winter car accident, Calce said he became a darker, more isolated kid.

"It definitely fueled me to not really care about what was going on in the real world," he said.

At 15, he had moved from AOL's chat rooms to the EFnet Internet Relay Chat (IRC) network, where he learned some nasty tricks indeed.

On the day he knocked Yahoo offline, Calce estimated, he had hacked into perhaps 40% of the major universities in the U.S., using attack code that he had picked up online.

His bag of tricks included attacks for the Solaris, HP-UX and Linux operating systems. The BIND (Berkeley Internet Name Domain) software used to manage the Internet's Domain Name System was also a favorite target.

To hit Yahoo, he used a denial-of-service attack, sending the online portal's Web servers a stream of useless information and forcing them to constantly respond, using up precious network bandwidth.

He took denial-of-service attack code written by a hacker named "Sinkhole" and developed a way to remotely train all of his approximately 200 university networks on the same target simultaneously, he said.

Soon Yahoo was offline.

"I really couldn't believe it at first," Calce remembered. "Did I get lucky with that attack, or was my network really that powerful?"

"This is why I continued with my attacks. I thought Yahoo might have been a fluke" he added.

Over at Yahoo, nobody seemed to think that luck was involved.

"It was horrible," said Jeremiah Grossman, who worked in Yahoo's security department at the time. "It worked quite well; it knocked down one of the most stable sites on the Web."

Grossman, now chief technology officer at White Hat Data Security, said he still uses Calce's Yahoo attack as a point of reference when he needs to talk about what kind of bandwidth it takes to knock a site offline.

Denial-of-service attacks may soon be in the news again, security experts said.

Last week, researchers Robert Lee and Jack Louis at security vendor Outpost24 AB said they discovered a major flaw in the Internet's TCP/IP protocol that could allow an attacker to take out a major Web site without first building up the massive network of attacking machines that Calce needed for his crimes.

Calce said one thing is certain: Mafiaboy won't be involved in any new computer attacks. Today he works as a legitimate security consultant, and he's on a book tour this week, having published a tell-all story documenting his criminal career and offering advice on how people can protect themselves from, well, people like him on the Internet.

He wants to help protect regular computer users, he said, because they've now replaced universities and corporations as the major targets of attack. And, clearly, Calce wants to dispel the notion that he was a know-nothing "script kiddie" who used other people's software to wreak havoc on the Internet.

"I want to let everybody know that I acknowledge what I did was wrong," he said. "I just want to share my knowledge with people."

First look: Office 2019’s likeliest new features
Shop Tech Products at Amazon