Despite using the outdated Low Orbit Ion Cannon DDoS tool, which most systems should have no problem with, the teen was able to shut down distance learning for the entire district for days.
On Thursday, police arrested a 16-year-old teenager accused of conducting a cyberattack that completely halted online learning in Miami-Dade, the Miami Herald reported . He used a simple, now outdated LOIC (Low Orbit Ion Cannon) program to overwhelm the servers of the country’s fourth largest school district.
The South Miami high school student is accused of orchestrating at least eight of the at least two dozen cyberattacks that paralyzed the district’s first three days of virtual classes, law enforcement officials said Thursday. All cyberattacks ceased around 3:00 am. The teenager’s name was not released because he is a minor.
A house in northwest Miami-Dade where a 16-year-old teenager who was arrested and charged with cyberattacks on Miami-Dade schools lived. Photo: Miami Herald
The ease of the attack alarmed cybersecurity experts, who were surprised that district schools could not withstand such an attack.
The student admitted to using a tool called LOIC, software that is easy to find and download. It is mainly used to attack websites. It’s the same tool that the hacker group Anonymous used a decade ago to launch attacks on companies like MasterCard, Visa and PayPal.
Low Orbit Ion Cannon Interface
Like any other DDoS attack program, LOIC uses lots of random computers to flood a website with data packets.
"It’s like if you own a restaurant and 1,000 people suddenly show up without booking and ordering food," says Barrett Lyon, CEO of cybersecurity firm Netography. "You’ll have a lot of clients coming in unexpectedly and you’ll have to deal with a huge mess."
Lyon said using primitive LOIC software is the "modern equivalent" of triggering a school fire alarm, but warned that this could only be the start of cyberattacks as more learning takes place online.
"There will be more sophisticated attacks and more sophisticated players who know how to code," said Lyon, who founded Hollywood’s first DDoS protection company in 2003.
The LOIC program isn’t particularly complex, say cybersecurity experts.
Cybersecurity expert Mark Rush said he was surprised that the school district’s servers were unable to deal with the LOIC attack – firewalls on the district’s computer network should be able to detect and process traffic.
"It’s really easy to prevent," Rush said. "The school must be really out of date in their router configuration."
It is easy for teenagers as young as 16 to carry out a DDoS attack on a scale similar to those faced by schools. Using the right search queries, you can find any tools on the Internet, but your identity will most likely be revealed.
Police detectives visited the student’s home shortly before the arrest. According to them, the student confessed, but the conversation was brief, and he did not give motives. The student’s parents were unaware of the attacks and were upset by their son’s arrest. Detectives confiscated a computer and a game console.
The student was released Thursday from the Juvenile Assessment Center into parental custody. His court hearing is scheduled for October 8. The student faces charges of using a computer in an attempt to deceive, as well as a misdemeanor charge of interfering with the activities of an educational institution.