Lizard Squad Hacker Avoids Jail Despite 50,000 Attacks

A teenager in Finland has been convicted for carrying out 50,700 “instances of aggravated computer break-ins” or hacking attacks.

Julius Kivimaki was part of the hacking collective Lizard Squad, and reportedly played an integral role in the distributed denial of service (DDoS) attacks that hit Microsoft’s Xbox Live and Sony’s Playstation Network in late 2014 and over the Christmas break.

No Prison

17 year old Kivimaki, who went by the online moniker of “Zeekill” or “Ryan” during his two year crime spree, was still not jailed despite being convicted of more than 50,000 charges related to hacking.

He instead received a two-year suspended prison sentence from the District Court of Espoo, had his computer confiscated, and was ordered to surrender €6,588 (£4,725) worth of property obtained through his crimes.

It seems that Kivimaki’s age when he carried out the attacks could have played a role in him not going to prison. He was arrested by Finland’s National Bureau of Investigation (NBI) in early January, just as another 22-year old Lizard Squad hacker was arrested by police in Twickenham, South West London.

The BBC reported that Judge Wilhelm Norrmann had noted that Kivimaki had only been 15 and 16 when he carried out the crimes in 2012 and 2013.

“[The verdict] took into account the young age of the defendant at the time, his capacity to understand the harmfulness of the crimes, and the fact that he had been imprisoned for about a month during the pre-trial investigation,” said a statement from the court.

Kivimaki reportedly exploited vulnerabilities in Adobe’s ColdFusion software to compromise web servers. Once he was in, he would trawl databases to steal billing and payment card details. He also inserted malware to create a botnet for distributed denial-of-service attacks.

Kivimaki also reportedly bought luxury goods with stolen credit cards, participated in a money-laundering scheme, and took a holiday in Mexico from the proceeds.

Untouchable Hacker God

Yet despite all this, this prolific hacker who used his Twitter profile to describe himself as an “untouchable hacker god”, has managed to avoid prison.

That decision will dismay many in the tech industry.

“The FBI and Finnish authorities combined their forces to identify and bring him to justice,” said security expert Graham Cluley. “The untouchable hacker had his collar felt, and he spent approximately a month incarcerated while the case was investigated. He may have escaped a prison sentence, but chances are that the authorities would have been less sympathetic if he had been over 18 years of age at the time of his offences.”

“But there is a danger that other young hackers might see the headlines of Kivimaki escaping jail, and his cocky online behaviour as a green light for their own criminal activity,” Cluley warned.

Indeed, the Lizard Squad responded to the courts decision not to jail Kivimaki’s by posting a video of the MC Hammer’s hit song, “U Can’t Touch This”.

Lizard Squad came to prominence in 2014 after taking down the online presences of numerous gaming companies, including Blizzard, Activision, and Sony. It also carried out attacks on Facebook, Tinder, Amazon and the Malaysia Airlines website.

It also carried out a bomb threat against a Sony executive in August 2014. A Twitter user named “LizardSquad”, which had claimed responsibility for the attack, and then began posting comments related to Iraq’s ISIS and the “Islamic State”. He tweeted that there might be “explosives” on board a plane carrying a Sony executive. The flight from Dallas to San Francisco was diverted to Phoenix, Arizona.

Are you a security pro? Try our quiz!