Y’all may be familiar with geeksta rap:

Geeksta rappers… bust rhymes about elite script compiling and dope machine code… Nerdcore now refers to artists waxing lyrical about topics as disparate as engineering and Lord of the Rings…

“50 Cent has dance clubs and oral sex, we have awesome video cards…”

“If the genre is to succeed, you’re going to need some females…” [Wired News]

You may have heard of the Northbridge-Southbridge rap feud:

“Feuds between Nas and Jay-Z, Biggie and Tupac and 50 Cent and Ja Rule have… [resulted] in more exposure for both artists, so I decided to bring this to the world of CS gangsta rap by starting a feud with MC Plus+,” Monzy explained. [Wired News]

Well, all the trash IMs and dis MP3s have finally claimed their first real-life victim. A desi script kiddie from an Edison high school commanded a botnet to attack a rival online vintage jersey shop. The attack took down an entire desi-owned ISP in upstate New York as well as an Internet backbone in Pennsylvania:

… on one day over the summer it knocked out a “backbone provider” of Internet service in eastern Pennsylvania for 12 hours… [Detroit Free Press]

Jasmine (Jasminder?) Singh infected thousands of PCs with a Trojan horse by spreading a file called ‘Jennifer Lopez’ over file sharing networks. Victims expecting to see J.Lo in BootyVision actually ended up letting Singh control their computers.

Early last July, with control over ~2,000 PCs, he commanded them to take down his victim’s Web site:

Soumen Das, owner of a small Internet provider in Pittsford, N.Y. … realized he was on the receiving end of… a flood of traffic so immense that a site has no option but to shut down. What Das didn’t know at the time, and wouldn’t know until months later, was that the attacker was a 17-year-old high school student from Edison…

Singh’s target? A handful of merchants that sell “retro” or “throwback” sports apparel – replicas of shirts and caps worn by teams of yesteryear… His motivation? A few sneakers and a watch. That was the payment offered by Jason Arabo, an 18-year-old community college student in a Detroit suburb. Arabo had his own retro sports apparel business and was hoping to steal customers from his competitors… [Bergen Record]

… an online sports-apparel merchant… told federal authorities that traffic to his site, jersey-joe.com, had been disrupted for several days, at a cost of hundreds of thousands of dollars of lost sales. When customers tried to gain access to the site, they would be greeted with an error message. The attacks continued through the fall of last year and became so severe that they affected service to other customers of the Web-site hosting company used by Jersey Joe. The host company ultimately told Jersey Joe to go elsewhere, as did two other companies that it then tried to use…

Investigators determined that Mr. Singh had spread the rogue software through file-sharing networks like Kazaa, using the Jennifer Lopez come-on, and instructed the zombie computers to attack two of Mr. Arabo’s competitors… His compensation, he said, was three pairs of sneakers and a watch. [NYT]

The attack shut down the rival businesses off and on from July through December last year. The crapflood’s packets had forged sender addresses, so tracing it was futile at first. The FBI managed to make this rare bust only because Das invested in forensics, a $20K anti-DDOS box:

Soon after the first wave in early July, the store’s Internet provider bought a piece of equipment that not only repels denial-of-service attacks, but attempts to decipher the true “IP addresses” of the zombie computers… “We could then go back to the FBI and say, ‘Look, we now have IP addresses that are accurate.’ ” [NYT]

It helped that Soumen Das, who hosted Hyman’s Web site, quickly spent $20,000 on new equipment that yielded crucial clues. It helped that the damage was widespread, rippling far beyond a few small merchants. [Bergen Record]

With the bots’ addresses in hand, the FBI physically tracked down a few infected university PCs and dissected the Trojan. Singh had been unbelievably careless:

The FBI says it caught Pherk because all the bots were communicating with domains with “Pherk” in them and with an IP address linked to a computer in his home. [Courier-Post]

The FBI eventually busted Singh:

The FBI raided Singh’s Edison home in December. Singh admitted that he had launched the attacks at the behest of someone… who praised him for the attacks’ success and said his business was better on the days of the attacks… Two weeks after raiding Singh’s home, the FBI raided Arabo’s Michigan home. He, too, admitted the details of the crime. [NYT]

Had the FBI thought to ask the Sikh guy already on their payroll, there was a huge clue to the perp’s identity right in his nickname. He probably sat there thinking, ‘You’ll never figure it out, you silly Americans‘:

When Arabo started searching for someone to orchestrate a denial-of-service attack against his competitors, he soon learned about “Pherk,” who also used the online name “Jatt.”

Singh pled guilty last month. He faces five years but may get probation. Jason Salah Arabo, whose name implies he may be part of the Arab-American community in Michigan, was charged in March; he faces five to ten years and is out on $50K bail.

How do you prevent some punk from taking over your PC? If you use Windows, click here. In any case, take the following prophylactic cocktail:

• Don’t use file sharing programs unless you’re an advanced user
• Never double-click files you receive in email
• Turn on your operating system’s firewall
• Install free antivirus and anti-spyware programs

Here’s the criminal complaint (PDF) against Arabo. Related posts: 1, 2, 3.