The founder and previous owner of a cybersecurity firm has confessed in court to hiring hackers to carry out a distributed denial-of-service attack.

Tucker Preston, 22, from Macon, Georgia, the previous owner of BackConnect Inc., a company that claims to be “the new industry standard in DDoS mitigation,” pleaded guilty under the terms of a plea agreement to one count of damaging protected computers by transmission of a program, code or command before a court in New Jersey last week.

The DDoS attacks in question were initially exposed by KrebsOnSecurity who obtained a copy of a customer list of vDOS, at the time the world’s most popular DDoS-for-hire service, after the site was hacked. Preston, then 19, was on that customer list.

The vDos hack was prominent news at the time given not only its size but also the exposure of its customers. The hack led to the founders of vDOS also being arrested and jailed in Israel.

The customer list allegedly showed that Preston had used a vDOS account to target a number of companies with DDoS attacks, including the Free Software Foundation. The FSF, a nonprofit organization, had briefly considered working with BackConnect. Preston allegedly launched the DDoS attack after the organization had decided not to do business with the company.

Preston’s downfall, however, related to an unnamed New Jersey firm that was also targeted. “Victim 1 was a company engaged in business in multiple states and kept and maintained servers in the District of New Jersey,” a court statement reads. “Service 1 was an entity that engaged in DDoS attacks. In exchange for a fee, Service 1 would carry out DDoS attacks targetting victims selected by its customers… in or around December 2015, defendant Tucker Preston paid Service 1 to engage in DDoS attacks against Victim 1.”

In a statement, the U.S. Department of Justice noted that the count to which Preston pleaded guilty is “punishable by a maximum penalty of 10 years in prison and a fine of up to $250,000 or twice the gross gain or loss from the offense.” Sentencing is scheduled for May 7.

Image: Arielinson/Wikimedia Commons