Miley Cyrus picture hacker led police to his house

A teen who stole images from the online accounts of actress Miley Cyrus before apparently leaving a hard-to-miss chain of evidence that led police to his house, has pleaded guilty to a separate charge of credit card fraud.

Joshua Holly, now 21, has admitted possession of 200 stolen credit card numbers and to having hijacked 20 celebrity online accounts between 2005 and 2008 to aid in spam marketing that made him at least $110,000.

However, it was his attack on the Myspace and Gmail accounts of actress Miley Cyrus in October 2007, during which he stole a number of revealing images, which proved to be his eventual undoing.

Using the online name ‘TrainReq’, he subsequently boasted of the attack, after trying to sell the images to commercial sites. With no buyers, he posted the images to an online site. He was eventually formally arrested by police in January 2011.

Up to this point the case looks like a simple case of a hacker caught in the act, but the publication of a police affidavit on the case suggests a further unusual dimension to events.

Holly apparently went to reckless lengths to advertise his activities, including posting proof-of-attack screenshots to a website and even detailing his attacks in a phone interview on an Arizona radio show.

Using his TrainReq moniker, Holly also corresponded with Myspace’s security director by email and phone regarding the techniques behind his attack, using his first name and eventually supplying his Gmail address. In return for his security advice, Holly asked that Myspace reactivate a previously suspended account on the service, which turned out to be one associated with his address and name. The profile even contained his photograph.

Whether this was an extraordinary lapse or a deliberate attempt to gain attention is impossible to say but police had enough information to raid his house only weeks later in October 2008. Although Holly admitted to his activities in some detail, subsequent examination of his PC revealed the full extent of his criminal career, including the illegal possession of credit card data.

Interestingly, police have decided to set aside the account hijacking in favour of a prosecution based on the more serious charges relating to the credit cards.

In subsequent exchanges with the judge Aleta A. Trauger this week, Holly reportedly said he believed he was addicted to the thrill of Internet hacking, more evidence of what has turned out to be a psychologically-complex case.

He will be sentenced on 31 October and faces up to 13 years in prison.