Three Norwich schools probed for weakness by teenage hacker
PUBLISHED: 16:25 05 April 2019 | UPDATED: 16:25 05 April 2019
A teenage hacker probed websites of three Norwich schools for weaknesses and hacked the Instagram account of an Australian ‘influencer’ with 1.3m followers, a court heard.
Elliott Gunton is standing trial accused of offences under the Computer Misuse Act and money laundering after police seized his laptop in April of last year.
But last Thursday, he admitted two offences, Norwich Crown Court heard.
On September 8, 2017, Gunton attacked the Instagram account ‘A Designers Mind’, belonging to Australian designer Phil Darwen.
He had control of the account for two weeks, prosecutor Kevin Barry said, and set up an automatic response which sent “grotesquely offensive” messages to customers of the business.
The 19-year-old had previously used his abilities as a hacker to expose the “back door vulnerability” of TalkTalk, exposing the telecoms company to cyber-attacks.
And between December 2017 and January 2018 he probed the websites of Sprowston High School, Open Academy on Salhouse Road and Thorpe St Andrew School for weaknesses.
There is no evidence their security was breached.
Gunton is now accused of hacking “high tier” Instagram accounts and advertising them for sale on hacker forums for up to $3,000.
When police seized his laptop in April 22 last year, they discovered a wealth of cryptocurrency of more than $380,000.
They also found forum posts and chat logs advertising Instagram accounts for sale, with positive reviews for his services left by other users.
One conversation, on November 13, 2017, revealed an apparent plot to “heist” Australian telecoms giant Telstra.
But Gunton has insisted he made his fortune as a Bitcoin trader, selling “stocks and shares” in the cryptocurrency market.
Matthew McNiff, for Gunton, said the defendant “bragged and boasted” about his hacking exploits online, but had never carried them out with the exception of the hack on Mr Darwen.
“What he was doing was not behaving illegally and he had nothing to hide in his mind,” he said.
“He was a tipster. He was analysing the market.
“If your motive is to steal to sell, the last thing you want to do is destroy its value. That is exactly what he did with Mr Darwen’s account - destroy its value. He set up an auto-reply in relation to the account being taken over that was grotesquely offensive.”
But Mr McNiff suggested no other Instagram accounts were compromised.
“He brags and boasts and makes claims that on occasion are fantasy and on occasions are true.
“There is no evidence to support the puffs he makes about how great and clever he is.
“He lived in the computer world, not the real world. He lived in his bedroom and didn’t have a friendship circle.”
Gunton was being monitored by police at the time of the alleged offences as a requirement for a sexual harm prevention order (SHPO), imposed in June 2016 for possession of indecent images.
Police were checking his laptop every six months, and on April 22 last year they seized his laptop after learning he was applying to have the SHPO removed.
Five days later Gunton wrote in an online chat: “Police got a warrant to search my stuff so I deleted everything.”
Mr McNiff said someone of Gunton’s skill and ability would have “obliterated” incriminating evidence if he had done anything illegal.
Det Con Mark Stratford, of the cyber and serious organised crime directorate, said Gunton was “confident he would not be found out by police”, so became “careless”.
“Mr Gunton’s notoriety at this point within the online community was already well established as a result of previous activity,” he said. “He doesn’t necessarily need to brag.
“He would absolutely have the skill to obliterate evidence. The only reason we would have found anything at all is if he hasn’t followed his clinical forensic process and has become careless.
“It is quite a laboursome process to get to a point where police can find no evidence at all of what has happened on a computer.”
Gunton, of Mounteney Close, is charged with five counts including charges under the Computer Misuse Act 1990,
They include supplying profile user names and email accounts believing that they were likely to be used to commit or to assist in the commission of an offence.
Gunton is also charged with money laundering charges involving crypto currency.
He is also charged with breaching his sexual harm prevention order. Gunton has denied all charges.
The trial continues.