textfiles/hacking/stoll.doc

I grabbed these philes of a CD-ROM disk, hope you enjoy, they are interresting.
BTW, Cliff's # is 1-617-495-7149.  Hehehe! L8r dudes,
                                                     Chamelion

Journal:   PC-Computing  Oct 1989  v2 n10 p114(9)

Title:     The Cuckoo's egg. (tracing a hacker) (part 2)
Author:    Stoll, Clifford.

Summary:   When Astronomer Clifford Stoll discovered a subtle breach into the
computer system at the Lawrence Berkeley Labs, Stoll knew he might be dealing
with something big. The hacker was apparently after information with national
security implications.  Stoll set out to find and trap the hacker.  Here, in
Part 2 of his story, Stoll follows the trail to West Germany, closing in on
the invader.

Full Text:

THE STORY SO FAR : Whoever had stolen into the computer system at
the Lawrence Berkeley Labs was after something big.  This hacker scanned for
military secrets, and Clifford Stoll knew he might well be a spy working for
a foreign power.  Astronomer Stoll set out to snare the invader. The trail
began with 75 cents' worth of computing time left unaccounted for.  Stoll
quickly discovered that the hacker was entering via the international
communications company Tymnet-he could be coming from anywhere in the world.
The hacker's dabblings in the LBL computer left other bread crumbs-his
mission was to find information about nuclear arms and SDI.  Stoll assembled
a posse to catch his hacker.  They trailed him as he breached the Milnet, a
network that links military computers.  The hacker tapped into CIA and
National Security Agency systems, and meandered through files at the Anniston
army base and the Navy Research Labs. Stoll and company tracked his progress
by tracing his connections and phone calls.  The mystery man entered Tymnet
over an ITT line, they found, one that came through a communications
satellite over the Atlantic-he was in Europe.  Probing deeper, they learned
that the hacker was using the German Datex network, and they solicited the
help of the Bundespost, the German national post office, to draw the net
tighter. PART II Curious whether other people might have a similar problem
with a hacker, I spent a few hours one early December day searching bulletin
boards on the Usenet network for news about hackers and found one note from
Toronto.  I called the author on the phone-I didn't trust electronic mail.
Bob Orr, the manager of the University of Toronto's physics computers, told a
familiar story.

"Some hackers from Germany have invaded our system, changing programs and
damaging our operating system."

"How'd they get in?" "We collaborate with the Swiss physics lab, CERN.  And a
group of German hackers called the Chaos Club has thoroughly walked through
their computers.  They probably stole passwords to our system and linked
directly to us."

As an aside, Bob mentioned that the Chaos Club might have gotten into the US
Fermilab computer as well.

"One guy uses the pseudonym Hagbard," he told me.  "Another, Pengo.  I don't
know their real names."

Next I called Stanford and asked one of their system managers, Dan Kolkowitz,
if he'd heard anything from Germany.

"Come to think of it, someone broke in a few months ago.  I monitored what he
did and have a listing of him."

Dan read the listing over the phone.  Some hacker with the nom-de-guerre of
Hagbard was sending a file of passwords to some hackers named Zombie and
Pengo.

Hagbard and Pengo again.  I wrote them in my logbook.

One good thing was happening.  One by one, I was making contact with other
people who were losing sleep and slugging down Maalox over the same troubles
that obsessed me.  It was comforting to learn that I wasn't completely alone.

A few days later, I received a call telling me that the German Bundespost had
determined that the hacker came from the University of Bremen.  Soon they
found the account he was using to connect across the Atlantic.  They set a
trap on that account: the next time someone used it, they'd trace the can.

The Germans weren't sining around.  The university would monitor the
suspicious account, and the Bundespost would keep track of the network
activity.  More and more mouseholes were being watched.

Friday, December 19, 1986, at 1:38 p.m., the hacker showed up again.  Stayed
around for two hours, fishing on the Milnet.  A pleasant Friday afternoon,
trying to guess passwords to the Strategic Air Command, the European Milnet
Gateway, the West Point Geography Department, and 70 other assorted military
computers.

I phoned Steve White at Tymnet.  "The hacker's on our computer.  Tymnet's
logical port number 14."

"OK," Steve said.  The usual keyboard clatter in the background. Twenty
seconds elapsed, and he called"Got it!"

Steve had traced a connection from California to Germany in less than a
minute.

"He's not coming from Bremen," he told me.  "Today, he's dialing into
Hannover."

"So where is he? In Bremen or Hannover?" "Wolfgang Hoffman, the Datex network
manager in Germany, doesn't know.  For all we know he could be in Paris,
calling long distance."

Yesterday it was Bremen.  Today Hannover.  Where would he hide tomorrow?

The hacker, I discovered, didn't take holidays; he even logged in on New
Year's Day.  His hacker's celebration was saved on my printers.  I scribbled
notes on the printouts, next to his:

WELCOME TO THE ARMY OPTIMIS DATABASE

PLEASE ENTER A WORD OR 'EXIT'.

/ SDI Looking for SDI dope

THE WORD "SDI" WAS NOT FOUND.  But there's none there

PLEASE ENTER A WORD OR 'EXIT'.

/ STEALTH Any word on the Stealth bomber?

THE WORD "STEALTH" WAS NOT FOUND.  No such luck

PLEASE ENTER A WORD OR 'EXIT'.

/ SAC Strategic Air Command?

THE WORD "SAC" WAS NOT FOUND.  Nope

PLEASE ENTER A WORD OR 'EXIT'.

/ NUCLEAR

THANK YOU.

I HAVE FOUND 29 DOCUMENT(S) CONTAINING THE PHRASE 'NUCLEAR'.

ITEM* MARKS* TITLE

1 20-lF IG INSPECTIONS (HEADQUARTERS, DEPART

MENT OF THE ARMY)

2 50A NUCLEAR, CHEMICAL, AND BIOLOGICAL NATION

AL SECURITY AFFAIRS

3 50B NUCLEAR, CHEMICAL, AND BIOLOGICAL WAR

FARE ARMS CONTROLS

4 50D NUCLEAR AND CHEMICAL STRATEGY

FORMULATIONS 5 50E NUCLEAR AND CHEMICAL POLITICO-MILITARY

AFFAIRS 6 5OF NUCLEAR AND CHEMICAL REQUIREMENTS

7 5OG NUCLEAR AND CHEMICAL CAPABILITIES

8 50H THEATER NUCLEAR FORCE STRUCTURE

DEVELOPMENTS 9 501 NUCLEAR AND CHEMICAL WARFARE BUDGET

FORMULATIONS 10 50J NUCLEAR AND CHEMICAL PROGRESS AND STA

TISTICAL REPORTS 11 50K ARMY NUCLEAR, CHEMICAL, AND BIOLOGICAL

DEFENSE PROGRAM 12 50M NUCLEAR AND CHEMICAL COST ANALYSES

13 5ON NUCLEAR, CHEMICAL WARFARE, AND BIOLOGI

CAL DEFENSE SCIENTIFIC AND TECHNICAL

INFORMATION 14 50P NUCLEAR COMMAND AND CONTROL

COMMUNICATIONS

15 50Q CHEMICAL AND NUCLEAR DEMILITARIZATIONS

16 5OR CHEMICAL AND NUCLEAR PLANS

17 50-5A NUCLEAR ACCIDENT/INCIDENT CONTROLS

18 50-5B NUCLEAR MANPOWER ALLOCATIONS

19 50-5C NUCLEAR SURETY FILES

20 50-5D NUCLEAR SITE RESTORATIONS

21 50,5-lA NUCLEAR SITE UPGRADING FILES

22 50-115A NUCLEAR SAFETY FILES

23 55-355FRTD DOMESTIC SHIPMENT CONTROLS

24 200-IC HAZARDOUS MATERIAL MANAGEMENT FILES

25 385-11K RADIATION INCIDENT CASES

26 385-11M RADIOACTIVE MATERIAL LICENSING

27 385-40C RADIATION INCIDENT CASES

28 700-65A INTERNATIONAL NUCLEAR LOGISTICS FILES

29 1125-2-300A PLANT DATA

And he wasn't satisfied with the titles to these documents-he dumped all 29
over the line printer.  Page after page was filled with army doubletalk.  At
one point, my printer jammed.  The old DECwriter had paid its dues for the
past ten years and now needed an adjustment with a sledgehammer.  Damn.
Right where the hacker had listed the army's plans for nuclear bombs in the
central European theater, there was only an ink blot.

Around noon on Sunday, January 4, my beeper sounded.  I jumped for the
computer, checked that the hacker was around, then called Steve White.
Within a minute, he'd started the trace.

The hacker tried the Air Force Systems Command, Space Division, and managed
to log in as Field Service: not as an ordinary user but as one

with a completely privileged account.

His first command was to show what privileges he'd

garnered.  The air force computer responded automatically: System Privilege,
and a slew of other rights, including the ability to read, write, or erase
any file on the system.

He was even authorized to run security audits on the air force computer.  I
could imagine him sitting behind his terminal in Germany, staring in
disbelief at the screen.  He didn't just have free run of the Space Command's
computer; he controlled it.

Confident that he was undetected, he probed nearby computers.  In a moment,
he'd discovered four on the air force network and a pathway to connect to
others.  From his high ground, none of these were hidden from him; if their
passwords weren't guessable, he could steal them by setting up Trojan horses.

This wasn't a little desktop computer he'd broken into.  He found thousands
of files on the system, and hundreds of users.

He commanded the air force computer to list the names of all its files; it
went merrily along typing out names like "Laser-design-plans" and
"Shuttlelaunch-manifest." But he didn't know how to shut off the spigot.  For
two hours, it poured a Niagara of information onto his terminal.

Finally, at 2:30, he hung up.  While the hacker stepped through the air force
computer, Steve White traced Tymnet's lines.  I asked Steve for the details.

"I checked with Wolfgang Hoffman at the Bundespost.  Your visitor is coming
from Karlsruhe today.  The University of Karlsruhe."

My hacker was moving around.  Or maybe he was staying in one place, playing a
shell game with the telephone system.  Perhaps he was a student, visiting
different campuses and showing off to his friends.  Was I certain that there
was only one hacker-or was I watching several people?

Two days later, the hacker was back.  He went straight over thc Milnet to the
Air Force Space Division.  I watched him log in as Field Service.

He didn't waste a minute.  He went straight to the authorization software,
searched for an old, unused account, and modified it, giving it system
privileges and a new password: AFHACK.

AFHACK-what arrogance.  He's thumbing his nose at the United States Air
Force.

From now on, he didn't need the field service account.  Disguised as an
officer in the air force, he had unlimited access to the Space Division's
computer.

A call to Steve White started a trace rolling.  Within five minutes, he'd
traced the connection to Hannover and called the Bundespost.

A few minutes of silence then: "Cliff does the con

nection look like it will be

a long one?"

"I can't tell, but I think so," I said.

"OK." Steve was on another telephone; I could hear only an occasional shout.

In a minute, Steve returned to my fine.  "Wolfgang is tracing the call in
Hannover.  It's a local call.  They're going to try to trace it all the way."

Here's news! A local call in Hannover meant that the hacker was somewhere in
Hannover.

Steve shouted instructions from Wolfgang: "Whatever you do, don't disconnect
the hacker.  Keep him on the line if you can!"

But he's rifling files at the air force base.  It was like letting a burglar
rob your home while you watched.

He went for operational plans.  Documents describing air force payloads for
the space shuttle. Test results from satellite detection systems.  SDI
research proposals.  A description of an astronaut-operated camera system.

Tymnet came back on the I'm sorry, Cliff, but the trace in Germany is
stymied."

"Can't they trace the call?" "Well, the hacker's line comes from Hannover,
all right," Steve replied.  "But Hannover's phone fines connect through
mechanical switches-noisy, complicated widgets-and these can be traced only
by people, not by computers."

Another opportunity lost.  I cut off the hacker's connection so that he
couldn't do more harm.

Later, Steve White explained that American telephones are computer
controlled, so it's pretty easy to trace them.  But in Germany they need
someone at the Hannover exchange to trace the call.

"So we can't trace him unless the hacker calls during the day or evening?" I
asked.

"Worse than that.  It'll take an hour or two to make the trace once it's
started."

Lately, the hacker had been showing up for five minutes at a time.  Long
enough to wake me up, but hardly enough for a two-hour trace.  How could I
keep him on for a couple of hours?

The answer, I realized, was disarmingly simplegive him what he wants: all the
classified data, all the top-secret information he could gather.  Not for
real, of course.  Instead, I'd create a phony database.  Its documents would
describe a new Star Wars project.  An outsider reading them would believe
that Lawrence Berkeley Laboratories had just landed a fat government contract
to manage a new computer network.  The SDI Network.

This bogus network, which would apparently link together scores of classified
computers,would extend to military bases around the world.  By reading the
files, you'd find lieutenants and colonels, scientists and engineers.  Here
and there, I would drop hints of meetings and classified reports.

And I invented Barbara Sherwin, the sweet, bumbling secretary trying to
figure out her new word processor and keep track of the endless stream of
documents produced by our newly invented "Strategic Defense Initiative
Network Office."

My snare was baited.  If the hacker bit, he'd take two hours to swallow the
bait.  Long enough for the Germans to track him down.

The next move was the hacker's.

My beeper sounded at 5:14 p.m., Friday, January 16.  There's the hacker.

It didn't take him very long to swallow the hook; soon he broke into my phony
SDInet.  Quickly, I got on the phone to Steve White.

"Steve, call Germany.  The hacker's on, and it'll be a long session."

"Spot-on, Cliff.  Call you back in ten minutes." For the next 45 minutes, the
hacker dumped out file after file, reading all the garbage that I had
created.  Boring, tedious ore, with an occasional nugget of technical
information.

Then he dumped the file named FORM LETTER:

DEAR SIR:

THANK YOU FOR YOUR INQUIRY ABOUT SDINET.  WE ARE HAPPY TO COMPLY WITH YOUR
REQUEST FOR MORE INFORMATION ABOUT THIS NETWORK.  THE FOLLOWING DOCUMENTS ARE
AVAILABLE FROM THIS OFFICE.  PLEASE STATE WHICH DOCUMENTS YOU WISH MAILED TO
YOU:

#37.6 SDINET OVERVIEW DESCRIPTION DOCUMENT

19 PAGES, REVISED SEPT.  1985

#41.7 STRATEGIC DEFENSE INITIATIVE AND COMPUTER NETWORKS:

PLANS AND IMPLEMENTATIONS (CONFERENCE NOTES) 227 PAGES, REVISED SEPT.  1985

#45.2 STRATEGIC DEFENSE INITIATIVE AND COMPUTER NETWORKS:

PLANS AND IMPLEMENTATIONS (CONFERENCE NOTES) 300 PAGES, JUNE 1986

#47.3 SDINET CONNECTIVITY REQUIREMENTS

65 PAGES, REVISED APRIL 1986

#48.8 How TO LINK INTO THE SDINET

25 PAGES, JULY 1986

#49.1 X.25 AND X.75 CONNECTIONS TO SDINET (INCLUDES JAPA

NESE, EUROPEAN, AND HAWAIIAN NODES) 8 PAGES, DECEMBER 1986 #55.2 SDINET
MANAGEMENT PLAN FOR 1986 TO 1988

47 PAGES, NOVEMBER 1985

#62.7 UNCLASSIFIED SDINET MEMBERSHIP LIST (INCLUDES MAJOR

MILNET CONNECTIONS) 24 PAGES, NOVEMBER 1986

#65.3 CLASSIFIED SDINET MEMBERSHIP LIST

9 PAGES, NOVEMBER 1986

#69.1 DEVELOPMENTS IN SDINET AND SDI DISNET

28 PAGES, OCTOBER 1986

SINCERELY YOURS,

MRS.  BARBARA SHERWIN

DOCUMENTS SECRETARY

SDINET PROJECT

Steve White called back from Tymnet.  "I've traced your connection over to
the University of Bremen.  And the Bundespost has traced the Datex line from
Bremen into Hannover.  In the past half hour, the technician traced the line
and has narrowed it down to one of 50 telephone numbers."

"Why can't they get the actual number?" "Wolfgang's unclear about that.  It
sounds like they've determined the number to be from a group of local phones,
but the next time they make a trace, they'll zero in on the actual telephone.
From tile sound of Wolfgang's message, they're excited about solving this
case."

The next day, at 10:17 a.m., the hacker came back.  This time, he wasn't
interested in SDI files.  Instead, he went out over the Milnet, trying to
break into military computers.

He was concentrating on air force and army computers, though he occasionally
knocked on the navy's door as well.  Places I'd never heard of, like the Air
Force Weapons Lab, Descom headquarters, Air Force CC OIS, and the CCA-amc.
Fifty places, all without success.

Then he slid across the Milnet into a computer named Buckner.  He got right
in .  .  .  didn't even need a password on the account named "guest."

He'd broken into the Army Communications Center in Building 23, Room 121, of
Fort Buckner.  Fort Buckner was in Okinawa.

What a connection! From Hannover, Germany, the hacker linked to the
University of Bremen, across a transatlantic cable into Tymnet, then into my
Berkeley computer, and into the Milnet, finally reaching Okinawa.

A bit after 11 in the morning, he finally grew tired and logged off.

While he'd circled the globe with his spiderweb of connections, the German
Bundespost had homed in on him.

The phone rang-had to be Steve White.  "Hi Cliff," Steve said, "The trace is
complete." "The Germans got the guy?" "They know his phone number." "Well,
who is he?" I asked.

"They can't say right now, but you're supposed to tell the FBI."

"Just tell me this much," I asked Steve.  "Is it a computer or a person?"

"A person with a computer at his home.  Or should I say, at his business."

Days later, Tymnet passed along a chilling message: "This is not a benign
hacker.  It is quite serious.  The scope of the investigation is being
extended.  Thirty people are now working on this case.  Instead of simply
breaking into the apartments of one or two people, locksmiths are making keys
to the houses of the hackers, and the arrests will be made when the hackers
cannot destroy the evidence.  These hackers are linked to the shady dealings
of a private company."

Throughout the spring, I kept making new bait.  My mythical Barbara Sherwin
created memos and letters, requisitions and travel orders.  Here and there,
she sprinkled a few technical articles, explaining how the SDI network
interconnected all sorts of classified computers.

On Monday, April 27, came one of the biggest shocks.  A letter arrived,
addressed to the imaginary Barbara Sherwin.

Triam International, Inc.

6512 Ventura Drive

Pittsburgh, PA 15236 April 21, 1987

Dear Mrs.  Sherwin:

I am interested in the following documents.  Please send me a price list and
an update on SDI Network Project.  Thank you for your cooperation.

Very truly yours,

Laszlo J.  Balogh

Balogh then asked for every phony document I had made up in the file called
FORM LETTER.

Someone had swallowed the bait and was asking for more information! I could
understand it if the letter came from Hannover.  But Pittsburgh?

I called Mike Gibbons at the Alexandria FBI office and told him about it.

"OK," Mike said.  "Listen up carefully.  Don't touch that letter.
Especially, don't touch around the edges.  Go find a glassine envelope.
Gently insert the paper in the envelope.  Then express mail it to me.
Whatever you do, don't handle it.  Wear gloves if you must."

This sounded like Dick Tracy's "Crimestoppers," but I followed orders.

A hacker in Hannover, Germany, learns a secret from Berkeley, California.
Three months later, a Hungarian named Laszlo Balogh living in Pittsburgh
writes us a letter.  What's happening here? Tuesday moming, June 23, Mike
Gibbons called from the FBI.

"You can close up shop, Cliff." "What's happened?" "Arrest warrants were
issued this morning at IO." "Anyone arrested?" "I can't say." Something was
happening.  But Mike wouldn't say what.

A few hours later, Wolfgang Hoffman sent a message: "An apartment and a
company were searched, and nobody was home at the time.  Printouts, disks,
and tapes were seized and will be analyzed in the next few days.  Expect no
further break-ins."

Finally, it was over.  The FBI still wasn't talking, but I managed to fmd out
who the Germans had fingered; I could now attach a name to the shadowy hacker
I had chased across two continents: Markus Hess.

So what really happened? Was Hess working alone, or was he in league with
others? And why was he breaking into defense department computers? Here's my
estimate, based on interviews, police reports, newspaper accounts, and
messages from German computer programmers.

In the mid-1980s, a dozen hackers started the Chaos Computer Club, whose
members specialized in creating viruses, breaking into computers, and serving
as a computer counterculture.  Through electronic bulletin boards and
telephone links, they anonymously exchanged phone numbers of hacked
computers, as well as stolen passwords and credit cards.

Markus Hess knew of the Chaos Club, although he was never a central figure
there.  Rather, he kept his distance as a freelance hacker.  During thc day,
he worked at a small software firm in downtown Hannover.

Over a crackling phone connection, an astronomer friend in Hannover explained
to me, "You see, Hess knew Hagbard, who kept in touch with other hackers in
Germany, Eke Pengo and Frimp.  Hagbard is a pseudonym, of course, his real
name is .  .  .  "

Hagbard.  I'd heard that name before-he'd broken into Fermilab and Stanford.

Hagbard worked closely with Markus Hess.  The two drank beers together at
Hannover bars and spent evenings behind Hess's computer.

Apparently, Hess apparently just played around the networks at first,
searching for ways to connect around the world.  Like a ham-radio operator,
he started out a hobbyist, trying to reach as far away as possible.  In the
beginning, he managed to connect to Karlsruhe; later he reached Bremen over
the Datex network.

Soon he discovered that many system managers hadn't locked their back doors.
Usually these were university computers, but Markus Hess began to wonder: how
many other systems were wide open? What other ways could you sneak into
computers?

By September 1985, Hagbard and Pengo were routinely breaking into computers
in North America: mostly high energy physics labs, but a few NASA sites as
well.  Excitedly, Hagbard described his exploits to Hess.

Hess began to explore outside of Germany.  But he no longer cared about
universities and physics laboratories-he wanted some real excitement.  Hess
now targeted the military.

The leaders of the Chaos Computer Club had issued a warning to their members:
"Never penetrate a military computer.  The security people on the other side
will be playing a game with you almost like chess.  Remember that they've
practiced this game for a long time.  .  .  .  " Markus Hess wasn't
listening.

Hess apparently found his way into an unprotected computer belonging to a
German subsidiary of U.S.  defense contractor Mitre.  Once inside that
system, he discovered detailed instructions to link into Mitre's computers in
Bedford, Massachusetts, and McLean, Virginia.

By summer 1986, Hess and Hagbard were operating separately but frequently
comparing notes. Meanwhile, Hess worked in Hannover, programming VAX
computers and managing several systems.

Hess soon expanded his beachhead at Mitre.  He explored the system
internally, then sent out tentacles into other American computers.  He
collected telephone numbers and network addresses and methodically attacked
these systems.  On August 20, he struck Lawrence Berkeley Labs.

Even then, Hess was only fooling around.  He'd realized that he was privy to
secrets, both industrial and national, but kept his mouth shut.  Then, around
the end of September, in a smoky Hannover beergarden, he described his latest
exploit to Hagbard.

Hagbard smelled money.  And Hagbard knew who to contact: Pengo, in West
Berlin.

Pengo, with his contacts to hackers across Germany, knew how to use Hess's
information. Carrying Hess's printouts, one of the Berlin hackers crossed
into East Berlin and met with agents from the East German
Staatssicherheitsdienst-the Secret Service.

The deal was.  made: around 30,000 deutschemarks-$18,000-for printouts and
passwords.

From there, who knows what happened to the information? The East German
Secret Service cooperates closely with the Soviet KGB; surely the
Staatssicherheitsdienst would tell the KGB about this new form of espionage.

The KGB wasn't just paying for printouts, though.  Hess and company
apparently sold their techniques as well: how to break into VAX computers;
which networks to use when crossing the Atlantic; details on how the Milnet
operates.

Even more important to the KGB was obtaining research data about Western
technology, including integrated circuit design, computer-aided
manufacturing, and, especially, operating system software that was under U.S.
export control.  They offered 250,000 deutschemarks for copies of Digital
Equipment's VMS operating system.

According to the German television station NDR, the Berlin hackers supplied
much of this order, including source code to the Unix operating system
designs for high-speed gallium-arsenide integrated circuits, and computer
programs used to engineer computer memory chips.  Hagbard wanted more than
money.  He demanded co

caine.  The East German Secret Service was a willing supplier.

Hagbard passed some of the money (but none of the cocaine) to Hess in retum
for printouts, passwords, and network information.  Hagbard's cut went toward
paying his telephone bill which sometimes ran over $1,000 a month as he
called computers around the world.

Hess saved everything.  He kept a detailed notebook and saved every session
on a floppy disk. This way, after he disconnected from a military computer,
he could print out the interesting parts and pass these along to Hagbard and
on to the KGB.

Also on the KGB's wish list was SDI data.  As Hess searched for it, I
naturally detected SDI showing up in his requests.  And I had fed Hess plenty
of SDI  fodder.

But could the East Germans (or KGB?) trust these printouts? How could they be
sure Hagbard wasn't inventing all of this to feed his own coke habit?

The KGB decided to verify the German hacker ring.  The mythical Barbara
Sherwin served as a perfect way to test the validity of this new form of
espionage.  She had, after all, invited people to write to her for more
information.

But secret services don't handle things directly.  They use intermediaries.
The East Germans (KGB?) contacted another agency-either the Hungarian or
Bulgarian intelligence service.  They, in tum, apparently had a professional
relationship with a contact in Pittsburgh: Laszlo Balogh.

Does the FBI have enough evidence to indict Laszlo Balogh? They won't tell
me.  But the way I see it, Laszlo's in deep trouble: the FBI is watching him,
and whoever's pulling his puppet strings isn't pleased.

The West German police, though, have plenty of evidence against Markus Hess.
Printouts, phone traces, and my logbook.  When they broke into his apartment
on June 29, 1987, they seized a hundred floppy disks, a computer, and
documentation describing the U.S.  Milnet.

But when the police raided Hess's apartment, nobody was home.  Though I was
waiting patiently for him to appear on my computer, the German police entered
his place when he wasn't connected.

At his first trial, Hess got off on appeal.  His lawyer argued that since
Hess wasn't connected at the moment his apartment was raided, he might not
have done the hacking.  This, along with a problem in the search warrants,
was enough to overtum the case against Hess on computer theft.  But the
German federal police continued to investigate.

On March 2, 1989, German authorities charged five people with espionage:
Pengo, Hagbard, Peter Carl, Dirk Bresinsky, and Markus Hess.

Peter Carl met regularly with KGB agents in East Berlin, selling any data the
others could find.

When the German officials caught up with him, he was about to run off to
Spain.  He's now in jail, waiting for trial, along with Dirk Bresinsky, who
was jailed for desertion from the German army.

Pengo is having second thoughts about his years working for the KGB.  He says
that he hopes he "did the right thing by giving the German police detailed
information about my involvement." But as long as there's an active criminal
case, he'll say no more.

All the same, the publicity hasn't helped Pengo's professional life as a
computer consultant. His business partners have shied away from backing him,
and several of his computing projects have been canceled.  Outside of his
business losses, I'm not sure that he feels there's anything wrong with what
he did.

Today, Markus Hess is walking the streets of Hannover, free on bail while
awaiting a trial for espionage.

Hagbard, who hacked with Hess for a year, tried to kick his cocaine habit in
late 1988.  But not before spending his profits from the KGB: he was deep in
debt and without a job.  In spring 1989 he found a job at the office of a
political party in Hannover.  By cooperating with the police, he and Pengo
avoided prosecution for espionage.

Hagbard was last seen alive on May 23, 1989.  In an isolated forest outside
of Hannover, police found his chaffed bones next to a melted can of gasoline.
A borrowed car was parked nearby, keys still in the ignition.

No suicide note was found.

Journal:   PC-Computing  Sept 1989  v2 n9 p112(8)

Title:     The cuckoo's egg. (excerpts from book on hacker espionage)
Author:    Stoll, Clifford.

Full Text:

Me, a wizard?

Until a week before, I had been an astronomer, contentedly designing
telescope optics.  But then I found myself transferred from the Keck
Observatory at the Lawrence Berkeley Lab (LBL) down to the computer center in
the basement of the same building.

On either side of my new cubicle were the offices of two systems people,
Wayne Graves and Dave Cleveland, the old hands of the system.  Together,
Wayne, Dave, and I were to run the computers as a labwide utility.  We
managed a dozen mainframe computers-giant workhorses for solving physics
problems, together worth around $6 million.  The scientists using the
computers were supposed to see a simple, powerful computing system, as
reliable as the electric company.  This meant keeping the machines running
full-time, around the clock.  And just like a utility company, we charged for
every cycle of computing that was used.

On my second day, Dave was mumbling about a hiccup in the Unix accounting
system.  Someone must have used a few seconds of computing time without
paying for it.  The computer's books didn't quite balance; last month's bills
of $2,387 showed a 75-cent shortfall.

Now, an error of a few thousand dollars is obvious, and isn't hard to find.
But errors in the pennies column arise from deeply buried problems, so
finding these bugs is a natural test for a budding software wizard.

Around about 7 p.m., my eye caught the name of one user, Hunter. This guy
didn't have a valid billing address.  Ha! Hunter had used 75 cents of time in
the past month, but nobody had paid for him.  Here was the source of our
imbalance.  Someone had screwed up while adding a user to our system.  A
trivial problem caused by a trivial error.

A day later, an obscure computer named Dockmaster sent us an electronic-mail
message.  Its system manager claimed that someone from our laboratory had
tried to break into his computer over the weekend.  I guessed Dockmaster was
some navy shipyard.  It wasn't important, but it seemed worth spending a few
minutes looking into.

The message gave the date and time when someone on our Unix computer tried to
log in to Dockmaster's computer.  Our stock Unix accounting file showed a
user, Sventek, logging in to our system at 8:25, doing nothing for half an
hour, and then disconnecting.  No time-stamped activity in between.  Our
homebrew software also recorded Sventek's activity, but it showed him using
the networks from 8:31 until 9:01 a.m.

Jeez.  Another accounting problem.  The timestamps didn't agree. One recorded
activity when the other account said everything was dormant.

Why were the two accounting systems keeping different times? And why was some
activity logged in one file without showing up in the other? Was this related
to the earlier accounting problem? Had I screwed things up when I poked
around before? Or was there some other explanation-was there a hacker on the
loose?

So how do you find a hacker? I figured it was simple: just watch for anyone
using Sventek's accounts, and try to trace the connection.  I spent Thursday
watching people log in to the computer.  I wrote a program to beep my
terminal whenever someone connected.

At 12:33 on Thursday afternoon, Sventek logged in.  I felt a rush of
adrenaline, then a complete letdown when he disappeared within a minute.
Where was he? The only pointer left for me was the identifier of his
terminal: he had used terminal port tt23.  I suspected a dial-in modem,
connected fRom some telephone line, but it might conceivably be someone at
the laboratory.

By lucky accident, the connection had left some footprints behind.  Paul
Murray, a reclusive hardware technician who hides in thickets of telephone
wire, had been collecting statistics on how many people used our
communications switchyard.  By chance he had recorded the port numbers of
each connection for the past month.  Since I knew when Sventek was active on
port tt23, we could figure out where he came from.  The printout of the
statistics showed a one-minute, 1,200-bit-per-second connection had taken
place at 12:33.

Any lab employee here on the hill would run at high speed-9,600 or 19,200
bps.  Only someone calling through a modem would let his data dribble out a
1,200-bps soda straw.  But how to catch him? About the only place to watch
our incoming traffic was in between the modems and the computers.  Our modem
lines were flat, 25-conductor wires, snaking underneath the switchyard's
false floor.  A printer or personal computer could be wired in parallel with
each of these lines, recording every keystroke that came through.

A kludge? Yes.  Workable? Maybe.

All we'd need were 50 teletypes, printers, and portable computers.  I rounded
them up; strewn with four dozen obsolete teletypes and portable terminals,
the floor looked like a computer engineer's nightmare.  I slept in the
middle, nursing the printers and computers.  Each was grabbing data from a
different line, and whenever someone dialed our system, I'd wake up to the
chatter of their typing.  Every half-hour, a printer would run out of paper
or a computer out of disk space, so I'd have to roll over and reload.
Saturday morning, a coworker shook me awake. "Well, where's your hacker?"

The first 49 printers and monitors showed nothing interesting.  But from the
50th trailed 80 feet of printout.  During the night, someone had sneaked in
through a hole in the operating system.

For three hours a hacker had strolled through my system, reading whatever he
wished.  Unknown to him, my DECwriter had saved his session on singlespaced
computer paper.  Here was every command he issued, every typing mistake, and
every response from the computer.

This printer monitored the line from Tymnet, a communications company that
interconnected computers around the world.  Our hacker might be anywhere.

How the Cuckoo Laid Its Egg

The hacker had become a super-user.  He was like a cuckoo bird.  The cuckoo
is a nesting parasite that lays her eggs in other birds' nests: some other
bird will raise her young.  The survival of cuckoo chicks depends on the
ignorance of other species.  Our mysterious visitor had laid an egg-program
into our computer, letting the system hatch it and feed it privileges.

That morning, the hacker wrote a short program to grab privileges.  Normally,
Unix won't allow such a program to run, since it never gives privileges
beyond what a user is assigned.  But if our hacker ran this program from a
privileged account, he'd become privileged.  His problem was to masquerade
this special program-the cuckoo's egg-so that it would be hatched by the
system.

Every five minutes, the Unix system executes its own program called atrun.
In turn, atnin schedules other jobs and does routine housecleaning tasks.  It
runs in a privileged mode, with the full power and trust of the operating
system behind it.  If a bogus atrun program were substituted, it would be
executed within five minutes, with full system privileges.  For this reason,
atrun sits in a protected area of the system, available only to the system
manager.  Nobody else has license to tamper with atrun.

Here was the cuckoo's nest: for five minutes he would swap his egg for the
system's atrun program.  For this attack, he needed to find a way to move his
egg-program into the protected systems nest.  The operating system's barriers
are built specifically to prevent this.  But there was a wildcard that we'd
never noticed.

We used a powerful editing program called GnuEmacs.  But Gnu's much more than
just a text editor-it's a foundation upon which other programs can be built.
It even has its own mail facility built in.  just one problem: there's a bug
in that software.

Because of the way it was installed on our Unix computer, the Gnu-Emacs
editor lets you forward a mail file from your own directory to anyone else's.
It doesn't check to see who's receiving it, or even whether they want the
file.  No problem to send a file from your area to mine.  But you'd better
not be able to move a file into the protected systems area: only the systems
manager is allowed there.

Gnu didn't check.  It let anyone move a file into protected systems space.
The hacker knew this; we didn't.  He used Gnu to swap his special atrun file
for the system's legitimate version. Five minutes later, the system hatched
his egg, and he held the keys to my computer.

In front of me, the first few feet of the printout showed the cuckoo
preparing the nest, laying the egg, and waiting for it to hatch.  The next 70
feet showed the fledgling cuckoo testing its wings.

As a super-user, he had the run of our system and could read anybody's work.
By studying several scientists' command files and scripts, he discovered
pathways into other lab computers. Every night, our computer automatically
calls 20 others, to exchange mail and network news.  When the hacker read
these phone numbers, he learned 20 new targets.

I had to weave a net fine enough to catch the hacker but coarse enough to let
our scientists through.  I'd have to detect the hacker as soon as he came
online and call Tymnet's technicians to trace the call.

If I knew the stolen account names, it would be easy to write a program that
watched for the bad guy to show up.  No need to check out every person using
the computer; just ring a bell when a stolen account was in use.  But I also
had to stay invisible to the hacker, so I wrote the program for a new Unix-8
system we had just installed.  I could connect it to our local area network,
secure it against all possible attacks, and let it watch the other computers,
all the while recording the traffic on printers.

Wednesday afternoon, September 3, 1986, marked a week since we'd first
detected the hacker. Suddenly, the terminal beeped twice: Sventek's account
was active.  I ran to the switchyard; the top of the ream of paper showed
that the hacker had logged in at 2:26 and was still active.

Logged in as Sventek, he first listed the names of everyone connected.
Lucky-there was nobody but the usual gang of physicists and astronomers; my
watchdog program was well concealed within the Unix-8 computer.

He didn't become a super-user; rather, he checked that the Gnu-Emacs file
hadn't been modified. At 2:37, 11 minutes after logging in, he abruptly
logged off.  But not before we'd started the trace.

Ron Vivier traces Tymnet's network within North America 'In a couple of
minutes he had traced the connection from LBL's Tymnet port into an Oakland
Tymnet office, where someone had dialed in.

It's easier to call straight into our Berkeley lab than to go through
Oakland's Tymnet office. Calling the local Tymnet access number instead of
our lab was like taking the interstate to drive three blocks.  But calling
via Tymnet added one more layer to trace.  Whoever was at the other end of
the line knew how to hide.

The morning after we had watched the hacker break in to our system, my boss
met with Aletha Owens, the lab's attorney.  She wasted no time in calling the
FBI.

Our local FBI office didn't raise an eyebrow.  Fred Wyniken, special agent
with the Oakland resident agency, asked incredulously"You're calling us
because you've lost 75 cents in computer time?" Owens tried explaining
information security and the value of our data.  Wyniken interrupted, "Look,
if you can demonstrate a loss of more than a million dollars, or that
someone's prying through classified data, then we'll open an investigation.
Until then, leave us alone."

Wednesday, September 10, at 7:51 a.m., the hacker appeared in our system for
six minutes.  I wasn't at the lab to watch, but the printer saved three pages
of his trail.  He logged in to our computer from Tymnet as Sventek, then
jumped into another network.  Using Milnet, a network that links military
computers, he connected to address 26.0.0.113.  He logged in there as Hunter,
checked that they had a copy of Gnu-Emacs, and disappeared.

The hacker left an indelible trail downstream to the Redstone Army Depot in
Anniston, Alabama, the home of the army's Redstone missile complex2,000 miles
from Berkeley.  He listed files at the Anniston system.  judging from the
dates of these files, he'd been in Anniston's computers since early June.
For four months, an illegitimate system manager had been using an army
computer.  Yet he'd been discovered by accident, not through some logic bomb
or lost information.

Looking closely at the morning's printout, I saw that, on the Anniston
computer, the hacker had changed Hunter's password to Hedges.  A clue at
last: of zillions of possible passwords, he'd chosen Hedges.  Hedges Hunter?
Hunter Hedges? A hedge hunter?

Time was running out; if I didn't catch the hacker soon, the lab would shut
down my tracking operation and put me on other work.  At 2:30 in the
afternoon, the printer advanced a page and the hacker logged in with a new
stolen account, Goran.  A minute after the hacker connected, I called the
phone company and Ron Vivier at Tymnet.  I took notes as Ron mumbled.  "He's
coming into your port 14 and entering Tymnet from Oakland.  It's our port
322, which is, uh, let me see here." I could hear him tapping his keyboard.
"Yeah, it's 2902.  430-2902.  That's the number to trace.'

The phone company, by law, couldn't reveal information about the trace to me,
but my printers showed his every move.  While I talked to Tymnet and the
telephone techs, the hacker had prowled through my computer.  He wasn't
satisfied reading the system manager's mail; he also snooped through mail for
several nuclear physicists.

After 15 minutes of reading our mail, he jumped back into Goran's stolen
account, using a new password, Benson.  He started a program that searched
our users' files for passwords; while that executed, he called up the Milnet
Network Information Center and asked for a pathway into the CIA.

Instead of their computer, though, he found four people who worked at the
CIA.  Later, I phoned one of them.

I didn't know where to begin.  How do you introduce yourself to a spy?

"Uh, you don't know me, but I'm a computer manager, and we've been following
a computer hacker."

"Uh-huh." "Well, he searched for a pathway to try to get into the CIA's
computers.  He found your name and phone number."

"Who are you?" Nervously, I told him, expecting him to send over a gang of
hit men in trench coats.  I described our laboratory, making sure he
understood that the People's Republic of Berkeley didn't have official
diplomatic relations with his organization.

He sent over a delegation several days later.  OK, so they didn't wear trench
coats.  Not even sunglasses.  just boring suits and ties.  Wayne saw the four
of them walk up the drive and flashed a message to my terminal: "All hands on
deck.  Sales reps approach through starboard portal. Charcoal gray suits.
Set warp speed to avoid IBM sales pitch." If only he knew.

The four spooks introduced themselves.  One guy in his fifties said he was
there as a "navigator" and didn't give his name-he just sat there quietly the
whole time.  The second spy, Greg Fennel, I guessed to be a computer jockey,
because he seemed uncomfortable in a suit.  The third agent, Teejay, was
built like a halfback.  The fourth guy must have been the bigwig: everyone
shut up when he talked.  Together, they looked more like bureaucrats than
spies.

The four of them sat quietly while we gave them an overview of what we'd
seen.  Mr.  Big nodded and asked, "What keywords has he scanned for?"

"He looks for words like password, nuclear, SDI, and Norad He's picked some
curious passwords: lblhack hedges, jaeger, hunter, and benson.  The accounts
he stole, Goran, Sventek, Whitberg, and Mark don't say much about him,
because the names are people here at the laboratory."

Mr.  Big nodded and asked, "Tell me, what did he do at Anniston?"

"I don't have much of a printout there," I said.  "He was into their system
for several months, perhaps as long as a year.  Now, since he knows they've
detected him, he logs in only for a moment."

Mr.  Big fidgeted a bit, meaning that the meeting was about to break up.
Greg asked one more question.  "What machines has he attacked?"

"Ours, of course, and the army base in Anniston.  He's tried to get into
White Sands Missile Range, and some navy shipyard in Maryland.  I think it's
called Dockmaster."

"Shit!" Greg and Teejay simultaneously exclaimed.  Greg said, "How do you
know he hit Dockmaster?"

"About the same time he screwed up our accounting, this Dockmaster place sent
us a message saying that someone had tried to break in there."

"Did he succeed?" "I don't think so.  What is this Dockmaster place, anyway?
Aren't they some navy shipyard?"

They whispered among themselves, and Mr.  Big nodded.  Greg explained:
"Dockmaster isn't a navy shipyard.  It's run by the National Security
Agency."

A hacker breaking into the NSA? Bizarre.  This wanted to get into the CIA,
the NSA, army missile bases, and the North

American Air Defense headquarters.  "Dockmaster is NSA's only unclassified
computer," Greg said.

"It belongs to its computer security group, which is actually public."

Mr.  Big started talking slowly.  "There's not much we can do about this
affair.  I think there's no evidence of foreign espionage."

"Well, who should be working on this case?" I asked.

"The FBI.  I'm sorry, but this isn't our bailiwick.  Our entire involvement
has been the exposure of four names-names that are already in the public
domain, I might add."

Then they were gone.

The spooks were no help, so I was on my own again.  I searched the Berkeley
phone book for Jaegers and Bensons; I figured I ought to try Stanford as
well.  So I stopped by the library. Maggie Morley, our 45-year-old
documentmeister, plays rough-and-tumble Scrabble: posted on her door is a
list of all legal three-letter Scrabble words.

"I need a Stanford telephone book," I I'm looking for everyone in Silicon
Valley named Jaeger or Benson."

'Jaeger.  A word that's been kind to me," Maggie smiled.  "Worth 16 points,
but I once won a game with it, when the [J] landed on a triple-letter score.
Turned into 75 points."

"Yeah, but I need it because it's the hacker's password.  Hey, I didn't know
names were legal in Scrabble."

"Jaeger's not a name.  Well, maybe it's a nameEllsworth jaeger, the famous
omithologist, for instance-but it's a type of bird.  Gets its name from the
German word meaning hunter."

"Huh? Did you say hunter?"

"Yes.  Jaegers are hunting birds that badger other birds with full beaks.
They harass weaker birds until they drop their prey."

"Hot ziggity! You answered my question.  I don't need the phone book."

"Well, what else I can do for you?"

"How about explaining the relationship between the words hedges, jaeger,
hunter, and benson?"

"Well, jaeger and hunter is obvious to anyone who knows German.  And smokers
know Benson & Hedges."

Omigod-my hacker smokes Benson & Hedges.  Maggie had won on a triple-word
score.

During one of the phone traces, I had copied down all the numbers and digits
I heard from the technician.  I called all combinations of them and ended up
at a computer modem at Mitre, a defense contractor just down the road from
CIA headquarters in McLean, Virginia.  How deeply was Mitre's system
infested? By listing its directory, I saw that the hacker had created a
Trojan horse there on June 17.  For six months, someone had silently
booby-trapped Mitre's computers.

In alllikelihood, Mitre served as a way station, a stepping-stone on the way
to breaking into other computers.  Someone dialed into Mitre, turned around,
and dialed out from it.  This way, Mitre paid the bills both ways: the
incoming Tymnet connection and the outgoing long-distance phone call.  Even
nicer, Mitre served as a hiding place, a hole in the wall that couldn't be
traced.

Monday morning, I called a man named Bill Chandler at Mitre and told him the
news.  Bill wanted me to be quiet about the problems I had found.  Well, yes,
but I had a price.

"Say, Bill, could you send me copies of your computer's phone bills?"

"What for?" "It might be fun to see where else this hacker got into."

Two weeks later, a thick envelope arrived, stuffed with long-distance bills
from Chesapeake and Potomac.  Six months of phone bills.  Dates, times, phone
numbers, and cities.  Probably 5,000 in all.  So many that I couldn't analyze
them by hand.  Perfect for analyzing on a computer-there's plenty of software
designed to search out correlations.  All I had to do was enter them into my
Macintosh computer and run a few programs.

Ever type 5,000 phone numbers? It's as boring as it sounds.  And I had to do
it twice, to make sure I didn't make any mistakes.  Took me two days.

After running an analysis, I found that this hacker hadn't just broken into
my computer.  He was into more than six, and possibly a dozen.

From Mitre, the hacker had made long connections to Norfolk, Oak Ridge,
Omaha, San Diego, Pasadena, Livermore, and Atlanta.

At least as interesting: he had made hundreds of one-minute phone calls, all
across the country.

To air force bases, navy shipyards, aircraft builders, and defense
contractors.  What can you learn from a oneminute phone call to an army
proving ground?

For six months, this hacker had been breaking into bases and computers all
across the country. Nobody knew it.  He was out there, alone, silent,
anonymous, persistent, and apparently successful-but why? What was he after?
What had he already learned? And what was he doing with this information?
Friday, December 5, the hacker showed up again at 1:21 in the afternoon.
Nine minutes later, he disappeared.

Enough time for me to trace the connection to Tymnet.  But the network's
sorcerer, Ron Vivier, was taking a long lunch that day, so

Tymnet couldn't make the trace.  Another chance lost.

Ron returned my call an hour later.

"Hey, Cliff, how come you never call me at night?"

"Guess the hacker doesn't show up at night.  I wonder why." He started me
thinking.  My logbook recorded every time the hacker had shown up.  On the
average, when was he active?

I'd remembered him on at 6 a.m.  and at 7 p.m.  But never at midnight.  Isn't
midnight operation the very image of a hacker?

On the average, the hacker showed up at noon, Pacific time.  So what did this
mean? Suppose he lives in California.  Then he's hacking during the day.  If
he's on the East Coast, he's three hours ahead of us, so he works around 3 or
4 in the afternoon.

This didn't make sense.  He'd work at night to save on long-distance
telephone fees.  To avoid network congestion.  And to avoid detection.  Yet
he brazenly breaks in during the day.  Why?

When it's noon in California, I wondered, where is it evening? Lunchtime in
Berkeley is bedtime in Europe.  Was the hacker coming from Europe?

On a Saturday afternoon, the hacker hit again.  I called Tymnet's Ron Vivier
at home.

"I've got a live one for you," I gasped.  "Just trace my port  14."

"Right.  It'll take a minute." A couple of eons passed, and Ron came back on
the line.  "Hey, Cliff, are you certain that it's the same guy?,"

I watched the hacker searching for the word ]DI on our computer"Yes, it's
him."

"He's coming in from a gateway that I've never heard of.  I'm locked onto his
network address, so it doesn't matter if he hangs up.  But the guy's coming
from somewhere strange."

"Where's that?"

"I don't know.  It's Tymnet node 3513, which is a strange one.  I'll have to
look it up in our directory." In the background, Ron's keyboard clicked.
"Here it is.  Your hacker is coming from outside the Tymnet system.  He's
entering Tymnet from a communications line operated by the International
Telephone and Telegraph company."

"So what?"

"ITT takes a Westar downlink, the communications satellite over the Atlantic.
It handles ten or twenty thousand phone calls at once."

"So my hacker is coming from Europe?"

"For sure."

"Where?"

"That's the part I don't know, and I probably can't find out.  But hold on,
and I'll see what's there." More keyboard clicks.

Ron came back to the phone.  "Well, ITT identifies the line as DSEA 744031.
That's their line number.  It can connect to either Spain, France, Germany,
or Britain."

"Well, which is it?" "Sorry, I don't know.  In three days they'll send us
billing information, and then I can find out.  Meantime, I can't tell you
much more than that."

Ron rang off, but the hacker was still on my computer, trying to chisel into
the Navy Research Labs, when one of Tymnet's international specialists, Steve
White, called.

"Ron can't trace any farther," Steve said.  "I'll do the trace myself"

I kept watching the hacker on my screen, hoping that he wouldn't hang up
while Steve made the trace.

Steve came back on the line.  In his modulated, almost theatrical British
accent, he said, "Your hacker has the calling address DNIC dash 2624 dash
542104214."

"So where's the hacker coming from?"

"West Germany.  The German Datex network."

"What's that?"

"It's their national network to connect computers together.  We'll have to
call the Bundespost to find out more."

"Who's the Bundespost?"

"They're the German national postal office.  The government communications
monopoly."

Steve seemed pessimistic about completing a successful "We know where he
connects into the system.  But there's a couple of possibilities there.  The
hacker might be at a computer in Germany, simply connected over the German
Datex network.  If that's the case, then we've got him cold, We know his
address, the address points to his computer, and the computer points to him."

"It is unlikely.  More likely, the hacker is coming into the German Datex
network through a dial-in modem."

Just like Tymnet, Datex let anyone dial into its system and connect to
computers on the network.

Perfect for businesspeople and scientists.  And hackers.

"The real problem is in German law," Steve said.  "I don't think they
recognize hacking as a crime."

"You're kidding, of course." "No," he said.  "A lot of countries have
outdated laws.  In Canada, a hacker who broke into a computer was convicted
of stealing electricity, rather

than trespassing.  He was prosecuted only because the connection had used a
microwatt of power from the computer."

Steve's pessimism was contagious.  But his trace jogged my spirits.  So what
if we couldn't nail the hacker-our circle was closing around him.

Germany.  I remembered my librarian recognizing the hacker's password.
"Jaeger-it's a German word meaning hunter." The answer had been right in
front of me, but I'd been blind.

Some details were still fuzzy, but I understood how he operated. Somewhere in
Europe, the hacker called into the German Datex network.  He asked for
Tymnet, and the Bundespost made the connection.  Once he reached the States,
he connected to my laboratory and hacked his way around Milnet.

Mitre must have been his stopover point.  Now I realized why Mitre paid for a
thousand one-minutelong phone calls.  The hacker would connect to Mitre and
instruct the system to phone another computer.  When it answered, he would
try to log in with a default name and password. Usually he failed and went on
to another phone number.  He'd been scanning computers, with Mitre picking up
the tab.

But he'd left a trail.  On Mitre's phone bills.

The path led back to Germany, but it might not end there.  Conceivably,
someone in Berkeley could have called Berlin, connected to the Datex network,
connected through Tymnet, and come back to Berkeley.  Maybe the start of the
path was in Mongolia.  Or Moscow.  I couldn't tell.  For the present, my
working hypothesis would be Germany.

And he scanned for militaly secrets.  Could I be following a spy? A real spy,
working for them-but who's "them"?

Three months ago, I'd seen some mouse droppings in my accounting files.
Quietly we'd watched this mouse sneak through our computer, out through a
hole, and into the military networks and computers.

At last I knew what this rodent was after.  And where he was from.  I'd been
mistaken.

This wasn't a mouse.  It was a rat.