The Cuckoo’s Egg

Markus Hess

The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage’ is a 1989 book written by Clifford Stoll, an astronomer turned systems administrator of the computer center of the Lawrence Berkeley Laboratory (LBL) in California. It is his first-person account of the hunt for a computer hacker who broke into a computer at the lab.

In August of 1986 his supervisor asked him to resolve a US$0.75 accounting error in the computer usage accounts. He traced the error to an unauthorized user who had apparently used up nine seconds of computer time and not paid for it, and eventually realized that the unauthorized user was a hacker who had acquired root (high-level) access to the LBL system by exploiting a vulnerability in the movemail function of the original GNU Emacs (an open-source computer program that moves a user’s mail to another file).

Over the next ten months, Stoll spent a great deal of time and effort tracing the hacker’s origin. He saw that the hacker was using a 1200 baud connection and realized that the intrusion was coming through a telephone modem connection. Over the course of a long weekend he rounded up fifty terminals, mostly by ‘borrowing’ them from the desks of co-workers away for the weekend, and teleprinters and physically attached them to the fifty incoming phone lines. When the hacker dialed in that weekend, Stoll located the phone line, which was coming from the Tymnet routing service. With the help of Tymnet, he eventually tracked the intrusion to a call center at MITRE, a defense contractor in McLean, Virginia.

Stoll left a teleprinter attached to the intrusion line in order to see and record everything the hacker did. He watched as the hacker sought, and sometimes gained unauthorized access to military bases around the United States, looking for files that contained words such as ‘nuclear’ or ‘SDI.’ The hacker also copied password files (in order to make dictionary attacks) and set up Trojan horses to find passwords. Stoll was amazed that on many of these high-security sites the hacker could easily guess passwords, since many system administrators never bothered to change the passwords from their factory defaults. Even on military bases, the hacker was sometimes able to log in as ‘guest’ with no password.

Over the course of this investigation, Stoll contacted various agents at the FBI, CIA, NSA, and Air Force OSI. Since this was one of the first documented cases of a computer break-in — he seems to have been the first to keep a daily logbook of the hacker’s activities — there was some confusion as to jurisdiction and a general reluctance to share information. Studying his log book, Stoll saw that the hacker was familiar with VMS, as well as AT&T Unix. He also noted that the hacker tended to be active around the middle of the day, Pacific time. He hypothesized that since modem bills are cheaper at night, and most people have school or a day job and would only have a lot of free time for hacking at night, the hacker was in a time zone some distance to the east.

With the help of Tymnet and agents from various agencies, Stoll eventually found that the intrusion was coming from West Germany via satellite. The Deutsche Bundespost, the German post office, also had authority over the phone system, and they traced the calls to a university in Bremen. In order to entice the hacker to reveal himself, Stoll set up an elaborate hoax — known today as a ‘honeypot’ — inventing a fictitious department at LBL that had supposedly been newly formed because of an SDI contract. He knew the hacker was mainly interested in SDI, so he filled the ‘SDInet’ account with large files full of impressive-sounding bureaucratese. The ploy worked, and the Deutsche Bundespost finally located the hacker at his home in Hanover. The hacker’s name was Markus Hess, and he had been engaged for some years in selling the results of his hacking to the Soviet KGB. There was ancillary proof of this when a Hungarian spy contacted the fictitious SDInet at LBL by mail, based on information he could only have obtained through Hess: Apparently this was the KGB’s method of double-checking to see if Hess was just making up the information he was selling them. Stoll later flew to Germany to testify at the trial of Hess and a confederate.

Tags:

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.