The Cuckoo's Egg

by Clifford Stoll

Roy Kerth had shown me the high-energy particle detectors attached to the Bevatron: they find jillions of subatomic interactions, and 99.99 percent are explainable by the laws of physics. Spending your time exploring each particle trail will lead you to conclude that all the particles obey known physics, and there’s nothing left to discover. Alternatively, you could throw away all the explainable interactions, and only worry about those that don’t quite satisfy the canonical rules. Astronomers, distant cousins of high-energy physicists, work along similar lines. Most stars are boring. Advances come from studying the weirdies—the quasars, the pulsars, the gravitational lenses—that don’t seem to fit into the models that you’ve grown up with. Knowing cratering statistics on the planet Mercury tells you how often the planet was bombarded in the early solar system. But study the few craters intersected by scarps and ridges and you’ll learn how the planet shrank as it cooled during its first billion years. Collect raw data and throw away the expected. What remains challenges your theories. Well, let’s apply this way of thinking to watching someone visiting my computer. I’ve got a terminal on my desk, and can borrow a couple others. Suppose I just watched the traffic coming into the computer center. There’s about five hundred lines entering the system. Most of these lines run at 9600 baud, or around one hundred fifty words per second. If half the lines are used at any time, I’d h...

Saturday morning, Roy Kerth shook me awake. “Well, where’s your hacker?” Still in my sleeping bag, I must have smelled like a goat. I blinked stupidly and mumbled something about looking at the fifty piles of paper. He snorted, “Well, before you start poking around those printouts, return those printers. You’ve been running around here like a maniac swiping equipment used by people who are getting work done. You’ve pissed off a dozen astronomers. Are you getting work done? No. Whaddya think this place is, your own personal sandbox?” Bleary-eyed, I dragged each printer back to its rightful owner. The first forty-nine showed nothing interesting. From the fiftieth trailed eighty feet of printout. During the night, someone had sneaked in through a hole in the operating system.

Richard Stallman, a free-lance computer programmer, loudly proclaimed that information should be free. His software, which he gives away for free, is brilliantly conceived, elegantly written, and addictive. Over the past decade Stallman created a powerful editing program called Gnu-Emacs. But Gnu’s much more than just a text editor. It’s easy to customize to your personal preferences. It’s a foundation upon which other programs can be built. It even has its own mail facility built in. Naturally, our physicists demanded Gnu; with an eye to selling more computing cycles, we installed it happily. Just one problem: there’s a bug in that software. In the way it was installed on our Unix computer, the Gnu-Emacs editor lets you forward a mail file from your own directory to anyone else in an unusual way. It doesn’t check to see who’s receiving it, or even whether they want the file. It just renames the file and changes its ownership label. You’ve just transferred ownership of the file from you to me. No problem to send a file from your area to mine. But you’d better not be able to move a file into the protected systems area: only the system manager is allowed there. Stallman’s software had better make sure this can’t happen. Gnu didn’t check. It let anyone move a file into protected systems space. The hacker knew this; we didn’t. The hacker used Gnu to swap his special atrun file for the system’s legitimate version. Five minutes later, the system hatched his egg, and he held the ...

“You saw that guy typing in the ps -eafg command, right?” “Yeah, here’s the printout,” I replied. “It’s just an ordinary Unix command to list all the active processes—‘ps’ means print status, and the four letters modify the display. In a sense, they’re like switches on a stereo—they change the way the command works.” “Cliff, I can tell you’re used to Berkeley Unix. Ever since Berkeley Unix was invented, we’ve mechanically typed ‘ps’ to see what’s happening on the system. But tell me, what do those four letters modify?” Dave knew my ignorance of obscure Unix commands. I put up the best front I could: “Well, the e flag means list both the process name and environment, and the a flag lists everyone’s process—not just your process. So the hacker wanted to see everything that was running on the system.” “OK, you got half of ’em. So what are the g and f flags for?” “I dunno.” Dave let me flounder until I admitted ignorance. “You ask for a g listing when you want both interesting and uninteresting processes. All the unimportant jobs, like accounting will show up. As will any hidden processes.” “And we know he’s diddling with the accounting program.” Dave smiled. “So that leaves us with the f flag. And it’s not in any Berkeley Unix. It’s the AT&T Unix way to list each process’s files. Berkeley Unix does this automatically, and doesn’t need the f flag. Our friend doesn’t know Berkeley Unix. He’s from the school of old-fashioned Unix.”

Most personal computers satisfy the needs of their owners, and don’t need to talk to other systems. For word processing, accounting spread-sheets, and games, you really don’t need any other computers.

There are lots of dated statements here from when the Internet was in its relative infancy. I highlighted them for entertainment purposes.

In 1969, the Defense Advanced Research Projects Agency’s (DARPA) experiments evolved into the Arpanet and then into the Internet: an electronic highway interconnecting a hundred-thousand computers around the world. In the world of computing, the Internet is at least as successful as the interstate system. Both have been overwhelmed by their success, and everyday carry traffic far beyond what their designers dreamt. Each regularly inspires complaints of traffic jams, inadequate routes, shortsighted planning, and inadequate maintenance. Yet even these complaints reflect the phenomenal popularity of what was an uncertain experiment only a few years ago.

Of note, traffic issues have, for the end user, been all but solved.

At first, DARPA’s network was simply a testbed to prove that computers could be linked together. Since it was seen as an unreliable experiment, universities and laboratories used it, and mainstream military people ignored it. After eight years, only a few hundred computers connected into the Arpanet, but gradually, others were attracted by the network’s reliability and simplicity. By 1985 the network directory listed tens of thousands of computers; today, there must be over one hundred thousand.

Over 100,000!!! Wow, so many!

But there’s not much difference between the military and academic nets, and gateways let traffic flow between them. Indeed, any Arpanet user can connect to any Milnet computer without so much as an invitation. Together, the Arpanet, Milnet, and a hundred other networks make up the Internet.

In a sense, Dennis is the enemy of computer centers. He wants people to use computers without the mumbo jumbo of programming. As long as there are software wizards and gurus, Dennis won’t be satisfied with the distribution of computing power. His is a world of ethernets, optical fibers, and satellite links. Other computer folks measure size in megabytes of memory, and speed in megaflops—millions of floating-point-operations per second. To Dennis, size is measured by counting computers on your network; speed is measured in megabytes per second—how fast the computers talk to each other. The system isn’t the computer, it’s the network.

THIS ended up being very true.

Do spooks have computers?” Greg looked at Teejay and laughed. “We’ve lost count. Our building floats on computers.” “What would the CIA use computers for? Can you overthrow foreign governments with software?”

"Can you overthrow foreign governments with software?" Can and have, author. :)

But there was still a way to find the hacker’s distance. After the hacker left, I called a friend in Los Angeles and told him to connect to my computer through AT&T and Tymnet. He started Kermit running, and I timed his echoes. Real short, maybe a tenth of a second. Another friend, this time in Houston, Texas. His echoes were around 0.15 seconds. Three other people from Baltimore, New York, and Chicago each had echo delays of less than a second. New York to Berkeley is about two thousand miles. It had a delay of around a second. So a three-second delay means six thousand miles. Give or take a few thousand miles.

I glanced at my own logbook. Somewhere, someone was keeping a mirror-image notebook. A kid on a weekend lark doesn’t keep detailed notes. A college joker won’t patiently wait three months before checking his prank. No, we were watching a deliberate, methodical attack, from someone who knew exactly what he was doing.

Eight-bit and sixteen-bit computers are diddlysquat machines; the thirty-two-bit systems are the biggies. Thirty-two bits meant a big machine, ten MIPS meant fast. He’d entered a super-minicomputer. One of the fastest in Berkeley. One of the most mismanaged.

Of note is that the specs for this computer are now beaten by everyone's phone.

For the first time in my life, something important was entirely up to me. My attitude at work had always been like my days as an astronomer—I’d write proposals, observe at the telescope, publish papers, and stand cynically apart from the struggles and triumphs of the world around me. I didn’t care if my research led anywhere.

It turned out that a search warrant wasn’t necessary to trace a phone call made to your own telephone, so long as you wanted the trace made. This made sense. You shouldn’t need a court order to find out who was calling you. Indeed, some telephone companies now sell phones that display the digits of the calling telephone as your phone is ringing.

"some telephone companies now sell phones that display the digits of the calling telephone as your phone is ringing." WOW!!

Mitre, the high-security defense contractor—I’d been told that you can’t get past their lobby without showing picture ID. Their guards wear guns, and their fences are barbed. Yet all it takes is a home computer and a telephone to prowl through their databases.

Looking at Mitre’s phone bills, I knew that only the hacker would call the Army base in Anniston, Alabama. Pretty likely that a phone call made a minute after calling Anniston belonged to the hacker. Same for a call that ended just before dialing Alabama. In physics, this is correlation analysis. If you see a solar flare today and tonight there’s a bright aurora, chances are that these are correlated. You look at things that occur close together in time, and try to find the probability that they’re somehow connected.

“a lot of countries have outdated laws. In Canada, a hacker that broke into a computer was convicted of stealing electricity, rather than trespassing. He was prosecuted only because the connection had used a microwatt of power from the computer.”

If it was hard to talk to the military, then calling the CIA was a real hurdle. A month ago, I’d accepted that they needed to know about someone trying to break into their computers. I’d done my duty. Now, should I tell them that it’s a foreigner? But once again, they seemed like the right people to call. I could understand the nodes, and networks, but espionage … well, they don’t teach you that stuff in grad school. Surely my friends among Berkeley’s flourishing left wing would tell me I’d be co-opted by the State. But I didn’t exactly feel like a tool of the ruling class, unless imperialist running-dog puppets breakfasted on stale granola.

So in one sense, the Systems Command’s Space Division had nothing to lose: its computer is unclassified. But there’s a deeper problem. Individually, public documents don’t contain classified information. But once you gather many documents together, they may reveal secrets. An order from an aircraft manufacturer for a load of titanium sure isn’t secret. Nor is the fact that they’re building a new bomber. But taken together, there’s a strong indicator that Boeing’s new bomber is made of titanium, and therefore must fly at supersonic speeds (since ordinary aluminum can’t resist high temperatures).

The more I thought about it, the more impressed I was with the military people. They’d zeroed in on the weak points of my talk, and understood both the details and importance of what I’d said. How far I’d come. A year ago, I would have viewed these officers as war-mongering puppets of the Wall Street capitalists. This, after all, was what I’d learned in college. Now things didn’t seem so black and white. They seemed like smart people handling a serious problem.

That’s the problem with talking about security problems. If you describe how to make a pipe bomb, the next kid that finds some charcoal and saltpeter will become a terrorist. Yet if you suppress the information, people won’t know the danger.