Cybersec Canon Ep 11. The Cuckoo’s Egg - Chapters 48-56. The Hacker Ring Exposed
There is finally light at the end of the tunnel. German authorities apprehend the hackers and the world gets to know the details.
“They charge our government tens of millions of dollars to develop secure software. No doubt about it: the shoemakers’ kids are running around barefoot.”
Stoll, Clifford. CUCKOO’S EGG (Chapter 50). Kindle Edition.
Notes
Chapter 48: Meeting with DoJ & CIA
Apr, 1987. Cliff flies over to the East Coast and meets Bob Morris at the NSA. They chat about puzzles for a bit. (One puzzle was pretty interesting - Bob asks Cliff to complete this -> 1, 11, 21, 1211, 111221. I tried this for a bit and finally asked Gemini for an answer. The next numbers are 312211, 13112221, 1113213211 … and so on. It is called a Look-and-Say sequence.) Then they go over to the DOJ, where Cliff gets to meet high-ranking officials who ask him insightful questions. The next day, he speaks with the NSA’s X-1 dept. They give him a list of questions, like - 1. How was the penetrator tracked? 2. What auditing features exist?, etc. Cliff feels he needs to make the questions more personal to be able to answer better. So he changes them to 1. How does this scoundrel break into computers? 2. Which systems does he slither into? , etc. Then he goes over to the CIA office at Langley. To his surprise, they give him a certificate of appreciation, wrapped up formally like a diploma, and Cliff is happy. He gets back to Berkeley after that.
Chapter 49: The Letter from Pittsburgh
Apr 22, 1987. The FBI is very much interested in the case now. They are even working on getting a warrant in Europe. Someone named Laszlo J. Balogh sends a letter to the fictional Barbara Sherwin asking for a physical copy of the SDINET files. Cliff immediately informs the authorities. FBI asks him not to touch the file and send it in a glassine envelope. Other agencies are also very interested in this. Cliff asks his sister to find out where the name Balogh originates from. She suggests Hungary. Looks like a Hungarian from Pittsburgh is also part of the hacking operation. Air Force OSI sends over an investigator to look at the letter. Mike Gibbons from the FBI calls often to check on the hacker’s activities.
Chapter 50: Navigating SDINET files again
May 18, 1987. The hacker tries to use x-preserve vulnerability of the vi editor. But Cliff and Dave had already patched this. The hacker goes through the SDINET files and ends up spending a lot of time on those fake files since Cliff had deliberately put long file names that the hacker had to type out to view the contents. When the hacker accesses a major defense contractor, Cliff wonders about the irony of companies that make secure computers for others not being secure themselves.
Chapter 51: Searching for SDI port
June, 1987. Martha is preparing for her bar exam. Cliff remembers his grad school days. He had an 8-hour exam and, after passing that, had a tough oral exam from a panel of 5 professors. The hacker logs in and finds Dave Cleveland’s email that says that he has hidden the port number of the SDI network. The hacker ends up wasting over an hour searching for this. Cliff asks if the arrest warrant is ready, and he said the FBI is working on it and it is almost imminent.
Chapter 52: The Police Raid
June 22, 1987. Steve calls Cliff to inform him that he got a message from Wolfgang at the Bundespost that they have a policeman on full-time watch outside the hacker’s apartment, and once Cliff gives a signal that the intruder is in the network, they are ready to apprehend the culprit. The next day, Cliff learns from Mike that the German police raided the apartment and the office of the hacker, didn’t find anyone, but took floppy discs and printouts. Cliff doesn’t get more details in the next few days, but Mike tells him that it is handled now, and he can close all the holes. He also tells Cliff to keep silent on the whole matter. Cliff decides to write more notes and keep them ready when the time comes to publish.
Chapter 53: Chaos Computer Club
A month before the Hannover hacker was caught, a brilliant programmer named Darren Griffith joined Cliff’s team. Cliff explains the situation to him, and he immediately gets it. He knows Unix pretty well. In the meantime, the Chaos computer club was wreaking havoc on the network just for the fun of it. Cliff doesn’t endorse these methods. He calls them vandals and not people who are exposing flaws.
Chapter 54: The Story becomes public
End of August 1987. This marked the first year anniversary of starting the quest to find the hacker. It was two months after the hacker was caught. The FBI was still asking Cliff to keep quiet about this. Cliff wanted to write and publish his findings. Martha tells him that the First Amendment gives him the right to write what he wants.
To take their minds away from the pressure of the bar exam due in 3 weeks, they start sewing a quilt. Laurie tells them that this should be their wedding quilt. When they were alone, Cliff asks Martha if she would marry him, and she agrees.
By October, Cliff starts thinking about the hacker again. Wonders about publishing and saving further hacking. But it would also enable potential hackers.
By January, Cliff sends his paper to the Communications of the ACM. The paper was scheduled to come in the May issue, the same month they were planning on getting married. But by April, a German magazine, Quick, publishes the results based on Cliff’s logbook notes. This forces LBL to have a press conference and American news outlets to also publish the story.
Chapter 55: Details of the Hackers
The American journalists get to know who the hackers are, and Cliff reconstructs the events once he gets to know the details. The main hacker was Markus Hess, a 25-year-old programmer from Hannover, who was involved with the Chaos Computer Club. There, he got to know a hacker named Hagbard (Karl Koch). Hagbard had a cocaine addiction problem and needed money. Hagbard collaborated with Pengo (Hans Huebner), who had contacts in West Berlin and the KGB. Hess & Hagbard gave information to Pengo, who sold it to the KGB in return for cash. Pengo was just an 18-year-old programmer and was so accomplished that he said he was in it only for the technical challenge. But it is also revealed that he needed money for his computer company. KGB wanted to confirm if the information was correct. So, they contacted Lazlo in Pittsburgh to ask Berkeley for physical copies of SDINET files. The chapter ends with the revelation that Hess was still free on bail and Hagbard, after spending all the money he had, was in debt and had apparently killed himself.
Chapter 56: Rumination
Cliff says it took a lot of crap to make him give a damn, and now he is very serious about computer security. He laments that many people waste their talent breaking into computers instead of helping build great systems that will benefit a lot of people. He considers returning to astronomy.
ps: There are a couple of Epilogue chapters about the Morris worm, which was pretty interesting to read.
Thoughts
The quote - “the shoemakers’ kids are running around barefoot” with reference to the security vendors themselves being vulnerable, reminded me of the recent news of the FBI Director Kash Patel’s emails being hacked.
Security vendors charge millions of dollars for protecting their customers, but they themselves may not be using the safeguards they tell others to use. Also, a high price tag does not mean a great security product. Moreover, even if you pay a lot of money to cybersecurity vendors, you should still be vigilant about your security since no system is fully secure. Only you know about the intricacies of the systems in your company.
Back in 1987, people assumed that being open on the network was okay, and that people would rarely spend the time and effort to prowl around. But that was proven to be false. Now the assumption is that security vendors can provide foolproof security. But that is also called into question. Now, with AI, hackers are able to infiltrate faster than ever.
“Cybercriminals are increasingly operating like highly-efficient businesses, establishing partnerships that have collapsed the window for defenders to intervene from hours down to just 22 seconds.”
source: Google Cloud Blog