Cybersec Canon Ep 8. The Cuckoo’s Egg - Chapter 31-36. The Bremen Connection
Cliff finds out that the hacker logs in from the University of Bremen. The hacker is so methodical that someone wonders if he is human or not.
If he’s so methodical, how do you know you’re not just following some computer program?” This one threw me for a loop. Zeke had challenged me on a point I hadn’t thought of before. Could I prove that I was following a real person?
Stoll, Clifford. CUCKOO’S EGG (Chapter 33). Kindle Edition.
Summary
Chapter 31: Slowing down the Hacker
Cliff stayed late on Saturday updating his logbook. Wanted to sleep longer on Sunday, but got paged around 10 when the hacker broke into his system at LBL. He called Steve to trace the call, who confirmed that the hacker was dialing in from Germany. Cliff rushes to his office, but by the time he reaches it, the hacker is gone. But he comes back and tries to log into 30-odd different Army and Air Force locations across the US, but is not successful. When he comes back again later to copy over the password file from the LBL computer, Cliff short-circuits the physical connection to slow down the copy. The hacker gives up after some time.
Chapter 32: Chaos Computer Club
Cliff reaches out to the FBI, Air Force OSI, CIA, etc. His boss, Roy, is upset that he is spending so much time on the hacker. But he doesn’t shut him down. Cliff also browses Usenet for possible news on this. He gets in touch with Bob, a scientist at the Univ of Toronto who is upset about hackers infiltrating his system.
“Bob realized that damage wasn’t measured in dollars ripped off, but rather in trust lost. He didn’t see this as fun and games, but a serious assault on an open society.”
Cliff gets to know about the Chaos Computer Club, whom Bob refers to as vandals, and learns about hackers using pseudonyms like Hagbard and Pengo. Cliff gets a call from Mike from the FBI and exchanges info. Then he calls NSA, talks to Zeke and gives him information that the hacker is from Germany.
Chapter 33: Univ of Brennen Connection
Over the next few days, many people from different agencies call Cliff to get details about the hacker. Even a famous Unix guy named Mike Muuss calls him. Meanwhile, Steve White says he heard back from the person at Bundespost who said that the hacker dialed from the University of Bremen. Zeke from the NSA asks Cliff whether the hacker could be a computer program since he was so methodical and organized. Cliff says some of the typing errors point out that the hacker is human. Steve gets to know that the University of Bremen would be closed for 3 weeks for Christmas.
Chapter 34: FBI Rescue & Hannover Connection
Cliff’s boss, Roy Kerth, asks him to stop working on finding the hacker, saying that this has gone on for too long and they cannot afford it anymore. So he needs to shut down the access to the hacker. Mike Gibbons from the FBI calls Roy and tells him not to stop the investigation. The next time the hacker dials in, Cliff gets to know that the hacker is in Hannover. Things are faster now since Steve has automated a part of the tracing process.
Chapter 35: Search Warrant from the US to Germany
Steve gets to know from Wolfgang at Bundespost that they need a search warrant and a request has to come from ‘a high-level US Criminal office’. Cliff calls Mike from the FBI, and he says they will get the necessary paperwork done through the US Legal Attache. Roy stops by to tell Cliff that DOE (who pays their bills) is going to reprimand them for not informing them. Cliff says he did. His logbook shows he informed DOE two months ago.
Chapter 36: New Year’s Eve of 1987
Cliff and Martha go to SF for New Year’s Eve - Mission District, Chinatown, etc. There were light shows, dancing, etc. (no mention of fireworks, though). The beeper wakes Cliff up in the morning, and he finds that the hacker had broken into the Army’s computer at the Pentagon and was looking at the Army’s plans of nuclear force structures in Europe. When Cliff calls the FBI, he gets to know that Mike Gibbons is no longer working on the case.
Thoughts
Cliff says he was thrown into a loop by Zeek’s question - “If he’s so methodical, how do you know you’re not just following some computer program?” This made me think.
Is being methodical and disciplined not being human? One reason why many corporate leaders, especially from the US, are revered, is because they are so methodical and disciplined in their work. There is a precision in them that common people feel they lack. Being methodical is the hallmark of a professional. There are a lot of self-help books that promise to take ordinary people to that level. Even major religions expect people to strive towards perfection that is not human but divine - like “you need to be perfect as Jesus” - humble, sacrificing, perfect in words and deeds, etc. If AI models that are being trained become more intelligent and handle many of the day-to-day aspects, they might also expect humans to strive to be more perfect, as they are.
But a downside of writing that I see sometimes is that people are not putting that much effort into polishing their writing, fearing that if they write and rewrite and make it polished, it might give the impression that AI wrote it, and now there seems to be some sort of stigma to this. In fact, it is an opportunity to be even more methodical and precise with less effort than before, and it is now accessible to more people than before. In fact, from a work standpoint, we can be more on top of things, write documents and slides easily and actually get time to do more interesting stuff, like talking to people!
From a cybersecurity standpoint, is there now a difficulty in really knowing if the attacker is human or not? Earlier, we could clearly know if an attacker was a bot trying to DDoS through IoT devices or a human accessing unauthorized stuff. But now, an AI agent could perfectly mimic a human, and what could appear as a slow attack targeting a small set of machines could be much larger. But does agentic identity really matter if all that you’re doing is defending your assets? An intruder who violates the confidentiality, integrity and availability of your resources is an intruder who needs to be stopped. I guess it does matter if you need to find out who the intruder was.