T A K E D O W N

E V I D E N C E


This is just like last(1), except there's a hostname in front of every entry. These are Kevin's logins to Netcom using the account "gkremen." This was compared with other login and phone records, in order to trace the path of the attacker. 

netcom2   gkremen   ttyqe    NETCOM-min2.netc Mon Feb 13 17:47 - 18:13  (00:25)
netcom5   gkremen   ttys5    NETCOM-atl7.netc Mon Feb 13 16:46 - 17:42  (00:56)
netcom15  gkremen   ttyr1    NETCOM-min1.netc Mon Feb 13 16:44 - 16:44  (00:00)
netcom9   gkremen   ttyq9    NETCOM-min1.netc Mon Feb 13 16:33 - 16:41  (00:07)
netcom19  gkremen   ttyq4    NETCOM-min1.netc Mon Feb 13 15:45 - 15:58  (00:13)
netcom8   gkremen   ttyq3    NETCOM-la3.netco Mon Feb 13 00:57 - 00:58  (00:01)
netcom22  gkremen   ttyp7    csn.org          Sun Feb 12 23:05 - 23:11  (00:05)
netcom17  gkremen   ttysc    NETCOM-min1.netc Sun Feb 12 12:40 - 12:53  (00:12)
netcom6   gkremen   ttyse    NETCOM-min1.netc Sun Feb 12 11:43 - 12:15  (00:32)
netcom5   gkremen   ttys5    NETCOM-min1.netc Sat Feb 11 22:25 - 23:13  (00:47)
netcom19  gkremen   ttysf    NETCOM-min1.netc Sat Feb 11 21:48 - 22:25  (00:36)
netcom16  gkremen   ttyu6    NETCOM-min1.netc Sat Feb 11 21:46 - 21:47  (00:00)
netcom14  gkremen   ttys1    NETCOM-min1.netc Sat Feb 11 13:39 - 14:35  (00:56)
netcom15  gkremen   ttysf    NETCOM-rtp1.netc Fri Feb 10 23:21 - 00:45  (01:23)
netcom10  gkremen   ttyp3    NETCOM-rtp1.netc Fri Feb 10 22:44 - 23:19  (00:35)
netcom4   gkremen   ttyr7    NETCOM-den1.netc Fri Feb 10 18:20 - 18:58  (00:38)
netcom10  gkremen   ttyp4    NETCOM-min1.netc Fri Feb 10 17:22 - 18:12  (00:49)
netcom8   gkremen   ttyta    NETCOM-min2.netc Fri Feb 10 17:21 - 17:21  (00:00)
netcom18  gkremen   ttyta    NETCOM-min1.netc Fri Feb 10 17:20 - 17:20  (00:00)
netcom5   gkremen   ttypc    NETCOM-den1.netc Fri Feb 10 16:58 - 17:14  (00:15)
netcom13  gkremen   ttyu2    NETCOM-den3.netc Fri Feb 10 14:11 - 14:37  (00:26)
netcom7   gkremen   ttyqf    NETCOM-rtp2.netc Fri Feb 10 14:08 - 14:09  (00:00)
netcom11  gkremen   ttyt5    NETCOM-atl1.netc Fri Feb 10 12:29 - 13:14  (00:44)
netcom19  gkremen   ttyra    NETCOM-rtp2.netc Fri Feb 10 12:27 - 12:28  (00:00)
netcom7   gkremen   ttyq7    NETCOM-rtp2.netc Fri Feb 10 11:48 - 12:11  (00:22)
netcom5   gkremen   ttyqe    NETCOM-rtp2.netc Fri Feb 10 11:32 - 11:41  (00:09)
netcom17  gkremen   ttys2    NETCOM-chi1-1.ne Fri Feb 10 11:24 - 11:24  (00:00)
netcom4   gkremen   ttys3    NETCOM-den2.netc Fri Feb 10 11:11 - 11:18  (00:06)
netcom19  gkremen   ttysd    NETCOM-rtp2.netc Fri Feb 10 10:55 - 11:05  (00:09)
netcom3   gkremen   ttyq5    NETCOM-den4.netc Fri Feb 10 10:09 - 10:37  (00:27)
netcom12  gkremen   ttyqa    NETCOM-den2.netc Fri Feb 10 00:40 - 01:06  (00:26)
netcom20  gkremen   ttys3    NETCOM-den2.netc Thu Feb  9 23:12 - 23:17  (00:05)
netcom8   gkremen   ttyt8    NETCOM-rtp2.netc Thu Feb  9 21:35 - 21:36  (00:00)
netcom9   gkremen   ttyt3    NETCOM-rtp2.netc Thu Feb  9 21:30 - 21:34  (00:03)
netcom20  gkremen   ttyp7    NETCOM-den2.netc Thu Feb  9 20:35 - 21:27  (00:52)
netcom20  gkremen   ttysc    NETCOM-den2.netc Thu Feb  9 20:23 - 20:33  (00:09)
(this is when we arrived at Netcom)
netcom17  gkremen   ttyq3    NETCOM-rtp1.netc Thu Feb  9 11:35 - 12:07  (00:31)
netcom17  gkremen   ttypa    NETCOM-rtp1.netc Thu Feb  9 11:13 - 11:31  (00:18)
netcom17  gkremen   ttyrb    NETCOM-rtp1.netc Thu Feb  9 11:10 - 11:12  (00:01)
netcom13  gkremen   ttyrb    NETCOM-rtp1.netc Thu Feb  9 07:30 - 07:37  (00:06)
netcom11  gkremen   ttys2    NETCOM-rtp1.netc Wed Feb  8 23:00 - 23:02  (00:01)
netcom11  gkremen   ttys9    NETCOM-rtp1.netc Wed Feb  8 22:58 - 22:59  (00:01)
netcom6   gkremen   ttyu1    NETCOM-rtp2.netc Wed Feb  8 19:39 - 19:39  (00:00)
netcom6   gkremen   ttyqc    NETCOM-rtp2.netc Wed Feb  8 19:37 - 19:38  (00:00)
netcom18  gkremen   ttyu0    NETCOM-rtp1.netc Wed Feb  8 16:23 - 16:33  (00:10)
netcom7   gkremen   ttys0    NETCOM-rtp2.netc Wed Feb  8 16:16 - 16:18  (00:01)
netcom7   gkremen   ttyr5    NETCOM-rtp2.netc Wed Feb  8 16:14 - 16:14  (00:00)
netcom7   gkremen   ttys9    NETCOM-rtp1.netc Wed Feb  8 15:53 - 16:13  (00:19)
netcom4   gkremen   ttyrb    NETCOM-rtp1.netc Wed Feb  8 15:36 - 15:50  (00:13)
netcom7   gkremen   ttyp2    NETCOM-rtp1.netc Wed Feb  8 14:49 - 15:14  (00:24)
netcom12  gkremen   ttys8    NETCOM-rtp1.netc Wed Feb  8 14:34 - 14:47  (00:12)
netcom17  gkremen   ttyq8    NETCOM-rtp1.netc Wed Feb  8 08:56 - 08:59  (00:03)
netcom13  gkremen   ttyq4    NETCOM-rtp1.netc Wed Feb  8 07:33 - 08:02  (00:29)
netcom4   gkremen   ttyp5    NETCOM-rtp1.netc Wed Feb  8 07:00 - 07:31  (00:31)
netcom3   gkremen   ttyqc    NETCOM-rtp1.netc Tue Feb  7 20:14 - 20:18  (00:04)
netcom14  gkremen   ttyq3    NETCOM-rtp1.netc Tue Feb  7 12:41 - 12:44  (00:02)
netcom11  gkremen   ttyte    NETCOM-rtp1.netc Sun Feb  5 23:00 - 23:06  (00:05)
netcom19  gkremen   ttyq2    NETCOM-rtp1.netc Sun Feb  5 22:56 - 22:59  (00:03)
netcom22  gkremen   ttyq0    escape.com       Sun Feb  5 21:43 - 21:45  (00:01)
netcom11  gkremen   ttys7    NETCOM-rtp1.netc Sun Feb  5 20:34 - 20:53  (00:19)
netcom22  gkremen   ttyr6    teal.csn.org     Sun Feb  5 20:03 - 20:12  (00:09)
netcom15  gkremen   ttysf    NETCOM-rtp1.netc Sun Feb  5 18:33 - 18:36  (00:03)
netcom17  gkremen   ttyre    NETCOM-rtp1.netc Sat Feb  4 23:16 - 00:35  (01:18)
netcom22  gkremen   ttyp0    teal.csn.org     Sat Feb  4 21:53 - 22:19  (00:25)
netcom2   gkremen   ttyr8    NETCOM-rtp2.netc Sat Feb  4 12:40 - 13:19  (00:39)
netcom22  gkremen   ttyp1    csn.org          Sat Feb  4 00:45 - 00:52  (00:06)
netcom22  gkremen   ttyrb    teal.csn.org     Fri Feb  3 19:34 - 20:05  (00:30)
netcom22  gkremen   ttyr7    escape.com       Thu Feb  2 21:57 - 22:04  (00:06)
netcom22  gkremen   ttyt4    teal.csn.org     Wed Feb  1 20:18 - 20:40  (00:21)
netcom22  gkremen   ttyq9    teal.csn.org     Wed Feb  1 19:29 - 19:32  (00:02)
netcom23  gkremen   ttyqc    teal.csn.org     Wed Feb  1 14:56 - 15:06  (00:09)
netcom21  gkremen   ttyp2    teal.csn.org     Wed Feb  1 14:55 - 15:05  (00:10)

netcom21  gkremen   ttyq7    teal.csn.org     Tue Jan 31 18:55 - 19:40  (00:44)
netcom1   gkremen   ttyqf    teal.csn.org     Mon Jan 30 21:56 - 21:59  (00:02)
netcom1   gkremen   ttyp7    escape.com       Sun Jan 29 21:03 - 21:03  (00:00)
netcom5   gkremen   ttyrc    escape.com       Sun Jan 29 18:49 - 18:56  (00:07)
netcom21  gkremen   ttyq1    teal.csn.org     Sun Jan 29 10:37 - 10:50  (00:12)
netcom12  gkremen   ttyp7    sunom10.cern.ch  Sun Jan 29 10:12 - 10:30  (00:17)
netcom3   gkremen   ttys4    escape.com       Sun Jan 29 09:33 - 09:33  (00:00)
netcom5   gkremen   ttyqe    teal.csn.org     Sat Jan 28 22:14 - 22:26  (00:12)
netcom19  gkremen   ttysb    teal.csn.org     Sat Jan 28 13:39 - 13:48  (00:09)
netcom6   gkremen   ttyrc    netcom3          Tue Jan 24 22:23 - 22:54  (00:30)
netcom3   gkremen   ttyp8    NETCOM-rtp1.netc Tue Jan 24 22:23 - 22:54  (00:31)
netcom6   gkremen   ttys2    netcom8          Tue Jan 24 22:20 - 22:21  (00:00)
netcom8   gkremen   ttypb    NETCOM-rtp1.netc Tue Jan 24 22:06 - 22:21  (00:14)
netcom4   gkremen   ttyqf    teal.csn.org     Tue Jan 24 20:49 - 21:08  (00:19)
netcom20  gkremen   ttyt8    NETCOM-rtp1.netc Tue Jan 24 14:38 - 16:40  (02:02)
netcom7   gkremen   ttyqd    teal.csn.org     Mon Jan 23 16:45 - 16:52  (00:06)

<starting 1 Jan 1995>


TAKEDOWNBIOGRAPHYTIMELINEEVIDENCE
PURSUITCOVERAGESCENIC TOUR

Copyright © 1995 Vicious Fishes Web Design and Dan Meriwether. All rights reserved.
Contact: webmaster@takedown.com