TAKEDOWN: Transcripts: February 8

Kevin On Demand!

February 8, 1995

That's odd

Start: 1995 Feb 8 07:30:59
Total Run Time: 1:11
From well.sf.ca.us to gaia.internex.net.
Session to Internex from the Well. Session from Netcom to the Well to Internex. Session dropped in mid-word.
This session is of particular interest because it ended abruptly in mid-word. This was important because we suspected that this might have been from a disconnect/dropped call. If it was, then the disconnection would propagate almost instantly through the network, giving us an event that happened at the same time everywhere along his path. Without such an event, with many people logging on and off of these systems (especially service providers), it can be difficult to match a login on one system to a login on another, since the login to the second system from the first could have been made by anyone currently on the first system.

Pick up where we left off

Start: 1995 Feb 8 07:34:51
Total Run Time: 11:54
From well.sf.ca.us to gaia.internex.net.
Resumes session from Netcom to the Well to Internex. Starts exactly where he got dropped. Pokes at sf1.nyt.com. Installs trojan and back door. Tries to hide them as well.

"itni" as in "Mitnick"?

Start: 1995 Feb 8 19:59:48
Total Run Time: 1:18
From inmet.camb.inmet.to to well.sf.ca.us.
Searches John Markoff's mail for the string "itni", as in "Mitnick."