TAKEDOWN: Netcom

<BODY BGCOLOR=#ffffff BACKGROUND="../back1.jpg" TEXT=#990211 LINK=#ff4040 VLINK=#4040ff> <H1 ALIGN=CENTER><IMG SRC="../../SmallTakeDown.jpg" VSPACE=0 ALT="T A K E D O W N"></H1> <TABLE WIDTH=100%><TR><TD VALIGN=TOP WIDTH=25% ALIGN=LEFT><A HREF="../the-well/index.html"><IMG SRC="../ARROW-L.jpg" ALT="Prev" BORDER=0></A></TD><TD VALIGN=TOP WIDTH=50% ALIGN=CENTER><H2><IMG SRC="netcom.jpg" ALT="N e t c o m"></H2></TD><TD VALIGN=TOP WIDTH=25% ALIGN=RIGHT><A HREF="../sprint/index.html"><IMG SRC="../ARROW-R.jpg" ALT="Next" BORDER=0></A></TD></TR></TABLE> <P> <BR> <P> <BLOCKQUOTE> <STRONG>February 9.</STRONG> The trail from the Well leads to <A HREF="http://www.netcom.com/">Netcom Online Communications Services</A>, a nationwide Internet services provider based in San Jose, California. <A HREF="../../bio/tsutomu.html">Tsutomu</A> drives to San Jose in the evening and begins setting up a monitoring system there. The effort is complicated by the torrent of data that is passing through the Netcom network. Special tools are required to set up a monitoring operation and Tsutomu works through the night to have monitoring set up by the next morning, when the attacker usually comes online. <P> <STRONG>February 10.</STRONG> Monitoring at Netcom, Tsutomu is able to determine the attacker's identity when - in a keyboard session with a confederate in <A HREF="http://www.info.co.il/eindex.html">Israel</A> - the intruder complains that his picture has appeared on the front page of the <A HREF="http://www.nytimes.com/"><EM>New York Times</EM></A>. <A HREF="../../bio/mitnick.html">Mitnick</A> and the Israeli are systematically breaking in to the machines of computer security experts hunting for information on system vulnerabilities. Mitnick is trying to mask his location by connecting to the Internet via different Netcom local telephone numbers around the country, but he appears to be coming from Raleigh, North Carolina, most frequently. </BLOCKQUOTE> <P> <BR> <P> <TABLE WIDTH=100% BORDER=1> <TR> <TH COLSPAN=4><BR><H3>Players</H3></TH> </TR> <TR> <DL> <TD ALIGN=CENTER VALIGN=TOP WIDTH=25%> <DT><H4>People</H4> <DD> <DL> <DT><A HREF="../../bio/tsutomu.html">Tsutomu Shimomura</A> <DT><A HREF="../../bio/mitnick.html">Kevin Mitnick</A> <P> <DT><A HREF="http://www.sjmercury.com/digital/bank.htm">Bank, David</A>, <EM>San Jose Mercury News</EM> <DT>Burns, Levord, FBI <DT><A HREF="http://www.boardwatch.com/mag/95/oct/bwm10.htm">Chen, Hua-Pei, system administrator, the Well</A> <DT>Christensen, Soeren, Sun Microsystems <DT><A HREF="http://www.hks.net/cpunks/cpunks-11/0000.html">Cunningham, Kathleen, United States marshal</A> <DT>Francis, Rick, Netcom VP of software development <DT>Gross, Andrew <DT>Hoffman, John, Netcom system administrator <DT>Hood, Robert, Netcom network administrator <DT>jsz, Israel <DT><A HREF="http://www.cryptography.com/about_pck.html">Kocher, Paul</A> <DT><A HREF="../../bio/markoff.html">Markoff, John</A> <DT>Menapace, Julia <DT>Sardina, Laura, Sun Microsystems <DT>Seiden, Mark <DT><A HREF="http://www.hotwired.com/Lib/Privacy/privacy.meeks.html">Walker, Kent, assistant United States attorney</A> </DL> </DD> </TD> <TD ALIGN=CENTER VALIGN=TOP WIDTH=25%> <DT><H4>Organizations</H4> <DD> <DL> <DT><A HREF="http://www.sei.cmu.edu/SEI/programs/cert/">CERT</A> <DT><A HREF="http://www.csn.org/">Colorado SuperNet</A> <DT><A HREF="http://www.dsys.com/">dsys.com (Colorado)</A> <DT><A HREF="http://www.escape.com/">escape.com</A> <DT><A HREF="http://www.fish.com/">fish.com</A> <DT><A HREF="http://info.gte.com/">GTE</A> <DT><A HREF="http://www.xs4all.nl/">hacktic.nl</A> <DT><A HREF="http://www.internex.com/">Internex</A> <DT><A HREF="http://www.lexis-nexis.com/">Lexis-Nexis</A> <DT><A HREF="http://www.motorola.com/">Motorola Corporation</A> <DT><A HREF="http://www.netcom.com/">Netcom</A> <DT><A HREF="http://www.netsys.com/">Netsys</A> <DT><A HREF="http://www.oki.com/OKItelecom.htm">Oki Telecom</A> <DT><A HREF="http://www.sprint.com/">Sprint</A> <DT><A HREF="http://www.well.com/">The Well</A> </DL> </DD> </TD> <TD ALIGN=CENTER VALIGN=TOP WIDTH=25%> <DT><H4>Hardware/Software</H4> <DD> <DL> <DT><A HREF="http://www.Sun.COM:80/products-n-solutions/hw/wstns/index.html">Sun workstation</A> <DT><A HREF="http://www.sun.com:80/cgi-bin/show?products-n-solutions/hw/wstns/jtf_ss4.html">Sun SPARCstation</A> <DT><A HREF="http://eantc.prz.tu-berlin.de/INFOSYS/fddi/ueberblick/FddiIntroduction.html">Fiber Distributed Data Interface (FDDI) local network ring</A> <DT><A HREF="http://www.sprint.com/lowrez/sprint/product/dictionary/t.html">T-3 backbone</A> <DT><A HREF="http://www.sprint.com/lowrez/sprint/product/dictionary/t.html">T-1</A> <DT><A HREF="http://www.netcom.com/netcom/press/200pops.html">Netcom points of presence (POPs)</A> <DT><A HREF="http://www.livingston.com/products/pm_main.htm">Portmaster communications servers</A>, <A HREF="http://www.livingston.com/">Livingston Enterprises</A> <DT><A HREF="http://www.cisco.com/">Cisco</A> routers <DT><A HREF="http://www.ford.com/vehicles/cars/Mustang/">Mustang</A> <DT><A HREF="http://www.Sun.COM:80/products-n-solutions/hw/servers/index.html">SPARCstation servers</A> <DT><A HREF="http://ndtl.harvard.edu/ndtl/results/test_lab/Crescendo/SBus_FDDI">Crescendo FDDI concentrator</A> <DT><A HREF="http://www.Sun.COM/cgi-bin/show?products-n-solutions/hw/networking/jtf_fddi.html">Sun FDDI concentrator</A> <DT><A HREF="http://access1.sun.com/">access1, Sun Microsystems firewall</A> <DT><A HREF="http://www.best.com/~shred/">Cellular telephone</A> <DT><A HREF="http://www.airnote.net/ww/pager-faq.html">Beepers/Pagers</A> <DT><A HREF="http://www.radiomail.net/productov/productov.html">RadioMail terminal</A> <DT><A HREF="http://www.skytel.com/products/skypager.html">SkyPager</A> <DT>Netcomsv <DT><A HREF=http://pages.ripco.com:8080/~glr/sb27.txt"">Triggerfish</A> <DT><A HREF="http://www.cs.dal.ca:5000/nit(4P)">Network Interface Tap (NIT)</A> <DT><A HREF="http://www.Sun.COM:80/sunsoft/solaris/index.html">Solaris OS</A> <DT>Modified <A HREF="http://avebury.arch.soton.ac.uk/Manuals/LinuxMan/man.en.shtml/bpf(4)">Berkeley Packet Filter</A> <DT>prefilter (snit____foo) <DT><A HREF="http://www.reednews.co.uk/~gavin/security/sendmail.hole.html">sendmail</A> <DT><A HREF="http://www.quadralay.com/www/Crypt/PGP/pgp00.html">Pretty Good Privacy (PGP)</A> <DT><A HREF="http://metro.turnpike.net/M/mircalla/htmls/irc.html">Internet Relay Chat (IRC)</A> </DL> </DD> </TD> </DL> </TR> </TABLE> <P> <TABLE WIDTH=100% BORDER=1> <TR> <TH COLSPAN=3><BR><H3>Details</H3></TH> </TR> <TR> <DL> <TD ALIGN=CENTER VALIGN=TOP WIDTH=33%> <DT><H4>Locations</H4> <DD> <DL> <DT><A HREF="http://www.com/acvb/index.html">Atlanta, Georgia</A> <DT><A HREF="http://www.belmont.gov/">Belmont, California</A> <DT><A HREF="http://hamilton.netmedia.com/cgi-bin/rest/GetRest?Bucks_Restaurant@Woodside">Buck's restaurant, Woodside, California</A> <DT><A HREF="http://www.milehigh.com/webad/">Denver, Colorado</A> <DT><A HREF="http://iwi.com/norm/microbrew.html">Fault Line microbrewery, Sunnyvale, California</A> <DT><A HREF="http://shaych.stanford.edu/goodlife/hobee5.html">Hobee's restaurant, San Jose</A> <DT><A HREF="http://www.info.co.il/eindex.html">Israel</A> <DT><A HREF="http://www.abag.ca.gov/abag/local_gov/city/client/menlo_pk/menlo_pk.htm">Menlo Park, California</A> <DT><A HREF="http://dcvb.durham.nc.us/">Raleigh-Durham, North Carolina</A> <DT><A HREF="http://www.zpub.com/sf/">San Francisco, California</A> <DT><A HREF="http://www.ipac.net/csj/">San Jose, California</A> <DT><A HREF="http://www-rnc.lbl.gov/Restaurants/West.html">Siam Cuisine, Berkeley, California</A> <DT><A HREF="http://www.sf.net/lantern/r/17/r1772.html">Zona Rosa, Haight Street, San Francisco</A> </DL> </DD> </TD> <TD ALIGN=CENTER VALIGN=TOP WIDTH=33%> <DT><H4>Evidence</H4> <DD> <DL> <DT><A HREF="ftp://info.cert.org/pub/cert_advisories/CA-94:01.ongoing.network.monitoring.attacks">CERT file 94:01.ongoing.network.monitoring.attacks</A> <DT>Picture on the front page of the <A HREF="http://www.nytimes.com/"><EM>New York Times</EM></A> <DT><A HREF="../../evidence/transcripts/index.html">talk sessions</A> <DT>test1 program <DT>Well/Netcom accounting data </DL> </DD> </TD> <TD ALIGN=CENTER VALIGN=TOP WIDTH=33%> <DT><H4>Background</H4> <DD> <DL> <DT><A HREF="http://www.hk.super.net/~naxos/tchaikov.htm">1812 Overture</A> <DT><A HREF="http://www.2600.com/"><EM>2600</EM> magazine</A> <DT><A HREF="http://www.doc.gov/pace/sf3.html">3000 Sand Hill Road, Menlo Park</A> <DT><A HREF="http://www.aerosmith.com/aerosmith/">Aerosmith</A> <DT><A HREF="http://http.cs.berkeley.edu/~eric/">Allman, Eric</A> <DT><A HREF="http://www.netaxs.com/people/dgresh/graffiti.html"><EM>American Graffiti</EM></A> <DT><A HREF="http://www.apple.com">Apple Computer</A> <DT><A HREF="http://www.att.com/">AT&T</A> <DT><A HREF="http://www.cs.technion.ac.il/~biham/">Biham, Eli</A> <DT><A HREF="http://www.bmw.de/">BMW</A> <DT><A HREF="http://128.165.96.145/welcome.html">Center for Nonlinear Studies</A> <DT><A HREF="http://catless.ncl.ac.uk/Risks/16.14.html#subj14">Clift, Neill</A> <DT><A HREF="http://www.coca-cola.com">Coke</A> <DT><A HREF="http://www.mvhs.edu/cupertino/">Cupertino, California</A> <DT><A HREF="http://www.phil.uni-sb.de/fun/jargon/Cyberpunk_-_Outlaws_and_Hackers_on_the_Computer_Frontier.html"><EM>Cyberpunk</EM>, John Markoff and Katie Hafner</A> <DT><A HREF="http://ndsun.ee.nd.edu:1111/crypto/research.html">Data Encryption Standard (DES)</A> <DT>DiCicco, Lenny <DT><A HREF="http://www.dec.com/">Digital Equipment Corporation (DEC)</A> <DT><A HREF="http://www.research.digital.com/nsl/home.html">DEC's Palo Alto Research laboratory</A> <DT><A HREF="http://www.paranoia.com/~ebola/privacy6.html">Electronic Communications Privacy Act</A> <DT><A HREF="http://www.fish.com/~zen/">Farmer, Dan</A> <DT><A HREF="http://www.fbi.gov/">Federal Bureau of Investigation (FBI)</A> <DT><A HREF="http://www.fry-s.com/">Fry's</A> <DT><A HREF="http://www.cygnus.com/~gnu/">Gilmore, John</A> <DT><A HREF="http://purcell.ecn.purdue.edu/~landsied/rube.html">Goldberg, Rube</A> <DT><A HREF="http://www.cognito.com/0003/articles/00017309/17309682.htm">Grand Central Station</A> <DT><A HREF="http://t13.lanl.gov/People/">Hasslacher, Brosl</A> <DT><A HREF="http://riem.com/disk$user_disk1/http/all-chp.txt">I-280</A> <DT><A HREF="http://www.research.ibm.com/xw-div-press-record">IBM Winchester drive</A> <DT>Jobs, Steve <A HREF="http://ei.cs.vt.edu/~history/Jobs.html">1</A> <A HREF="http://ei.cs.vt.edu/~history/Jobs.html">2</A> <A HREF="http://www.adze.com/bios/computer/jobs.html">3</A> <DT><A HREF="http://www.monmouth.com/~jshahom/jargon/kludge.html">Kludge</A> <DT><A HREF="http://www.lanl.gov">Los Alamos National Laboratory (LANL)</A> <DT><A HREF="http://www.penwest.com/demograp/losalhil.htm">Los Altos Hills, California</A> <DT><A HREF="http://www.nw.com/nw/WWW/whoarewe.html">Lottor, Mark</A> <DT><A HREF="http://www.en.utexas.edu/~daniel/309m/students/assign/drafts/christal/lucas.html">Lucas, George</A> <DT><A HREF="http://www.ci.malibu.ca.us/">Malibu, California</A> <DT><A HREF="../../coverage/most-wanted.html">Markoff's article about Mitnick, New York Times</A> <DT>McClary, Jimmy, Computer Systems Security officer, LANL <DT><A HREF="http://ezinfo.ucs.indiana.edu/~lwagers/metallica/">Metallica</A> <DT><A HREF="http://www.microsoft.com/">Microsoft</A> <DT><A HREF="http://www.das.harvard.edu/users/students/Robert_Morris/Robert_Morris.html">Morris, Robert Tappan</A> <DT><A HREF="http://www.phoenix.ca:80/mossad/">Mossad</A> <DT><A HREF="http://www.amazing.com/david/view.html">Mulholland Drive, Los Angeles, California</A> <DT><A HREF="http://stasi.bradley.edu/privacy/accuracy.html">National Crime Information Center (NCIC)</A> <DT><A HREF="http://www.nsa.gov:8080/">National Security Agency (NSA)</A> <DT><A HREF="http://www.nokia.com/">Nokia</A> <DT><A HREF="http://www.cco.caltech.edu/~maronj/text/razor.html">Occam's Razor rule</A> <DT><A HREF=" http://www.macnet.com/home/anderson/Hacking/hack-fa2.html#b31">PBX</A> <DT><A HREF="ftp://ripem.msu.edu/pub/crypt/docs/kocher-pkzip-attack.txt">PK Zip</A> <DT><A HREF="http://www.abag.ca.gov/abag/local_gov/city/Portola_Valley.html">Portola Valley, California</A> <DT>Posse, The <DT><A HREF="http://www.qualcomm.com/">Qualcomm</A> <DT>Radio scanner <DT><A HREF="http://www.wbr.com/chilipeppers">Red Hot Chili Peppers</A> <DT><A HREF="http://www.reid.org/brian/">Reid, Brian</A> <DT><A HREF="http://www.pulver.com/million/">Rieger, Robert, Netcom chairman</A> <DT><A HREF="http://www.netsys.com/ack.html">Rose, Len</A> <DT><A HREF="http://www.rsa.com/">RSA Data Security, Inc.</A> <DT><A HREF="http://www.saabusa.com/">Saab</A> <DT><A HREF="http://www.slip.net/~brent/safeway/safeway.htm">Safeway</A> <DT><A HREF="http://vflylab.calstatela.edu/edesktop/WWW_Projects/Geol_WWW_Projects/SanAndreas_atripat/SanAndreasFault.html">San Andreas Fault</A> <DT><A HREF="http://www.sddt.com/files/realestate/citymap.html">San Diego, California</A> <DT><A HREF="http://gate.cruzio.com/~slv/nature.html">Santa Cruz mountains</A> <DT><A HREF="http://inept.scubed.com/caltrans/la/tables/10_1.html">Santa Monica freeway</A> <DT><A HREF="http://www.csubak.edu/business_conference/speakers/SPEAKERS18.HTML">Sculley, John</A> <DT><A HREF="http://www.wileyco.com/PRSA/">Seattle, Washington</A> <DT>Settle, Jim, I-Net <DT><A HREF="http://theory.lcs.mit.edu/~dmjones/STOC/Authors/shamiradi.html">Shamir, Adi</A> <DT><A HREF="http://www.netview.com/svg/">Silicon Valley, California</A> <DT><A HREF="http://www.msstate.edu/M/title-exact?+Sneakers+(1992)"><EM>Sneakers</EM></A> <DT><A HREF="http://www.ccd.bnl.gov/LINK.bnl/Sep95/kern.html">"Social engineering"</A> <DT><A HREF="http://www.commerce.digital.com/palo-alto/historical-assoc/centennial-bios/LelandStanford/bio.html">Stanford, Leland</A> <DT><A HREF="http://www.sun.com">Sun Microsystems</A> <DT><A HREF="http://www.csh.rit.edu/~gentry/tbnet.html">Taco Bell</A> <DT>Tap <DT><A HREF="http://www.technion.ac.il/">Technion</A> <DT><A HREF="http://www.msue.msu.edu/jargon/A4000010.html"><EM>True Names</EM>, Vernor Vinge</A> <DT><A HREF="http://www.okstate.edu/cis_info/cis_manual/ultrix.html">Ultrix operating system</A> <DT><A HREF="http://www.unlv.edu/">University of Nevada, Las Vegas</A> <DT><A HREF="http://musie.phlab.missouri.edu/IntroToUnix/unix-tutor/what-is-unix.html">Unix operating system</A> <DT><A HREF="http://www.okstate.edu/cis_info/cis_manual/vms_toc.html">VMS</A> <DT><A HREF="http://www.netview.com/svg/tourist/winchest/">Winchester Mystery House</A> <DT><A HREF="http://www.hotwired.com/"><EM>Wired</EM></A> <DT><A HREF="http://www.penwest.com/demograp/woodside.htm">Woodside, California</A> </DL> </DD> </TD> </DL> </TR> </TABLE> <P> <HR> <P> <SMALL> Copyright &copy 1995 <A HREF="http://www.fish.com/vf/">Vicious Fishes Web Design</A> and <A HREF="http://www.Delux.Com/">Dan Meriwether</A>.<BR> All rights reserved. Contact: <A HREF="mailto:webmaster@takedown.com">webmaster@takedown.com</A> </SMALL> </BODY>