<![CDATA[
<BODY BGCOLOR=#ffffff BACKGROUND="../back1.jpg" TEXT=#0000aa LINK=#ff4040 VLINK=#4040ff>
<H1 ALIGN=CENTER><IMG SRC="../../SmallTakeDown.jpg" VSPACE=0 ALT="T A K
E D O W N"></H1>
<TABLE WIDTH=100%><TR><TD VALIGN=TOP WIDTH=25% ALIGN=LEFT><A
HREF="../beginning/index.html"><IMG SRC="../ARROW-L.jpg" ALT="Prev"
BORDER=0></A></TD><TD VALIGN=TOP WIDTH=50% ALIGN=CENTER><H2><IMG
SRC="re-construction.jpg" ALT="R e - c o n s t r u c t i o
n"></H2></TD><TD VALIGN=TOP WIDTH=25% ALIGN=RIGHT><A
HREF="../all-talk/index.html"><IMG SRC="../ARROW-R.jpg" ALT="Next"
BORDER=0></A></TD></TR></TABLE>
<P>
<BR>
<P>
<BLOCKQUOTE>
<STRONG>December 28.</STRONG> <A HREF="../../bio/tsutomu.html">Tsutomu</A>
spends several days with Andrew and several other members of the <A
HREF="http://www.sdsc.edu/">Supercomputer Center</A> staff poring over
the faint traces left behind by the attackers.
<P>
After working virtually around the clock for several days, the
small team is able to piece together the method of the attack. The intruder
or intruders have taken advantage of the Internet's basic protocols by
spoofing one of Tsutomu's computers, fooling it into believing that
messages were being sent from a trusted source.
<P>
By understanding the attack, Tsutomu is able to improve his
defenses, and he reattaches his computers to the Internet.
<P>
<STRONG>December 30.</STRONG> A <A HREF="../../evidence/voicemail/text2.html">second
threatening voice mail message</A> is left. The intruders have
discovered that Tsutomu has strengthened his system's security and they
promise that his "security technique will be defeated."
</BLOCKQUOTE>
<P>
<BR>
<P>
<TABLE WIDTH=100% BORDER=1>
<TR>
<TH COLSPAN=4><BR><H3>Players</H3></TH>
</TR>
<TR>
<DL>
<TD ALIGN=CENTER VALIGN=TOP WIDTH=25%>
<DT><H4>People</H4>
<DD>
<DL>
<DT><A HREF="../../bio/tsutomu.html">Tsutomu Shimomura</A>
<P>
<DT>Bowen, Mike, CERFnet
<DT><A HREF="http://www.sdsc.edu/SDSC/Staff/dombrowh/dombrowh.html">Dombrowski, Jay, SDSC communications manager</A>
<DT><A HREF="http://www.cygnus.com/~gnu/">Gilmore, John</A>
<DT>Gross, Andrew
<DT>Hutton, Tom, SDSC manager of network security
<DT><A HREF="http://www.sdsc.edu/EnablingTech/Visualization/Behaviors/early_behaviors.html">Moreland, John</A>
<DT><A HREF="http://titan.ecs.fullerton.edu/~jherndon/articles/a/asteal.html">Petersen, Justin Tanner (Eric, Agent Steal)</A>
<DT><A HREF="http://rosebud.sdsc.edu/SDSC/Staff/henry/">Ptasinski, Henry</A>
<DT><A HREF="http://www.sdsc.edu/0/SDSC/Geninfo/Fun/movie.html">Ramachandran, Rama</A>
</DL>
</DD>
</TD>
<TD ALIGN=CENTER VALIGN=TOP WIDTH=25%>
<DT><H4>Organizations</H4>
<DD>
<DL>
<DT><A HREF="http://www.cerf.net/">CERFnet</A>
<DT><A HREF="http://www.csn.org/">Colorado SuperNet</A>
<DT><A HREF="http://www.sdsc.edu/">San Diego Supercomputer Center</A>
</DL>
</DD>
</TD>
<TD ALIGN=CENTER VALIGN=TOP WIDTH=25%>
<DT><H4>Hardware/Software</H4>
<DD>
<DL>
<DT>Anti-spoofing/warning network software
<DT><A HREF="http://avebury.arch.soton.ac.uk/Manuals/LinuxMan/man.en.shtml/bpf(4)">Berkeley Packet Filter</A>
<DT>Catch
<DT>Cook
<DT>Data bus
<DT><A HREF="http://wwwhost.ots.utexas.edu/ethernet/ethernet-home.html">Ethernet</A>
<DT><A HREF="http://www.iwi.com/pubs/faq.htm">Firewall</A>
<DT>Forensic-analysis programs
<DT>Handshake procedures <A HREF="http://www.seas.gwu.edu/student/cadams/bell2.html">Bellovin's paper</A> <A HREF="http://www.seas.gwu.edu/student/cadams/morris.html">Morris' paper</A>
<DT>Hunt
<DT><A HREF="http://csrc.ncsl.nist.gov/nistpubs/800-10/node49.html#SECTION00545000000000000000">Packet filtering</A>
<DT><A HREF="http://marie.mit.edu/server/smash/html/postscript.html">PostScript</A>
<DT><A HREF="http://www.rdi.com/">RDI PowerLite</A>
<DT><A HREF="http://www.cs.uregina.ca/~hamilton/courses/430notes/rpc.html">Remote procedure call (RPC)</A>
<DT>Remote prodecure call ToolTalk database server daemon (rpc.ttdbserverd)
<DT>SCSI disk drive
<DT>Secure routing computer
<DT>showmount -e
<DT>Sun workstation
<DT><A HREF="http://www.beckman.uiuc.edu/groups/biss/VirtualLibrary/mail/Archive/95March/bugtraq/0226.html">SYN command</A>
<DT>VME bus
<DT>Tap
<DT>toad.com
<DT><A HREF="http://www-cne.gmu.edu/modules/network/telnet.html">Transmission Control Protocol/Internet Protocol (TCP/IP)</A>
<DT><A HREF="http://www.csd.abdn.ac.uk/man2html/xnews.1.html">XNeWS</A>
</DL>
</DD>
</TD>
</DL>
</TR>
</TABLE>
<P>
<TABLE WIDTH=100% BORDER=1>
<TR>
<TH COLSPAN=3><BR><H3>Details</H3></TH>
</TR>
<TR>
<DL>
<TD ALIGN=CENTER VALIGN=TOP WIDTH=33%>
<DT><H4>Locations</H4>
<DD>
<DL>
<DT><A HREF="http://emporium.turnpike.net/~walk/sandiego/gaslamp/4_e900.htm">Rubio's restaurant, San Diego, California</A>
<DT><A HREF="http://www.sddt.com/files/realestate/citymap.html">San Diego, California</A>
<DT><A HREF="http://www.sdsc.edu/">San Diego Supercomputer Center, rm. 408</A>
<DT><A HREF="http://www.zpub.com/sf/">San Francisco</A>
<DT><A HREF="http://www.best.com/~blholmes/sffind/haight/haight.html">Toad Hall, San Francisco, California</A>
</DL>
</DD>
</TD>
<TD ALIGN=CENTER VALIGN=TOP WIDTH=33%>
<DT><H4>Evidence</H4>
<DD>
<DL>
<DT>Ariel packet log reconstruction
<DT><A HREF="http://www.arqana.com/networks/netsys/spoofing.htm">IP Spoofing attack</A>
<DT>Tap 2.01
<DT><A HREF="../../evidence/voicemail/text2.html">Voice mail #2</A>
</DL>
</DD>
</TD>
<TD ALIGN=CENTER VALIGN=TOP WIDTH=33%>
<DT><H4>Background</H4>
<DD>
<DL>
<DT><A HREF="../../bio/tsu_links.html">Tsutomu Shimomura's personal history</A>
<P>
<DT>Adrian/Berferd
<DT><A HREF="http://www.arpa.mil/">Advanced Research Projects Agency (ARPA)</A>
<DT><A HREF="http://www.research.att.com/">Bell Laboratories</A>
<DT>Bellovin, Steve, AT&T Bell Laboratories
<DT><A HREF="http://www.caltech.edu">Caltech</A>
<DT><A HREF="http://www.umich.edu/~umlaw/student/mttlr/charney.htm">Charney, Scott</A>
<DT><A HREF="http://plan9.att.com/netlib/att/cs/home/cheswick.html">Cheswick, Bill, AT&T Bell Laboratories</A>
<DT><A HREF="http://policy.net/capweb/congress.html">Congress</A>
<DT><A HREF="http://www.cs.umbc.edu/~mohan/Work/crypt.html">Cryptography</A>
<DT><A HREF="http://www.doe.gov/">Department of Energy</A>
<DT><A HREF="http://www.lehigh.edu/~pjl2/films/strangelove.html"><EM>Dr. Strangelove</EM></A>
<DT><A HREF="http://www-pf.eb.com/">http://telecom95.gte.com/News/Docs/19951002-air.html<EM>Encyclopedia Britannica</EM></A>
<DT><A HREF="http://www.fbi.gov/">Federal Bureau of Investigation (FBI)</A>
<DT><A HREF="http://www.tkg.com/~castor/">Fu, Castor</A>
<DT><A HREF="http://www.gao.gov/">General Accounting Office (GAO)</A>
<DT><A HREF="http://www.gulfwar.org/">Gulf War</A>
<DT><A HREF="http://www.panix.com/~rbs/Skate/">Inline skating</A>
<DT><A HREF="http://www-nrg.ee.lbl.gov/">Jacobson, Van</A>
<DT><A HREF="http://www.sdsc.edu/SDSC/Staff/karin/karin.html">Karin, Sid, SDSC director</A>
<DT><A HREF="http://www.beckman.uiuc.edu/groups/biss/VirtualLibrary/mail/Archive/95pre-March/bugtraq/0445.html">Kernel modules</A>
<DT><A HREF="http://www.lanl.gov/">Los Alamos National Laboratory (LANL)</A>
<DT><A HREF="http://www.lbl.gov/">Lawrence Berkeley Laboratories</A>
<DT><A HREF="http://pubweb.acns.nwu.edu/~flip/politics.html#imelda">Marcos, Imelda</A>
<DT><A HREF="../../bio/markoff.html">Markoff, John</A>
<DT><A HREF="../../coverage/dutch-rogues.html">Markoff's article on Dutch hackers</A>
<DT><A HREF="http://web.mit.edu/">Massachusetts Institute of Technology (MIT)</A>
<DT><A HREF="http://www-nrg.ee.lbl.gov/mccanne/">McCanne, Steven</A>
<DT>Menapace, Julia
<DT><A HREF="../../bio/mitnick.html">Mitnick, Kevin</A>
<DT><A HREF="http://www.das.harvard.edu/users/students/Robert_Morris/Robert_Morris.html">Morris, Robert Tappan</A>
<DT><A HREF="http://www.southam.com/nmc/guide/computips/msdos.html">MS-DOS</A>
<DT><A HREF="http://www.nasa.gov/">National Aeronautics and Space Administration (NASA)</A>
<DT><A HREF="http://www.nsa.gov:8080/">National Security Agency (NSA)</A>
<DT>Packet sniffers
<DT><A HREF="http://mbhs.bergtraum.k12.ny.us/cybereng/history.html">Packet switching, Paul Baran</A>, Rand Corporation
<DT><A HREF="http://www.sfgate.com/~scottr/netsecurity-7-5-95.html">Pentagon's Pacific Fleet Command</A>
<DT><A HREF="http://www.well.com/user/fine/journalism/jail.html">Poulsen, Kevin</A>
<DT>ps command
<DT>Rand Corporation
<DT><A HREF="http://www.lick.pvt.k12.ca.us/misc/ldocs/gs/subsection2_6_1_1.html">root account</A>
<DT>Secret Service
<DT><A HREF="http://www.sri.com/">SRI International</A>
<DT><A HREF="http://www.stanford.edu/">Stanford</A>
<DT><A HREF="http://www.sun.com">Sun Microsystems</A>
<DT><A HREF="http://www.cienet.com/bystyle/th.html">The Thai House restaurant</A>, San Diego, California
<DT><A HREF="http://www.usdoj.gov/">United States Department of Justice</A>
<DT><A HREF="http://www.ucla.edu/">University of California, Los Angeles (UCLA)</A>
<DT><A HREF="http://musie.phlab.missouri.edu/IntroToUnix/unix-tutor/what-is-unix.html">Unix operating system</A>
<DT><A HREF="http://wzv.win.tue.nl/wietse/">Venema, Wietse</A>
<DT>Washington, DC
<DT><A HREF="http://www.penwest.com/demograp/woodside.htm">Woodside, California</A>
</DL>
</DD>
</TD>
</DL>
</TR>
</TABLE>
<P>
<HR>
<P>
<SMALL>
Copyright © 1995 <A HREF="http://www.fish.com/vf/">Vicious
Fishes Web Design</A> and <A HREF="http://www.Delux.Com/">Dan
Meriwether</A>.<BR> All rights reserved.
Contact: <A HREF="mailto:webmaster@takedown.com">webmaster@takedown.com</A>
</SMALL>
</BODY>
]]>