TAKEDOWN: The Well

<BODY BGCOLOR=#e0e0e0 BACKGROUND="../back1.jpg" TEXT=#770433 LINK=#ff4040 VLINK=#4040ff> <H1 ALIGN=CENTER><IMG SRC="../../SmallTakeDown.jpg" VSPACE=0 ALT="T A K E D O W N"></H1> <TABLE WIDTH=100%><TR><TD VALIGN=TOP WIDTH=25% ALIGN=LEFT><A HREF="../tech-talk/index.html"><IMG SRC="../ARROW-L.jpg" ALT="Prev" BORDER=0></A></TD><TD VALIGN=TOP WIDTH=50% ALIGN=CENTER><H2><IMG SRC="the-well.jpg" ALT="T h e W e l l"></H2></TD><TD VALIGN=TOP WIDTH=25% ALIGN=RIGHT><A HREF="../netcom/index.html"><IMG SRC="../ARROW-R.jpg" ALT="Next" BORDER=0></A></TD></TR></TABLE> <P> <BR> <P> <BLOCKQUOTE> <STRONG>January 27.</STRONG> Bruce Koball, a Berkeley, California software designer finds hundreds of megabytes of software in an account he has been using infrequently on the Well, a Sausalito, California online service. Late in the evening he receives the next day's edition of the <A HREF="http://www.nytimes.com/"><EM>New York Times</EM></A>, which contains a profile of <A HREF="../../bio/tsutomu.html">Tsutomu</A>. He realizes it is Tsutomu's software that has been illegally stashed in his account. <P> <STRONG>January 28.</STRONG> Koball calls Tsutomu and tells him his stolen data is on the Well. Tsutomu calls the Well and asks them to remove his stolen data and electronic mail. Well managers ask Tsutomu to come to Sausalito to help with their security problems. He already has commitments, but he asks Andrew Gross to go in his place. <P> <STRONG>February 4.</STRONG> A <A HREF="../../evidence/voicemail/text4.html">fourth voice mail message</A>, complaining about the posting of the first two messages, is left. <P> <STRONG>February 5.</STRONG> Andrew calls Tsutomu and tells him that the situation is far more serious than he expected. He has found millions of dollars worth of stolen software. Tsutomu agrees to drive down from a ski cabin in <A HREF="http://www.cdiguide.com/916/agencies/pics/vacatio4.jpg">Truckee, California</A> the next day and help. <P> <STRONG>February 7.</STRONG> Tsutomu sets up additional monitoring gear and finds that the intruder is using the Well as a staging base for attacks on corporate and university computers all over the Internet. The attacker keeps his tools at the Well and then uses them to break-in to a succession of systems. He finds a series of clues that the attacker may be Kevin Mitnick, a well known computer criminal, who is a fugitive for a parole violation and who is suspected in a number of computer break-ins. </BLOCKQUOTE> <P> <BR> <P> <TABLE WIDTH=100% BORDER=1> <TR> <TH COLSPAN=4><BR><H3>Players</H3></TH> </TR> <TR> <DL> <TD ALIGN=CENTER VALIGN=TOP WIDTH=25%> <DT><H4>People</H4> <DD> <DL> <DT><A HREF="../../bio/tsutomu.html">Tsutomu Shimomura</A> <P> <DT><A HREF="http://www.eff.org/~barlow/barlow.html">Barlow, John Perry</A> <DT><A HREF="http://www.InterNex.Net/Senior_Staff.html#robert">Berger, Robert</A>, Founder, Internex <DT>Burns, Levord, FBI <DT>Carson, Kathleen, FBI <DT><A HREF="http://www.boardwatch.com/mag/95/oct/bwm10.htm">Chen, Hua-Pei, system administrator, the Well</A> <DT><A HREF="http://www.fish.com/~zen/">Farmer, Dan</A> <DT>Gross, Andrew <DT>Hatfield, Barry, FBI <DT><A HREF="http://www.hotwired.com/staff/kevin/">Kelly, Kevin</A>, editor of <EM><A HREF="http://www.hotwired.com/">Wired</A></EM> <DT>Koball, Bruce <DT><A HREF="../../bio/markoff.html">Markoff, John</A> <DT>Mendez, John, Well lawyer <DT><A HREF="http://java.sun.com/people/mrm/">Mueller, Marianne, Sun Microsystems</A> <DT>Murphy, Pat, FBI <DT>Seiden, Mark <DT><A HREF="http://www.ncsa.uiuc.edu/General/SmarrBio.html">Smarr, Larry</A> <DT>Stroud, Claudia, the Well <DT><A HREF="http://www.hotwired.com/Lib/Privacy/privacy.meeks.html">Walker, Kent, assistant United States attorney</A> <DT><A HREF="http://asylum.apocalypse.org/pub/u/zonker/fpp/html/oblique.html">Wharton, John</A> </DL> </DD> </TD> <TD ALIGN=CENTER VALIGN=TOP WIDTH=25%> <DT><H4>Organizations</H4> <DD> <DL> <DT><A HREF="http://www.csn.org/">Colorado SuperNet</A> <DT><A HREF="http://www.escape.com">escape.com</A> <DT>Hacktic <DT><A HREF="http://www.intermetrics.com/">Intermetrics</A> <DT><A HREF="http://www.internex.com/">Internex</A> <DT><A HREF="http://www.motorola.com/">Motorola Corporation</A> <DT><A HREF="http://www.nando.net/">NandoNet</A> <DT><A HREF="http://www.netcom.com">Netcom</A> <DT>Rosewood Stone Group <DT><A HREF="http://www.sdsc.edu/">San Diego Supercomputer Center</A> <DT><A HREF="http://www.well.com/">The Well</A> </DL> </DD> </TD> <TD ALIGN=CENTER VALIGN=TOP WIDTH=25%> <DT><H4>Hardware</H4> <DD> <DL> <DT>Break-in program <DT>"Cloaking" program <DT>Crunch <DT><A HREF="http://www.honda.com/cars/accord/">Honda Accord</A> <DT>in.pmd (Portmaster daemon) <DT><A HREF="http://www.jeepunpaved.com/cherokee/cherokee.html">Jeep Cherokee</A> <DT>newgrp <DT><A HREF="http://www.rdi.com/">RDI PowerLite</A> <DT><A HREF="http://www.lacie.com/scsi.html">Small Computer Standard Interface (SCSI)</A> <DT>Sniffer program <DT>snoop <DT>SPARCcenter 100 <DT>STI-III <DT><A HREF="http://www.sun.com:80/cgi-bin/show?products-n-solutions/hw/wstns/jtf_ss4.html/">Sun SPARCstation</A> <DT>Sun workstation <DT><A HREF="http://www.clock.org/clock.org.html">Time synchronization</A> </DL> </DD> </TD> </DL> </TR> </TABLE> <P> <TABLE WIDTH=100% BORDER=1> <TR> <TH COLSPAN=3><BR><H3>Details</H3></TH> </TR> <TR> <DL> <TD ALIGN=CENTER VALIGN=TOP WIDTH=33%> <DT><H4>Locations</H4> <DD> <DL> <DT><A HREF="http://www.fsr.com/National/thewell/bay_area/mill_valley/homepages/buckeye.html">Buckeye Roadhouse, Mill Valley, California</A> <DT><A HREF="http://www.fsr.com/National/thewell/bay_area/mill_valley/homepages/cantina.html">Cantina restaurant, Mill Valley</A> <DT><A HREF="http://www.holiday-inn.com/">Holiday Inn</A>, San Rafael <DT>Mount Rose <DT><A HREF="http://www.palmsprings.com/">Palm Springs, California</A> <DT>Samurai restaurant, Sausalito <DT><A HREF="http://sbt.sbtcorp.com/sausalito/resource.html">Sausalito, California</A> <DT><A HREF="http://www.cdiguide.com/916/agencies/pics/vacatio4.jpg">Truckee, California</A> <DT><A HREF="http://www.DesertResorts.com/westin/index.html">Westin Mission Hills Resort, Palm Springs, California</A> </DL> </DD> </TD> <TD ALIGN=CENTER VALIGN=TOP WIDTH=33%> <DT><H4>Evidence</H4> <DD> <DL> <DT>Files found at The WELL <DD> <DL> <DT>Cellular phone software from Qualcomm <DT>Credit card numbers of Netcom subscribers <DT><A HREF="http://http.cs.berkeley.edu/~eric/">Eric Allman</A>'s email <DT><A HREF="http://www.fish.com/~zen/">Dan Farmer</A>'s email <DT>Netcom password file <DT>Oki cellular telephone source code <DT>Password file from apple.com <DT>Paul Kocher's email <DT><A HREF="http://www.fish.com/satan/">SATAN</A> source <DT>Silicon Graphics source code and security tools <DT>Software from Intermetrics <DT>Sniffer logs from Motorola's Semiconductor Products Sector Internet gateway <DT>Various cracking tools </DL> </DD> <DT><A HREF="../../evidence/voicemail/text4.html">Voice mail #4</A> </DL> </DD> </TD> <TD ALIGN=CENTER VALIGN=TOP WIDTH=33%> <DT><H4>Background</H4> <DD> <DL> <DT><A HREF="http://w3.gti.net/mod/phiber.html">Abene, Mark (Phiber Optik)</A> <DT><A HREF="http://www.americanexpress.com/">American Express</A> <DT><A HREF="http://www.art.net/">Art on the Net (art.net)</A> <DT>Austin, Ron <DT><A HREF="http://rs733.gsfc.nasa.gov/~jntjw/bike/tips/avcalibration.html">Avocet cyclometers</A> <DT><A HREF="http://www.campmor.com/watches/avocet.vertech.alpin.html">Avocet Vertech altimeter watches</A> <DT><A HREF="http://www.catalog.com:80/amw/">Asilomar conference on microprocessor design</A> <DT><A HREF="http://www.att.com/">AT&T</A> <DT><A HREF="http://www.sjmercury.com/digital/bank.htm">Bank, David</A>, <EM>San Jose Mercury News</EM> <DT><A HREF="http://www.airnote.net/ww/pager-faq.html">Beepers/Pagers</A> <DT><A HREF="http://www.organic.com/Staff/brian/">Behlendorf, Brian</A>, <EM>Wired</EM> <DT><A HREF="http://www.footwise.com/">Birkenstocks</A> <DT><A HREF="http://bcn.boulder.co.us/">Boulder, Colorado</A> <DT><A HREF="http://www.well.com/user/sbb/index.html">Brand, Stewart</A> <DT><A HREF="http://voyager.bxscience.edu/">Bronx High School</A> <DT><A HREF="http://www.best.com/~shred/">Cellular telephone</A> <DT><A HREF="http://plan9.att.com/netlib/att/cs/home/cheswick.html">Cheswick, Bill, AT&T Bell Laboratories</A> <DT>Christensen, Soeren, Sun Microsystems <DT><A HREF="http://catless.ncl.ac.uk/Risks/16.14.html#subj14">Clift, Neill</A> <DT><A HREF="http://www.bucknell.edu/~mullins/clipper.html">Clipper phones</A> <DT><A HREF="http://www.haifa.ac.il/~weblaw/courses/villprog/cfaa.html">Computer Fraud and Abuse Act</A> <DT><A HREF="http://www-swiss.ai.mit.edu/~switz/cfp96/">Computers, Freedom, and Privacy (CFP) conference</A> <DT><A HREF="http://www.tekptnr.com/tpi/b/vendors/csc/home2.html">Computer Sciences Corporation</A> <DT><A HREF="http://www.2600.com/">Corley, Eric (Emmanuel Goldstein)</A> <DT><A HREF="http://fiction.plaidworks.com/sfspiders/Arenamap/mappage.html">Cow Palace</A> <DT><A HREF="http://www.ocf.berkeley.edu:80/~stoll/cuckoos_egg.html"><EM>The Cuckoo's Egg</EM></A>, Clifford Stoll <DT><A HREF="ftp://ftp.csua.berkeley.edu/pub/cypherpunks/Home.html">Cypherpunks</A> <DT><A HREF="http://www.defcon.org/">Defcon</A> <DT><A HREF="http://www.via.net/~lewis/">DePayne, Lewis</A> <DT>DiCicco, Lenny <DT><A HREF="http://www.Sun.COM/cgi-bin/show?sunergy/Bios/diffie_bio.html">Diffie, Whitfield</A> <DT><A HREF="http://www.art.net/Studios/Visual/Lile/lile.html">Elam, Lile</A> <DT><A HREF="http://www.paranoia.com/~ebola/privacy6.html">Electronic Communications Privacy Act</A> <DT><A HREF="http://www.eff.org/">Electronic Frontier Foundation</A> <DT>Richard Ress, <A HREF="http://www.fbi.gov/compcrim.htm">FBI Computer Crime Squad</A> <DT>FBI's Quantico training center <DT><A HREF="http://www.fedex.com/">Federal Express</A> <DT><A HREF="http://www.tkg.com/~castor/">Fu, Castor</A> <DT><A HREF="http://www.fujitsu.com/">Fujitsu</A> <DT><A HREF="http://www.cygnus.com/~gnu/">Gilmore, John</A> <DT>Goggans, Chris <DT><A HREF="http://www.dead.net/">Grateful Dead</A> (DeadHeads) <DT>Heinz, Eric <DT><A HREF="http://www.persimmon.com/palo/city/communserv/recreation/maps/map-bay-area.html">Highway 101</A> <DT><A HREF="http://wl.iglou.com/hippie/real.htm">Hippies</A> <DT><A HREF="http://www.pc.ibm.com/pchome.html">IBM PC</A> <DT>IBM's Thomas Watson Research Center <DT><A HREF="http://www.kei.com/homepages/mkapor/">Kapor, Mitchell</A> <DT><A HREF="http://www.sdsc.edu/SDSC/Staff/karin/karin.html">Karin, Sid, SDSC director</A> <DT><A HREF="http://www.boardwatch.com/mag/95/oct/bwm10.htm">Katz, Bruce, Well owner</A> <DT><A HREF=http://www.halcyon.com/colinp/kesey.htm"">Ken Kesey's Merry Pranksters</A> <DT>L.A. Cellular <DT><A HREF="http://www.vegas.com/">Las Vegas, Nevada</A> <DT>Littman, Jonathan <DT><A HREF="http://www.nw.com/nw/WWW/whoarewe.html">Lottor, Mark</A> <DT><A HREF="http://www.lotus.com/">Lotus Development</A> <DT>Macintosh Computer <DT>McCaw Cellular <DT><A HREF="http://www.media.mit.edu.">MIT Media Laboratory</A> <DT><A HREF="../../bio/mitnick.html">Mitnick, Kevin</A> <DT>Model trains <DT><A HREF="http://www.mty.com/">Monterey, California</A> <DT>Morgan Stanley <DT>MSB Associates <DT><A HREF="http://www.ncsa.uiuc.edu/">National Center for Supercomputer Applications (NCSA)</A> <DT><A HREF="http://www.nsa.gov:8080/">National Security Agency (NSA)</A> <DT><A HREF="http://nicholas.www.media.mit.edu/people/nicholas/">Negroponte, Nicholas</A> <DT><A HREF="http://www.nytimes.com/"><EM>New York Times</EM></A> <DT>Novatel <DT><A HREF="http://www.oki.com/">Oki</A> <DT>Pan American Cellular <DT>Password cracking <DT><A HREF="http://titan.ecs.fullerton.edu/~jherndon/articles/a/asteal.html">Petersen, Justin Tanner (Eric, Agent Steal)</A> <DT><A HREF="http://freeside.com/phrack.html"><EM>Phrack</EM></A> <DT><A HREF="http://www.playboy.com/"><EM>Playboy</EM></A> <DT><A HREF="http://www.well.com/user/fine/journalism/jail.html">Poulsen, Kevin</A> <DT><A HREF="http://www.qualcomm.com/">Qualcomm</A> <DT>RadioMail terminal <DT>Reno Airport <DT><A HREF="http://www.next.com.au/music/rstone/"><EM>Rolling Stone</EM> Magazine</A> <DT><A HREF="http://www.clubtroc.com/">San Francisco club scene</A> <DT><A HREF="http://www.rockweb.com/save-the-earth/carlos-questions.html">Santana, Carlos</A> <DT><A HREF="http://www.wileyco.com/PRSA/">Seattle, Washington</A> <DT><A HREF="http://www.reednews.co.uk/~gavin/security/sendmail.hole.html">sendmail</A> <DT><A HREF="http://www.skipatrol.org/">Ski Patrol</A> <DT><A HREF="http://www.sprint.com/">Sprint</A> <DT><A HREF="http://www.ocf.berkeley.edu:80/~stoll/">Stoll, Clifford</A> (<A HREF="http://town.hall.org/university/security/stoll/cliff.html">pictures</A>) <DT><A HREF="http://www.sun.com">Sun Microsystems</A> <DT>SunSoft <DT>Tahoe Donner cross-country center <DT>Toshiba T4400 <DT><A HREF="http://www.turner.com/">Turner Broadcasting</A> <DT><A HREF="http://www.usc.edu/">University of Southern California</A> <DT><A HREF="http://www.washington.edu/">University of Washington</A> <DT><A HREF="http://www.uswest.com/">US West</A> <DT><A HREF="http://www.csc.com/CSC_Vanguard/u_recent_schedule.html">Vanguard conference</A> <DT>VMS <DT><A HREF="https://www.well.net/mwec/mwec.toc.html"><EM>Whole Earth Catalog</EM></A> <DT><A HREF="http://www.well.net/mwec/wer.html"><EM>Whole Earth Review</EM></A> <DT><A HREF="http://www.xerox.com/PARC/default.html">Xerox Palo Alto Research Center (Xerox PARC)</A> <DT><A HREF="http://www.bridge.net/~hyperust/">Young, Neil</A> <DT>Ziese, Kevin, Air Force Information Warfare Center </DL> </DD> </TD> </DL> </TR> </TABLE> <P> <HR> <P> <SMALL> Copyright &copy 1995 <A HREF="http://www.fish.com/vf/">Vicious Fishes Web Design</A> and <A HREF="http://www.Delux.Com/">Dan Meriwether</A>.<BR> All rights reserved. Contact: <A HREF="mailto:webmaster@takedown.com">webmaster@takedown.com</A> </SMALL> </BODY>