Hacker News Reader

Comment by amanaplanacanal | Hacker News Reader

Cliff Stoll is a pretty funny guy. He also wrote a fascinating book about tracking hackers back in the day.

Seconded! It gives very good flavor of life working at Berkeley and living there, and also the Internet of the day: https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espiona...

I read this book shortly after he wrote it. I was a junior engineer at a big company, and the final chapter (on humans being the weakest link in computer security) inspired me to run "crack" on the password (shadow) file of one of our networked Sun workstations. (I actually wrote some code to re-create the shadow file from the output of ypcat because we were running NIS.) Crack managed to obtain about 20% of the users passwords, including root. I wasn't an admin on that network, so I informed the admin and his reaction was that he did not care if I had admin on his network. (I ran a few others already.) One of the cracked user passwords struck me as funny so one day in the hallway I casually asked what that word meant (to the owner of the password). The terror-stricken user froze and asked me why I wanted to know. Instead of recognizing the issues associated with using a dictionary word for a password, he went and complained to my manager. I got called on the carpet for "hacking his windows account." (Apparently he used the same password everywhere.) Fortunately my boss had a good sense of humor and nothing came of it. This was before the company even had a computer security policy. A year or two later, doing what I did would become a fire-able offense.

Hey everybody, I found Randal Schwartz's HN account!

;-)

(For people who weren't Perl hackers in the mid-late '90s, Randal pretty much did exactly that while contracting at Intel, and got 3 felony convictions and 5 years probation, and it took him 12 years of fighting to get the felonies expunged. Be very very careful "trying out" security related things at your employer, without very clear written instruction showing it was authorised - you do not want to be the guy in front of a judge saying "it's part of my job description as a sysadmin!" when your employer is claiming otherwise....)

I was defacto 'network admin' at one company. One guy I warned off the porn (dont care you look just do it at home on your own line). He got mad and yelled at the owner and got my privs revoked on the network by bullying one of my other co-workers. My boss took them back and then added even more just to make the guy look bad. Lesson learned. Just block it and do not say anything if you are not in authority to say so. If they complain 'you will look into it'.

Just to be clear, I obtained the passwords (including root) with "crack", but I NEVER used them. I did not ever attempt to log into any account that I was not authorized to use. All I did was to notify the actual administrator of the system about the security issues. The issues being both that even through "shadow passwords" was working properly, one could still obtain encrypted passwords by using "ypcat passwd", and that some users (including him) were using insecure passwords. The user who panicked and called my boss had just assumed that I accessed his Windows account. Oh, and there were never any hard feelings between us after that. We are still friends today.

I'd still be super careful doing that without explicit written authorisation. You "got away with it", not everybody does. (Although I'll note he admits to having made some "stupid" decisions which perhaps you avoided. And I'm guessing he knowingly or unknowingly pissed off someone powerful enough to push through 3 felony convictions, even if they were borderline enough to be completely expunged 12 years later. You never want to piss those guys off without appropriate in-writing justification):

https://www.washingtonpost.com/archive/business/1997/09/15/t...

"He installed a program called "Crack" that automatically guesses passwords. Like most tools, it's used by both good guys and bad guys, by those who abuse computer systems and by system administrators who want to find out whether users are avoiding such easy targets as plain English words. It's even distributed by the Computer Emergency Response Team at Carnegie Mellon University.

He installed the program without telling his boss, something that he today admits was "stupid." But the program proved his point: Crack quickly guessed nearly 50 passwords of the 600 users of that system -- one belonging to a company vice president. Instead of reporting the company's security problem right away, Schwartz has said, he decided to continue testing. Again, he admits in hindsight, "stupid."

Other system administrators discovered the program and traced it back to Schwartz.

Schwartz insisted he never used the passwords for any nefarious purpose, and said he only acted because the company's lax security bugged him."

All very true! My story is from about 10 years before Randal's, but it was after the CFAA was passed so I guess I dodged a bullet.

Oh, and another good story from when I still had the same boss. A few years later I thought I would prank my office-mate (and show how easy it was to spoof email headers). This was back in the days with SMTP didn't have any security. From a hallway computer (not directly traceable to me), I composed a "You're Fired!" email from my boss to my office-mate. My office-mate had an east-European surname that was easy to misspell and I did. So the email bounced back to my boss and my office-mate never saw it. My boss knew right away who was responsible. He laughed.

A Cuckoo’s Egg! Fantastic book.

Cliff stops by here from time to time to comment as well. Here’s a recent comment thread he participated in: https://news.ycombinator.com/item?id=21830277

Sometimes. It helps when someone tells me...

There's an episode of Nova about it as well, that's up free online various places. Cliff is such a unique and energetic personality it's really entertaining to watch.

The episode is called "The KGB, the Computer, and Me". Here's one on YouTube: https://youtube.com/watch?v=hTx9h3Sm29I

Hmmm -- that guy doesn't have grey hair! Or a cellphone. Or a web browser. I don't recognize him.

Oh wow thank you, I’ve looked for this for years. I am pretty sure this story and King’s Quest are the two major reasons I ended up in computer engineering.

I'm sure it's that way for quite a lot of us that are of a similar age. I have a really distinct memory of watching it as a child. I wasn't really interested in computers beyond the (rudimentary) games we had on ours, but this episode planted a lot of ideas in my head I'm sure.

Jason, I thought I was an oldster when I chased down that hacker and wrote about it.

  Thirty plus years later, I think of how young I was back then.  
 
  There must be some lesson in this, but I can't find it.

I would have been roughly kindergarten age at the time. That kid back then watching a face on tv would have never predicted the world would change in such ways that we'd be here chatting. As ugly as some things have gotten on the internet of late, that still fills me with something like awe, joy, and hope for the future.

I may only be 2/3rds your age, but every time I look back on life I feel the same way. I hope I always feel that way, because I think that means I'm continuing to learn and grow.

My friend, I am doing my best and really hope to catch up. But I always seem to be almost 600 days behind you. Please, can we do something to fix this? (Without any danger to either of us, of course!)

OH! You need a simple one-way time machine. You're welcome to borrow mine, but it seems to be out of order for the moment.

Wait a minute!

You have an out of order time machine? That is what I've been looking for all my life.

I already have an in order time machine, and it keeps going the same direction. I want an out of order machine!

Can we trade? Today, tomorrow, or yesterday.

I will give you a Klein bottle for it. And even do your dishes!

Hey Scope of the Stratos,

I'm unable to wait a minute. My time machine's out of order.

[edit: already answered in the parent thread!]

Wasn’t there an old Nova episode about this on PBS? I vaguely recall it, and have always wanted to rewatch as an adult. Just a fantastic (real!) story.

Reply on news.ycombinator.com