Reading Network Logs

Two programs at Lawrence Berkeley Laboratory kept track of who used the lab's computers, so that each department could be billed for its time. Their totals disagreed by 75 cents in August 1986. The job of finding out why went to Clifford Stoll, an astronomer who had just started working in the lab's computer center. The gap came from an account named hunter, which had used a few seconds of computer time and had no one to bill. No one at the lab had set it up. It was removed, and soon afterward someone signed in with the account of a member of the lab's staff who was spending the year in England.

To see what the visitor was doing, Stoll spent a weekend borrowing printers and terminals from around the lab. Each of the lab's incoming phone lines ended in a modem, which turned the sound arriving over the line into a computer's data. He attached a printer or terminal to each line after its modem, and every keystroke arriving on them was printed on paper. When the visitor came back, the paper filled with what he typed. He made himself the system's superuser, the account allowed to do anything, through a flaw in a program the system trusted. Then he used the lab's link to a military network to reach one computer after another, at army bases, defense contractors, and Air Force sites. At each he tried the same few usernames and passwords, such as guest. On the ones that let him in, he searched the files for words like nuclear and SDI, short for the Strategic Defense Initiative, a planned missile-defense system.

Leave aside how he became superuser. What in the record of his connections already showed that the visitor wasn't that staff member?

A staff member signing in from away reads mail and runs programs on the lab's own computers. This visitor went from the lab to dozens of computers the lab had no business with, one after another, trying the same logins at each. Probing machine after machine on other networks, uninvited, is the kind of unauthorized scan that counts as an indicator of compromise, and it left from the lab's own computer under a staff member's name.

Stoll's intruder reached the lab over a phone line. An attack on a local network can start much closer, on a machine already inside it. The bus agency's garage has its own segment, with a switch that serves the mechanics' laptops, among them the diagnostic laptop that reads fault codes from the dispatch server. Say one of those laptops picks up malware that starts MAC flooding: it sends the switch frame after frame (frames are the units of data a switch passes along), each from a different made-up hardware address. Describe what the switch's MAC address table would show, and what a sensor watching the garage's traffic would see.

The table normally holds about one address for each device in the garage. Within seconds it holds thousands, until it is full. The sensor sees the cause as it happens: a sudden surge of frames carrying thousands of hardware addresses it has never seen.

ARP poisoning, the other attack that works inside a segment, is quieter. The attacker's machine sends ARP replies again and again, each claiming another device's IP address for its own hardware address. A sensor that sees one hardware address answering for two IP addresses has found the sign.

A smurf attack, the forged broadcast ping from the lesson on network attacks, leaves a trace of its own. The garage's laptops and switches almost never send pings to the broadcast address, so a sensor there normally counts close to none.

The drivers' tablets sync over Wi-Fi when the buses come back to the depot, and an attacker can go after that network without plugging into anything. One way is an evil twin. The attacker sets up a device that announces a Wi-Fi network under the depot's network name, its SSID, so that tablets join it on their own, or under a name close to it, so that a driver picks it by hand. The agency's IT staff scan the depot every week for names that look like its own. When an unfamiliar one appears, they find the device by triangulation. They measure its signal strength from three or more places, work out where the readings meet, and go there to switch it off.

Another way is a jammer, which fills the frequencies Wi-Fi uses with electromagnetic noise. Nothing near it can hold a connection.

DNS poisoning leaves even less behind. Riders who look up the trip planner's name and get a false address from a poisoned DNS server go to someone else's server, and the agency's servers never see them. All its own records can show is that far fewer riders are arriving.

Stoll's printouts showed where the intruder went. They didn't show where he was. His calls reached the lab through Tymnet, a commercial network. Following them back took months of work with Tymnet, the phone companies, the FBI, and the West German post office, which ran that country's phone network. Each trace had to be finished while the intruder was still connected, and his visits were short. So Stoll and the people helping him gave him a reason to stay. They filled an account with invented files about a military network project that didn't exist, and the intruder spent more than an hour reading them, long enough for the trace to finish. It ended in Hannover, West Germany, with Markus Hess, a programmer there, part of a group that had been selling what it found to the Soviet KGB, and in 1990 a West German court convicted him and two other men of spying. The files had been bait, of the kind now called a honeypot.