Kuji Media Corporation Ltd.

UK Hacker Says He Found Anti-Gravity Engine File
At W/P AFB

By Matthew Williams

2-7-99

Mathew Bevan is a 23 old computer hacker with an interest in UFOs. Recently he made front page world headlines when he was charged with hacking offences which included access to the most secret military computers of the United States Military. Mathew was able to access computers, which had the ability to launch nuclear missiles or other missiles. Described by one pentagon spokesman as being “The biggest threat to world peace since Adolf Hitler”, Mathew Bevan talks to Matthew Williams about how he did it and the fact that whilst in Wright Patterson Air Force Base computers he saw plans to a secret Anti Gravity propulsion engine….

Matthew Williams: How many years have you been into the Internet.

Mathew Bevan: Since about 16. It was a case that over here there were very few Internet providers. The only one was Demon Internet and the closest phone number to dial was in Bristol, so it was just easier to do a free (hacked) phonecall to the States and use a free provider and not worry about paying any bills.

MW: How does one “hack” the phones – what is the procedure involved.

MB: You use a little program on the old computer… The Amiga was the first computer to be used for “Blueboxing” (hacking phones) and the reason was that it has four channels of sound whereas the PC could only go “BEEP”. To get the blueboxing to work you had to play dual tones into your phone. There was a set of frequencies of tone not dissimilar to DTMF which is on most modern phones (DTMF – the tones played when you press a number on your phone keypad). When the special tones were played it would cause the network to do a number of special things.

What you then needed to do is to call a 0800 number for a foreign countries operator service – such as Columbia or Hawaii. You would play a few tones down the line and it would cut the operator off and BT would think that you had hung up the call but in fact you were still in the trunking system and you play a few more tones and you could re-route your call anywhere.

MW: Is it complicated to do these things because playing sets of musical tones down the phone line sounds quite complicated and what if you make a mistake.

MB: Well it is complicated but is a case of playing around to see what you could do. If you make a mistake you just hang up and try again. There were some other interesting things you could do like dialling a number and when you get the engaged signal then play a couple of tones and break into the call and listen without the two parties knowing you were there.

MW: You are saying that there are ways to listen to calls without being detected and this can be done from any home phone with such codes! Are you saying that you could listen to another call anywhere in the world?

MB: Yes but most of the time I was calling into the States anyway so that’s where I did it the most. I think that secretly listening in is what it was designed for.

MW: So when did you go from hacking innocent university computers into hacking the military computers?

MB: It was a case of getting onto a system and getting the password file and then running the encrypted passwords through a code cracking program so that you get the passwords. Once you have the passwords then you can get a higher level of access and get into peoples files and folders and you can monitor the system to see what it is happening. You can see that there are people that are themselves who are going from computer to computer with legitimate reasons. Now it would just happen that some of these people would be working on projects with the military. You could find that a professor would be contacting a military site (computer).

One would get fed up with doing small computer systems and would want to try to hack something bigger. The thing with people is that they tend to like the same password for multiple systems and so if you have hacked their account on a relatively unprotected system then the password will probably work on another more well protected system. The professor probably has some silly password like “professor” on the university computer and more often than not would use the same on a military system.

It is not a case of sitting there typing in millions of passwords and hoping that you get the right one. There are much more intelligent programs to do that for you and get you in to a system.

We now use things called SNIFFERS, which are covert and do not harm the system in any way. These sit in the background and watch for people’s passwords and they send them back to you. This is something that I was charged with and the offence read “modification to a system with intent to impair the operation of the computer”. Well the whole point of a sniffer is that it sits there and nobody knows it is there – if it did any harm we wouldn’t use them.

Well once inside you would use various hacker techniques to bump up your access level to that of systems administrator, so that you would have the entire system under your control. You could connect to other systems on the network with the same authority. You could monitor people’s emails and you could get into their project folders and look at their research and development work or papers that they have written. Occasionally you would get into somewhere that was quite interesting but it wasn’t always that way. Most of it was quite boring. Back in the old days before Internet Browsers that give you nice pictures and buttons to click on, it was all text based and you had to use the keyboard to type commands. There were pictures, but you had to manually download them and view them “offline”.

MW: So what were the most exciting computer systems you hacked?

MW: Firstly there was the FLEX system. This stands for Force Level Execution, and this is the thing which the News of the World newspaper picked up on. The reason this system was of interest because it had control of nuclear missiles. To explain what this program does; the official line is to plan an air war and to find out what things are incoming and what air strikes are pending. The system would then advise you of where to strike next with the best killing ratio and where to launch you missiles etc. From looking on the computer and through the “source code” I got the impression that the system had direct access to real missiles. What type of missiles I do not know and the News of the World printed that these were in fact Peacekeeper Missiles, but that didn’t come from me – I don’t know where they got those details from…?

The easiest comparison I could make is that it was a very similar system to the Skynet System in the Terminator movies. This means that the computer has access to all available information and can make intelligent decisions about how to operate a war and even control the weapons.

Of course the FLEX system is secret and something that they do not want the public to know about and the fact that weapons are controlled solely by computer. You would think that there would be other failsafe system but, as far as I could tell, that was not the case.

There were other systems such as Wright Patterson Air Force base and White Sands Missile Testing Ground, some now I forget – I went to a lot. I had been to so many I had to tell the police that I could not remember all the systems I had been in.

The lawyers couldn’t get their stories straight even for a trial of this type, which you would have expected. They would not present evidence to show how I was able to hack into their systems. So with the details of the computer systems real purpose having been removed from the case then I am now pretty sure that I did have a good idea about the real function of the programs – they didn’t want this information out in any form. This was probably the reason that they were so pissed off about it because I came forward and told everyone. You see after I was arrested then I started to get some very strange phone calls from people claiming to be in the military, Koreans and other people. I had weird semi-threatening things said to me and this is why I moved away to get away from these treats and this is another reason that I spilled the beans, in order to keep myself and my wife safe, after all what is the point of silencing me after I had talked.

MW: Where were you living and did the police give you any assistance in your moving because of these threats.

MB: Firstly I was living in Grangetown and then I was moved by the benefits agency to another location. They were aware of the court case and the sensitivity and people from Scotland Yard were helping in this respect also. I was given a new name under the benefits agency computers and was living under name of Mr Smith for a while.

MW: Why do you think they were prepared to go to this trouble to help you?

MB: What you have to understand is the fact that there was a big Senate hearing on the fact that two hackers had got into secret computer systems. One of these was a 16-year-old who they had arrested and the other person was supposedly thought to be a foreign spy who was paying the 16-year-old for information. I was made out to be the foreign spy and I was prepared to believe from the threats I was getting that these people were serious. So I had to move home.

To give you an idea of the level of the ominous phone calls I was getting, at the time I was just about to change my phone over to British Telecom. Just days before I was arrested I was due to sign the BT phone forms and send them off, but had not done do at that point. Then I had another threatening phone call and I told them to **** off and said that I was now having my number changed. The voice on the other end of the line said “yeah we know that your new number is going to be 01222 233blah blah blah” and so they knew my new number already! My wife asked often who was speaking and one name we got was Chung Lee Makasuki and he gave some phone number in China, I think.

MW: When you were arrested what happened?

MB: I was working at Admiral Insurance at the time in their computer department for around a year and a half. One of the managers came in and asked me to come and have a look at one of their computer systems and I got up and went with him. I went with him to the MDs office and there were seven people in the office, your typical men in black so to speak but as this was the MDs office I didn’t at first see this as abnormal. When I got inside one of then said to me “Mathew Bevan” and I replied “yes” and then he put up his hand and said “I am placing you under arrest for hacking of NASA and various Air Force bases.” I was standing there stunned and I was going “Oh, gosh… ummm.” They then told me that they were going to search my desk, which they did, then they took me back to my house and searched there too.

When they got to the house they took all my X Files videos and X Files posters and the reason was because the “KUJI” hacker that they were after had a computer user description which read “The Truth Is Out There”. So they wanted to use the X Files material to prove that they had the correct “KUJI”. They just wanted to pin me on anything they could. They took all of my computer kit as well as my passport.

During the interview I agreed that I used the handle ‘Kuji’ and afterwards the police gave me my property back such as the X Files videos, posters,monitor and the keyboard back but they kept everything else.

I was taken to the Central Police station in Cardiff. The officers were from the computer crime unit of the Met Police. I believe that the C.C.U. also uses the code S.O.6 which leads me to believe that they are intelligence (MI6) related but I don’t think they would admit that.

MW: What was the atmosphere like in the interviews?

MB: It was a good cop bad cop scenario. The one person was very nice and the other guy was quite nasty and was giving snide remarks and shouting at me. There were bits in the interviews that were really stupid too where I was asked by the nice cop if I had any political leanings and I said no – then the other cop stepped in and said “Yeah, but your a vegetarian” and he then said “So you do have a leaning then.”. To this I then replied “Well if being vegetarian is a political leaning then I plead guilty!”. The other copper then steps in and make a lighthearted comment and then the other one steps in again and says “ah so you indicate a leaning then” and so on.

I was under arrest for the best part of 36 hours but there was about 28 hours spent in the cells. I wasn’t allowed to speak to my wife or anyone else. They threatened that they would arrest my wife and I pointed out that she knew nothing about computers and they said tough because they would arrest her anyway. This was part of their oppression tactics. I said what do I have to do to stop you arresting her and they said that if I co-operated then they would not arrest her. So the only telephone calls I was allowed were to my solicitor because they didn’t want me to tell anyone I had been arrested.

One thing I didn’t realise but found out was the fact that in Cardiff police station they bug the cells with listening devices and recently a few people have had tape recorded evidence used against them when they have admitted to things whilst in custody. This is immoral but they seem to be able to do it.

MW: What sort of specific questions were you asked by the police in the interview.

MB: They asked me about the Rome Labs computer and if I had placed a sniffer program on the computers. I would not admit to this. They also asked me about Goddard Space Flight Centre and Wright Patterson, I admitted to these but was never charged with them! They don’t charge me with the right things. They then charge me with conspiracy with the other hacker, but by the time they realise that they don’t have any evidence to prove this it transpires that they could not charge me with the original intended charges anyway because they are out of time by 6 months; They would have had to charge me with a summary offence within six months of my arrest. They also found out that they were out of time for a 3-year clause

The Americans position in court was that they claimed that they had to spend 1/2 a million dollars to repair their computer systems. A fundamental question that my defence asked was could we see a backup of the system to show before and after these so called repairs to prove what was being claimed. The Americans said that we could not see the records because they were so sensitive and also said that it was not in the jurisdiction of the British courts to order them to show the files. If it were any other trial then you would ask how could we accept this evidence but because we are asked to take the Americans word, this is supposed to be good enough.

The next thing that happened was that my barrister had meetings with the prosecution and he then turns around to me and says that he feels that they will find me guilty on some charges so I should give in and change my plea to guilty. So I ‘relieved’ him of his professional duties and got a new barrister who was then completely on my side and who felt that I did indeed have a worthwhile and quite solid defence.

MW: What was the final stage of the case and how did you get acquitted?

MB: The judge surprised everyone by saying to the prosecution that because my charges were lesser than those of the other hacker and that the other hacker had received a small fine of ?1200 then my sentence at best would be non-custodial so to proceed with such a case would not produce a large penalty whilst the costs for running such a case would run into millions. It was estimated that if I would be found guilty I would get a ?450 fine and considering that the court’s daily costs would be ?10,000 it would not be worth it.

However the prosecution was determined still and said that they would still proceed and then at the last stage they pulled out and said that they wished to offer no evidence and that it wasn’t in the public interest to run the case. Verdicts of not guilty were entered, this being the equivalent of a full acquittal and so ensuring that the police would waive the right to re-arrest me in conjunction with these charges.

This being the case I was then free to admit to the press and everyone else that I had in fact done some of those things and that I did hack those systems. This pissed Scotland Yard off immensely and they are now being very awkward about returning the seized goods that are in evidence storage even though the case has been dropped.

MW: How were you tracked down?

MB: I cannot be sure because this was never disclosed – I have my suspicions that I was grassed on by a hacker. They said they found my number on somebody’s computer system and traced me back like that but I think somebody told them who I was. The point was if it took them 2 years to find my number on the other hackers hard- drive as they claim then that is incompetence, as a search of a 250meg drive takes less than five minutes.

MW: Where does the story take a turn to where you started hacking military sites for UFO information?

MB: In a hacker magazine called PHRACK, it gave a list of sites that people who said they were interested in UFOs would like to see hacked and that hackers should check these out. Allegedly there were forty people who were trying to penetrate these sites and they got into some of them but they all went missing?

MW: A group of forty people went missing?

MB: Apparently so. They said in the magazine that if you were going to do it then do it carefully and printed a list of the sites. I used that list and used it and I also used some of the folklore of UFOs like “Roswell wreckage taken to Wright field”, “Lockheed space missile company have connection to Area 51” etc. It is then just a case then of picking up the addresses and names of these computers. They are quite easy to find as the military provide you with as much information on their computers as you could ever want.

It was a case of “go for it”, “lets have a look”. As far as I was concerned I was not traceable and not causing any harm to anybody. If I couldn’t get in then no big deal, if I could then I was not going to screw the system up.

MW: You did gain access to some interesting UFO type files – what were these?

MB: The information was obtained through the Wright Patterson Air Base computer system. I was looking for information on the Roswell crash. On one of the computers at Wright Patterson the systems administrator was very un-secured. Captain Beth Long was the system administrator she is supposedly working in a pumping station in Alaska now instead of working at Wright Patterson – the reason being, because she had no password so this meant that anyone logging in as her meant they had the highest level of access on the system with no password needed!

Wright Pattersons’ computers were strange because unlike all other computers I had hacked which had clear warnings to hackers and people using the system regarding the classified information, their system had a banner which read in flashing red letters that no classified information is to be stored on the computer system. This throws you a bit. I was unsure if it was a real banner or if it was to put off people who had got that far.

In getting into that there was one machine on the network where I read current files and future project proposals. I read documents which gave me the impression that they had an anti-gravity engine which was capable of at least Mach 12 to Mach 15. I don’t know how exactly how fast that is but I think that is faster than most aircraft we know of today. Supposedly the aircraft which employs this engine uses a reactor to which there were a lot of detailed numbers and figures for, but I have no idea what all this meant. I can remember that the documents referred to a super heavy element, whatever that means. The element is the main fuel for the reactor. The engine worked by making a disturbance of molecules at the front of the craft so that it was able to stop the inertia or G-force inside the craft. I got the impression that this information was the type of material I was looking for because it was far in advance of our current technology and could be something to do with the Roswell UFO. Finding this threw me ecause I didn’t know if this information was a disinformation exercise and that people were meant to get in and find this stuff or if it was real. I can’t be sure and this is the one annoying thing.

In the interviews that were carried out with the police Wright Patterson was mentioned. Officer D S Janes asked me, had I been in there and I said that I had. He then asked me if I had got any information from this computer and I said that I had found details of an anti-gravity propulsion system. He asked if I downloaded any files from this project and I said no and I had only read the files online. As I said earlier I admitted to this but no charges were brought against me on this matter which is a bit odd. Then the interviewing officer asked me if I knew what Hanger 18 meant. I said “well if you are thinking of a building where they store extraterrestrial aircraft then this is what you might mean but perhaps you mean it is a computer or a bulletin board -is this what you mean?”. He replied that this could be the place that he was thinking of. This was the only time that Hanger 18 was mentioned in the interview.

In one of the hearings at magistrates’ court there was a special agent who came over called Jim Hanson. When asked what did he feel I was trying to achieve by my hacking he said that he believed I was not trying to do any harm but was just looking for information on Hanger 18. The prosecution then asked Jim Hanson in a light-hearted manner if he could confirm if Hanger 18 exists and Hanson responded “I can’t tell you that because I am not party to that information”.

What surprised me is the fact that I was asked about the little known Hanger 18 story instead of somewhere well known such as Area 51. Some members of the press alluded that I had hacked into Area 51, but I never said this and I refused to comment on the UFO issue to them. There were things I was not prepared to talk about to the press because I was not sure if I would be able to sell my story or not, so I did not want to give the information away.

The point was that I knew where Wright Patterson airbase was but I didn’t know, until I read a UFO magazine recently, that Hanger 18 was located at Wright Patterson. This was the first I ever learned about this.

When you put it all together it seems weird – the fact that I hacked into Wright Patterson and found details of a secret gravity engine and then the coppers asking me about Hanger 18, even to have a secret service agent in an open court saying about Hanger 18 and then me later on finding out that the two places are the same.

MW: Wasn’t there a ban on press reporting of your case?

MB: The press were there and they heard many interesting things which the failed to print but yes there was a ban on reporting the case, they said because they did not want the press opinion to influence the case in any way. This is the principal of subjudicy.

The prosecution had originally intended to have the case heard in secret (In Camera) but we did not allow this to happen.

MW: Have you ever seen any UFOs yourself?

MB: There was a time when I was going back to Newport from Cardiff and there were two very feint lights which were like passenger plane lights at first. They looked like they were going towards Rhoose airport but in-between them there was a start which was shooting back and forth between these two points. I had to force my friends to look at the lights because they would not look and said was crazy but when eventually they did look they agreed that they had seen something strange.

My Wife and I went on holiday to Fuertaventura in the Canaries and there were unusual lights in the sky above us which we watched for many hours. They changed colour and went on and off. They seemed so far away that they couldn’t be sure if they were satellites or not. I am not saying that this could not have been explainable phenomena.

MW: What interest did you have in UFOs before the trial.

MB: Just before I got into the hacking scene I was making the free phone calls and I found a Bulletin Board in Australia which had loads of UFO files. There were about 500 or 600 text files on offer so I downloaded them all and waded through them slowly. I found it really interesting and I wanted to know more. I go into the MUFON files and Keelynet Bulletin Boards and they had interesting things on them also.

It seems to me that far more people have seen UFOs and have evidence of this than there is evidence of GOD but people go around believing in GOD and are not ridiculed for this in any way!

My opinion is that there is a lot of information UFO information out there and it is hard to separate the liars from the truthful people. The thing is that some of the wilder claims may also be the truth but sometimes you cannot be certain of any claims either way.

The types of thing I mean are cases where people say that they have been onboard spacecraft and seen the classic alien with big black eyes and that they had experiences which are consistent with other witnesses. You then hear from the same person that the aliens took her for a ride and they were walking around on the moon without a spacesuit and the story starts to take a strange turn. It seems that people seem to go overboard but who knows that person may in fact be telling the truth.

MW: Do you know much about Bob Lazar? Tell me what you about his story.

MB: Well yes, Bob Lazar was able to show documents from his previous work to show that he worked with certain companies, but they deny he ever worked for them.

As I remember he is a really nerdy looking guy that claims to have worked at Area 51’s S3 complex I think? He claimed to have been working on crashed UFO technology. He said that he had seen saucers in hangers and had seen one flying one day. Only recently I saw the original interview he gave on video where he talked about his work and was drawing on a blackboard. I think he got prosecuted for running a brothel, I don’t know much more than that.

MW: Do you know anything about the propulsion systems he was talking about in his work on the saucers?

MB: No not really – I can remember the shape of the craft and I can remember that the propulsion system was in the bottom of the craft and that it is like a segmented thing. I remember a little area in the middle where the “guys” would sit. I don’t really remember the details or specifics of that.

MW: I am interested because you used the term “heavy element reactor” earlier on and I wondered if you have heard about something called “element 115”?

MB: No I did chemistry at school but was very bad at it and got kicked out. I don’t know anything about elements full stop really.

MW: Bob Lazars story was that he worked on propulsion systems, which utilised a reactor, fuelled by a super heavy element. Everyday scientists do not know of the element 115 of which he speaks. Does this mean anything to you?

MB: Maybe that is a parallel. The only things I know about him really is that he worked on UFOs and his involvement in the brothel and the fact that he looks a bit “geeky”.

MW: Can you remember any names of people on the project. Were there dates on any of the letters you saw regarding the propulsion system?

MB: Nope, as for dates all the information was current at 1994. Whether this was a totally new engine or if it was a new version I can’t be sure. I do know that it was a working prototype.

MW: Did they say what type of aircraft the propulsion system would be used in?

MB: Not that I remember, although I believe the engine was in use.

MW: Do you fear going to the United States?

MB: I am, not so much worried about being tried in the US for these things because they still have the same flawed evidence – but I fear that over there they would just stick me in prison without a trial and leave me to rot. This is something I have to look at carefully and to study the international law on these matters because there is a question of where was the crime committed on my computer in my house in the UK or in the US on their systems. This is a legal dilemma and is open to question.

A point is that there is a hacker out there now called Kevin Minick who did some minor hacking and has been in prison for 2 years and hasn’t been charged with anything yet! This can happen.

MW: Why did you do all this? Are you an anarchist or is this political or just for pure curiosity?

MB: I just get a thrill out of exploring new computer systems. If you could see my CV I now have knowledge of all these computers systems I have used. If employers wanted to know how I got that experience it may get a bit awkward to have to tell them that these were military systems I was playing with – but it still makes for a good CV! I can now admit to my hacking and not have any fear because it may be a plus point in that I know a lot about systems security.

I did it for the pure adrenaline buzz of hacking a secret system. This can keep you awake on no food for hours and this is one of the other reasons – because of the thrill.

MW: Thank you very much.

MB: Thanks.

In final clarification on some of the interview I asked Mathew if he saw any images on the computer systems at Wright Patterson Airbase. He says he saw one but remembers that the antigravity engine was a working prototype and is fitted in some form of aircraft and is in use although the type of aircraft was not disclosed. The information was dated around 1994, when the system was originally breached. It is now up to researchers and hackers alike to try and find out more.

Friday, 27 October, 2000, 17:57 GMT 18:57 UK
Hacking: A history

The ILOVEYOU virus as victims saw it

By BBC News Online internet reporter Mark Ward

Great hacks of our time

The original meaning of the word “hack” was born at MIT, and originally meant an elegant, witty or inspired way of doing almost anything.

Many early hacks took the form of elaborate practical jokes. In 1994, MIT students put a convincing replica of a campus police car on top of the Institute’s Great Dome.

Now the meaning has changed to become something of a portmanteau term associated with the breaking into or harming of any kind of computer or telecommunications system.

Purists claim that those who break into computer systems should be properly called “crackers” and those targeting phones should be known as “phreaks”.

1969

Arpanet, the forerunner of the internet, is founded. The first network has only four nodes.

1971

First e-mail program written by Ray Tomlinson and used on Arpanet which now has 64 nodes.

1972

John Draper, also known as Captain Crunch, finds that a toy whistle given away in the cereal with the same name could be used to mimic the 2600 hertz tones phone lines used to set up long distance calls.

1980

In October, Arpanet comes to a crashing halt thanks to the accidental distribution of a virus.

1983

The internet is formed when Arpanet is split into military and civilian sections.

Wargames, a film that glamorises hacking, is released. Many hackers later claim it inspired them to start playing around with computers and networks.

1986

In August, while following up a 75 cent accounting error in the computer logs at the Lawrence Berkeley Lab at the University of California, Berkeley, network manager Clifford Stoll uncovers evidence of hackers at work. A year-long investigation results in the arrest of the five German hackers responsible.

1988

Robert Morris, a graduate student at Cornell University, sets off an internet worm program that quickly replicates itself to over 6,000 hosts bringing almost the whole network to a halt. Morris is arrested soon afterwards and is punished by being fined $10,000, sentenced to three years on probation and ordered to do 400 hours of community service.

1989

Kevin Mitnick: Arrested
twice for hacking
Kevin Mitnick is
convicted of stealing software from Digital Equipment and codes for long-distance lines from US telephone company MCI. He is the first person convicted under a new law against gaining access to an interstate computer network for criminal purposes. He serves a one-year prison term.

At the Cern laboratory for research in high- energy physics in Geneva, Tim Berners-Lee and Robert Cailliau develop the protocols that will become the world wide web.

1993

Kevin Poulsen, Ronald Austin and Justin Peterson are charged with conspiring to rig a radio phone-in competition to win prizes. The trio seized control of phone lines to the radio station ensuring only their calls got through. The group allegedly netted two Porsches, $20,000 in cash and holidays in Hawaii.

1994

A 16-year-old music student called Richard Pryce, better known by the hacker alias Datastream Cowboy, is arrested and charged with breaking into hundreds of computers including those at the Griffiths Air Force base, Nasa and the Korean Atomic Research Institute. His online mentor, “Kuji”, is never found.

Also this year, a group directed by Russian hackers breaks into the computers of Citibank and transfers more than $10 million from customers’ accounts. Eventually, Citibank recovered all but $400,000 of the pilfered money.

1995

In February, Kevin Mitnick is arrested for a second time. He is charged with stealing 20,000 credit card numbers. He eventually spends four years in jail and on his release his parole conditions demand that he avoid contact with computers and mobile phones.

On November 15, Christopher Pile becomes the first person to be jailed for writing and distributing a computer virus. Mr Pile, who called himself the Black Baron, was sentenced to 18 months in jail.

The US General Accounting Office reveals that US Defense Department computers sustained 250,000 attacks in 1995.

1996

Popular websites are attacked and defaced in an attempt to protest about the treatment of Kevin Mitnick.

The internet now has over 16 million hosts and is growing rapidly.

1999

David Smith: Creator of
the Melissa virus
In March, the Melissa
virus goes on the rampage and wreaks havoc with computers worldwide. After a short investigation, the FBI tracks down and arrests the writer of the virus, a 29-year- old New Jersey computer programmer, David L Smith.

2000

In February, some of the most popular websites in the world such as Amazon and Yahoo are almost overwhelmed by being flooded with bogus requests for data.

In May, the ILOVEYOU virus is unleashed and clogs computers worldwide. Over the coming months, variants of the virus are released that manage to catch out companies that didn’t do enough to protect themselves.

In October, Microsoft admits that its corporate network has been hacked and source code for future Windows products has been seen.

Hacker infiltrates military satellite
By Sean Fleming
Posted: 01/03/1999 at 16:42 GMT

The UK Ministry of Defence has come under attack from a hacker who is allegedly threatening to target military satellites unless a £3 million ransom is handed over.

According to a story in today?s Daily Mail, the hacker has already seized control of one satellite, altering its course. The satellite in question is said to be involved in co- ordinating bombing raids on Iraq. Other targets for the hacker have been GCHQ – the spying operation that listens in on telephone calls and other communications – and a number of UK operations overseas. Officers from the Metropolitan Police Computer Crime Unit are said to be engaged in tracking down the source of the attacks. The authorities are said to have been so concerned about the attack on the satellite that the prime minister, Tony Blair, was informed. High profile hackings are becoming more common. One of the most well known was involved two UK hackers, Datastream Cowboy (Richard Pryce) and Kuji (Mathew Bevan), who caught the CIA’s attention in 1994 after the Pentagon?s computer was broken into. The South Korean atomic research institute was also hacked, provoking fears that World War III might be started by a teenage computer hacker sitting in his bedroom.

Hacker turns to vendors as IT PI

Steve Masters [05-12-1997]

One of the two hackers accused of almost starting World War III from his bedroom in the UK walked free from court on 21 November because the law is not set up to deal with cases like his, writes Sean Fleming.

In an interview with Computing, Matthew Bevan announced he is now considering a career in IT security.

Bevan was arrested on 21 June 1996 and charged with intent to secure access to computer systems belonging to the US Air Force and defence manufacturer Lockheed. His accusers maintained he knew that such access would be unauthorised.

More than three years and 14 court appearances later, the case has been dropped. The prosecution declared it would not be in the public interest to pursue the matter.

Bevan, who used the name Kuji, and Richard Pryce – known as Datastream Cowboy – stood accused of hacking into a research centre at Griffiss Air Force base in New York state. It took two years for the US authorities to admit the break-in had taken place.

In a statement to the court, US Air Force investigator Jim Christy said the incident cost the US Air Force $211,722 (#124,000) – exclusive of the cost of their investigations.

Christy outlined the events that almost brought East and West to the brink of war. He described how Datastream Cowboy (aged 16 at the time) hacked his way into a research facility in Korea. The US authorities became aware of this when they realised that the contents of the Korean Atomic Research Institute’s database had been deposited on USAF’s New York system.

‘Initially it was unclear whether the system belonged to North Korea or South Korea,’ Christy said. ‘The concern was that if it was North Korea, they would think the transfer of data was an intrusion by the US Air Force.’

It turned out to be South Korean data, but it is not hard to imagine the potential outcome had the 16-year-old found his way into North Korea’s system. The US press referred to Bevan and Pryce as ‘digital delinquents’.

Pryce walked out of court this summer with a #1,200 fine – not much of a slap on the wrists for actions that might have sparked a war. The lenience of his sentence was the key to Bevan escaping punishment altogether.

Simon Evenden, Bevan’s solicitor, told Computing why the prosecution chose not pursue his client. He stressed that in court, judge Jeffrey Rivlin QC made it clear that he felt the prosecution had in no way done anything wrong when preparing its case.

‘The case collapsed simply because it was not economically viable to take it forward. It would have cost hundreds of thousands of pounds to bring witnesses over from the US and because of what happened to Pryce, Matthew would probably only have been fined or given community service. So it was agreed that it was not in the public interests to continue.’

Had the case continued, getting the prosecution evidence to stand up in court could have proved problematic. It is unlikely the court would have accepted any evidence stored on a computer, unless it could satisfy itself it had not been tampered with. The US authorities were happy to supply copies of emails plus records showing times and dates at which computers were hacked into, but they would not allow the court access to original information.

In the light of the Bevan case, the defence and prosecution teams are to come together in an attempt to plug some of the gaps in the law. They will be arguing for changes to a system that is clearly finding it hard to keep pace with technological change.

From the horse’s mouth Interview with Matthew Bevan

Offered the choice between pleading guilty in the hope of the court being lenient or fighting it out, Matthew Bevan plumped for the latter. He explained why to Computing. ‘As far as I was concerned, I was charged with conspiracy, which was not true, and charged with working with Richard Pryce, which was not true. As well as having to prove that I did it, the prosecution would have had to prove there had been intent. I was accused of putting a sniffer on one of the computers. The point of a sniffer is to sit undetected on a computer monitoring who’s using it and copying their passwords. It’s not there to impair the performance of the computer. So, even if they could have proved I put it there, they couldn’t prove intent to cause damage.’ Bevan is now considering a career in IT security. ‘If I can find a job where I can get paid for doing the same sort of thing as hacking, I won’t complain,’ he said.

Hacked off: Court frees Air Force one

By Steve Masters [26-11-1997]

A hacker charged with breaking into the US Air Force’s command and control centres walked free from court last week

A hacker charged with breaking into the US Air Force’s command and control centres walked free from court last week, writes Sean Fleming.

The Crown Prosecution Service (CPU) said a costly court case would not be in the interests of the public.

Matthew Bevan, known as Kuji, was one of two hackers alleged to have accessed US military intelligence centres in 1994. Richard Pryce was fined #1,200 earlier this year.

Bevan has said that he was searching the US Air Force’s command and control centre for evidence of encounters with UFOs.

US Air Force investigator Jim Christy revealed that the hackers had also accessed the South Korean Atomic Research Institute, copied all the data and placed it on the US Air Force system.

Christy pointed out that the US was concerned this would be misinterpreted by the Koreans as an act of US aggression.

Tangled Web:

Tales of Digital Crime from the Shadows of Cyberspace

Chapter Six

One of the greatest misconceptions among the many who hamper the defense of cyberspace is the idea that all hacking is done only by juvenile joy riders: i.e., youthful geniuses bent on embarrassing law enforcement and the military. Of course, one of the ways in which this misconception is spread is through the mainstream media. Most cases that reach the light of day usually do end up involving juvenile hackers.

Why? Well, cases involving true cyberterrorists, information warriors, intelligence agencies, and corporate spies slip below the surface of the headlines. They are lost in the murky waters of “classified operations” or are swept under thick corporate carpets. (You’ll read more about such cases in Chapter 10 and Chapter 12.)

Juvenile hackers or other “sport hackers” (a term used to describe hackers who break into systems for the same reasons but aren’t minors) end up in the newspapers because they get caught. They also end up in the headlines because they seek the limelight. Furthermore, acknowledging their activities doesn’t open a Pandora’s box for the government agency or the corporation that was hit. If a government agency acknowledged an intelligence operation conducted by another country, there could be serious diplomatic or even military consequences. If a major corporation acknowledged a hack attack in which trade secrets were compromised seemingly by another corporation, there would be a public relations debacle: for example, their stock could dive, lawsuits could get filed, etc.

Nevertheless, juvenile or sport hackers, or joy riders, have wreaked a lot of havoc and mayhem over the years.

Here are some of the details of three high-profile stories, stretching from 1994 to 1999, that illustrate some of the lessons learned and unlearned along the way.

The Rome Labs Case: Datastream Cowboy and Kuji Mix It Up with the U.S. Air Force

The Rome Air Development Center (Rome Labs), located at Griffiss Air Force Base (New York), is the U.S. Air Force’s premier command-and- control research facility.

Rome Lab researchers collaborate with universities, defense contractors, and commercial research institutions on projects involving artificial intelligence systems, radar guidance systems, and target detection and tracking systems.

On March 28, 1994, Rome Labs’s system administrators (sysadmins) noticed that a password sniffer, a hacking tool that gathers user’s login information, had been surreptitiously installed on a system linked to the Rome Labs network. The sniffer had collected so much information that it filled the disk and crashed the system, according to James Christy, who was director of Computer Crime Investigations for the Air Force Office of Special Investigations.

The sysadmins informed the Defense Information Systems Agency (DISA) that the Rome Labs network had been hacked into by an as yet unknown perpetrator. The DISA Computer Emergency Response Team (CERT), in turn, informed the Air Force Office of Special Investigations (AFOSI) of the report of an intrusion. The AFOSI, in turn, informed the Air Force Information Warfare Center (AFIWC), headquartered in San Antonio, Texas.

An AFOSI team of cybercrime investigators and security experts was dispatched to Rome Labs. They reviewed audit trails and interviewed the sysadmins. The conclusions that they reached in their preliminary investigation were very disturbing.

Two hackers had broken into seven different computers on the Rome Labs network. They had gained unlimited access, downloaded data files, and secreted sniffers on every one of them. The seven sniffers had compromised a total of 30 of Rome Labs’s systems.

These systems contain sensitive research and development data.

System security logs disclosed that Rome Labs’s systems had been actually been hacked into for the first time on March 23, five days before the discovery made on March 28.

The investigation went on to disclose that the seven sniffers had compromised the security of more than 100 more user accounts by capturing user logons and passwords. Users’ e-mail messages had been snooped, duplicated, and deleted. Sensitive battlefield simulation program data had been pursued and purloined. Furthermore, the perpetrators had used Rome Labs’s systems as a jumping-off point for a series of hack attacks on other military, government, and research targets around the world. They broke into user accounts, planted sniffer programs, and downloaded massive quantities of data from these systems as well.

The investigators offered the Rome Labs commanding officer the option of either securing all the systems that had been hacked or leaving one or more of them open to attack. If they left a few systems open, they could monitor the comings and goings of the attackers in the hope of following them back to the their point of origination and identifying them.

The commander opted to leave some of the systems open to lay a trap for the intruders.

Investigators Wrestle with Legal Issues and Technical Limitations

Using standard software and computer systems commands, the attacks were initially traced back one leg of their path. The majority of the attacks were traced back to two commercial Internet service providers, cyberspace.com, in Seattle, Washington and mindvox.phantom.com, in New York City.

Newspaper articles indicated that the individuals who provided mindvox.phantom.com’s computer security described themselves as “two former East Coast Legion of Doom members.”

The Legion of Doom (LoD) was a loose-knit computer hacker group that had several members convicted for intrusions into corporate telephone switches in 1990 and 1991. Because the agents did not know whether the owners of the New York Internet service provider were willing participants or merely a transit point for the break-ins at Rome Labs, they decided not to approach them. Instead, they simply surveiled the victim computer systems at Rome Labs’s network to find out the extent of the intruders’ access and identify all the victims.

Following legal coordination and approval with Headquarters, AFOSI’s legal counsel, the Air Force General Counsel’s Office, and the Computer Crime Unit of the Department of Justice, real-time content monitoring was established on one of Rome Labs’s networks. Real-time content monitoring is analogous to performing a wiretap because it allows you to eavesdrop on communications, or in this case, text. The investigative team also began full keystroke monitoring at Rome. The team installed a sophisticated sniffer program to capture every keystroke performed remotely by any intruder who entered the Rome Labs.

This limited context monitoring consisted of subscribing to the commercial ISPs’ services and using only software commands and utilities the ISP authorized every subscriber to use. The team could trace the intruder’s path back only one leg. To determine the next leg of the intruder’s path required access to the next system on the hacker’s route. If the attacker was using telephone systems to access the ISP, a court-ordered “trap and trace” of telephone lines was required.

Due to time constraints involved in obtaining such an order, this was not a viable option. Furthermore, if the attackers changed their path, the trap and trace would not be fruitful. During the course of the intrusions, the investigative team monitored the hackers as they intruded on the system and attempted to trace the intruders back to their origin. They found the intruders were using the Internet and making fraudulent use of the telephone systems, or “phone phreaking.”

Because the intruders used multiple paths to launch their attacks, the investigative team was unable to trace back to the origin in real-time due to the difficulty in tracing back multiple systems in multiple countries.

In my interview with James Christy for this book, he provided fascinating insight into the deliberations over what capabilities could be used to pursue the investigation.

“The AFIWC worked the Rome Labs case with us,” Christy says. “They developed the Hackback tool right at Rome.” According to Christy, Hackback is a tool that does a finger back to the system the attack came from, then launches a scripted hack attack on that system, surveils the system, finds the next leg back, and then launches a scripted attack on that system. Hackback was designed to follow them all the way back over the Internet to their point of origination.

“Well, AFIWC developed this tool,” Christy continues, “but we told them, ‘Hey, you can’t use that ’cause it’s illegal. You’re doing the same thing as the hacker is doing: You’re breaking into systems.’ They said, General Minihan [who was at that time the head of the NSA] says, ‘We’re at war, we’re going to use it.’ My guys had to threaten to arrest them if they did. So we all said, ‘Let’s try something.’ ”

Christy tells me there was a big conference call involving the DoJ, the Secret Service, the FBI, AFOSI, and the guys that were up at Rome Labs. “We all claimed exigent circumstances, a hot pursuit. Scott Charney [who was at that time the head of DoJ’s computer crime unit] gave us the approval to go run Hackback one time. We did it, but it didn’t buy us anything. The hackers weren’t getting into those nodes via the Internet. They were getting in through telephone dial-ups. So it dead-ended where we already knew it was coming from.”

Datastream Cowboy’s Biggest Mistake

As the result of the monitoring, the investigators could determine that the hackers used the nicknames Datastream and Kuji. With this clue, AFOSI Computer Crime Investigators turned to their human intelligence network of informants that surf the Internet. The investigators levied their informants to identify the two hackers using the handles Datastream and Kuji.

“Our investigators went to their sources,” Christy recalls, “saying, ‘Help us out here, anybody know who these guys are?’ And a day and a half later, one of these sources came back and said, ‘Hey, I got this guy. Here’s his e-mail!'”

According to Christy, these informants have diverse motivations. Some of them want to be cops; some of them want to do the right thing; some of them simply find hacking exciting; some of them have pressure brought to bear on them because of their own illegal activities.

Indeed, whatever the motivation, on April 5, 1994, an informant told the investigators he had a conversation with a hacker who identified himself as Datastream Cowboy.

The conversation was via e-mail and the individual stated that he was from the United Kingdom. The on-line conversation had occurred three months earlier. In the e-mail provided by the informant, Datastream indicated he was a 16-year-old who liked to attack .mil sites because they were so insecure.

Datastream had even provided the informant with his home telephone number for his own hacker bulletin board systems he had established.

Bragging of his hacking feats, as Christy explains, was Datastream Cowboy’s big mistake.

“It was the only way we solved the case,” he said. “If we had to rely on surveillance alone, we never would have traced it back to them because of all the looping and weaving through South America. We would have been working with multiple countries.

“Did these South American countries have laws against hacking?” Christy continues. “No. Would the South Americans have been able to do a trap and trace? Maybe not. Remember, they were using telephone lines.”

The Air Force agents had previously established a liaison with New Scotland Yard who could identify the individuals living at the residence associated with Datastream’s telephone numbers.

New Scotland Yard had British Telecom initiate monitoring of the individual’s telephone lines with pen registers. A pen register records all the numbers dialed by the individuals at the residence. Almost immediately, monitoring disclosed that someone from the residence was phone phreaking through British Telecom, which is also illegal in the United Kingdom.

Within two days, Christy and the investigative team knew who Datastream Cowboy was. For the next 24 days, they monitored Datastream’s online activity and collected data.

During the 26-day period of attacks, the two hackers, Datastream Cowboy and Kuji, made more than 150 known intrusions.

Scotland Yard Closes in on Datastream Cowboy

New Scotland Yard found that every time an intrusion occurred at Rome Labs, the individual in the United Kingdom was phone-phreaking the telephone lines to make free telephone calls out of Britain. Originating from the United Kingdom, his path of attack was through systems in multiple countries in South America and Europe, and through Mexico and Hawaii; occasionally he would end up at Rome Labs. From Rome Labs, he was able to attack systems via the Internet at NASA’s Jet Propulsion Laboratory in California and its Goddard Space Flight Center in Greenbelt, Maryland.

Continued monitoring by the British and American authorities disclosed that on April 10, 1994, Datastream successfully penetrated an aerospace contractor’s home system. The attackers captured the contractor’s logon at Rome Labs with sniffer programs when the contractor logged on to home systems in California and Texas. The sniffers captured the addresses of the contractor’s home system, plus the logon and password for that home system. After the logon and password were compromised, the attackers could masquerade as that authorized user on the contractor’s home system. Four of the contractor’s systems were compromised in California and a fifth was compromised in Texas.

Datastream also used an Internet Scanning Software (ISS)1 attack on multiple systems belonging to this aerospace contractor. ISS is a hacker tool developed to gain intelligence about a system. It attempts to collect information on the type of operating system the computer is running and any other available information that could be used to assist the attacker in determining what attack tool might successfully break into that particular system. The software also tries to locate the password file for the system being scanned, and then tries to make a copy of that password file.

The significance of the theft of a password file is that, even though password files are usually stored encrypted, they are easily cracked. Several hacker “password cracker” programs are available on the Internet. If a password file is stolen or copied and cracked, the attacker can then log on to that system as what the systems perceive is a legitimate user.

Monitoring activity disclosed that, on April 12, Datastream initiated an ISS attack from Rome Labs against Brookhaven National Labs, Department of Energy, New York. Datastream also had a two-hour connection with the aerospace contractor’s system that was previously compromised.

Kuji Hacks into Goddard Space Flight Center

On April 14, 1994, remote monitoring activity of the Seattle ISP conducted by the Air Force indicated that Kuji had connected to the Goddard Space Flight Center through an ISP from Latvia. The monitoring disclosed that data was being transferred from Goddard Space Flight Center to the ISP. To prevent the loss of sensitive data, the monitoring team broke the connection. It is still not known whether the data being transferred from the NASA system was destined for Latvia. (Latvia as a destination for sensitive data was, of course, something that concerned investigators. After all, the small Baltic nation had only recently become independent of Russian domination. It had been a part of the former U.S.S.R.)

Further remote monitoring activity of cyberspace.com disclosed that Datastream was accessing the National Aero-Space Plane Joint Program Office, a joint project headed by NASA and the Air Force at Wright- Patterson Air Force Base, Ohio. Monitoring disclosed a transfer of data from Wright-Patterson traversing through cyberspace.com to Latvia.

Apparently, Kuji attacked and compromised a system in Latvia that was just being used as conduit to prevent identification. Kuji also initiated an ISS attack against Wright-Patterson from cyberspace.com the same day. He also tried to steal a password file from a computer system at Wright- Patterson Air Force Base.

Kuji Attempts to Hack NATO HQ

On April 15, real-time monitoring disclosed Kuji executing the ISS attack against NATO Headquarters in Brussels, Belgium, and Wright-Patterson from Rome Labs. Kuji did not appear to gain access to any NATO systems from this particular attack. However, when interviewed on April 19 by AFOSI, a systems administrator from NATO’s SHAPE Technical Center in the Hague, Netherlands, disclosed that Datastream had successfully attacked one of SHAPE’s computer systems from the ISP mindvox.phantom.com in New York.

After authorities confirmed the hacker’s identity and developed probable cause, New Scotland Yard requested and obtained a search warrant for the Datastream Cowboy’s residence. The plan was to wait until the individual was online at Rome Labs, and then execute the search warrant. The investigators wanted to catch Datastream online so that they could identify all the victims in the path between his residence and Rome Labs. After Datastream got online at Rome Labs, he accessed a system in Korea, downloaded all data stored on the Korean Atomic Research Institute system, and deposited it on Rome Labs’s system.

Initially, it was unclear whether the Korean system belonged to North or South Korea. Investigators were concerned that, if it did belong to North Korea, the North Koreans would think the logical transfer of the storage space was an intrusion by the U.S. Air Force, which could be perceived as an aggressive act of war. During this time frame, the United States was in sensitive negotiations with the North Koreans regarding their nuclear weapons program. Within hours, it was determined that Datastream had hacked into the South Korean Atomic Research Institute.

At this point, New Scotland Yard decided to expand its investigation, asked the Air Force to continue to monitor and collect evidence in support of its investigation, and postponed execution of the search warrant.

Scotland Yard Knocks on Datastream Cowboy’s Door

On May 12, investigators from New Scotland Yard executed their search warrant on Datastream’s residence. When they came through the door, 16- year-old Richard Pryce (a.k.a. Datastream Cowboy) curled up in the fetal position and wept.

The search disclosed that Datastream had launched his attacks with only a 25 MHz, 486 SX desktop computer with only a 170 megabyte hard drive. This is a modest system, with limited storage capacity. Datastream had numerous documents that contained references to Internet addresses, including six NASA systems and U.S. Army and U.S. Navy systems with instructions on how to loop through multiple systems to avoid detection.

At the time of the search, New Scotland Yard detectives arrested and interviewed Datastream. Detectives stated that Datastream had just logged out of a computer system when they entered his room. Datastream admitted to breaking into Rome Labs numerous times as well as multiple other Air Force systems (Hanscom Air Force Base, Massachusetts, and Wright-Patterson). (He was charged with crimes spelled out in Britain’s Computer Misuse Act of 1990.)

Datastream admitted to stealing a sensitive document containing research regarding an Air Force artificial intelligence program that dealt with Air Order of Battle. He added that he searched for the word missile, not to find missile data but to find information specifically about artificial intelligence. He further explained that one of the files he stole was a 3_4 megabyte file (approximately three to four million characters in size). He stored it at mindvox.phantom.com’s system in New York because it was too large to fit on his home system.

Datastream explained he paid for the ISP’s service with a fraudulent credit card number that was generated by a hacker program he had found on the Internet. Datastream was released on bail following the interview.

This investigation never revealed the identity of Kuji. From conduct observed through the investigators’ monitoring, Kuji was a far more sophisticated hacker than the teenage Datastream. Air Force investigators observed that Kuji would only stay on a telephone line for a short time, not long enough to be traced successfully. No informant information was available except that Computer Crime Investigators from the Victoria Police Department in Australia had seen the name Kuji on some of the hacker bulletin-board systems in Australia.

Unfortunately, Datastream provided a great deal of the information he stole to Kuji electronically. Furthermore, Kuji appears to have tutored Datastream on how to break into networks and on what information to obtain. During the monitoring, the investigative team could observe Datastream attack a system and fail to break in. Datastream would then get into an online chat session with Kuji, which the investigative team could not see due to the limited context monitoring at the Internet service providers. These chat sessions would last 20_40 minutes. Following the on-line conversation, the investigative team would then watch Datastream attack the same system he had previously failed to penetrate, but this time he would be successful.

Apparently Kuji assisted and mentored Datastream and, in return, received stolen information from Datastream. Datastream, when interviewed by New Scotland Yard’s Computer Crime Investigators, told them he had never physically met Kuji and only communicated with him through the Internet or on the telephone.

Kuji’s Identity Is Finally Revealed

In 1996, New Scotland Yard was starting to feel some pressure from the glare of publicity surrounding the upcoming hearings in the U.S. Senate, chaired by Sam Nunn (D-Georgia). Two years had passed since the arrest of the Datastream Cowboy, and yet Kuji was still at large.

New Scotland Yard investigators went back to take a closer look at the evidence they had seized and found a phone number that they hadn’t traced back to its origin. When they did trace it, they discovered Kuji’s true identity. Ten days after Jim Christy’s initial testimony concerning the Rome Lab intrusions, 21-year-old Matthew Bevan (a.k.a. Kuji) was finally apprehended.

In court, Pryce pleaded guilty to 12 hacking offenses and paid a nominal fine of 1,200 British pounds.

But Bevan, whose father was a police officer, “lawyered-up.”

After 20 hearings in which the defense challenged the Crown’s evidence, the prosecution made a “business decision” and dropped the charges.

Bevan is now a computer security consultant. His Web site, http:// www.bogus.net/, features an archive of news media coverage of the Rome Labs case, a timeline of his exasperating and successful legal maneuvers, photographs of his arresting officers, and scanned headlines from the London tabloids.

In my interview with Bevan, I asked him about the motivation in the attack on Rome.

“My quest,” he tells me, “was for any information I could find relating to a conspiracy or cover-up of the UFO phenomenon. I was young and interested in the UFO stuff that I had read and of course as I had the access to such machines that were broken (i.e., with poor security) it was a natural progression to seek out information.

“Also,” Bevan continues, “I was bullied almost every day of my school life; the hacking world was pure escapism. I could go to school, endure the day, come home, and log on to another world. Somewhere I could get respect, somewhere that I had friends.

“At school I may have been bullied but in the back of my mind was ‘Well, I hacked NASA last night, and what did you do?'”

I also asked Bevan if he wanted to set the record straight in regard to how authorities handled the case or how the media reported it.

“One of the biggest concerns that I have about the reporting of the case relates to the InfoWar aspect,” he says. “It is suggested that we were taken to the brink of WWIII because of an attack on the Korean nuclear research facility. A Secret Service agent here alleged that bombers were already on their way to Korea to do a preemptive strike as it was thought that when they discovered the attack, said to have come from a U.S. military computer, they would retaliate.

“In the evidence presented in the case,” Bevan says, “there was a snippet of a log that shows Datastream Cowboy logging into said facility with the user ID of ‘sync,’ and as the user has no Unix shell associated with it, the login is terminated. Nowhere else in the logs is any record of the intrusion being successful, and in my opinion the logs do not reflect that. Being called ‘the single biggest threat to world peace since Adolf Hitler’ is a tad annoying, but then even the layman can see that is just hype and propaganda.”

Who Can Find the Bottom Line?

A damage assessment of the intrusions into the Rome Labs’s systems was conducted on October 31, 1994. The assessment indicated a total loss to the United States Air Force of $211,722. This cost did not include the costs of the investigative effort or the recovery and monitoring team.

No other federal agencies that were victims of the hackers (for example, NASA) conducted damage assessments.

The General Accounting Office conducted an additional damage assessment at the request of Senator Nunn. (See GAO Report, Information Security: Computer Attacks at Department of Defense Pose Increasing Risks [AIMD-96-84], May 22, 1996.)

Some aspects of this investigation remain unsolved:

The extent of the attack. The investigators believe they uncovered only a portion of the attack. They still don’t know whether the hackers attacked Rome Labs at previous times before the sniffer was discovered or whether the hackers attacked other systems where they were not detected.

The extent of the damage. Some costs can be attributed to the incident, such as the cost of repair and the cost of the investigative effort. The investigation, however, was unable to reveal what they downloaded from the networks or whether they tampered with any data. Given the sensitive information contained on the various computer networks (at Rome Labs, Goddard Space Flight Center, the Jet Propulsion Laboratory, Wright- Patterson AFB, or the National Aero-Space Plane Program), it is very difficult to quantify the loss from a national security perspective.

HotterthanMojaveinmyheart:2 The Case of Julio Cesar Ardita

On March 29, 1996, the U.S. Justice Department announced it had charged Julio Cesar Ardita (a.k.a. “El Griton”), a 21-year-old Argentine, with breaking into Harvard University’s computer network and using it as a staging platform for many other hacks into sites throughout cyberspace. Like Kuji and the Datastream Cowboy, Ardita targeted sites belonging to NASA, DoD, several American universities, and those in other countries (for example, Korea, Mexico, Taiwan, Chile, and Brazil). Like Kuji and the Datastream Cowboy, Ardita gained unauthorized access to important and sensitive information in his explorations. In Ardita’s case, the research information that was compromised involved satellites, radiation, and energy-related engineering.

Peter Garza of Evidentdata (Ranchero Cucamonga, California) was a special agent for the Naval Criminal Investigative Services. He led the digital manhunt that ended in Buenos Aires. Garza described Ardita as a dedicated hacker. “Ardita was no ordinary script kiddie,”

Garza tells me. “He didn’t run automated hacking scripts downloaded from someone else’s site. He did his hacking the old-fashioned way. He used a terminal emulator program, and he conducted manual hacks. He was prodigious. He had persistence and stamina. Indeed, I discovered records of ten thousand sessions on Ardita’s home computer after it was seized. During the technical interviews we did of Ardita in Argentina (after his arrest), he would describe all-night sessions hacking into systems all over the Internet.

“Early on in the investigation,” Garza adds, “I had guessed this would be a solvable case because of this persistence. I had guessed that because this was such a prolific hacker, he had to use the same file names, techniques, and hiding places just so that he would be able to remember where he left collected userids and passwords behind on the many hacked systems. Also, I hoped the hacker was keeping records to recall the hacked sites. Records that would help further the investigation if we were successful in tracking the hacker down. It was gratifying that I was right on both counts. Records on his seized computer, along with his detailed paper notes, helped us reconstruct much of what he had done.”

Like the investigation that led to the identification and arrest of the Rome Labs hackers, the pursuit that led to the identification and arrest of Ardita accelerated the learning curve of those responsible for tracking down cybercriminals and bringing them to justice.

The following account, drawn from my interview with Garza and the court affidavit written by Garza himself in support of the criminal complaint against Ardita, sheds light on the details of the investigations and the groundbreaking work that the case required.

How the Search for “El Griton” Began

Sysadmins at a U.S. Navy research center in San Diego detected that certain system files had been altered. Taking a closer look, they uncovered certain files, including a sniffer he left behind, the file that contained the passwords he was logging, and a couple programs he used to gain root access and cover up his tracks.

This evidence enabled Garza to construct a profile of the hacker.

Coincidentally, and fortuitously, Garza and other naval security experts happened to be at the San Diego facility for a conference on the day that the intrusion was detected.

They worked late into the night. They succeeded in tracking the as-yet- unidentified hacker to a host system administered by the Faculty of Arts and Sciences (FAS) at Harvard University, Cambridge, Massachusetts. The hacker was making unauthorized use of accounts on the FAS host and trying to access other systems connected to Harvard’s network via the Internet.

(As early as July 1995, host computers across the United States as well as in Mexico and the United Kingdom reported both successful and unsuccessful hacking attempts seeming to originate from the FAS Harvard host. But this U.S. Navy investigation that commenced in late August would lead to Ardita’s arrest.)

Although it was impossible at first to determine the hacker’s true identity because he was using the legitimate account holders’ identities as his aliases or covers, investigators could distinguish the hacker from other users of the FAS Harvard host and the Internet through certain distinctive patterns of illicit activity. But to track the hacker all the way back to his point of origination, Garza was going to need a court order for a wiretap.

“I called the U.S. Attorney’s office in Boston on a Thursday and asked if we could have the court order in place by Monday,” Garza recounts. “They laughed. Six months was considered the ‘speed of light’ for wiretap approval. But we started to put the affidavit together anyway, and got it okayed in only six weeks, which at that time was unheard of.

SAN FRANCISCO (TABLOID NEWS SERVICES) — One of cyberspace’s most shocking cases of hacking came to a pathetic close late last week when all the charges had to be dropped against a London kid who made himself famous by breaking into the Pentagon and touching off a nuclear weapons panic in the U.S. Air Force.

British prosecutors said it’s a waste of time and money to continue trying to convict 23-year-old Matthew “Kuji” Bevan, a hacker who made world headlines in 1995 when he was arrested along with his 16-year-old cohort Richard Pryce, aka “Datastream Cowboy.”

Led by Pryce, the pair apparently broke into U.S. military computers at the Griffiss Air Force Base in New York and accessed sensitive weapons information. And from there they hopped over to the computers of a nuclear research facility on the Korean peninsula.

U.S. military officials were so confused by the two hackers they thought at least one of Bevan’s break-ins was the work of an Eastern European spy ring. And when the military saw that the intruders had used USAF computers to hack a link into the Korean military site, then copy information back on the USAF computers, they were positively panicked. The military cyber-cops didn’t know if the Korean computers were in North or South Korea — and they feared the hack would be seen by crazy Communist North Korea as an act of war.

According to the tech news service Newsbytes, the incident touched off a “diplomatic crisis” between the U.S. and South Korea, where the facility turned out to be located, although other reports have portrayed the pair’s adventures as mostly harmless.

It was an embarrassing shock to U.S. military’s cyber cops when it was revealed that their online assailants were a pair of bored London kids.

When cops arrived to arrest Pryce at his parents’ home in 1995, he reportedly curled up in a ball on the floor and cried.

Pryce was fined nearly $2,000 for the crime back in 1996, but Bevan’s case dragged on until last week.

It finally ran out of steam when British prosecutors realized they weren’t going to get any help from their American colleagues, according to Newsbytes.

The case was dumped when the court and prosecutors were told that classified military information would be made public during the trial, and that the case would be incredibly expensive to prosecute. Witnesses would have to be flown from the U.S. and the technical details would take months to explain, the court heard.

Worse, the government was pretty sure it would lose, because the U.S. was refusing to turn over information about how it traced and identified the hackers.

“The U.S. cyber sleuth teams simply did not understand the difference between conducting a technical investigation and producing robust admissible evidence,” said Peter Sommer, a senior fellow at the London School of Economics’ Computer Security Research Center, according to Newsbytes. Sommer testified as a defense expert for both Pryce and Bevan.

Sommer said the U.S. government had flubbed the case from the start. The government detectives “neglected to produce ‘before’ and ‘after’ file dumps of the target computers,” Sommer said. Such raw data dumps could show what changed the hackers made while they had access to the USAF systems.

And the Americans refused to turn over the source code to the software it used to monitor the hackers’ attacks. Without that, the court would have no opportunity to test the software to make sure it was working right.

Bevan left the court last week without talking to reporters. The only word came from his lawyers, who said the young man was happy it was over.

Ex-hacker to help Nintendo with viral marketing
By: John Leyden
Posted: 29/03/2001 at 14:44 GMT

A well-known former computer hacker has been hired to do viral marketing for games firm Nintendo and TV channel E4.

Mathew Bevan, whose hacker handle is Kuji, was accused of breaking into US military computer systems but escaped without punishment when a 1997 case at Woolwich Crown Court was dropped after a long-running legal battle.

After the case Bevan became an ethical hacker and security consultant with Tiger Computer Security, and later on a freelance basis with his firm the Kuji Media Corporation.

Bevan was reluctant to go into details of his marketing work just yet, but said he was offered work for Nintendo and the E4 site, e4chained, through a third party and the Kuji Media Corporation. As a security expert it was felt he had the talent to help run a successful viral marketing campaign.

Bevan, and Richard Pryce (Datastream Cowboy) were accused of hacking into a research centre at Griffiss Air Force base in New York state and faced charges related to the Computer Misuse Act.

The case revolved an incident when the Korean Atomic Research Institute’s database was found to have had been deposited on USAF’s systems.

In court, USAF investigators admitted that they initially feared the data had come from North Korea – something that could spark a major international incident. This provoked fears that World War III might be started by a teenage computer hacker sitting in his bedroom.

An inquiry into the hack led investigators to Bevan and Pryce, who were subsequently charged.

Pryce, who was 16 at the time, was fined £1,200 in a hearing before the Woolwich Crown Court case. The prosecution against Bevan was dropped because after the leniency shown to Pryce, prosecutors concluded it was too expensive to continue with the case. ?

Foreign hackers working from overseas via the Internet penetrated sensitive U.S. Government computer systems.

Hacking U.S. Government Computers from Overseas

Foreign-based hacker groups working via the Internet have had substantial success breaking into U.S. Government and defense contractor computer systems holding sensitive but not classified information. There is one publicly known case in which computer break-ins from overseas were sponsored by a foreign intelligence service.

Three Germans in Bremen, West Germany were hired by the Soviet KGB during 1986- 1989 to hack into U.S. Government systems. They penetrated Pentagon systems, NASA networks, Los Alamos National Laboratories and Lawrence Berkeley Laboratories. They were detected by Clifford Stoll, at Berkeley, when he checked out minor discrepancies in the account billings. Stoll later wrote the popular book, The Cuckoo’s Egg, about the case. The three hackers were arrested and convicted of espionage.

The following three cases also show the ability of hackers overseas to penetrate protected domestic U.S. systems via the Internet. In these three cases there was some suspicion of possible foreign intelligence involvement. This could not be confirmed, but also could not be ruled out. Enterprising foreign hackers could collect this information on their own and then sell it to a foreign intelligence service, or a foreign service could sponsor the same kind of operation itself.

Argentine Hacker Intrusion Into Navy Systems

In July 1995 computers in several states and Mexico reported intrusions originating from Harvard University. The hacker apparently lifted user IDs and password information from accounts on a system administered by the university. The U.S. government became concerned in August when an intrusion was detected on a network operated by the U.S. Naval Command, Control and Ocean Surveillance Center (NCCOSC). The intruder broke into the NCCOSC computer and installed sniffer programs to capture the IDs and passwords of legitimate users, and other software that would allow him to alter or destroy network files or to make them inaccessible to users.

After attacking a site in Taiwan, the intruder was monitored while “chatting” on the Internet, using the name Griton. Griton was traced back to Argentina where the moniker was known by Argentine authorities as a computer pirate who specialized in hacking, cracking and phreaking. The subject was soon traced to Buenos Aires and identified as Julio Cesar Ardita, then a 21-year-old student in Buenos Aires at the University of Argentina.

According to news reports, this hacker gained access to a host computer at the Army Research Lab in Edgewood, Maryland; the Naval Research Laboratory in Washington; the California Institute of Technology in Pasadena, California; and the NASA Jet Propulsion Laboratory. Victim sites include 62 U.S. government, 136 U.S. educational, and 31 U.S. commercial facilities. The U.S. Navy, NASA, and Department of Energy’s National Laboratories were high on the list of frequency of penetration.

Ardita was served a warrant and his computer was seized. He admitted responsibility, but claimed he was guilty only of mischief. He was arraigned in December, 1995. The U.S. Department of Justice filed criminal charges against Ardita. Prosecution in the U.S. was initially frustrated by the fact that computer crime is not covered by international agreements for extradition. In December 1997, Ardita agreed to come voluntarily to the United States and plead guilty to unlawfully intercepting electronic communications over a military computer and damaging files on a military computer. In return for Ardita’s agreement to come voluntarily to the United States, he is being sentenced to only three years probation and fined $5,000.1

Although he hacked into important and sensitive government research files on satellites, radiation, and energy-related engineering, Ardita is not accused of obtaining classified information related to national security. To counterintelligence analysts, the hacker’s selection of targets and subject matter suggested a well-defined intelligence collection tasking, but foreign intelligence involvement has not been established. If a foreign intelligence service was involved, it is impossible to know which one, as many countries might have been interested in the information Ardita collected.

The Ardita case was the first time a court-ordered wire tap was used for real-time monitoring of an unknown subject to catch a computer criminal. It demonstrates the ability to chase and identify an international hacker on-line.1

Air Force Rome Development Center Break-In

Two young British hackers, Richard Pryce, age 16, and Mathew Bevan, age 21, broke into U.S. military computer systems. Pryce, who was identified and charged in 1995, allegedly obtained access to files on ballistic weapons research and messages from U.S. agents in North Korea during a 1994 crisis over inspection of nuclear facilities in North Korea. The penetrations were carried out over a period of several months.

Bevan, an information technology technician, was charged in 1996 with conspiracy to gain unauthorized access to computers. Pryce used the on-line nickname of “Datastream Cowboy” while Bevan identified himself as “Kuji.” Kuji was tutoring Datastream in his attempts to break into specific systems. According to news reports, investigators suspected the older culprit of being a foreign agent.

Pryce and Bevan broke into the Rome Air Development Center, Griffiss Air Force Base, NY, and before authorities became aware of their presence (five days later) they had penetrated seven systems, copied files including sensitive battlefield simulations, and installed devices to read passwords of everyone entering the systems. Rome Air Development Center was used as a launching pad for more than 150 intrusions into military, government and other systems including NASA and Wright-Patterson Air Force Base. Large volumes of data were downloaded from penetrated systems. One such data transfer (which was being monitored) involved the downloading of files from the Goddard Space Flight Center to an Internet provider in Latvia. In order to prevent the loss of sensitive data, the monitoring team broke the connection.

In one of these break-ins, Pryce used Rome to access a Korean facility. According to media reports, “For several anxious hours [U.S. authorities] didn’t know whether the intrusion was into a North or South Korean system. The concern was that the North Koreans would trace an intrusion coming from the U.S. and perceive it as an aggressive act of war.” The penetrated system turned out to be the South Korean Atomic Research Institute. The two were arrested after a long investigation by the Air Force Office of Special Investigation and New Scotland Yard.2

Dutch Teen Hackers

A group of Dutch teenagers penetrated computer systems at 34 U.S. military installations during 1990-91. They gained access to information on personnel performance reports, weapons development, and descriptions of movement of equipment and personnel. The systems penetrated included the Naval Sea Systems Command, the Army’s readiness system at Ft. Belvoir, Virginia, and the Army missile research lab at Aberdeen, Maryland.

At least one penetrated system directly supported U.S. military operations in Operation Desert Storm prior to the Gulf War. They copied or altered unclassified data and changed software to permit future access. The hackers were also looking for information about nuclear weapons. Their activities were first disclosed by Dutch television when camera crews filmed a hacker tapping into what was said to be U.S. military test information.

According to an ABC News report, the Dutch hackers had been operating for at least a year reading sensitive information about military plans and operations. Documents obtained by ABC indicate that hackers got so much information about the Patriot Missile that they had to break into several other computers just to find a place to store the data. At one point the intruders shut down computers in Wisconsin and Virginia which were later used to mobilize troops for Desert Storm. Information was gathered on the Patriot rocket launching system, the Navy’s Tomahawk cruise missile, and on the call up of military reserves for the Gulf War. The search words the hackers were particularly interested in were “military,” “nuclear” and “Desert Storm” or “Desert Shield.”

Many of the computer penetrations originated in Geldrop, Holland. At the time, investigators suspected the hackers could have been freelance spies looking for information to sell to the KGB or Iraqi intelligence, but no evidence of foreign intelligence service involvement has been found.

04/04/98 THE SCHOOLBOY SPY.

By Jonathan Ungoed-Thomas

The Americans called him their No 1 enemy, but he was only 16. Jonathan Ungoed-Thomas reveals one of the strangest stories of the cyber-age. On the evening of April 15, 1994, six American special agents sat in a concrete basement at a secret air force base patiently waiting for an attack. Their unseen and unknown enemy had for weeks been rampaging across the Pentagon network of computers, cracking security codes and downloading secret files.

Defence officials feared the infiltrator was a foreign agent. They were monitoring his movements in a desperate effort to trace him to his lair. He had first been spotted by a systems manager at the Rome Laboratory at the Griffiss air base in New York state, the premier command and control research facility in the United States. He had breached the security system and was using assumed computer identities from the air base to attack other sites, including Nasa, Wright-Patterson air force base – which monitors UFO sightings – and Hanscom air force base in Massachusetts. He was also planting “sniffer files” to pick up every password used in the system. This was a new type of warfare, a “cyber attack” at the heart of the most powerful military machine on earth. But the American military had been preparing for “cyber war” and it had a new breed of agent ready to fight back against the infiltrator. Computer specialists from the Air Force Office of Special Investigations (AFOSI) and the Air Force Information Warfare Centre in San Antonio, Texas, were dispatched to Rome Laboratory to catch the attacker.

By the end of the second week of their attempt to outwit him, their windowless basement room was a mess of food wrappers, sleeping bags and empty Coca-Cola cans. Sitting among the debris, the American cyber agents saw a silent alarm throb on one of the many terminals packed into the 30ft by 30ft room. Datastream Cowboy, as he called himself, was online again. They carefully tracked him on a computer screen as he used the access code of a high-ranking Pentagon employee to sign on. This gave him the power to delete files, copy secret information and even crash the system. As he sifted through battlefield simulation data, artificial intelligence files and reports on Gulf war weaponry, the agents worked frantically at their terminals, trying yet again to establish who he was and where he had come from. It was futile. Datastream Cowboy always bounced around the world before launching an attack and it was impossible even to establish in which country he was sitting.

Suddenly he left the Pentagon system. The agents rapidly checked the computer address of his new target and were chilled by the result: he was trying to get access to a nuclear facility somewhere in Korea. The shocked agents saw a terrible crisis coming. The United States was embroiled in tense negotiations with North Korea about its suspected nuclear weapons programme. The Clinton administration was publicly split between a faction that wanted to punish the Stalinist regime in Pyongyang for attempting to develop a nuclear bomb and State Department diplomats who insisted on a gentler approach.

If the paranoid North Koreans detected a computer attack on their nuclear facility from an American air base – because Datastream Cowboy had assumed an American military identity by routeing his assault through the Griffiss computer – they would be bound to believe that the hawks had won and this was an act of war. Senior defence officials were hurriedly briefed as the agents attempted to establish the exact location in Korea of the computer that Datastream Cowboy was trying to crack.

After several tense hours, they had their answer. His target was in South Korea, not North. The security alert was over, but the damage meted out by Datastream Cowboy was not. In the space of a few weeks he had caused more harm than the KGB, in the view of the American military, and was the “No 1 threat to US security”.

What made Datastream Cowboy so dangerous, in the view of the Americans, was that he was not alone; he was working with a more sophisticated hacker who used the “handle” of Kuji. The agents repeatedly watched Datastream Cowboy unsuccessfully attack a military site and retreat for an e-mail briefing from Kuji. He would then return and successfully hack into the site. Both Datastream Cowboy and Kuji were untraceable. They were weaving a path through computer systems in South Africa, Mexico and Europe before launching their attacks. Over 26 days, Datastream Cowboy and Kuji broke into the Rome Laboratory more than 150 times. Kuji was also monitored attempting an assault on the computers at Nato headquarters near Brussels. It was only three years after the final collapse of Soviet communism, but there was already a strong fear within the American government that the United States had become vulnerable to a new military threat: electronic and computer warfare.

Both America’s superpower military arsenal and its huge civilian economy had become reliant on microchips and in the words of Jamie Gorelick, a deputy attorney-general: “Some day we will wake up to find that the electronic equivalent of Pearl Harbor has crippled our computer networks and caused more chaos than a well placed nuclear strike. We do not want to wait for that wake-up call.”

What made the American military so vulnerable was that the Internet – the computer communications system that had been developed by Pentagon scientists as a tool for survival after nuclear war – was opening up in 1994 to anyone in the world who had access to a cheap and powerful personal computer.

The Internet automatically brought hackers to the very gates of the Pentagon’s most secret files – and it could not be policed, as it had been deliberately set up without controls to ensure ease of access for nuclear survivors.

According to official American figures, the Pentagon’s military computers are now suffering cyber attacks at the rate of 250,000 a year and it is retaliating with a $3.6bn programme of computer protection to key systems. THE attacks by Datastream Cowboy and Kuji were the opening shots in this barrage, and the Pentagon generals insisted that they had to be found and put out of action. It would have been relatively simple to shut them out of the Pentagon network, but they would survive to attack again – and their identities and the information they had already stolen would have remained unknown. The American cyber agents were ordered to continue chasing them through the electronic maze.

But how? They used a process called “fingering” in which they tried to detect every computer that Datastream Cowboy had used as stepping stones before attacking them. A computer on the Internet gives its own address in the first few bytes of any communication and the agents tried to trace Datastream Cowboy’s path backwards. The process can often be hit and miss because of the vast amount of traffic on the Internet and the hacker’s path was simply too long and circuitous to follow to its end. The agents almost gave up hope. Then old-fashioned police work was brought to bear. In the cyber age, where do hackers hang out? On the Internet, of course. They “chat” with each other through their screens.

The agents had informants who cruised the Internet and one of these made the breakthrough. He found that Datastream Cowboy hung out at Cyberspace, an Internet “service provider” based in Seattle. Moreover, he was a particularly chatty individual who was eager to engage other hackers in e-mail conversation. Naive, too. Before long, the informant had established that Datastream Cowboy lived in the United Kingdom. He even gave out his home telephone number.

Jubilant, a senior AFOSI agent contacted the computer crime unit in Scotland Yard for assistance. Datastream Cowboy’s number was traced to a house in a cul-de-sac in Colindale, part of the anonymous north London suburbs. In cold war days it would have been a classic address for a spy’s hideaway.

Telephone line checks revealed that the hacker was first dialling into Bogota, the Colombian capital, and then using a free phone line from there to hack his way into the sensitive military sites.

American agents flew to London and staked out the address with British police officers. Detectives were cautious, however, about making an immediate arrest because they wanted Datastream Cowboy to be online when they entered the house, so that he would be caught in the act.

At 8pm on May 12, 1994, four unmarked cars were parked outside the Colindale house. Inside one of them, a detective’s mobile phone rang. An agent from the Rome Laboratory was on the other end: Datastream Cowboy was online. Officers made a second call to British Telecom in Milton Keynes and established that a free phone call was being made to South America. Posing as a courier, one of the officers knocked on the door. As it was opened by a middle-aged man, eight policemen silently appeared and swept into the house. The officers quietly searched the downstairs and first floor. Then, creeping up the stairs to a loft-room, they saw a teenager hunched in his chair tapping frantically away on the keyboard of his ?700 PC World computer. They had found Datastream Cowboy.

One of the detectives walked up silently behind the young suspect and gently removed his hands from the computer. For 16-year-old Richard Pryce, a music student, it was the shock of his life. He looked at the policemen as they prepared to arrest him and collapsed on the floor in tears.

“They thought they were going to find a super-criminal and they just found me, a teenager playing around on his computer,” says Pryce now. “My mother had noticed people sitting outside our house for a few days beforehand, but I didn’t think much of it. I never thought I would get caught and it was very disturbing when I did.

“It had just been a game or a challenge from which I had got a real buzz. It was unbelievable because the computers were so easy to hack, like painting by numbers.”

Pryce, who was then a pupil at The Purcell School in Harrow, Middlesex, was arrested at his home but released on police bail the same evening. Five stolen files, including a battle simulation program, were discovered on the hard disk of his computer. Another stolen file, which dealt with artificial intelligence and the American Air Order of Battle, was too large to fit on to his desktop computer. So he had placed it in his own storage space at an Internet service provider that he used in New York, accessing it with a personal password.

During the subsequent police interviews, one pressing question remained unanswered: who was Kuji? Pryce claimed he had only talked with his hacking mentor on the Internet and did not know where he lived. American investigators regarded Kuji as a far more sophisticated hacker than Datastream. He would only stay on a telephone for a short time, not long enough to be traced successfully. “Kuji assisted and mentored Datastream and in return received from Datastream stolen information…Nobody knows what Kuji did with this information or why it was being collected,” agents reported.

Mark Morris, who was then a detective sergeant with Scotland Yard’s computer crime unit, was one of the investigating officers on the case. “It was awesome that Pryce, who was just one teenager with a computer, could cause so much havoc, but the greater worry in the US was about Kuji,” says Morris. “The fear was that he could be a spy working for a hostile foreign power. The job was then to find him.”

Pryce did give detectives one telephone number, but it was a red herring: a school library in Surrey. During the next two years of compiling evidence in Britain and America in the case against Pryce, British detectives and American agents failed to turn up any evidence that might lead to Kuji. Their break finally came in June 1996 when the computer crime unit decided to sift once again through the mass of information on the hard disk of Pryce’s computer.

Morris took on the job. “I was at home with my laptop and went through every bit of that hard disk, which was a huge task.” It took him three weeks. If all the files had been printed out they would have filled 40 filing cabinets.

At last he found what he wanted. “At the bottom of a file in the DOS directory I saw the name Kuji. Next to the name was a telephone number. Pryce might not have even known it was on his system because he downloaded so much information.”

For American agents hoping to catch a superspy, Kuji’s telephone number was a grave disappointment. He was based in Cardiff. A team of officers drove up to his address, a terraced house, and finally discovered Kuji’s identity. He was 21-year-old Mathew Bevan, a soft-spoken computer worker with a fascination for science fiction. His bedroom wall was covered with posters from The X Files and one of his consuming interests was the Roswell incident, the alleged crash of a UFO near Roswell, New Mexico, in July 1947. He was arrested on June 21, 1996, at the offices of Admiral Insurance where he worked.

“I would never have been caught if it wasn’t for Pryce and even then they took two years to find me,” Bevan says now. “And the only reason Pryce got caught was that he gave his number to a secret service informant.” Bevan, the son of a police officer, said he had not even been alarmed when Datastream Cowboy disappeared from the Internet. “Everyone was joking with me on the e-mail that he must have been arrested, but I didn’t believe it. It wasn’t until a year later that a friend phoned me and said: ‘Have you seen the papers? They think you’re a spy’.”

However, Bevan became confident that he had escaped detection and was stunned when he was arrested. “I was told to go and check the managing director’s computer. I went in and there were seven or eight of them in suits and I was arrested.” He was charged the next day with two counts of conspiracy under the Criminal Law Act 1997. He was later charged with three offences under the Computer Misuse Act 1990.

Pryce had been charged in June 1995, about 13 months after his arrest, with 12 offences under Section 1 of the Computer Misuse Act 1990. He was also charged with conspiracy three days before Bevan’s arrest. At the culmination of one of the biggest ever international computer crime investigations and after a massive security scare in the United States, law enforcers were left with a meagre and faintly embarrassing prize: two young hackers who in their spare time, from the comfort of their bedrooms, had penetrated what should have been the most secure defence network in the world. To rub salt into the wounds, their credentials were hardly impressive. Pryce had scraped a D grade in computer studies at A-level and Bevan had dropped out of an HND course in computer science.

Pryce’s father, Nick, who restores musical instruments, said: “They said Richard was a No 1 security threat and I think that was just rubbish. They had overreacted and when they found out it was just a teenager, they still wanted to try to make an example of him. I never knew what he was doing at the time; I just thought he was in his bedroom playing on his computer. When I found out, I never thought he had done anything particularly wrong and neither did our friends. He just showed how bad security was on those computers.”

But how did two rather ordinary young men manage to penetrate the Pentagon computer system and spark such a massive security alert? Both were bright and articulate, but there was nothing in their backgrounds to suggest a computer wizardry that would outwit the American military. Their success was based on a mixture of persistence and good luck, which was abetted by crude security mistakes in the Pentagon computer system. Pryce had had a musical upbringing with his two sisters, Sally and Katie, and had a passion for playing the double bass. He was bought his computer when he was 15 to help him in his studies. He would spend his spare time linked up to a bulletin board on the Internet, where computer users traded information and chatted. It was here that he got his first introduction to hacking.

“I used to get software off the bulletin boards and from one of them I got a ‘bluebox’, which could recreate the various frequencies to get free phonecalls,” he said. “I would phone South America and this software would make noises which would make the operator think I had hung up. I could then make calls anywhere in the world for free.”

Now 20 and in his third year at the Royal College of Music in London, Pryce said: “I would get on to the Internet and there would be hackers’ forums where I learnt the techniques and picked up the software I needed. You also get text files explaining what you can do to different types of computer. “It was just a game, a challenge. I was amazed at how good I got at it. It escalated very quickly from being able to hack a low-profile computer like a university to being able to hack a military system. The name Datastream Cowboy just came to me in a flash of inspiration.”

The attack on Rome Laboratory, his greatest success, relied on a ferret called Carmen. Pryce easily gained low-level security access to the Rome computer using a default guest password. Once inside the system, he retrieved the password file and downloaded it on to his computer. He then set up a program to bombard the password file with 50,000 words a second. “I just left the computer running overnight until it cracked it,” he explained.

If all the air force officers with access to the computer had followed orders and used passwords with a mixture of numerals and letters, his attack would have been foiled; but luck was on his side.

Morris, who has since left Scotland Yard’s computer crime unit and now works in London for Computer Forensic Investigations, a private company, revealed: “He managed to crack the file because a lieutenant in the USAF had used the password Carmen. It was the name of his pet ferret. Once Pryce had got that, he was free to roam the system. There was information there that was deemed classified and highly confidential and he was able to see it.”

Once he was in the system, Pryce kept getting access to higher levels in his aim to become a “root user”, which gives the hacker total control of the computer with the power to shut out other users and command the entire system.

“I was interested in Rome Labs because I knew they developed stuff for the military. I just wanted to find out what they were doing. I read that UFO material was being kept at Wright Patterson base and I thought it would also be a laugh to get in there. I also hacked into a Nasa site,” he said. “Rome Labs was my main project. I got the programming code for an artificial intelligence project. I downloaded files so I could view them at leisure at home.

“I know there was a big fuss when I tried to hack into a computer in Korea, but there was nothing sinister about it. I just fancied having a go at a different sort of computer and I happened to be on the Rome Laboratory computer. I just tapped in the address for the Korean research computer, but I didn’t hack into it. It never went further than that.” During an intensive three months of hacking, Pryce sent e- mails at least twice a week to the fellow hacker he knew as Kuji, without knowing his real name was Mathew Bevan.

Bevan, who is now 23, was more of a loner than Pryce and would spend up to 30 hours without a break on his computer. He claims the fraternity of hackers gave him the friendship that he had failed to find during his childhood. “I was bullied at school and I found my little community and interaction through my computer,” he said. “The hackers would all egg each other on. There wasn’t anything malicious about it. If there was, I could have downed as many computer systems as I wanted. I was just really looking for anything about UFOs. It was like war games; I just couldn’t believe what we could get into. I wasn’t tutoring Pryce, but the Americans made out I was because they thought I was some kind of east European masterspy.” Pryce agrees: “We embarrassed them by showing how lax their security was and that’s why they made out we had been a huge security threat. I’m now amazed by what I did, but I wasn’t surprised at the time. It was just my hobby. Some people watched television for six hours a day, I hacked computers.”

The first time Pryce and Bevan met in person was in July 1996 when they appeared at Bow Street magistrates court jointly charged with conspiracy and offences under the Computer Misuse Act. “He was at the back of the court when I went in and his mother said: ‘You’d better say hello’, which he did. We didn’t even have a chat,” said Bevan.

Conspiracy charges against both Pryce and Bevan were later dropped, but in March last year Pryce was fined ?1,200 after admitting 12 offences under the Computer Misuse Act. His lawyers said in mitigation that there had been some exaggeration when the Senate armed services committee had been told in 1996 that the Datastream Cowboy had caused more harm than the KGB and was the “No 1 threat to US security”. The remaining charges against Bevan were dropped in November after the Crown Prosecution Service decided it was not in the public interest to pursue the case.

Nevertheless, the case of Datastream Cowboy and Kuji remains one of the most notorious in American cyber history. The two young men are living this down in different ways. Pryce’s computer was confiscated, to his initial dismay. “After I had my computer taken away it was quite difficult because I had been doing it every night for a year,” he said. “If they hadn’t caught me, I would have carried on.” Now he thinks hacking was a waste of time and insists he will never do it again. He does not even own a computer any more.

Bevan, however, has put his notoriety to good use: he is now employed testing the computer security of private companies.Targeting the Pentagon United States defence computers have for years been one of the most covetedtargets for hacking addicts inspired by the film War Games, which showed a boy cracking an American defence network and nearly starting the third world war.

One of the pioneers of this craze was Kevin Mitnick, who repeatedly hacked into Pentagon computers in the mid-1980s. He was jailed in 1989 but continued his exploits on his release and was arrested again after a two-year hunt by the FBI. The number of cyber attacks on the Pentagon is estimated by Washington officials as 250,000 annually, but the incidents the public hears about are only the few where hackers get caught. In 1996 six Danes who hacked into Pentagon computers were given sentences of up to three months. The same year, special agents tracked down three teenage hackers in Croatia who had also succeeded in penetrating Pentagon computers.

They were never identified or charged, however, as there is no law against computer hacking in Croatia. Last month there was a spectacular example of the hackers’ work when American defence officials revealed that the Pentagon computer network had been subjected to a relentless two-month attack. CIA agents were reportedly anxious that the hackers might be the agents of Saddam Hussein.

FBI agents blamed a secret convention of hackers believed to be held in New York. A few days ago, the real culprit gave himself up. Ehud Tenenbaum, an Israeli teenager who dubbed himself The Analyser, had worked with two young hackers in California. Under house arrest in Tel Aviv, he said the attacks were not malicious. He had concentrated on American government sites because he hated organisations. “Chaos, I think it is a nice idea,” he said.

(c) Times Newspapers Ltd, 1998.

SUNDAY TIMES 29/03/98

Infowar.Com & Interpact, Inc. WebWarrior@Infowar.Com

Submit articles to: infowar@infowar.com
Voice: 813.393.6600 Fax: 813.393.6361

Last modified: Sun, 03 Jan 1999 00:04:46 GMT