Stalking the Wily Hacker: 40 years later – Cliff Stoll [video]

**TL;DR:** In 1986, astronomer Cliff Stoll noticed a 75-cent accounting error that led him to uncover a sophisticated hacker infiltrating military networks, beginning a year-long, low-budget investigation into early internet espionage. ## The 75-Cent Anomaly On August 8, 1986, Cliff Stoll was working as a system administrator at Lawrence Berkeley National Laboratory, managing a cluster of VAX computers in the early days of the ARPANET. While investigating a crashed accounting program, he discovered a 75-cent discrepancy. As the CIS manager and the only person who should have been adding new users, Stoll realized something was wrong. He suspected an intruder had access to his system. ## Laying the Trap Faced with no budget, no official authorization, and little expertise in computer security, Stoll took a creative, low-tech approach. After a department meeting, Lab Director David Shirley gave him the green light: "I want you to take all the equipment, all the time, all the resources you need to catch the bug. Take three weeks if you need to." Stoll decided not to lock the intruder out but to monitor them. He borrowed a cart, "liberated" printers and teletypes from offices across the lab, and connected them to his VAX machines using Radio Shack alligator clips. This created a physical, hard-copy log of all activity. He then slept in a sleeping bag in the basement next to the humming equipment, with a thermos of minestrone soup, waiting for the intruder to return. ## The Investigation Begins The next morning, the prints revealed the intruder's method: they used a `cron` tab script to trigger a `set user ID to root` command, elevating their privileges to root, bypassing the accounting system, and connecting to military networks via the lab's Cisco router. From there, they systematically searched for information on ballistic missiles, plutonium, and nuclear weapons—a curious pursuit from Berkeley, California. When Stoll contacted the FBI, they asked, "How much money have you lost?" He replied, "About 75 cents." The agent told him to call back when he'd lost $500,000. With no external help, Stoll continued his solo pursuit. ## Technical Pursuits and Clues Stoll employed various methods to track the hacker: * He modified a Motorola pager with a soldering iron to receive Morse code alerts (via DTMF signals) from a serial line analyzer whenever the intruder logged in. * He noted the intruder's immediate use of the Unix `ps` command to see running processes—a defensive check. Stoll observed the intruder used `ps -GXUA`, and the `-G` flag was not a standard BSD Unix option. This suggested the intruder was running AT&T System V, a clue that "immediately left Berkeley" since local systems used BSD. * Using an old HP Tektronix oscilloscope, he measured the packet round-trip time for Telnet connections, averaging it to 2.84 seconds. Calculating the delay against the speed of light, he determined the source was approximately 400,000 kilometers away—a figure he noted was close to the moon's distance (380,000 km), but ultimately a dead end. ## Tracing the Connection After weeks of monitoring, Stoll traced the connection back to a company called MITRE, a defense contractor in Northern Virginia with claimed "air-gapped" security. The CIS administrator dismissed any possibility of a breach. Stoll persisted, threatening to go to the press. MITRE then unplugged its modems, forcing the hacker to find an alternate entry path, which they did via X.25 links. A key breakthrough came when the intruder downloaded the lab's encrypted `/etc/passwd` file. Days later, the hacker logged in with a newly cracked account. Stoll realized he was dealing with someone capable of password cracking. He meticulously recorded everything in a lab notebook, noting that "in astronomy, the rule of thumb is, if you don’t write it down, it didn’t happen." Source: [Stalking the Wily Hacker: 40 years later – Cliff Stoll](https://www.youtube.com/watch?v=656058JxTM0)