objective summary # 2

in the second quarter of the book, " the cuckoos egg" by cliff stoll, Stoll spent a great deal of time and effort tracing the hacker's origin. He saw that the hacker was using a 1200 baud connection and realized that the intrusion was coming through a telephone modem connection.  Over the course of a long weekend he rounded up fifty terminals, mostly by "borrowing" them from the desks of co-workers away for the weekend, and teleprinters and attached them to the fifty incoming phone lines. When the hacker dialed in that weekend, Stoll located the phone line, which was coming from the tymnet  routing service. With the help of Tymnet, he eventually tracked the intrusion to a call center at mtire , a defense contractor in mclean Virginia  

Stoll, after returning his "borrowed" terminals, left a teleprinter attached to the intrusion line in order to see and record everything the hacker did. Stoll recorded the hacker's actions as he sought, and sometimes gained unauthorized access to military bases around the United States, looking for files that contained words such as "nuclear" or "SDI". The hacker also copied password files  and set up trojan horses  to find passwords. Stoll was amazed that on many of these high-security sites the hacker could easily guess passwords, since many system admin  never bothered to change the passwords from their factory defaults. Even on army bases, the hacker was sometimes able to log in as "guest" with no password.

Over the course of this investigation, Stoll contacted various agents at the fbi,cia, nsa, and air force. Since this was almost the first documented case of hacking Stoll was the first to keep a log on the hacker everyday, there was some confusion as to jurisdiction and a general reluctance to share information.