The Condor's last attack

Aaron Brancotti
Paul Stephen Borile
Alberto Vaccaro

When Kevin was charged with burglary and conspiring to commit computer fraud for the U.S. Leasing and COSMOS break-ins, Shelly had difficulty in understanding what her boy was accused of. Shy didn't know anything about telephone networks and computers, but on that occasion she learned that her son was evidently far less unprepared than she was.
In 1981, when Kevin David Mitnick was arrested for the first time, he was 18. He got a year's probation, after a three months diagnostic study mandated by the juvenile court system.
Overweight and extremely shy, Kevin started his career as a phone phreaker, and from the beginning his knowledge of the telephone company's control switches showed itself well beyond that of his friends.
And when the computer and digital network era begun, his passage into this new world was absolutely natural.
Kevin and his friend Roscoe started to break-in to U.S. Leasing (a San Francisco company specialized in leasing electronic equipment and computers) Digital Equipment PDP-11 computers in december 1980.
The two hackers got access to logging in to privileged accounts used only by system managers, destroying the computer's database and papering the offices' floor with printouts of threats and vulgarities.

In 1981 Mitnick and his friends Roscoe and Mark Ross slipped in the Pacific Bell's COSMOS (Computer System for Mainframe Operations) center in downtown Los Angeles, a program used by the phone companies for maintaining telephone cables, keeping records, carrying out service orders and so on. Their purpose was to gather useful material to break-in to the center computer system, and what they found were a list of numbers for calling the COSMOS computers, a list of codes to the digital door locks at nine phone central offices and the COSMOS manuals, with the information on everything which it was possible to do with the COSMOS computers.

Before the year on probation had ended, Mitnick was arrested in 1982 for intrusion into the University of Southern California computer network. He was 19. Kevin exploited a loophole in the campus computers' operating system to get access to privileged accounts. Mitnick downloaded university accounting files, and stole personal mail files from system managers to collect further information about the computer system.
Mitnick got six months of jail at the California Youth Authority's Karl Halton Training School in Stockton, California, being released in late 1983.
A year later, toward the end of 1994, Mitnick got a job at Great American Merchandising, a National GSC subsidiary owned by Donald Wilson, a Mitnick family friend. Kevin was bustling about the computer all day long, calling TRW and Pacific Bell giving himself out to be other persons. This aroused Richard Cooper's souspicions, a partner of Wilson, who reported his perplexities to Bob Ewen, an investigator in the L.A. district attorney's major fraud section, the same person who arrested Mitnick in 1981 for the break-ins to the COSMOS computers.
Ewen had already been on Kevin's tracks for a few weeks, with the suspects he was still tampering with some computersand illegally using access codes to make toll calls. The investigator issued an arrest warrant, but when he went to Mitnick's office to pick up the hacker, Kevin recognized him and fled. Mitnick left Los Angeles immediately, taking refuge in Israel.
He hid for about a year, neverthless without stopping his favourite hobby, and came back in circulation a few weeks after the expiry of his arrest warrant, in the summer of 1985.

A couple of years later, the Santa Cruz County Court fined Mitnick for unauthorized access to the Santa Cruz Operation computers, a multi-million dollar company that started selling a version of the UNIX operating system for the PC. Kevn was put on three years' probation and not imprisoned, in exchange for his full cooperation in explaining how he had cracked the Santa Cruz Operation computers.

In 1988 Mitnick conceived a new project: taking possession of the source code of release 5.0 (the latest version) of Digital Equipment's VMS operating system. With the assistance of his friend Leonard Dicicco and using Voluntary Plan Administrators - the company where Dicicco was employed - as base of operations, the attack on Digital began.
Mitnick's purpose probably was not selling the program, but using it to be able to open more easily back doors into VAX computers, on most of which  the VMS operating system was running.
To acquire the source code minimizing the risks to be discovered, Mitnick needed a warehouse to store it, and he found it in the University of Southern California computers, which Kevin had already broken into, having been arrested in 1982.
The intrusions into Digital computers lasted for months, but at the end Mitnick and Lenny succesfully reached their goal. Of course in doing so the two didn't only gain illegal access to Digital and USC machines. They also needed to be able to make untraceable long-distance calls: to do this they used illegal MCI calling card numbers and connected their modem line to another user's phone while using it for their electronic raids.
All Mitnick's knowledge as a phone phreaker had to put to the test.
Kevin and Lenny transferred the entire VMS source code and the security program XSafe on a USC computer after months of daily work. The operation was conducted so well that probably nobody would have been able to trace back to its authors.
But the 10 years hacking partnership between Mitnick and Dicicco got spoiled. Lenny felt he was under Kevin's control and that his fat friend would never drop his favourite hobby. Dicicco was afraid of losing his job and being caught by the police; he was fed up with spending nights behind the VPA office computer screens. 
So Lenny decided to bring Kevin to justice, and got him arrested.
Mitnick was held without bail and convicted in July 1988, sentenced to a year in a federal prison in Lompoc, California. In that occasion he was also placed in a treatment program for compulsive disorders, the Beit T'Shuvah center in Los Angeles, since one of his lawyers persuaded the court that Mitnick was computer addicted.
The hacker was released in mid-1990 and put on probation on condition that he wouldn't have touched a computer or modem.
But again Mitnick couldn't stay away a long time from the most exciting thing in his life and sometime later he violated that restriction. The federal officials started again to pursue him, and in November 1992 he went underground.

Mitnick resurfaced this year on february, 17, when he was arrested at 2 o'clock in the morning in his apartment in the Duraleigh Hills neighborhood of northwest Raleigh, North Carolina. 
This was the last act of a man hunt of more than two years, but the two months before the arrest were the decisive ones.
Everybody knows the story. On Christmas Day 1994 Mitnick, now 31, broke-in to Shimomura's computers in his cottage in Solana Beach near San Diego, California. Tsutomu Shimomura, a 30 years old computer security expert and researcher at the San Diego Supercomputer Center, made the decision to track down the intruder and led the FBI to Mitnick's arrest two months later.
The hacker has been charged with two federal crimes: illegal use of a telephone access device (punishable by up to 15 years in jail and a 250.000 dollars fine) and computer fraud (punishable by up to 20 years in jail and a 250.000 dollars fine). Mitnick's trial should start in July, 10, but Computer News magazine reported that Mitnick could be released. His lawyer John Dusenbury, infact, said the search warrant used by police to enter Mitnick's apartment was flawed since it listed the wrong address.

What follows is the technical description of Mitnick's attack to Shimomura's computers on Christmas Day 1994. It lasted only 16 seconds. 16 seconds in which Kevin David Mitnick known as the Condor, the greatest hacker in the computer era, signed his own masterpiece and his own sentence.

The Christmas Attack.

What can you do in sixteen seconds? Try it now: count up to sixteen. One, two, three... OK. End of your time. Now try it again, but please imagine to have lived side by side with computers for a lot of time. Please, think to electrons running in wires. Think to something very fast, then think that elecrons are even faster. Think to something very little, then think that transistors on a chip are probably far more little than you could imagine, and they are millions, and they work. Think what ÍTimeÎ for those objects means. Take a second, split it one thousand times. Take one of those little pieces of time and split it again one thousand times. You got a microsecond. And now please think that those little pieces of time are, for a computer, enough to work. So, now, please get back to your sixteen seconds. Your computer has a long digital life to live in those sixteen seconds. He will perform millions and millions of operations while you count up to sixteen. And now try to feel it. Touch your computer. Hear it. Try to intercept his binary thoughts transmitted through the wires, encoded in TCP/IP information packets...

What Kevin Mitnick did in his Christmas Attack, the one which Tsutomu Shimomura won't forgive, is something between black magic and digital understanding of the whole world, even for those who can understand what ÍsecurityÎ means in the exotheric World of the Nets. It took probably months to prepare the attack, but it took sixteen seconds to perform it.

Please be aware that Mitnick did many illegal things and caused troubles to many people. For this, he definitely deserves some kind of punishment (not necessarily those 35 years of prison he is facing ), but he also deserves the looserÌs honours. He has been a software artist and an outstanding enemy for Tsutomu Shimomura, which (with not much fantasy perhaps) has been defined a true Digital Samurai. 

For the reconstruction of the Christmas attack various sources have been used: informations and log files from Shimomura himself, extimation of times, comments from many Internet users and quite a lot of Net know-how. Read this as if it were a cyberpunk short novel, because we believe this is what the Attack had really been.

The attack was conducted initially from a machine named "toad.com". This was the name of MitnickÌs computer, but obviously nobody knew that behind that system was lurking the Condor. Physically, it was probably the same setup with which, months later, FBI and Shimomura got Mitnick: a laptop computer, two modems and two cellular phones. He used the modems and the phones to switch the connections back and forth between two telephone lines, making the task of tracing the calls much harder.

An additional two sites were also used: apollo.it.luc.edu, which is a real Internet site, and "130.92.6.97", an unused, forged IP address. IP packets sent to it will receive no aswer. Some explanations: when some information is sent over a net, this information is broken in pieces called "packets". This permits, for example, to ask again for a specific piece of information if we had some trouble in the transmission (noise, errors and so on ). Also, every packet is signed with numbers, so we can understand where it comes from and where it is going, and in which sequence we must rebuild the packets to get back our reconstructed information. So, think to a packet as a "software container", a "wrapper" for your information to let it go around safely on the wires. There are many standard specifications of how those packets must be built and what they must contain (apart from the information piece itself ), and those specifications are called "protocols". So, one of those protocols, and by the way the protocol used over the Internet, is called TCP/IP. Every distinct "point" on the Internet is a "site", and you can send information from one site to another. This is the way Internet works: you must be a site if you want to be able to be distinguished from other computers on the Net. A site has a specific, unique "IP address", which is a sequence of numbers like "130.92.6.97", and for semplicity those numbers are translated in "addresses" that can be remembered more easily. For example, reading "apollo.it.luc.edu" is easier to remember that an address ending with ".edu" is a site somewhere in a University or a High School ("edu"cation ), so it is easier to remember this "mnemonic" address than a sequence of numbers. Somewhere on the net there are computers that mantain a database of associations between numerical IP addresses and "easier" mnemonic addresses, and also mantain the list of valid addresses. In fact, not all the possible IP addresses have been used yet, and many had been but are no longer physically associated to a real site, a real computer. So, if you try to send a packet to an unused IP address, your computer will try to send it again and again for some time, receiving no answer.

This is Shimomura's configuration:

"Server": A SPARCstation running Solaris 1 serving Shimomura's X-Terminal.
"X-Terminal": A disk-less SPARCstation running Solaris 1.
"Target": The primary target of the attack.

All those computers are located in San Diego Supercomputer Center domain, where Shimomura works. Again, some explanations: a "Server" is a powerful computer, which normally lets other computers use his resources, like printers, modems, hard disk space, computation time and so on. A "Client" is a computer accessing the resources of a Server. Between Clients and Servers there is friendliness: the Server trusts his Client and vice-versa, because it is supposed that a full co-operation exists between the two and security controls are then very low. In this case, ShimomuraÌs X-Terminal, the computer upon which normally he works, is a Client without local hard disk, so Shimomura files are physically located somewhere else, for example on the ServerÌs hard disk. Both the Server and the Client are running a Operating System, that is the software between you and the bare hardware circuits, which is called Solaris 1 and is substantially a UNIX(R) Operating System. The SPARCStations are computers from SUN Corp. A "domain" of computers is a logical grouping: the computers does not necessarily reside in the same place, but they belong to the same working group.

And now, letÌs go with some preparatory work...

-----------------------Attack Start Time: 14:09:32 PST on 12/25/94

[toad.com]: User "root" on toad.com starts fingering the site to gather user information.

14:09:32 toad.com# finger -l @target
14:10:21 toad.com# finger -l @server
14:10:50 toad.com# finger -l root@server
14:11:07 toad.com# finger -l @x-terminal

The "finger" UNIX command is a command which gives you various informations about another computer on the net. A "root" user is the most powerful user a UNIX computer can have: a root user can delete, move and see any kind of file, resource and information on the computer; he has all the system at his knees. So here we have Mitnick, the owner and obviously the root of his laptop computer called toad.com, connected to the San Diego Supercomputer Center (SDSC) via Internet, checking and gathering informations about Target, Server, root user on the server and X-Terminal at SDSC. He cannot do any complex action on the SDSC computers, because he is an external user, having very low privileges. But he can ask some informations... so he checks nobody is around, which could notice something going wrong in the system. Also, let us remeber that it is Christmas, so probably very few people is using the system.

[toad.com]: Trying to figure out the trust relationship between x-terminal and server.

14:11:38 toad.com# showmount -e x-terminal

Here Mitnick checks which files owned by the ShimomuraÌs X-Terminal, physically located on the ServerÌs hard disk, are accessible and visible from outside the SDSC. Normally the files are made visible by the biggest computer in the domain, which is normally the server. So here Mitnick checks which could be the server of the SDSC domain. Mitnick is still gathering information. He is slow: he is probably doing this by hand, typing the commands on his laptop (check the timing!)

[toad.com]: check out the port-mapper to see which RPC programs are registered.

14:11:49 toad.com# rpcinfo -p x-terminal

A RPC (Remote Procedure Call) is a mechanism by which is possible to run procedures (which are pieces of programs) on a remote computer. This is a very important feature of the Client-Server architecture: you can ask your server to run specific pieces of code instead of yourself, so you do not use your local resources. Here Mitnick is checking what the X-Terminal can ask the Server to do using the RPC mechanism. Probably Mitnick had a full choice of software intruders; he is now checking the SDSC domain structure to decide which strategy and software he will use to hack it. He will not use this way.

[toad.com]: check out root user information on x-terminal

14:12:05 toad.com# finger -l root@x-terminal

Here, again, Mitnick checks some information about the root on the X-Terminal, which is Shimomura himself. Nobody is connected. The attack can go on.

----------------------------------Elapsed Time: min secs msec --
							      02 : 33 . 00

[toad.com]: Ok. Thinking. Take a break to analyze info obtained and set up the attack strategy.

Only Mitnick knows what was going on in these minutes. In these minutes of binary thinking, the MitnickÌs computer and brain are setting up the best strategy from the data received with standard commands like "finger" and the others.

At the end, Mitnick decides for the "spoofing" strategy, which permits to a computer to "change identity". We must explain this, before going on: The TCP/IP packets have got sequence codes which are created with algorithms which depend upon the Operating System and TCP implementation you are using, and every TCP/IP packet you send to a computer must be acknowledged from the receiving computer with a correct return packet, called ACK. An ACK is substantially a packet from the remote computer telling you "OK. I received your packet #2734628; now send me another packet #2734629". This is for security reasons:  the remote computer tells you how to prepare your TCP/IP packet in a way that he will accept it, and he also tells you if your packet was good or not and if he accepted it and how to build the next packet... and so on.  With the "spoofing" technique, you change addresses and sequence numbers of packets, and in this way the receiver believes they come from somewhere else...

But now, those few minutes are over. MitnickÌ system is ready to attack. The software believes to have found all the algorithms and procedures he needs for the break-in. Feel the adhrenaline flow in MitnickÌs veins. Feel the screaming buzz of the electronic laptopÌs heart. You are looking at a first-class hack, a new-era digital masterpiece...

Nobody can go so fast. Here the software Mitnick wrote for the attack will start and get total control. Mitnick probably just looks without breathing.

Fasten your virtual seatbelt - ready to start those sixteen seconds... 

Just press the Enter key.

----------------------------------Elapsed Time: min secs msec ----								06 : 00 . 00

[toad.com]: Start Spoofer1. Filling up with TCP SYN's (20) on TCP Port 513 (Login) with spoofed Source IP set to 130.92.6.97 (unknown host).

{ Answers from server (SYN-ACKs) back to 130.92.6.97 are lost. Server.login is now periodically retransmitting SYN-ACKs to 130.92.6.97 and so it is locked i.e.it will not send RST on unexpected SYN-ACK (later) }

Now MitnickÌ software starts to do magics: it sends to the server requests to enter the SDSC system (to "login"), signing himself as 130.92.6.97. He is not "toad.com" anymore: the server receives TCP/IP packets from 130.92.6.97 asking to let him enter the system. The Server ACKs those requests, but the answers are lost, because 130.92.6.97 does not really exists on the Net, and MitnickÌ system does not receive and/or answer to those ACKs. The Server "login" service is blocked, it will keep to send ACKs for a while. Nobody will be able to use the "login" service on the Server, but every other service will keep on working. Mitnick here blocked the service he wants to use freely on the X-Terminal.

----------------------------------Elapsed Time: min secs msec --
								00 : 02 . 40

[apollo.it.luc.edu]: Determine X-Terminal's TCP sequence number generation algorithm.

{ Send SYN, receive SYN-ACK, send RST and back again. Keeping track of SYN-ACK sequence number for later use. SYN packets are sent directly to port 514 (shell) }

Here MitnickÌ software tries to connect to the SDSC by way of the X-Terminal. It is not working from toad.com anymore: he surfs and jumps the Net connecting from his laptop to some sites and then he finally stops on site apollo.it.luc.edu, just to make harder to get back to it. From there, he does many login attempt sequences on the X-Terminal in the SDSC domain, keeping note of how the X-Terminal answers the requests. He stores all the ACK packets and analyzes them. He does this many times. He reconstruct the sequence number generation algorithm of the X-Terminal. Now the Intruder knows what the X-Terminal will answer if it receives a particular TCP/IP packet. 

----------------------------------Elapsed Time: min secs msec --
								00 : 13 . 08

[toad.com]: Starting Spoofer2. Sending SYNs (connection request) to X-Terminal.shell spoofing again source address. Now using server.login service. X-terminal will answer SYN-ACK to real server.login which is stuck. toad.com will blind acknowledge SYN-ACKs never received !!

Here the Intruder, from toad.com, starts to send TCP/IP packets signed with the IP address of the Server. He knows that address: he received TCP/IP packets from the Server when he issued the "finger" commands , about ten minutes earlier. To the X-Terminal, it seems that the Server wants to connect to him, using the "shell" service. The X-Terminal answers to the real Server. But the real Server is stuck! He cannot answer back! Here it is another magic: the Intruder does not see the answers going from the X-Terminal to the blocked Server because they are physically on another wire, but, having guessed the sequence number generation algorithm of the X-Terminal, can guess those X-Terminal answers to the shell request. So the Intruder simulates what the X-Terminal wants back from the Server to let him connect. And the Intruder sends the X-Terminal those packets... The X-Terminal accepts the shell command! Mitnick can now send packets to the X-Terminal, while the X-Terminal believes that is the Server connected...

----------------------------------Elapsed Time: min secs msec --
								00 : 00 . 51

[toad.com]: Connection is up. Sending to x-terminal.shell: "echo + + >>/.rhosts". 

Here the magics is in UNIX knowledge. Mitnick can send commands to the X-Terminal, while the X-Terminal believes he is the Server. The X-Terminal trusts the Server, so he will let him do nearly anything. But this connection is higly instable: any line problem could resolve in a crash, because the Intruder is answering to packets which he cannot see; the Intruder is really guessing the timings. If he should answer to a packet before the packet were effectively sent from the X-Terminal, the X-Terminal could receive an answer to a packet which has not yet been sent. It could happen anything... the Intruder must do something fast! Solution: letÌs arrange  everything such that everybody which is a root user on his machine can also enter the X-Terminal as a root user. The command "echo + + >>/.rhosts" writes "+ +" at the end of root's rhosts file, which is substantially a permission and security file which specifies the privileges of remote users; everybody who is root on his machine now can connect via remote login command to the X-Terminal and enter as root also on the X-Terminal... and incidentally Mitnick is the root user of toad.com!

And here are those sixteen seconds. Now everything is going to be easy...

----------------------------------Elapsed Time: min secs msec --
								00 : 01 . 02

[toad.com]: Shutting down the spoofed connection with X-Terminal.

Ok. We do not need any more to keep alive the hacked connection between X-Terminal and the Intruder disguised as Server. Close it. Hopefully nobody will notice ..

----------------------------------Elapsed Time: min secs msec --                                                                            								00 : 10 . 91

[toad.com]: Sending RST's to reset server.login queue on port 513.

And also we do not need to keep the real server stuck. Let us change again identity: toad.com becomes once again 130.92.6.97 and sends some reset packet, simulating that the unexistant site does not want access SDSC any more... the Server restart his normal work on the login service.

----------------------------------Elapsed Time: min secs msec --                                                                           								00 : 02 . 80

[toad.com]: DONE. Log as root on X-Terminal now. Download TAP-2.01 on X-Terminal. Take control of a TTY device and finally access target machine.

Now Mitnick, which is the root user of toad.com, can "legally" connect to the X-Terminal, issue a remote login command and enter on the X-Terminal with full root user access and privileges. Once in the system and in the SDSC domain, he checks for existing connections to the ultimate target of his attack, and runs a piece of Operating System somewhat modified and similar to a virus which permits to him to stole an existing and already validated connection to the target computer. He gains full access over that connection. Now he can do what he wants on the target machine. Time to leave a sign of himself...

[toad.com]: Leaving a signature - downloading tweedle-dee.au, tweedle-dum.au

These are Sun audio files 8-bit u-law, 8 khz sample rate. If you have internet FTP access, you can get them from ftp://ftp.sdsc.edu/pub/security/sounds/tweedle-dee.au and ftp://ftp.sdsc.edu/pub/security/sounds/tweedle-dum.au. 

ArenÌt you curious about the sound of the CyberSpace?

-------------------------Attack End Time: 14:51:00 PST on 12/25/94