The Jaeger

Speaker 1: This is about an astronomer Astronomy. Who in 1986 had just lost his funding. And Clifford, the out of work astronomer, takes a job at the lab where he'd been doing his research. They needed someone to run the lab's computers. He gets settled into his office, the small, unventilated cubicle, when the main guy in charge, this guy named Dave Cleveland, walks in. The lab makes money by renting out computer systems, and Dave comes in holding, like, a report of the usage, essentially a bill.

Speaker 2: At the end of that particular month, we had 75 left over in charges that we had no one to bill for. And that was very frustrating because our programs, our accounting programs were very accurate, and, we knew it wasn't a, rounding problem or something like that or arithmetic error. We knew we we didn't have someone to charge the 75¢ to. And what happened to that person? Where'd they come from? Where'd they go? And, opened up a whole can of worms.

Speaker 3: 75¢. 75¢. To Cliff, like,

Speaker 1: a big discrepancy in the bill was gonna be easy to find, but 75¢ was sort of like a fun challenge for a Yeah. Sure. Tiny amount. Yeah. So first, Clifford writes a test program to make sure that the accounting system was working properly, which it was. And then Clifford decides to dive into the list of names, account numbers, and charges. And, one of them stands out at him. One account doesn't have an account number associated with it and has used exactly 75¢ worth of computer time.

Speaker 3: Seems like an obvious place to start.

Speaker 1: Seems like a pretty obvious place to start. The account's name is Hunter. So, Cliff shuts down Hunter's account. Done. Right? We're done here.

Speaker 3: Alright. Hunter is disabled. 75¢ nullified. Move on. Write it off. Get that tax break.

Speaker 1: So the next day, Clifford gets a message from a computer in Maryland, codenamed Dockmaster, and it turns out that someone had tried to break into Dockmaster's system, and the attack was launched from Clifford's lab. And the second day on the job, Clifford is tasked with hunting down the culprit, codenamed Hunter. The German word for hunter is Jaeger, which is also this, like, small bird with this really distinct predatory behavior known for intruding on other birds and lurking around a nest where it's not welcome and launching these little attacks.

Speaker 3: Sounds appropriate. So this

Speaker 1: is that story. The story of the three years that followed, which saw this sort of mild mannered astronomer embarking on one of the first cases of cyber forensics, looking for this new type of criminal.

Speaker 4: A hacker sneaking into military computers, stealing secrets. As a scientist, it was bewildering. But in the end, it was science that showed the way out. Let me tell you what happened.

Speaker 1: This is the Jaeger, here on Hacked.

Speaker 4: Used to be that computers were isolated. Big computer here would solve one problem. This computer would solve another. Now, though, we share data from one scientist to another, and that means we need to network our computers. We need to send messages from one system to another, yet to another. Those computer networks form communities, form neighborhoods where one system sends information to another. And it's not just the computers that form the communities, the people using them are in one large neighborhood as well. Our networks are like a new kind of highway system. Once you get on a network, you can travel around the world. All you have to do is find a computer's network address and then call it up. You type in your account name and then your password. Password's usually not displayed to keep it secure from somebody looking over your shoulder. If you're legitimate, it invites you in. You can even dial up a network on a telephone line with your home computer. It all works great until somebody, a hacker, tries to break in where he doesn't belong.

Speaker 3: That's the world we live in now.

Speaker 1: So a lot of listeners might know this story. Clifford Stoll, the guy that it's about, wrote a very popular book about it called The Cuckoo's Egg. And Which I've read. You've read that? Right.

Speaker 3: I read it in, like, the nineties, though. Then you know this story. Crazy. I don't even remember the book, but I know I read it.

Speaker 1: Have you seen the PBS doc?

Speaker 3: No. Oh, it's good.

Speaker 1: Is it? It's really good. We got a lot of the archival material in this episode from that documentary. Sick. He's given a lot of interviews. So a lot of people have maybe heard this story. I hadn't heard this story. You apparently had. But I just thought it was a pretty fun story. And since I never heard it, I figured a

Speaker 3: lot of people hadn't. I read this book when I was a formulating young cybersecurity nut. There's a lot of bad acting in this movie. I I can tell You could tell. By the audiotakes. So No offense if this makes another episode. I'm sure you're all great distinguished actors.

Speaker 1: They all went on to have established acting careers. The best part about it, though, is that, like, when we hear from Dave Cleveland, that's actually Dave Cleveland taking part in that PBS documentary. When we hear from a secondary character, that's the real person because they were all really excited to be in this movie about this really cool thing they had just done. Cool. So it's lunch the next day, and Clifford has a lead on the culprit. There's only one user connected from their lab to dock master at the time of the break in.

Speaker 4: Someone named Sventech. Sventech?

Speaker 2: Oh, that's Sven's heck? Oh, that's impossible. Joe is the professor down at the university here, a well known computer scientist. He's worked here for years. A lot of us know him. He's not the type of guy to break into a computer. Besides, he's so good, we probably wouldn't have caught him if he had decided to break in.

Speaker 1: Wow. Yeah. I know. Right? We probably wouldn't have caught him. So Spentek, this real username belonging to a real person who his boss is, like, certain isn't behind the attack. And Clifford figures out that, oh, a student must have stolen this professor's login. And Cliff decides, I'm just gonna teach this little little punk a lesson. He sets a trap. He gets the hacker on the line.

Speaker 4: I programmed my terminal to beep whenever anyone logged into the lab.

Speaker 1: And Clifford just watches as hundreds of people connect and disconnect from the lab's computers. And at 12:33 in the afternoon, it beeps for like the hundredth time, and the username Sventech is back online. Line.

Speaker 4: All he'd left was a terminal number. The line that he'd used to enter the lab's computer system.

Speaker 1: So Clifford figures out the line that this person is using to log in as Sventech.

Speaker 3: Sure. The terminal ID.

Speaker 1: So Clifford goes to talk to a guy in the office named Paul Murray. Snaking all through the astronomy lab is just miles and miles of cables, and Paul is the guy who oversaw all that physical infrastructure. And, Paul confirmed that the person using Spentek's account was coming in from outside the lab. Coming in through one of the 50 phone lines running in. And Paul has one of the wildest ideas ever to figure out who it is.

Speaker 4: Attach a printer to each line and print out every call that came in. Great.

Speaker 1: So Cliff liberates 50 printers from around the entire university and he connects one printer to every one of the 50 phone lines coming into the lab and he tells them to print out the login info of every single person from around the world that connects to their laboratory. The next day he comes in and he finds 80 feet of printouts documenting every single login by username. He starts by hand parsing through the logins, and Clifford discovers that his intruder isn't just passing through the lab's computers. Looking at the actual traffic, he's like, actively looking around on their system.

Speaker 3: Oh, so he wasn't just printing out the login information. He was printing out every console command being executed to? That sounds correct. I'm assuming that is what happened. That's what I would do in a pre Excel world.

Speaker 1: Sure. He's opening stuff and he's mucking around in files that the Spentec account shouldn't have even had the ability to look at. So now we have this new question. How is he getting access to this stuff?

Speaker 4: He not only could read any file in my whole system, but he could change any of them. He could erase any of those files.

Speaker 1: I love those reads.

Speaker 3: Man, really bringing it home for me.

Speaker 1: So the question now is how is this fake fintech done, and how has he gotten this sort of, like, admin access, essentially? Let's call

Speaker 3: it superuser access or root access.

Speaker 1: So it turns out that the lab had this kind of, like, crude early mailing system. And, essentially, if you wanted say I wanted to send you a file, I just renamed it your username or I renamed it with your username somewhere in the file, and it would just move it over to your account. The way that you would transfer files was just by renaming them, and they would jump over to this other person's, profile.

Speaker 3: That sounds like a grotesque security vulnerability.

Speaker 1: Yeah. It sure does. And the hacker figured it out, and he figured out that you could use that system to send files not to say Scott

Speaker 3: But to root?

Speaker 1: But to the systems area that ran the machine, which apparently is called root. And the systems area had this routine, also super duper secure, that basically said, hey, just run all of the local maintenance software every five minutes.

Speaker 3: So he transferred in a new maintenance algo that does whatever he needs, or a new maintenance, you know, commandlet.

Speaker 1: And it just says makes Fintech the admin. Perfect. Waits five minutes. It runs it.

Speaker 3: It's called Cron too, the thing that you're the scheduling system, just so you're up on the names. Root is superuser, and Cron is the the, scheduled maintenance. So Cron job. So he added a Cron job for something. And that Cron job was probably to make him superuser.

Speaker 1: So the Cron job runs?

Speaker 3: The Cron job runs.

Speaker 1: The Cron job runs. He now has this superuser access. He uses it to immediately go in and change the accounting records to delete any record that he has over there.

Speaker 3: Clean up his history, like all good hackers.

Speaker 5: It's a

Speaker 4: little bit like brushing away your footprints as he walked down the street.

Speaker 1: And the only way that any of this ever got launched off was because he just, like, mucked up and forgot to remove $1.75 cent usage charge.

Speaker 3: So the, most consoles so when you terminal into a computer, the shell that you use, the shell is the thing that you type commands into and they execute on the the remote computer. Most shells keep a history file of all the commands run. So a common practice is to clean up after yourself is to delete your history. But if you're really good, you'll actually just manufacture a fake history so it doesn't look suspicious.

Speaker 1: I don't think this guy was quite that good.

Speaker 3: Well, he was early days.

Speaker 1: This is true. None of that stuff has been cooked up yet. Yeah. By the time you're getting into this, there's already books about what this guy was doing.

Speaker 3: Exactly

Speaker 1: interesting So cliff decides the only way he's going to find this guy is if you can do a trace and in order to be able to do the trace He has to identify when the hackers logging on and he has to do that without 50 printers and an army of people parsing over every single thing that they print out He needed to kind of cook up the solution.

Speaker 3: Well, it it's interesting to me because one of the primitive Unix commands is who is, and who am I, and, like, who, and who is, like, a classic command to say who's online right now. So it'd be pretty easy to schedule a task, to constantly look at who, and when you find the username you're looking for, execute something, be it a notification or what.

Speaker 1: It's funny you should say that. So Clifford decides he's gonna invent this alarm system that ends up working out a lot like what you just said. One that's gonna alert him every time Sventech and only Sventech logs in any time of day. Mhmm. Which does sound kinda simple until you remember that Clifford couldn't connect to the lab from home because home Internet.

Speaker 3: Dial in back then. You used to be able to dial it. You'd have a terminal at home, and you'd literally plug your phone into two sockets, and it would send audio signals back and forth.

Speaker 1: Damn. Yeah. Cliff didn't have that, I guess.

Speaker 3: Well, other people had it to connect to Cliff's lab, so it's weird that the admin didn't have that.

Speaker 1: Yeah. I wonder what the it's funny to consider that this is just an out of work astronomer doing all of this as part of his, like, lab maintenance job. Some of the solutions he had to come up with, I sense, are a little bit more rough and tumble than what someone else might have been able to do at the same time. Sure. Yeah. So Clifford and a colleague write what he described as this It's kind of what you just described. It's a simple program that just monitor all the traffic coming in, filtering for the appearance of a single text phrase.

Speaker 3: Totally. Sentek. Spentek. Yeah.

Speaker 1: He called it in the documentary a logic analyzer, which I feel like Sure. Yeah.

Speaker 3: Logic analyzer being there's logic if username equals fintech, then do x. Then, yeah, there's logic in there.

Speaker 1: So then he goes out and he buys a $99 electronic dialer from, like, Radio Shack, which he connects to the system.

Speaker 3: Which they don't make anymore. No? Not really.

Speaker 1: I guess I don't really know what you'd use it for.

Speaker 3: They used to just dial numbers. You program them to dial numbers. They use, like, those telemarketers. They use them now. They they exist. They're just software now.

Speaker 1: Well, he programs it to call a phone in the office.

Speaker 3: Actually, you remember the Zoom Yeah. Episode? Autodialer. Same thing.

Speaker 1: Oh, okay. Sure. So he's got the autodialer, and it's looking for the text phrase spend tech, And it's The autodialer

Speaker 3: is looking for the No.

Speaker 1: The logic analyzer. Ah.

Speaker 3: The logic analyzer.

Speaker 1: There you go. K. And then it's 1986, so he goes out and he buys himself a pager. And strung together, the moment the hacker logs in using Spentek's info, the term Spentek appears in the traffic, which trips the logic analyzer, which dials the number of the phone in the lab, which pings his pager. Beautiful. It's pretty sweet.

Speaker 4: When the hacker called,

Speaker 1: I was waiting. So when the hacker calls, Clifford's waiting. And he runs up to the lab and he does a phone trace. And after, like, a handful of tries of getting this call, running over to the lab, which I guess he was within running distance of and not making it in time, after a couple of these, it works. And Clifford does the trace and he's able to follow the traffic. Do you wanna guess where it was?

Speaker 3: Somewhere else in the building. It was an army base. Oh, perfect.

Speaker 4: Same guy who logged into my computer as Fintech was logging into an army computer under the name Hunter. Same guy who caused that 75¢ accounting imbalance. Once he got into this army computer, I could see him searching their database, looking for military information, looking for stuff about their missile plans. Weird stuff was happening

Speaker 1: here. And so what did Cliff do? He called the army.

Speaker 2: What you gonna do?

Speaker 4: Call the army.

Speaker 3: This movie is too much.

Speaker 1: It's so good, man. Clifford calls the army after this break. Starting some new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's gonna work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all ecommerce commerce in The US. From household names like, well, hacked podcasts merch to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button is used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, sort of getting abandoned in the parking lot and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked.

Speaker 6: When you finally find your thing, you want the whole world to know about that thing. So you use a thing called Canva to make it an even bigger and better thing. Whether you want to create flyers for that thing, make presentations for that thing, or design merch for that thing, you can do anything. So people can see your thing, feel your thing, love your thing. The next thing you know, it's a thing. Canva, the thing that makes anything a thing.

Speaker 4: Scientists use the networks to connect to other labs and universities, but you could also connect to a network of unclassified military computers over something called the Milnet. That's what the hacker did.

Speaker 1: So this is a recurring motif in this story where every time Cliff hits a dead end, he goes back to that network traffic. Following the hacker as he moves around from system to system, which apparently he could do. I guess he could watch the hacker maybe because he's using their computer to keep going and do other stuff. The traffic is somewhat visible. I don't really understand how that works.

Speaker 3: He can see this stuff in his world pretty easily.

Speaker 1: And I think he's somehow seeing this stuff after the guys come into his network.

Speaker 3: Oh, yes.

Speaker 1: Guys doing.

Speaker 3: Yeah. So if he's passing through his lab onto other people's computers

Speaker 1: Yes.

Speaker 3: He would see that. Yes. Yes. Now that we're all summarized and clear.

Speaker 1: So Clifford is watching this hacker kinda lurk around, this time on the Milnet.

Speaker 4: When he got onto the Milnet, he tried to get into one computer after another. He didn't do anything fancy. He tried standard account names and passwords. All new computers are supplied with them. You're supposed to replace them, but people forget, even on military computers.

Speaker 3: Sounds like a common problem that still exists today.

Speaker 1: Some things truly do not change.

Speaker 3: That was, what, almost thirty four years ago?

Speaker 1: Yeah. Yeah. The concept of usernames and passwords is brought up as, like, a novel context in this story. Like, if you're watch reading interviews

Speaker 3: and watching the docs It wasn't just a phone number?

Speaker 1: No. So he'd find a new system, and he'd try those default usernames and passwords, kind of whatever they came preset as, whatever they were in the box. And roughly speaking, one out of 10 machines were using those default, usernames and passwords. A ratio that has probably changed?

Speaker 3: Probably not. But not by that much. The, weakest link theory. You know?

Speaker 1: One out of 10.

Speaker 3: Once you get into one, typically, you can find other ways to get access to the other nine.

Speaker 1: So once he's in, he'd set up a phony account using one of essentially four usernames.

Speaker 4: Hunter, Hedges, Jaeger, Benson, over and over again.

Speaker 1: Hunter, Hedges,

Speaker 3: Jaeger, Benson. Some strong names.

Speaker 1: Clifford watched the names appear over and over again. Hunter, Hedges, Jaeger, Benson. So he takes these four words, and he goes to someone named Maggie Morley, the lab's librarian.

Speaker 7: The words he was interested in were Jaeger, and, Benson, and, Hunter, and Hedges.

Speaker 1: The name Jaeger pinged for her for two reasons. First, Maggie is a Scrabble player, Borderline pro level. And one time she played Jaeger and she landed that J on a triple word score. Damn. Yeah. I'm pretty sure she messed up that other Scrabble nerd. Like, but it also meant something else.

Speaker 7: Jaeger, I also knew was, was a kind of bird which, harassed other birds causing them to drop the food from their beaks. And it's also a German word meaning hunter.

Speaker 3: Jaeger and Hunter. So he's German. Two of the usernames.

Speaker 1: As for Hedges and Benson.

Speaker 3: Benson Hedges is a smoker. He's a German smoker. We figured it out.

Speaker 1: They have two clues. He has the Jaeger which implies that he's German and the cigarettes, which implies cigarettes. And he follows this trail for a little bit. But the next big break in the story comes from a collaborator of Clifford's. This guy named Ron Vavir. Ron Vavir worked over in IT over at a company called Telnet, and he's watching this hacker move around on the network as well. And Ron Vavir calls up Clifford and he tells him he's traced the hacker from Cliff's lab to his lab in Oakland to telephone lines at Pacific Bell's Exchange. And Bell won't agree to give them any information unless they go get a warrant. So Cliff calls up the Oakland DA, and he gets a warrant. And Bell agrees to trace the number. Did you ever do any, like, phone finagally hacky stuff? Maybe.

Speaker 3: Back in the day when servers had dial in modems, and you could literally just auto dial until you received a computer signal. So you'd be sitting at home at night, and your phone would ring, and you'd pick it up and say hello, and then you'd hear, like, a modem chirp at you. Back in the day, you used to be able to use an auto dialer and dial blocks of numbers used by companies, used by anything. And you'd only get a ping back when you hit a server. It would hang up on everybody until it got a computer signal, and then it would pop up on the terminal and be like, here's a computer. Oh. That's how that worked.

Speaker 1: So cool thing about phone tracing

Speaker 3: Cool thing. And I'm

Speaker 1: sure it's all automated now. But I guess back in 1986, doing a phone trace involved, like, a technician following the call by tracing it from one phone company's towers to the next, calling up technicians at those companies doing this massive cooperative, like, surveillance dragnet operation.

Speaker 3: Yeah. You'd be tracing the copper connections back.

Speaker 1: Because you have all these operators on the line at the same time until you've traced the call back to its original source. And this big cooperative mission manages to trace the call all the way back to the East Coast, Virginia. So they've got a technician in Virginia with this information, the location of the hacker, and the address where the phone connection terminates, and they've got a search warrant. And they hand that search warrant to the technician, and she looks at it, and she says, I'm in Virginia, and this is a search warrant from California. And Clifford says, oh, no.

Speaker 4: Oh, no.

Speaker 3: You're really leaning into this acting?

Speaker 1: So we find Clifford having followed the hacker all

Speaker 3: the way back to Virginia at this very abrupt dead end. Because they can't execute the search warrant?

Speaker 1: They can't execute the search warrant.

Speaker 3: So they need to get the FBI.

Speaker 1: This is going on for months, by the way, and I have no idea if Clifford has, like, any other job at this lab.

Speaker 3: He's just dedicated his life to tracking down this one person who's using 75¢ worth of extra computing power.

Speaker 1: Dedicated, like, six months and then kind of almost three years to doing this.

Speaker 3: The economic benefits are just shining through here.

Speaker 1: He did write a book, and you did read that book.

Speaker 3: I did read that book. We're talking about it.

Speaker 1: That's true. So, yet again, Clifford goes back to watching this hacker, watching this person lurk around on this network. And, they're digging around on some systems operated by the CIA. And, they're looking up, like, CIA staff information, addresses, phone numbers, like, really privileged information. So Clifford calls up the CIA, and the CIA flies to him, pays him a visit, and when they look over the whole thing, learn the whole story thus far, the story of this guy looking at their agent's information, they decide, well, this is none of our business because domestic surveillance apparently wasn't their prerogative. Yeah.

Speaker 3: It still isn't, I don't think.

Speaker 1: And they just didn't really understand, I think, what they were looking at.

Speaker 3: They must not have. No. Because I feel like protecting their information should be key, a key tenant of what the CIA

Speaker 1: is. You'd think. Right? Yeah. And if you want good confirmation that these sort of agencies didn't really understand what they were looking at, the FBI didn't care either.

Speaker 3: This is 1986.

Speaker 1: They saw 75% discrepancy and decided it wasn't worth their time.

Speaker 3: This is astronomers in labs. They don't they don't care about computers back then? No.

Speaker 1: So Clifford goes back to his method. Starts parsing through all that information again.

Speaker 4: So I had to rely on what I knew best, doing science.

Speaker 3: God loves science. And science led Clifford to Kermit. Kermit. So he's a German hunting, smoking frog?

Speaker 1: Not the frog, a piece of software. So Kermit apparently was a computer, file transfer protocol used back in the nineteen eighties, and the hacker was using Kermit to grab and move files around the network.

Speaker 3: Right.

Speaker 1: And Kermit would send a little packet of data, and they would wait. And And when the hacker would get the packet, the software would ping cool. Got that data. And then the next transfer would start. And Clifford has this idea concerning that little window of time between when the packet is sent and when the confirmation ping comes back.

Speaker 3: So he hijacks it? He hijacks it. Brilliant. Man in the middle.

Speaker 4: If I could measure the delay time between each reply, then I could calculate how far away the hacker was.

Speaker 1: So Clifford runs this experiment.

Speaker 3: It's smart. He's a pretty smart guy.

Speaker 1: There is one funny thing he gets very, very wrong later in life, but this is all very, very smart.

Speaker 3: Later in life. Not in this investigation.

Speaker 1: No. In this investigation

Speaker 3: He gives off something huge in his personal life. Adastrophic.

Speaker 1: He gets one thing wrong, and he admits he gets it wrong. Anyway, Clifford runs this experiment, and he watches as the hacker transfers a file, and then he counts waiting for the ping. One Mississippi, two Mississippi.

Speaker 3: I'm sure he uses science

Speaker 1: to count. He counted it out. Are you actually No. And it takes three seconds round trip from Berkeley to wherever the hacker is and back. And moving at the speed of light across these cables, that is, fun fact, 280,000 miles away. As physics goes, the hacker was on the moon.

Speaker 3: Or, he was just routing through so many networks.

Speaker 1: And, at this point Clifford figures that out. Figures out there's relay stations that the signal has to ping through that add a little bit of delay each time. So, they take this different approach and he performs a new experiment. And, what Clifford does is he connects from Berkeley to other systems around the country, transfers a file, and then measures those delay times. First Berkeley to LA, quarter second. Berkeley to Iowa, like three quarters of a second. California to Boston, second and a half. But none of those are anywhere close to the three second delay he's watching with this hacker, which means the hacker is somewhere much further away.

Speaker 3: Crossing an ocean, maybe. Maybe. Smoking cigarettes in a dark mysterious room with a jagged haircut and a long trench coat.

Speaker 1: Because the trail ends in Virginia, but it can't enter Virginia. It had to just be one stop on the way to this guy in the trench coat smoking his Benson hatches.

Speaker 3: It may do it.

Speaker 1: So right around this time, DA in Virginia gives them a warrant to find out where their original phone trace ended. And it turns out that his ping theory is correct, that the hacker had just been sort of passing through breaking into his system in Virginia as another node in this big relay to cover his tracks. Luckily for Cliff, the machine that he had infiltrated in Virginia wasn't owned by a university, it was operated by a company in Virginia called MITRE. He'd broken into MITRE, and then he'd dialed straight back out again. Which is probably where this would have ended if it wasn't for the fact that MITRE, which is in Virginia, is just miles from Langley, headquarters of the CIA, who are a big client of MITRE's. Suddenly, a bunch of clues kind of converge. First, the authorities finally get interested because it's not about 75¢. It's about a guy that they can see is mucking around in their system. Which I wonder why they cared this time, but not the first time, but that's on the CIA to answer. Second clue, Clifford's pager goes off again and the hacker is back active on their system. So he runs up to the lab and he runs this trace. Traces his hacker to Port 14 and he finds

Speaker 8: Cliff, are you sure this is the same guy?

Speaker 4: Yeah. I'm sure it's him.

Speaker 8: Okay. I've got his network address locked on, but he's coming in from somewhere strange.

Speaker 4: Like where?

Speaker 8: He's, coming in from outside TimeNet. He's coming in on a circuit that's owned by International Telephone Telegraph Company.

Speaker 1: The hacker was coming in from abroad. West Germany. And suddenly the username makes sense. Jaeger, the German word for hunter, the delay time, three seconds. It all kinda clicks together for Clifford. Does he Germans? I said Germans. So Cliff calls up the German telecom that the hacker's on, and the company quickly traces the hacker back to Hanover. He's in the hacker's backyard. He's getting really, really close to this guy.

Speaker 3: Great town, Hanover. Yeah. You bet? Yeah.

Speaker 1: A little bit of telephone line trivia for Hanover. Back in the nineteen fifties when Hanover built a lot of their telephone infrastructure, they used, like, old rotary switches, which worked fine. But it did mean that if you wanted to do a then modern trace, you had to test every single one of those switches by hand, which took a lot of time. And time is a really big problem because at this point, finding the guy was like a classic, we gotta keep the bad guy on the line type problem.

Speaker 3: Sure.

Speaker 1: Tracing the call on rotary switches could take up to an hour, but the hacker was only ever passing through Clifford's system on the way to juicier military stuff on the Milnet.

Speaker 4: For weeks, it went on like this. Time after time, the hacker would log on for five minutes or less and then disappear.

Speaker 1: There was never anything there for them on Clifford's network. So what do you think Clifford did to keep the hacker on for long enough to trace him?

Speaker 3: Talk to him. That's what I do.

Speaker 1: Yeah. He kinda did that.

Speaker 3: Kinda did Either that or I'd set up, like, a real juicy file transfer.

Speaker 1: Cliff's at home talking with his then girlfriend Martha and her roommate when they come up with this idea.

Speaker 9: If there isn't anything he's interested on your machine now, I want you to make some up.

Speaker 4: Why don't

Speaker 3: you just make some up? That's right. Honeypot. Honeypot. Classic. They did. I can't believe they actually didn't come up with the idea of a full blown honeypot and just have this guy dial into a isolated computer that that just kinda tracked everything he did, but maybe that's too advanced for 1986.

Speaker 1: Yeah. They didn't invent the idea. Like, that term predates all this

Speaker 5: Yeah. Of course.

Speaker 1: Like a long word from espionage, But they certainly, like, came up with it on their own. Yeah. And so Clifford cooks up some files. Something that this hacker is gonna wanna read. Like secret government information. Oh. And he'd write all of this dense bureaucratic nonsense, but then he would pepper in, like, terms like chemical warfare and Star Wars. Because it's 1986.

Speaker 3: And he takes his files.

Speaker 1: Wookie. And he takes this file and he plants a trap meant to keep the hacker on his servers long enough to be able to do this rotary trace way off in Germany. And it works.

Speaker 3: Oh, hi, Cliff.

Speaker 1: Is our friend on again?

Speaker 4: Yeah. Hacker's on. Start the trace.

Speaker 1: So the hacker bumps into Cliff's honeypot, and he peers in, and he sees all this jargon, and he likes what he sees. So he pulls up a chair, and he starts reading. And Cliff launches the trace. The technician in Germany is checking all these rotary switches. He's testing and testing and testing, and he finds it.

Speaker 3: Could you imagine the infrastructure required

Speaker 1: to do this? Literally, no.

Speaker 3: Like, just picking up a phone and calling Germany's secret service or whoever's taking care of it in Germany, who's then calling the telco, who's then like, just the amount of you'd have a twenty minute delay just in phone calls.

Speaker 1: Truly did he have no other duties at this job? Because it's like a fault anyway.

Speaker 3: The hacker's on again.

Speaker 1: So he does it. Finds the end destination where

Speaker 3: The origin point. Exactly.

Speaker 4: So we did it. Far out. Well, I'm headed home to celebrate celebrate with a strawberry milkshake.

Speaker 5: I think I'll have a beer.

Speaker 3: I think I'll have a beer.

Speaker 1: I think I'm 42. I'm gonna have a beer, Clifford. It had taken Cliff six months to track the hacker to a source, and it would be another six months of, like, legal wrangling between the FBI and the German authorities to to get the name of the guy. Special agent Mike Gibbons explained.

Speaker 10: Well, Cliff had originally traced the hackers into my backyard in Northern Virginia, but I didn't really have a lot to go on. A few weeks later, he called me and told me that the hackers were all the way over across the ocean in Germany and that he really needed some help. We thought it was a pretty serious matter when you have people from another country that are breaking into various government and military computer systems. So we opened full investigation into the matter. We met with the Germans, over here and tried to describe what was going on. We found we had no extradition in place, no way to bring these hackers over to American justice, but the Germans had some new laws in place and were quite willing to prosecute them over there.

Speaker 1: So in January 1990, the case comes to trial. Three years after it started, Clifford finally gets, a look at his hackers in this small town called Selle in Germany, where he's to appear as an expert witness. Hackers, plural. Dirk Brzezinski, Peter Carl, Marcus Hess, and Carl Cook. Brzezinski was a programmer. Carl Koch, also known as Hagbard, died a few months before the trial, Carl, a former croupier who comes up again later, and Marcus Hess, 28 years old, another programmer from Hanover, who was the kind of main actor that Clifford had been following. And it turned out that they were right. During the trial, Cliff found out that Hess smoked Benson the Hedges.

Speaker 5: It would

Speaker 1: turn out that the four men had started out as kind of this freedom of information hacker group that would meet at a bar and then muck around in networks all around the world, And there were just people who wanted to see kind of what was out there and how far into it they could get. And the trouble emerged when Carl, a former croupier, got involved with the group because Carl had contacts in the KGB. And when he told the KGB what kind of info this group of people was finding, the KGB offered to buy it, and suddenly the group was in business hacking for hire. All three defendants were found guilty and charged two years in prison and fined $12,000, which was about a quarter of what they'd made from selling information to the KGB, and they were immediately let on on bail. Agent Gibbons explained. Explained.

Speaker 10: We were surprised with the relative ease that they broke into a lot of these computer systems. It was really not through flaws in the computers, it was because some of the computer systems left their front door wide open. We don't feel this is really a sudden breakdown of security. People have been breaking into institutions for a number of years and hacking as it's called. But, what we're having now is that the computers are used, so much in everyday way of every business and every government agency that now we have a lot of sensitive information on these computers. And now, it's a much more serious matter for someone to break into one of these, institutions and steal the information or alter it.

Speaker 1: With just a telephone line and a home computer, you could break into just about anything. So Clifford finds himself at the end of this mystery in a bar in Hanover, the Kaiser, near where Marcus Hess had lived, sitting opposite a friend of Hess's, a member of their group, a guy named Woker Ulla.

Speaker 5: So we only wanted to hack for freedom of information and and showing holes in computers. Then we all realized that this had had happened happened, that no one could believe, no one of us could believe that this had happened.

Speaker 4: Did you know Marcus Hess at the time? Were

Speaker 1: you Yes.

Speaker 5: I I knew him very well, but but, I no one of us knew that that he they were perhaps selling information. Did he suspect

Speaker 4: that I had followed him?

Speaker 5: Did he know him? No. He didn't suspect. Marcus said, oh, I'm caught. I'm I'm I'm very afraid. There must be a freak on the other side who who who who traced me. I can't believe that. Yeah. Because I have have such a lot have done such a lot of things.

Speaker 4: I'm not a computer freak.

Speaker 5: You just seem to be one.

Speaker 3: So that's a compliment if you didn't know. A little bit. A freak, p h r e a k, was a person that was competent in telephone hacking. So not just hacking computers, but actually, you know, breaking into telephone systems and tracing and getting free connections and things like that. So freaking was a totally separate set of subset of hacking that was just telephone and PBX related.

Speaker 1: It sounds like Volker Ullin knew that and Clifford Stoll didn't.

Speaker 3: It sounds like that. Probably because Clifford Stoll wasn't a part of that world.

Speaker 1: So Volker had been staring down the barrel of this totally different mystery. What had happened to the fourth hacker, Hagbard? When they'd first met, he was this nice affable guy, but almost in tandem with their journey from a group of freedom of information hackers to hackers for hire selling the KGB, he'd kind of devolved as well. Volker told Clifford that Haggard had gotten more depressed, that he was doing more drugs. And while all of that kind of fed into the official story of how he died, suicide, it didn't convince Volker. Hagbar died in 1989 shortly after he'd been charged with espionage.

Speaker 5: He drove away from Hanover to Sellar, a city about 50 kilometers from Hanover, and he had to do a job there in Zelle. And he never came back from this job. And I heard in newspapers a few days later that he was found in a forest near the city, and he was burned. They said that he burned himself.

Speaker 1: A Jaeger is a little bird that feeds by chasing after other birds, until they drop whatever they had already caught. And Marcus Hess used it as a codename because the word meant hunter in Germany. And I think that if Clifford had used it as his username, it would have applied just as well. Clifford still ended up having like a really full career after all this. He wrote Cuckoo's Egg, he's written a bunch of different books, He's a kind of a beloved figure, I think, in the cybersecurity community. He also famously predicted that Internet commerce wasn't gonna ever be a thing.

Speaker 3: Oh, so that's the that's the drop?

Speaker 1: Yeah. That's the drop. He does admit it. He's like, well, I know I'm not that smart because I got that very, very wrong.

Speaker 3: I wonder if Bezos calls him, like, once a year just to be like, hey, man.

Speaker 1: Just, like, text him a winky emoji every single morning he wakes up.

Speaker 3: Yeah. With his current bank balance.

Speaker 1: And thirty years later, a lot has changed. I think I would imagine that rarely does cyber forensics involve stealing 50 printers, but some things haven't. Information is still worth a lot of money to people. Valuable things are often and left unlocked, and a lot of people still use the default password.

Speaker 3: The motivations are the same too. Like, a lot of people get into cybersecurity because it's a puzzle. People that like puzzles tend to like cybersecurity because it's just a big challenging puzzle. You know, a lot of the techniques are the same, routing through the computers, jumping through networks, things like that. Now we use, you know, proxies and dark webs and things like that, but a lot of the same is same is true today.

Speaker 4: So we did it. Far out. Well, I'm headed home to celebrate. Celebrate with a strawberry milkshake.

Speaker 5: I think I'll have a beer.

Speaker 1: If you wanna check out our main source for this episode, you can find it on YouTube. It's the 1990 PBS documentary The KGB, The Computer, and Me. Clifford Stoll is a really likable storyteller and a hell of a sleuth. It is definitely worth a watch. Big shout out to our new patrons on Patreon, Leif Mathis and Jimmy Cochran. Your support means the world to us. You can support the show at patreon.com/hackedpodcast or follow us on Twitter hackedpodcast. Until the next one. Thanks for listening.

Speaker 11: This episode is brought to you by Nespresso. Being the best version of yourself is an everyday journey, and it begins in the morning by taking a moment to ground yourself. With the new Nespresso Vertuo Up coffee machine, morning routines become rituals. Just one gentle press. And coffee brews, unfolding into whatever you need today. Bold or delicate, iced or hot, familiar or new. Press to explore. Every coffee, a new world. New Vertuo Up. Shop now at nespresso.com.

Speaker 12: Some follow the noise. Bloomberg follows the money. Because behind every headline is a bottom line. Whether it's the funds fueling AI or crypto's trillion dollar swings, there's a money side to every story. And when you see the money side, you understand what others miss. Get the money side of the story. Subscribe now at bloomberg.com.