Ghost in the Wires_ My Adventures as the World's Most Wanted Hacker - Kevin Mitnick [121]
That night, I periodically logged in to see if Joe was online and active. Even if he noticed that there had been an incoming call on his modem, it might not arouse his suspicion (I hoped) because he would remember giving Lewis access. Sometime after midnight, Joe’s computer went quiet; I figured he had nodded off for the night. Using the “Point-to-Point” protocol, I logged into Sun’s “mercury” host posing as Joe’s workstation, named “oilean.” Voilà! My computer was now an official host on Sun’s worldwide network!
Within a couple of minutes, with the help of rdist, I had managed to get root, since Sun, like Joe, had been lax about updating the security patches. I set up a “shell” account and installed a simple backdoor giving me future root access.
From there, I targeted the Engineering Group. This was totally familiar stuff, but at the same time totally exhilarating. I was able to log in to most of the Sun machines in Engineering, thanks to Joe’s efforts in cracking that group’s passwords.
So Joe had, without even knowing it, set me up to grab yet another treasure: the latest and greatest version of the SunOS, a flavor of the Unix operating system developed by Sun Microsystems for its server and workstation systems. It wasn’t hard to find the master machine storing the SunOS source code. Even when compressed, though, this was one humongous package of data—not as massive as DEC’s VMS operating system, but still massive enough to be daunting.
And then I had an idea that might make the transfer easier. Targeting the Sun office in El Segundo, just south of the Los Angeles International Airport, I began by doing queries on several workstations to learn what devices were attached to them. I was looking for a user who had a tape drive connected to his computer. When I found one, I called him on the phone and said I was with the Sun Engineering Group in Mountain View. “I understand you have a tape drive connected to your workstation,” I said. “One of my engineers is at a client site in LA, and I need to transfer some files to him, but they’re pretty large to transfer over a modem. Do you have a blank tape you could stick in your drive, so I could write the data to that instead?”
He left me hanging on the phone while he hunted down a blank tape. After a few minutes, he came back on the line and told me he was shoving it in the drive. I had encrypted the compressed source code into an unintelligible blob of data, just in case he got curious and took a look. I transferred a copy to his workstation, then gave a second command to write it to the tape.
When the transfer to tape was finally complete, I called him back. I asked him if he wanted me to send him a replacement tape, but as I expected, he said it was okay, I didn’t need to do that. I said, “Can you put it in an envelope for me, and mark it with the name ‘Tom Warren’? Are you going to be in the office for the next couple of days?”
He started telling me about when he would and wouldn’t be available. I interrupted him: “Hey, there’s an easier way. Can you just leave it with the receptionist, and I’ll tell Tom to ask her for it?” Sure, he’d be glad to do that.
I called my buddy Alex and asked him if he’d swing by the Sun office and pick up an envelope the receptionist was holding for “Tom Warren.” He was a little reluctant, knowing there was always a risk. But he overcame that a moment later and agreed with what sounded like a smile on his face—I suppose as he remembered the kick he always got from participating in my hacking adventures.
I felt triumphant. But here’s the odd part: when I got the tape, I didn’t even spend much time looking at the code. I had succeeded in my challenge, but the code itself was of less interest to me than the achievement.
I continued acquiring passwords and software treasures from Sun, but constantly having to dial up to the modems in Mountain View was chancy. I wanted another access point into Sun’s network.
Time for a social-engineering attack. Using my cloned cell phone, I programmed in a number with the 408 area code for