◆ SpookStack

FD-302 (Rev. 10-6.95) FEDERAL BUREAU OF INVESTIGATION Date of transcription Senate Legg advised as to the identi following information: Counsel 642 2 Senate, att t Building, Washington, DC pe men " In early Novembér 2002, the Intrusion Detection System ( the website www.se their network. The sfetwork team implemented safeguards against tl 06/27/2003 ‘daria’ 7C fer being S) logs of the network supporting e.gov showed evidence that an individual had gained access to a proxy server on he irregular traffic. They contacted the vendor of the proxy server and through cooperation with the vendor, within three (3) weeks they were able to configure the proxy server correctly. The network team monitored the network to observe if there was any irregular activity. They a proxy server sending outbound HTTP trafic from www.senate.gov. Thenetwork team isolated noticed this outbound traffic to a particular proxy server on their network, The The packets showed outbound URL requests. activity from the proxy server. © DS captured the packets of The proxy server transmitting the URL requests was outside their DMZ. The URL jespsacouah ihe proxy server were coming from more than one (1) source Internet Protocol (IP) address. TP addresses but does not remember the results of the search. on the team also preserved the IDS logs pertaining to the incident. networ! programs on their network. this incident. in the $ pertaining to this vulnerability. Spear’, Wan war ea eon The network team created a database to track the events/reports 0: stated that nothing in their was changed as a result of the vulnerability and to date has not discovered any backdoor ‘tated that their was no financial loss to t stated that she would provide the interviewing agent with the did a whois lookup b6 - b7C the incident. The network ¢ Senate pertaining to P addresses contained -2 -1 yeb3 soe ne Investigation on «{ This do CulAe ia ne 06/26/2003 “at Washington, DC bic -] Date dictated bIE -3 06/27/2003 nt contains neither recommendations nor conclusions of the FBI. lis is pats are not to bé disiribuied outside your 8chey. wy property of the FBI and js Toaned to your agency, FBI(19-cv-1495)-102 2 -2