◆ SpookStack

The Register The Mac Channel Channel Flannel Small Business BOFH Letters Site News Contact us The Reg Newsletter Enter your email address here for our daily news update. Subscribe Privacy Policy Get the Reg Screensaver. Join the Reg SETI group. Join Reg Cancerbusters. e@ e Page 2 of 3 The 22-year-old Lamo has become famous for publicly exposing gaping security holes at large corporations, then voluntarily helping the companies fix the vulnerabilities he exploited -- sometimes visiting their offices or signing non-disclosure agreements in the process. Until now, his cooperation and transparency have kept him from being prosecuted. Lamo's hacked Excite@Home, Yahoo, Blogger, and other companies, usually using nothing more than an ordinary Web browser. Some companies have even professed gratitude for his efforts: in December, 2001, Lamo was praised by communications giant WorldCom after he discovered, then helped close, security holes in their intranet that threatened to expose the private networks of Bank of America, CitiCorp, JP Morgan, and others. Lamo believes the arrest warrant is for his most high-profile hack. Early last year he penetrated the New York Times, after a two- minute scan turned up seven misconfigured proxy servers acting as doorways between the public Internet and the Times private intranet, making the latter accessible to anyone capable of properly configuring their Web browser. Once inside, Lamo exploited weaknesses in the Times password policies to broaden his access, eventually browsing such disparate information as the names and Social Security numbers of the paper's employees, logs of home delivery customers’ stop and start orders, instructions and computer dial-ups for stringers to file stories, lists of contacts used by the Metro and Business desks, and the "WireWatch" keywords particular reporters had selected for monitoring wire services. He also accessed a database of 3,000 contributors to the Times op-ed page, containing such information as the social security numbers for former U.N. weapons inspector Richard Butler, Democratic operative James Carville, ex-NSA chief Bobby Inman, Nannygate veteran Zoe Baird, former secretary of state James Baker, Internet policy thinker Larry Lessig, and thespian activist Robert Redford. Entries with home telephone numbers include Lawrence Walsh, William F. Buckley Jr., Jeanne Kirkpatrick, Rush Limbaugh, Vint Cerf, Warren Beatty and former president Jimmy Carter. n February, 2002, Lamo told the Times of their vulnerability hrough a SecurityFocus reporter. But this time, no one was grateful, and by May federal prosecutors in New York had begun an investigation. http://theregister.co.uk/content/55/32673.html 9/8/2003 FBI(19-cv-1495)-1072