◆ SpookStack

The researcher said he was able to access the Times’ networks simply through a Web browser by locating vulnerable New York Times “proxy” servers. Proxy servers are generally considered a tool of safety, acting as a bridge between a company’s internal network and the outside world. But if they are misconfigured, they act instead as the perfect place to launch an attack. Once Lamo accessed a Times proxy server, he was able to hunt and peck through private information belonging to Times’ employees and customers. “This surely wasn’t anything the people involved had counted on when they'd been filling out that tell-us-about-yourself account form,” he said. Lamo, a 21-year-old nomad who is among the few computer researchers that use their real name when informing a company about a security problem, said he generally does his work to improve the state of computer security at large companies. His unconventional tactics are frequently criticized, he says. “t recognize that some people will see my actions as illegal, immoral, or worse. It's not for me to contest them or try to win them over to the Adrian Lamo School of Security,” he said. “ve done my best to act in good faith and avoid harm to the company and employees involved.” FBI(19-cv-1495)-163