[ISN] Adrian Lamo charged with computer crimes

From: InfoSec News (isnat_private)
Date: Sun Sep 07 2003 - 22:22:39 PDT

  • Next message: InfoSec News: "[ISN] Majordomo Could Mean Major Spam"

    Forwarded from: Marjorie Simmons <lawyerat_private>
    
    http://www.securityfocus.com/news/6888
    
    By Kevin Poulsen
    SecurityFocus 
    Sept 5, 2003 
    
    FBI agents armed with a federal arrest warrant out of New York were
    searching for Adrian Lamo Thursday, SecurityFocus has confirmed.
    
    Lamo has been charged in New York under Title 18 U.S.C. 1030 and 1029,
    according to deputy federal public defender Mary French, who says
    she's spoken with one of the FBI agents that were searching for Lamo.
    The federal laws prohibit unauthorized access to a protected computer,
    and illegal possession of stolen "access devices" -- a term that
    encompasses passwords, credit card numbers, and the like. French did
    not know what the specific allegations were, because the charging
    document is sealed.
    
    Two agents visited the home of Lamo's parents, Mario and Mary Lamo,
    near Sacramento, California, Thursday afternoon, Mary Lamo said
    Thursday. "They wouldn't tell us anything but that they had an arrest
    warrant and they wanted to come in," she adds.
    
    When she demurred, the agents vowed to return with a search warrant,
    then began overtly watching the house from parked cars, she said.
    "They followed me when I went out, so they're not hiding it."
    
    Friday morning, a spokesperson for the U.S. Attorney's office in New
    York confirmed that the office had an open case file on Lamo, but
    otherwise declined to comment.
    
    Lamo frequently stays at his parents' home, but he was not there at
    the time of the FBI's visit, and has not returned since. His mother
    contacted the Federal Public Defender's office in Sacramento, which
    has agreed to handle his surrender. 'I have always said that actions
    have consequences, and this is something that I was always aware might
    happen.' -- Adrian Lamo "If he's arrested or turns himself in in this
    district, we will represent him for the initial proceedings," French
    said Friday morning. "I haven't had any direct contact with him yet."
    
    In a telephone interview Thursday, Lamo said he was in California, but
    did not plan to turn himself in until after conferring with the
    attorney. The hacker was quick-witted and seemingly in good humor,
    with only a trace of nervousness in his voice. He quipped about the
    proper etiquette of being arrested by the FBI, and suggested jokingly
    that SecurityFocus should purchase the publication rights to a
    favorite photo. He said he was in the company of a camera crew
    producing a television documentary on hackers.
    
    "I have always said that actions have consequences, and this is
    something that I was always aware might happen," said Lamo. "I don't
    intend to deny anything that I have done, but I do intend to defend
    myself vigorously."
    
    The 22-year-old Lamo has become famous for publicly exposing gaping
    security holes at large corporations, then voluntarily helping the
    companies fix the vulnerabilities he exploited -- sometimes visiting
    their offices or signing non-disclosure agreements in the process.
    
    Until now, his cooperation and transparency have kept him from being
    prosecuted. Lamo's hacked Excite@Home, Yahoo, Blogger, and other
    companies, usually using nothing more than an ordinary Web browser.
    Some companies have even professed gratitude for his efforts: In
    December, 2001, Lamo was praised by communications giant WorldCom
    after he discovered, then helped close, security holes in their
    intranet that threatened to expose the private networks of Bank of
    America, CitiCorp, JP Morgan, and others.
    
    Lamo believes the arrest warrant is for his most high-profile hack.
    Early last year he penetrated the New York Times, after a two-minute
    scan turned up seven misconfigured proxy servers acting as doorways
    between the public Internet and the Times private intranet, making the
    latter accessible to anyone capable of properly configuring their Web
    browser.
    
    Once inside, Lamo exploited weaknesses in the Times password policies
    to broaden his access, eventually browsing such disparate information
    as the names and Social Security numbers of the paper's employees,
    logs of home delivery customers' stop and start orders, instructions
    and computer dial-ups for stringers to file stories, lists of contacts
    used by the Metro and Business desks, and the "WireWatch" keywords
    particular reporters had selected for monitoring wire services.
    
    He also accessed a database of 3,000 contributors to the Times op-ed
    page, containing such information as the social security numbers for
    former U.N.  weapons inspector Richard Butler, Democratic operative
    James Carville, ex-NSA chief Bobby Inman, Nannygate veteran Zoe Baird,
    former secretary of state James Baker, Internet policy thinker Larry
    Lessig, and thespian activist Robert Redford. Entries with home
    telephone numbers include Lawrence Walsh, William F. Buckley Jr.,
    Jeanne Kirkpatrick, Rush Limbaugh, Vint Cerf, Warren Beatty and former
    president Jimmy Carter.
    
    In February, 2002, Lamo told the Times of their vulnerability through
    a SecurityFocus reporter. But this time, no one was grateful, and by
    May federal prosecutors in New York had begun an investigation.
    
    "I think this is unsporting of the New York Times," Lamo said
    Thursday.
    
    Lamo's mother said she has no opinion on her son's exploits. She's
    just worried about him.
    
    "I don't really know much of anything about computers," says Mary
    Lamo.  "He's my son. Right now, all I can worry about is how I can
    help him."
    
    "I hope there will be a time when Adrian can do positive things that
    everyone agrees are positive," she adds.
    
    
    
    -
    ISN is currently hosted by Attrition.org
    
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.
    



    This archive was generated by hypermail 2b30 : Mon Sep 08 2003 - 01:06:04 PDT