Lamo denies $300,000 database hack

Totting up, Enron style

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

Days before going public with his penetration of the New York Times internal network last year, hacker Adrian Lamo created five new user accounts with the LexisNexis database service under the Times corporate account, which he used to rack up $300,000 in charges over the following three months, a federal complaint in New York charges.

Lamo said the dollar amount has "no factual basis," and other sources expressed scepticism over the figure Wednesday.

A division of Reed Elsevier, LexisNexus provides subscribers with a wealth of online libraries covering legal decisions, public records, and newspaper and magazine archives.

Lamo allegedly used the service to run searches on his own name, the names of other hackers, and the names of AOL executives. He also checked real-estate records for his family home and his neighbors' properties, and even used the service's extensive news library to monitor press coverage of his Times hack, according to the complaint filed by FBI agent Christine Howard, unsealed following Lamo's surrender Tuesday.

The accounts were closed after LexisNexis officials noticed unusually high activity on them. While the accounts were open, Lamo's queries represented approximately 18% of all searches performed under New York Times accounts, according to the complaint.

Asked if he created and used the LexisNexis accounts, Lamo declined to comment Wednesday, "because it's a pending legal matter."

But he disputed the $300,000 bill.

"I believe this to have no basis in fact," said Lamo. "I don't know what method they used to calculate their damage estimates, but I believe the truth will come out in trial, and these estimates will be found to have no factual basis."

Times spokesperson Christine Mohan couldn't say how the $300,000 figure was reached, except that it was provided by LexisNexis. She added that the Times doesn't disclose the terms of its contracts with vendors. LexisNexis didn't immediately return a phone call on the case.

The LexisNexis website offers instant "pay as you go" services priced between $3.00 and $12.00 per search -- far less than the $100 per search alleged by the complaint. A Times journalist, speaking on condition of anonymity, said that reporters have not been told of any per-search cost on the paper's LexisNexis account, much less a $100 charge. "That sounds ridiculous," the reporter said. "We would be bankrupt."

"Three hundred thousand dollars seems very high, and it seem very unlikely it's what LexisNexis would charge," says Mark Rasch, an attorney and former Justice Department cybercrime prosecutor.

The question is more than academic. The $300,000 figure raises Lamo's maximum sentence under federal guidelines from six months in detention, to more than three years in prison, assuming no criminal history and a guilty plea, according to an analysis by Rasch. "It's the difference between going home at the end of the day, and spending more than three years in jail," says the lawyer.

Hack-and-Tell History

A second charge says that the paper suffered a loss of at least $25,000 spent "confirming, assessing, and repairing the damage" Lamo allegedly caused by cracking and creating accounts on the Times intranet, and adding his own name and phone number to the Times' database of Op-Ed contributors. He listed himself as an expert on "computer hacking, national security, communications intelligence."

The allegations of six-figure financial damages are new for the hacker, who's sometimes praised by his victims.

Lamo has voluntarily helped some targets fix the vulnerabilities he exploited -- sometimes visiting their offices or signing non-disclosure agreements in the process. Some companies have even professed gratitude for his efforts. In December, 2001, Lamo was praised by communications giant WorldCom after he discovered, then helped close, security holes in their intranet that threatened to expose the private networks of Bank of America, CitiCorp, JP Morgan, and others. Earlier this year, Google-owned Blogger.com blogged its thanks for the hacker's ministrations. "Adrian rocks for not only finding the problem but also for letting us know about them so other people won't be affected," a company engineer wrote. According to the New York complaint, FBI agent Howard began investigating the Times hack in February of last year, after reading about it on SecurityFocus, which first reported on the incident.

Lamo said at the time that he penetrated the New York Times after a two-minute scan turned up seven misconfigured proxy servers acting as doorways between the public Internet and the Times private intranet, making the latter accessible to anyone capable of properly configuring their Web browser.

Once inside, Lamo exploited weaknesses in the Times password policies to broaden his access, eventually browsing such disparate information as the names and Social Security numbers of the paper's employees, logs of home delivery customers' stop and start orders, instructions and computer dial-ups for stringers to file stories, lists of contacts used by the Metro and Business desks, and the "WireWatch" keywords particular reporters had selected for monitoring wire services.

He also accessed, and added his name to, a database of 3,000 contributors to the Times op-ed page, containing such information as the social security numbers for former U.N. weapons inspector Richard Butler, Democratic operative James Carville, ex-NSA chief Bobby Inman, Nannygate veteran Zoe Baird, former secretary of state James Baker, Internet policy thinker Larry Lessig, and thespian activist Robert Redford. Entries with home telephone numbers include Lawrence Walsh, William F. Buckley Jr., Jeanne Kirkpatrick, Rush Limbaugh, Vint Cerf, Warren Beatty and former president Jimmy Carter.

In February, 2002, Lamo told the Times of their vulnerability through a SecurityFocus reporter.

The paper said Wednesday that Lamo's hacking is no laughing matter.

"There are two parts to what he did: One is him accessing the internal networks... and then the creating and using of these false passwords," said Mohan. "We take both of them very seriously, and that's why we have been cooperating with the FBI and local authorities since the incident."

After a weekend in hiding, Lamo turned himself in at the federal courthouse in Sacramento, Calif., Tuesday morning. Pursuant to an agreement with prosecutors, he was quickly released on a $250,000 bond secured in part by his parent's house, but was banned from computers, ordered to obtain employment and placed on travel restrictions pending trial.

He's scheduled for arraignment in New York on Thursday.

Copyright © 2003,

Related story

SecurityFocus: Who is Adrian Lamo?

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story


Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.