Lamo denies $300,000 database hack

Totting up, Enron style

Days before going public with his penetration of the New York Times internal network last year, hacker Adrian Lamo created five new user accounts with the LexisNexis database service under the Times corporate account, which he used to rack up $300,000 in charges over the following three months, a federal complaint in New York charges.

Lamo said the dollar amount has "no factual basis," and other sources expressed scepticism over the figure Wednesday.

A division of Reed Elsevier, LexisNexus provides subscribers with a wealth of online libraries covering legal decisions, public records, and newspaper and magazine archives.

Lamo allegedly used the service to run searches on his own name, the names of other hackers, and the names of AOL executives. He also checked real-estate records for his family home and his neighbors' properties, and even used the service's extensive news library to monitor press coverage of his Times hack, according to the complaint filed by FBI agent Christine Howard, unsealed following Lamo's surrender Tuesday.

The accounts were closed after LexisNexis officials noticed unusually high activity on them. While the accounts were open, Lamo's queries represented approximately 18% of all searches performed under New York Times accounts, according to the complaint.

Asked if he created and used the LexisNexis accounts, Lamo declined to comment Wednesday, "because it's a pending legal matter."

But he disputed the $300,000 bill.

"I believe this to have no basis in fact," said Lamo. "I don't know what method they used to calculate their damage estimates, but I believe the truth will come out in trial, and these estimates will be found to have no factual basis."

Times spokesperson Christine Mohan couldn't say how the $300,000 figure was reached, except that it was provided by LexisNexis. She added that the Times doesn't disclose the terms of its contracts with vendors. LexisNexis didn't immediately return a phone call on the case.

The LexisNexis website offers instant "pay as you go" services priced between $3.00 and $12.00 per search -- far less than the $100 per search alleged by the complaint. A Times journalist, speaking on condition of anonymity, said that reporters have not been told of any per-search cost on the paper's LexisNexis account, much less a $100 charge. "That sounds ridiculous," the reporter said. "We would be bankrupt."

"Three hundred thousand dollars seems very high, and it seem very unlikely it's what LexisNexis would charge," says Mark Rasch, an attorney and former Justice Department cybercrime prosecutor.

The question is more than academic. The $300,000 figure raises Lamo's maximum sentence under federal guidelines from six months in detention, to more than three years in prison, assuming no criminal history and a guilty plea, according to an analysis by Rasch. "It's the difference between going home at the end of the day, and spending more than three years in jail," says the lawyer.

Hack-and-Tell History

A second charge says that the paper suffered a loss of at least $25,000 spent "confirming, assessing, and repairing the damage" Lamo allegedly caused by cracking and creating accounts on the Times intranet, and adding his own name and phone number to the Times' database of Op-Ed contributors. He listed himself as an expert on "computer hacking, national security, communications intelligence."

The allegations of six-figure financial damages are new for the hacker, who's sometimes praised by his victims.

Lamo has voluntarily helped some targets fix the vulnerabilities he exploited -- sometimes visiting their offices or signing non-disclosure agreements in the process. Some companies have even professed gratitude for his efforts. In December, 2001, Lamo was praised by communications giant WorldCom after he discovered, then helped close, security holes in their intranet that threatened to expose the private networks of Bank of America, CitiCorp, JP Morgan, and others. Earlier this year, Google-owned Blogger.com blogged its thanks for the hacker's ministrations. "Adrian rocks for not only finding the problem but also for letting us know about them so other people won't be affected," a company engineer wrote. According to the New York complaint, FBI agent Howard began investigating the Times hack in February of last year, after reading about it on SecurityFocus, which first reported on the incident.

Lamo said at the time that he penetrated the New York Times after a two-minute scan turned up seven misconfigured proxy servers acting as doorways between the public Internet and the Times private intranet, making the latter accessible to anyone capable of properly configuring their Web browser.

Once inside, Lamo exploited weaknesses in the Times password policies to broaden his access, eventually browsing such disparate information as the names and Social Security numbers of the paper's employees, logs of home delivery customers' stop and start orders, instructions and computer dial-ups for stringers to file stories, lists of contacts used by the Metro and Business desks, and the "WireWatch" keywords particular reporters had selected for monitoring wire services.

He also accessed, and added his name to, a database of 3,000 contributors to the Times op-ed page, containing such information as the social security numbers for former U.N. weapons inspector Richard Butler, Democratic operative James Carville, ex-NSA chief Bobby Inman, Nannygate veteran Zoe Baird, former secretary of state James Baker, Internet policy thinker Larry Lessig, and thespian activist Robert Redford. Entries with home telephone numbers include Lawrence Walsh, William F. Buckley Jr., Jeanne Kirkpatrick, Rush Limbaugh, Vint Cerf, Warren Beatty and former president Jimmy Carter.

In February, 2002, Lamo told the Times of their vulnerability through a SecurityFocus reporter.

The paper said Wednesday that Lamo's hacking is no laughing matter.

"There are two parts to what he did: One is him accessing the internal networks... and then the creating and using of these false passwords," said Mohan. "We take both of them very seriously, and that's why we have been cooperating with the FBI and local authorities since the incident."

After a weekend in hiding, Lamo turned himself in at the federal courthouse in Sacramento, Calif., Tuesday morning. Pursuant to an agreement with prosecutors, he was quickly released on a $250,000 bond secured in part by his parent's house, but was banned from computers, ordered to obtain employment and placed on travel restrictions pending trial.

He's scheduled for arraignment in New York on Thursday.

Copyright © 2003,

Related story

SecurityFocus: Who is Adrian Lamo?

Sponsored: 10 ways wire data helps conquer IT complexity