Final Victim

USER PID%CPU %MEM… TT STAT START TIME

snoopy 14232 70.6.06… r6 R17:12 0:00

/usr/ucb/telnet rIng2Ice. Anon. Pennet. No

He then fingered that account, all the while keeping up his communication with Satan, talking about things of no importance. Satan was becoming frustrated and began demanding more bloody information about his Atlanta kill. In minutes, The Rat's finger command revealed the host computer:

Login name: snoopyIn real life: RedBaron

Directory: /redbar3/snoopyShell: /binicsh

On since April 14 17:09:23 on ttyr6

from uscs6. Fedworld. Ustreas. Custms. Gov

His brilliant, twisted mind was now spinning with thoughts of survival. U. S. Customs? His fat, gluttonous body glistened with sweat. The Rat knew he couldn't safely finger a U. S. Treasury host directly and let some backfinger they had set up get a log entry on him. He'd have to go in some other way, get in and out like lightning, disconnecting from the Treasury host before someone started fingering him. His mind was racing. He knew now that he'd been followed into his invisible chat channel after the stack error. The Rat knew the sendmail program on any system always had to have high-level access rights since it had to be able to write and receive e-mail. Sendmail was notorious across the Net for security holes. CERT, the Computer Emergency Response Team, was constantly posting security hole bulletins.

As he set up a packet-sniffer on the incoming mail port, The Rat typed a message of praise to Satan. Messages telling Satan of his glory always mollified him:

"You are more beautiful than death. You are the god of fuck and mutilation," he wrote.

Then he wrote a program which would spoof sendmail at the Treasury host into executing a set of commands. He would have sendmail "grab" out all listings of telnet sessions to redbar3. Cc. Rutledge. Edu. He would be waiting…

The instant it rolled off the top of his window, he hit ‹Ctrl›-‹C› and killed off his connection to rutledge.

He looked through the scrollback buffer and saw:

Login name: redwitchIn real life: Karen Dawson

Directory: /staff10/redwitchShell: /bin/csh

On since April 14 17:02:51 on ttyr6 from USCS-stc5. Gov

It looked like this Karen Dawson person was logged via a modern from a Pacific Telephone POP (Point-of-Presence) in Studio City, California. Now, if only Karen Dawson would just stay logged on. He set his packet-sniffer on each phone connection to the POP, then set up a second window, which was the exact duplicate of the session he was having with Satan in his first window. That was the connection he would use to trace Karen Dawson.

He popped another disk into his PC from his kit. This one generated DTMF tones, "Touch-Tones" of a sort. In particular they generated an inquiry sequence similar to Caller ID. This had been designed by the phone company to allow customers to trigger an identification of any number on their system that was currently in use. It was a tracking device.

The Rat had his program send the tones. They left his computer in Florida and went through an intermediate host into the Electroinc Switching System at UCLA and over to the 5-ESS switch in Studio City, California. Then the signal was traced back through The Rat's telnet connections and printed: