◆ SpookStack

FD-302 (Rev. 10-6.95) FEDERAL BUREAU OF INVESTIGATION Date of transcription 06/27/2003 Senate Legal Counsel, 642 Senate Hart Building, Washington, DC 20510, of employment. Also present during the andl] Aer being advised as to the identity of the interviewing agent and the purpose of the interview, they provided the 7 following information: bo -2, -5 bIC -2, -5 In early November 2002, the Intrusion Detection System (IDS) logs of the network supporting the website wwnw.senate. gov showed evidence that an individual had gained access to a proxy server on their network. The network team implemented safeguards against the irregular traffic. They contacted the vendor of the proxy server and through cooperation with the vendor; within three (3) weeks they were able to configure the proxy server correctly. The network team monitored the network to observe if there was any irregular activity. They noticed a proxy server sending outbound HTTP traffic from www.senate.gov. The network team isolated this outbound traffic to a particular proxy server on their network. The IDS captured the packets of activity from the proxy server. The packets showed outbound URL requests. The proxy server transmitting the URL requests was outside their DMZ. The URL requests fizough the proxy server were coming from more than one (1) source Internet Protocol (IP) address. did a whois lockup on the IP addresses but does not remember the results of the search. pe -2 > Cc = The network team created a database to track the events/reports of the incident. The network team also preserved the IDS logs pertaining to the incident. Do Istated that nothing in their network was changed as a result of the vulnerability and to date has not discovered any backdoor programs on their network, stated that their was no financial loss to the Senate pertaining to this incident. stated that she would provide the interviewing agent with the IP addresses contained in the IDS pertaining to this vulnerability. Investigation on 06/26/2003 a Washington, DC b3 -2 a pve anne 6/27/2003 PO! This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency. FBI(19-cv- 1495)- 103