◆ SpookStack

Securityf ocus HUME News: “ey Adventures i WorldCom Page 3 Of > IMORE FROM SECURITY FOCUS...| RELATED STORIES He has some access to customer records, too, primarily Hackers Harvest subscribers to WoridCom's data services. He can browse Passwords from DSL. Routers notes and circuit diagrams for AOL's new Ti cross border link lews Hacked between its Virginia offices and AOL Mexico, and a detailed Proxy Exposes engineering order for a connection between the World Bank's xcite@Home Data Washington headquarters and its Buenos Aires resident « Hackers Steal AIM mission Accounts : More significantly, he can control a Web appiication called the Web Access Router Maintenance tool (WARM). The tool is a legacy from one of WorldCom's acquisitions, ANS Communications, purchased from AOL in 1997 for $175 million. WARM gives its users access to all of the routers on the private wide area networks provisioned by ANS. The list of customers is long, and includes Bank of America, JP Morgan, Citicorp, Sun Microsystems, and AOL itself. With a tittle manipulation, Lamo was able to pull down dial-up phone numbers and passwords for many of the routers, which would give him direct access to the networks. WARM is accessible to anyone on WorldCom's intranet, Lamo says, protected only by a Javascript password routine that's plainly readable in the source code for the page, which is to say, not protected at all. “For everyone at WordCom, the intranet is this boring thing that comes up in their web browser," says Lamo. “For me, it's a massive playground that's slowly and inexorably crumbling away at their security infrastructure." No Forwarding Address | A worker glances at Lamo from behind the counter, then turns his attention back to a print job. ! "The nights I'm alone in the city and I have nowhere to crash, I spend ail night in the Kinko's,” Lamo says. “They never kick you out.” One could call the copy shop chain Lamo’s home-away-from-home, except that he has no home to be away from. The hacker leads a deliberately nomadic existence, traveling the country by Greyhound, crashing with friends, sometimes steeping in abandoned buildings, always tugging the backpack that contains such necessities as a first aid kit, a thermal blanket, a change of clothes, the laptop with two missing keys. When he was 17, Lame's parents moved from San Francisco to the quieter environs of Sacramento, 80 miles to the east. Addicted to city tife, Lamo chose to stay behind. He'd already tested out of high school and was performing computer work for non-profit groups, sometimes sleeping in their offices at night. Later, he did three months of network security consulting for Levi Strauss -- the only paid security work on his résumé -- and six months with a San Adnan Lame does most af his hac: Francisco private investigator that he doesn't like to talk about. vath an ordinary Web browser, Today, Lama lives off a modest savings, and spends most of his time in San Francisco and the suburbs of Washington D.C. -- both regions where he lived growing up, during a childhood that also included three years in Colombia. He sometimes stays with his parents in Sacramento, but wherever he goes, he becomes restless in he lingers in one place for too tong. "I much prefer being mobile,” he says. Nonetheless, Lamo doesn't know how to drive a car, relying instead on public transportation. For tong distances, he prefers the bus over airliners or rai! because he likes the atmosphere. "On Greyhound, you know you're America... Also, it's the last made of transit http://www. security focus.com/news/296 7/7/2003 FBI(19-cv-1495)-1047