◆ SpookStack

(Rev. 08-28-2000) + Precedence: ROUTINE Date: 08/16/2002 To: New York Attn: C-37 From: New York Squad C-37 b3 -2 BIE -3 en Title: ADRIAN LAMO; 7 New York Times-Victim; Computer Intrusion; OO: NY Synopsis: investigative research assistance with analysis of, RIAN LAM@: coment ee Enclosure(s): One (1) copy"Of of ADRIAN b3 -4 LAMO for the dates of 6/1/01-5 Details: In February 2002, LAMO discovered several misconfigured proxy servers acting as doorways between the public Internet and the New York Times’ private intranet. LAMO utilized the proxy servers to gain access to the New York Times network. Once on the network, LAMO cracked a password for a userid with supervisor rights. Utilizing this userid he was able to broaden his access as well as perform certain functions within the network. LAMO had access to individuals names and Social Security Numbers. LAMO informed The New York Times of the security vulnerability through SECURITYFOCUS.COM. LAMO has committed computer intrusions into several other corporations such as WORLDCOM, MICROSOFT, AOL, EXCITE@HOME and YAHOO. LAMO uses'a “Proxy Hunter’ to search the Internet for proxy servers that are misconfigured. Once he obtains this information, he configures his browser to appear and utilize the proxy server as his own. Once the computer intrusion occurs, LAMO searches the network to determine if there are any other vulnerabilities and in the case of The New York Times, left a backdoor so that he could enter at another time undetected. Each time LAMO commits a computer intrusion on a high profile organization he reports the vunerability and intrusion to FBI(19-cv-1495)-164)