Lamo denies $300,000 database hack

Totting up, Enron style

Days before going public with his penetration of the New York Times internal network last year, hacker Adrian Lamo created five new user accounts with the LexisNexis database service under the Times corporate account, which he used to rack up $300,000 in charges over the following three months, a federal complaint in New York charges.

Lamo said the dollar amount has "no factual basis," and other sources expressed scepticism over the figure Wednesday.

A division of Reed Elsevier, LexisNexus provides subscribers with a wealth of online libraries covering legal decisions, public records, and newspaper and magazine archives.

Lamo allegedly used the service to run searches on his own name, the names of other hackers, and the names of AOL executives. He also checked real-estate records for his family home and his neighbors' properties, and even used the service's extensive news library to monitor press coverage of his Times hack, according to the complaint filed by FBI agent Christine Howard, unsealed following Lamo's surrender Tuesday.

The accounts were closed after LexisNexis officials noticed unusually high activity on them. While the accounts were open, Lamo's queries represented approximately 18% of all searches performed under New York Times accounts, according to the complaint.

Asked if he created and used the LexisNexis accounts, Lamo declined to comment Wednesday, "because it's a pending legal matter."

But he disputed the $300,000 bill.

"I believe this to have no basis in fact," said Lamo. "I don't know what method they used to calculate their damage estimates, but I believe the truth will come out in trial, and these estimates will be found to have no factual basis."

Times spokesperson Christine Mohan couldn't say how the $300,000 figure was reached, except that it was provided by LexisNexis. She added that the Times doesn't disclose the terms of its contracts with vendors. LexisNexis didn't immediately return a phone call on the case.

The LexisNexis website offers instant "pay as you go" services priced between $3.00 and $12.00 per search -- far less than the $100 per search alleged by the complaint. A Times journalist, speaking on condition of anonymity, said that reporters have not been told of any per-search cost on the paper's LexisNexis account, much less a $100 charge. "That sounds ridiculous," the reporter said. "We would be bankrupt."

"Three hundred thousand dollars seems very high, and it seem very unlikely it's what LexisNexis would charge," says Mark Rasch, an attorney and former Justice Department cybercrime prosecutor.

The question is more than academic. The $300,000 figure raises Lamo's maximum sentence under federal guidelines from six months in detention, to more than three years in prison, assuming no criminal history and a guilty plea, according to an analysis by Rasch. "It's the difference between going home at the end of the day, and spending more than three years in jail," says the lawyer.

Hack-and-Tell History

A second charge says that the paper suffered a loss of at least $25,000 spent "confirming, assessing, and repairing the damage" Lamo allegedly caused by cracking and creating accounts on the Times intranet, and adding his own name and phone number to the Times' database of Op-Ed contributors. He listed himself as an expert on "computer hacking, national security, communications intelligence."

The allegations of six-figure financial damages are new for the hacker, who's sometimes praised by his victims.

Lamo has voluntarily helped some targets fix the vulnerabilities he exploited -- sometimes visiting their offices or signing non-disclosure agreements in the process. Some companies have even professed gratitude for his efforts. In December, 2001, Lamo was praised by communications giant WorldCom after he discovered, then helped close, security holes in their intranet that threatened to expose the private networks of Bank of America, CitiCorp, JP Morgan, and others. Earlier this year, Google-owned blogged its thanks for the hacker's ministrations. "Adrian rocks for not only finding the problem but also for letting us know about them so other people won't be affected," a company engineer wrote. According to the New York complaint, FBI agent Howard began investigating the Times hack in February of last year, after reading about it on SecurityFocus, which first reported on the incident.

Lamo said at the time that he penetrated the New York Times after a two-minute scan turned up seven misconfigured proxy servers acting as doorways between the public Internet and the Times private intranet, making the latter accessible to anyone capable of properly configuring their Web browser.

Once inside, Lamo exploited weaknesses in the Times password policies to broaden his access, eventually browsing such disparate information as the names and Social Security numbers of the paper's employees, logs of home delivery customers' stop and start orders, instructions and computer dial-ups for stringers to file stories, lists of contacts used by the Metro and Business desks, and the "WireWatch" keywords particular reporters had selected for monitoring wire services.

He also accessed, and added his name to, a database of 3,000 contributors to the Times op-ed page, containing such information as the social security numbers for former U.N. weapons inspector Richard Butler, Democratic operative James Carville, ex-NSA chief Bobby Inman, Nannygate veteran Zoe Baird, former secretary of state James Baker, Internet policy thinker Larry Lessig, and thespian activist Robert Redford. Entries with home telephone numbers include Lawrence Walsh, William F. Buckley Jr., Jeanne Kirkpatrick, Rush Limbaugh, Vint Cerf, Warren Beatty and former president Jimmy Carter.

In February, 2002, Lamo told the Times of their vulnerability through a SecurityFocus reporter.

The paper said Wednesday that Lamo's hacking is no laughing matter.

"There are two parts to what he did: One is him accessing the internal networks... and then the creating and using of these false passwords," said Mohan. "We take both of them very seriously, and that's why we have been cooperating with the FBI and local authorities since the incident."

After a weekend in hiding, Lamo turned himself in at the federal courthouse in Sacramento, Calif., Tuesday morning. Pursuant to an agreement with prosecutors, he was quickly released on a $250,000 bond secured in part by his parent's house, but was banned from computers, ordered to obtain employment and placed on travel restrictions pending trial.

He's scheduled for arraignment in New York on Thursday.

Copyright © 2003,

Related story

SecurityFocus: Who is Adrian Lamo?

Other stories you might like

  • Failed gambler? How about an algorithm that predicts the future
    Hopefully an end to '... and you'll never guess what happened next!'

    Something for the Weekend Another coffee, please. Yes, I know we're about to start. There is always time for one more coffee. It's good for your brain. Thanks.

    Could you hold my cup for a moment? I need to visit the restroom. Yes, I know we're about to start; you told me that already. There is always time for coffee AND a comfort break. Yes, I know the two are related but I don't have time to chat about it. I'm bursting here.

    How about I drink the coffee straight away, nip to the WC, and return pronto? Slurp argh that's hot. Thanks, I'll be right back.

    Continue reading
  • Seriously, you do not want to make that cable your earth
    Network? What's that when it's at home?

    On Call This week we bring you a shocking incident for a Register reader who was party to an electrical engineer's earthly delights.

    "Andrew" takes us back to the 1980s, the days of DECNet, DEC Rainbow PCs, and the inevitable VAX or two.

    Back then, DECnet was a big noise in networking. Originally conceived in the 1970s to connect PDP-11 minis, it had evolved over the years and was having its time in the sun before alternative networking technologies took over.

    Continue reading
  • Protecting data now as the quantum era approaches
    Startup QuSecure is the latest vendor to jump into the field with its as-a-service offering

    Analysis Startup QuSecure will this week introduce a service aimed at addressing how to safeguard cybersecurity once quantum computing renders current public key encryption technologies vulnerable.

    It's unclear when quantum computers will easily crack classical crypto – estimates range from three to five years to never – but conventional wisdom is that now's the time to start preparing to ensure data remains encrypted.

    A growing list of established vendors like IBM and Google and smaller startups – Quantum Xchange and Quantinuum, among others – have worked on this for several years. QuSecure, which is launching this week after three years in stealth mode, will offer a fully managed service approach with QuProtect, which is designed to not only secure data now against conventional threats but also against future attacks from nation-states and bad actors leveraging quantum systems.

    Continue reading

Biting the hand that feeds IT © 1998–2022