UGN Security
Posted By: Ice Adrian Lamo charged with computer crimes - 09/06/03 07:07 PM
FBI agents armed with a federal arrest warrant out of New York were searching for Adrian Lamo Thursday, SecurityFocus has confirmed.

Lamo has been charged in New York under Title 18 U.S.C. 1030 and 1029, according to deputy federal public defender Mary French, who says she's spoken with one of the FBI agents that were searching for Lamo. The federal laws prohibit unauthorized access to a protected computer, and illegal possession of stolen "access devices" -- a term that encompasses passwords, credit card numbers, and the like. French did not know what the specific allegations were, because the charging document is sealed.

Two agents visited the home of Lamo's parents, Mario and Mary Lamo, near Sacramento, California, Thursday afternoon, Mary Lamo said Thursday. "They wouldn't tell us anything but that they had an arrest warrant and they wanted to come in," she adds.

When she demurred, the agents vowed to return with a search warrant, then began overtly watching the house from parked cars, she said. "They followed me when I went out, so they're not hiding it."

Friday morning, a spokesperson for the U.S. Attorney's office in New York confirmed that the office had an open case file on Lamo, but otherwise declined to comment.

Lamo frequently stays at his parents' home, but he was not there at the time of the FBI's visit, and has not returned since. His mother contacted the Federal Public Defender's office in Sacramento, which has agreed to handle his surrender.

"If he's arrested or turns himself in in this district, we will represent him for the initial proceedings," French said Friday morning. "I haven't had any direct contact with him yet."

In a telephone interview Thursday, Lamo said he was in California, but did not plan to turn himself in until after conferring with the attorney. The hacker was quick-witted and seemingly in good humor, with only a trace of nervousness in his voice. He quipped about the proper etiquette of being arrested by the FBI, and suggested jokingly that SecurityFocus should purchase the publication rights to a favorite photo. He said he was in the company of a camera crew producing a television documentary on hackers.

"I have always said that actions have consequences, and this is something that I was always aware might happen," said Lamo. "I don't intend to deny anything that I have done, but I do intend to defend myself vigorously."

The 22-year-old Lamo has become famous for publicly exposing gaping security holes at large corporations, then voluntarily helping the companies fix the vulnerabilities he exploited -- sometimes visiting their offices or signing non-disclosure agreements in the process.

Until now, his cooperation and transparency have kept him from being prosecuted. Lamo's hacked Excite@Home, Yahoo, Blogger, and other companies, usually using nothing more than an ordinary Web browser. Some companies have even professed gratitude for his efforts: In December, 2001, Lamo was praised by communications giant WorldCom after he discovered, then helped close, security holes in their intranet that threatened to expose the private networks of Bank of America, CitiCorp, JP Morgan, and others.

Lamo believes the arrest warrant is for his most high-profile hack. Early last year he penetrated the New York Times, after a two-minute scan turned up seven misconfigured proxy servers acting as doorways between the public Internet and the Times private intranet, making the latter accessible to anyone capable of properly configuring their Web browser.

Once inside, Lamo exploited weaknesses in the Times password policies to broaden his access, eventually browsing such disparate information as the names and Social Security numbers of the paper's employees, logs of home delivery customers' stop and start orders, instructions and computer dial-ups for stringers to file stories, lists of contacts used by the Metro and Business desks, and the "WireWatch" keywords particular reporters had selected for monitoring wire services.

He also accessed a database of 3,000 contributors to the Times op-ed page, containing such information as the social security numbers for former U.N. weapons inspector Richard Butler, Democratic operative James Carville, ex-NSA chief Bobby Inman, Nannygate veteran Zoe Baird, former secretary of state James Baker, Internet policy thinker Larry Lessig, and thespian activist Robert Redford. Entries with home telephone numbers include Lawrence Walsh, William F. Buckley Jr., Jeanne Kirkpatrick, Rush Limbaugh, Vint Cerf, Warren Beatty and former president Jimmy Carter.

In February, 2002, Lamo told the Times of their vulnerability through a SecurityFocus reporter. But this time, no one was grateful, and by May federal prosecutors in New York had begun an investigation.

"I think this is unsporting of the New York Times," Lamo said Thursday.

Lamo's mother said she has no opinion on her son's exploits. She's just worried about him.

"I don't really know much of anything about computers," says Mary Lamo. "He's my son. Right now, all I can worry about is how I can help him."

"I hope there will be a time when Adrian can do positive things that everyone agrees are positive," she adds.

View the source here
I got alot of love Lamo. I sincerely hope they don't [censored] with him. His style, outlook on life, and skills are impressive. I know he broke the law, but he breaks it in the most professional and productive way. Overall, I think he is a good guy and messing with him will provoke ALOT of not so good guys.
NyTimes are just a bunch of cocks.. They couldnt stand being hacked. he didn't tell everyone how to hack them and let an onslaught come to there server.. I would of thank'd him for pointing out the flaw i couldn't see.. It's just bs that they put charges onto him.. This is going to be another free kevin thing..
Hey, the admins had a job to do. I can speak from experience. You have to follow set protocol in case of an intrustion, and not allow your own personal beliefs or idealism to interfere with the job. Call me anti-hacker? Of course I'm not...I'm just a realist.
Had the admins done their job, they wouldn't have been in such a position. I think that was the issue they probably couldn't understand.

I understand what you are saying but at Cool Hand Luke says:

Boss Paul: Sorry, Luke. I'm just doing my job. You gotta appreciate that.
Cool Hand Luke: Nah -- calling it your job don't make it right, Boss.
lol yeah ^^
My point was they didn't do there job in the first place and when someone points out a flaw you can't just say i'll arrest you... If you think about it thats how microsoft get all there patches out, they don't find them themselves people tell them what idiots they were.. they could unleash a worm..to take down all windows boxes like blaster did.. But the fact is companies need hackers like lamo who do pen testing and don't try takeover or destroy data.. Why prosocute those who help you.. i could understand if he tried to get information on there employers etc.. and use it, like an id thief.. but he was just hacking.. without malicous intent
But i think the only reason nytimes is doing it, is because the social secutiy numbers of the contributors were seen by him.. and they are scared little kids
A bit more realism for you guys. The network tech guys may have been doing their jobs and a security hole may still exist. You can't realistically expect them to have a unhackable network. I don't know how this appointed martyr handled it so I don't know if I approve of what he did. All I know is that if administrators did their job - there'd still be a problem. And if hackers didn't hack them - the problem ceases to exist. So where does the blame lie?

I'm not a anti-hacker either. I just like to keep it simple. I don't pretend that hacking is right. It's wrong, and that's why we love it.
I do not believe it was a hole/bug in software. It was misconfigured proxies, which is how Lamo does most of his stuff from what I understand. Hell, all he uses is a webbrowser. So that is why I said they were not doing their job, rather than a vendor issue, it was lack of competency on the individuals part

"The 22-year-old Lamo has become famous for publicly exposing gaping security holes at large corporations, then volunteering to help the companies fix the vulnerabilities he exploited -- sometimes visiting their offices or signing non-disclosure agreements in the process. Until now, his cooperation and transparency have kept him from being prosecuted."
You're missing the point. I don't care if it's an exploit or misconfiguration. They can be doing their job and over look stuff. It's EASY to overlook stuff. So it's not like the admins were slacking off and not caring about their job. Maybe they were, but you cannot know that.

Rather than risk sounding even more redundant, I'm going to hit another issue you addressed by quoting whatever it was you quoted.

The issue: is it right to hack a network then turn around and help them fix the problem?

I'll draw a parrallel. Let's say you're sleeping peacefully in your house at night when somebody breaks into your garage, and into your ferrari, hot-wires it and goes driving around a little bit. Then they take it back the next morning and tell you all that they did to break in and help you prevent it happening again. Wouldn't you be just a little bit pissed? That's breaking and entering. That's tresspassing. That's illegal and can get you into a hotbed of trouble.

Likewise with a businesses' network.

Even if you left your door unlocked, it is tresspassing on private property if somebody were to just walk right in and sit themselves down looking as comfortable as you please. Ok, yeah, sure, you have the door unlocked, but that doesn't make it RIGHT that the person just walks in like it is his.

It's WRONG people. Admit it. Don't pretend. Just say "yeah, it's wrong, but I don't care". And face the frickin consequences of your actions.
ok
ok? Why did you even write the post? *silence* is an "ok" - an acceptance, unwillingness to argue further. At the very least you could've said "yeah, it's wrong, but I don't care - lol" if what you wanted to do was mock me and trivialize what I had to say.
I wrote OK, b/c I wanted ya to know I see your point and I figured silence could be taken as I ignored you or just don't care. But obviously, it wasn't anymore effective then the lack of a reply.
© UGN Security Forum