Anthrax - The Outsider

It was time to get out of this system, but not before leaving in a blaze of glory. A prank left as a small present.

CERT had written back to the admins acknowledging the incident and providing a case number. Posing as one of the admins, Anthrax drafted a letter to CERT. To make the thing look official, he added the case number 'for reference'. The letter went something like this:

'In regard to incident no. XXXXX, reported on this date, we have since carried out some additional investigations on the matter. We have discovered the security incident was caused by a disgruntled employee who was fired for alcoholism and decided to retaliate against the company in this manner.

'We have long had a problem with alcohol and drug abuse due to the stressful nature of the company environment. No further investigation is necessary.'

At his computer terminal, Anthrax smiled. How embar- rassing was that going to be? Try scraping that mud off. He felt very pleased with himself.

Anthrax then tidied up his things in the company's computer, deleted the sniffer and moved out.

Things began to move quickly after that. He logged into System X later to check the sniffer records, only to find that someone had used his login patch password on that system as well. He became very nervous. It was one thing goofing around with a commercial site, and quite another being tracked from a military computer.

A new process had been added to System X, which Anthrax recognised. It was called '-u'. He didn't know what it did, but he had seen it before on military systems. About 24 hours after it appeared, he found himself locked out of the system. He had tried killing off the -u process before. It disappeared for a split- second and reappeared. Once it was in place, there was no way to destroy it.

Anthrax also unearthed some alarming email. The admin at a site upstream from both System X and the company's system had been sent a warning letter: 'We think there has