Homeless Hacker

TeMpEsT · Apr 12, 2004

The Homeless Hacker v. The New York Times

A self-styled security expert and serial self-promoter, Adrian Lamo made headlines as a grayhat hacker. Then the Gray Lady came down on his head.

By Jennifer Kahn

Not long ago Adrian Lamo was exploring an abandoned gypsum processing plant in West Philadelphia with two friends, when a police cruiser drove slowly by. Lamo's friends were high on methamphetamines, and at the sight of the cops they urged him to run. Instead, Lamo stood still, and as he did, he heard a strange rasping sound. Peering down a nearby sewer grate, Lamo found the source: a kitten, meowed to hoarseness, scrambling around on a pile of trash.

When a second squad car pulled up and fixed its spotlight on Lamo, he walked forward. "I said, 'Officer, I'm so glad you're here!'" Lamo recalls, using his most innocent voice. "'There's a kitten trapped down here.'" The officer was suspicious, but two hours later, with the assistance of three additional cruisers and a police van, the kitten was out.

Illustration by Matthew Curry
"There we were," Lamo says. "Circle of police cars, flashing lights, me - quasi-notorious cybercriminal - and my coconspirators all working in concert to try and get this kitten out of the drain." In the hubbub, neither Lamo nor his friends got searched, and the kitten went home with them in a discarded juice carton. Lamo named it Alibi.

Being saved against all odds is a theme with Lamo, who told me the story of Alibi shortly after he was arrested by the FBI in September for computer fraud. The charges - that Lamo had broken into the private network of the New York Times Company and run up a $300,000 bill on the pay-per-use search tool Lexis-Nexis - carried a possible 15-year prison sentence. Asked if he was afraid of going to jail, Lamo said simply, "I'm sure it would be educational. The beautiful thing about the universe is that nothing goes to waste."

Thin and pale, Lamo has a delicate, androgynous face and a habit of hunching his shoulders as though to stay warm. He is one of the best-known hackers in the country, and was out being filmed for a documentary when the cops came looking for him at his parents' house in Sacramento. While cameras rolled, Lamo described his most famous hacks, a string of highly publicized computer intrusions - Microsoft, AOL, and Excite@Home - of which the Times was merely the most recent. Just months before the Times hack, he had made the papers by burrowing into WorldCom's intranet, where he found a database containing Social Security numbers, bank account data, and direct deposit instructions for some 86,000 WorldCom employees - plus a Web router maintenance tool that enabled him to go deep into the private networks of Bank of America, Citicorp, and JP Morgan.

Known as the Homeless Hacker before his arrest, Lamo did most of his virtual exploring from the Internet connections at Kinko's copy shops. Besides his laptop - an eight-year-old Toshiba with six keys missing - he traveled light, usually with a blanket, a change of clothes, and a Taser stun gun, which he used to pick electronic locks and sometimes to shock vending machines to see if they would drop food or spare change.

Relentlessly nomadic - he has crossed the country by bus half a dozen times - he's also a connoisseur of serendipity. He once spent two weeks attending a Pennsylvania Bible school on a whim. Mostly, though, he transited between Washington, DC, and San Francisco, where he grew up. Because he has friends in those cities, Lamo could usually count on finding a place to sleep that was both more secure and more pleasant than his usual home, an abandoned building. The capital also has the virtue of being an information hunter's paradise. "In DC, it's hard to open a dumpster without finding classified documents," he tells me wistfully.

In return for food and a place to sleep, Lamo took his hosts on rambling adventures: through city sewer systems or locked office buildings. The tours were always surreal, one friend recalls: "Not so much fun as different."

"To me," Lamo explains, "ending up in a city that I've never been to before, with no money, where I know nobody, and yet somehow making it work out is as much a unique and amazing exercise of faith as going to a computer network that I know nothing about and somehow finding myself in its innermost recesses."

Lamo prides himself on his ability to get out of tight situations, and once he became a wanted felon, he briefly dropped out of sight. But the FBI, prompted by fears of Internet terrorism, was only getting started. In the end, even the Justice Department got involved, unsuccessfully attempting to subpoena the notes of a dozen reporters who had interviewed Lamo. The game had suddenly turned serious. After five days as a fugitive, Lamo surrendered in a Sacramento Starbucks.

For someone with such a glamorous hacking resume, Lamo is strangely unschooled. Illiterate in computer languages like Java and C++, he cannot exploit loopholes in a system's underlying code. Instead, he uses a common man's tool: the Web browser. Firing up Internet Explorer, Lamo will troll through a corporation's homepage, seeking outsourced jobs like advertising, distribution, and payroll. The companies that handle these tasks link to the main corporate database, but their proxy servers - the point of connection between the two networks - are often poorly secured, sometimes with standard-issue passwords that no one bothers to reset.

Finding these weak points is a matter of perseverance more than talent, but Lamo has also been unusually lucky - often materializing in areas of corporate networks that were heavily guarded and distinctly off-limits. One fellow hacker describes the skill - with a nod to sci-fi author Neal Stephenson - as "the ability to condense fact from the vapor of nuance."

It was this vaporous instinct that in February 2002 first drew Lamo to the New York Times servers. Messing with the Times' news site would be a coup, Lamo knew, but the Gray Lady had been hacked this way once before, and security was tight. Rebuffed from the news server, Lamo focused on the corporate network, sending test emails to the paper's autoresponder, culling IP addresses, and finally stumbling onto a subnetwork that controlled, among other things, the database containing information about op-ed writers. This being The New York Times, the list of contributors was particularly luminous, an establishment who's who that included UN weapons inspector Richard Butler and former National Security Agency head Bobby Inman, as well as celebrities like Robert Redford and Rush Limbaugh. Many of the names had phone numbers and home addresses attached, along with notes on the person's area of expertise, payment history, and editorial temperament. After browsing a bit, Lamo added himself to the roster, brazenly giving his full name and cell phone number. (For his expertise, he drily listed "computer hacking, national security, communications intelligence.") Once the deed was done, he called SecurityFocus.com reporter Kevin Poulsen, a confidant and a convicted hacker himself. Lamo gave him the scoop, and Poulsen, hoping to verify the story, called the Times.
Click to expand...

That's too funny.

Will · Apr 12, 2004

Alacrity · Apr 12, 2004

TeMpEsT · Apr 12, 2004

"After browsing a bit, Lamo added himself to the roster, brazenly giving his full name and cell phone number. (For his expertise, he drily listed "computer hacking, national security, communications intelligence.")"

Registered on the New York Times employee roster as those expertise.

Mr. Benzedrine · Apr 12, 2004

It Was me............... :chemist: ......................... :whistle: lol, But that is really funny, Thanks for posting that.

ass_kicker · Apr 13, 2004

hilarious

Neil · Apr 13, 2004

Wow. I have tons of respect for this dude. Good damn hacker.

TeMpEsT · Apr 13, 2004

I love how he used a taser to break into vending machines. XD

Nikki · Apr 13, 2004

Haha I want to call my next cat Alibi now =P

LornVourkolakas · Apr 13, 2004

Originally posted by Vanil4_Intel@Apr 13 2004, 06:20 PM
I love how he used a taser to break into vending machines. XD
Click to expand...

Now I know how to get me some chocolate.

Great article. I found myself a hero.

Tomi · Apr 13, 2004

Alibi...he probably named it that because it was his alibi for being there

Mark · Apr 13, 2004

Very interesting.

Nowhere Kid · Apr 14, 2004

That made me laugh.

I should get a stun gun so I can get myself some free food.

Glenn · Apr 14, 2004

Funny.

Log in or Sign up

Homeless Hacker

TeMpEsT Live To Thrash LPA Super Member

Will LPA Addicted VIP LPA Addicted VIP

Alacrity don't stop talking to me; i haven't been listening LPA Super Member

TeMpEsT Live To Thrash LPA Super Member

Mr. Benzedrine Rock the 40 Oz

ass_kicker Banned

Neil Super Duper Member LPA Super Member

TeMpEsT Live To Thrash LPA Super Member

Nikki I have no idea what is going on LPA Super Member

LornVourkolakas About To Blow Chunks

Tomi   LPA Addict

Mark Canadian Beauty LPA Administrator

Nowhere Kid Well-Known Member

Glenn Super Member LPA Super Member

Share This Page

Log in or Sign up

Homeless Hacker

TeMpEsT Live To Thrash LPA Super Member

Will LPA Addicted VIP LPA Addicted VIP

Alacrity don't stop talking to me; i haven't been listening LPA Super Member

TeMpEsT Live To Thrash LPA Super Member

Mr. Benzedrine Rock the 40 Oz

ass_kicker Banned

Neil Super Duper Member LPA Super Member

TeMpEsT Live To Thrash LPA Super Member

Nikki I have no idea what is going on LPA Super Member

LornVourkolakas About To Blow Chunks

Tomi &nbsp; LPA Addict

Mark Canadian Beauty LPA Administrator

Nowhere Kid Well-Known Member

Glenn Super Member LPA Super Member

Share This Page

Useful Searches

Tomi LPA Addict