response 18 of 45:

Jun 9 02:01 UTC 2000

To whom it may concern,

        I go by the name 'xdr'. I am 17 years of age and I live somewhere
        within the place you call southeastern Michigan. I in no way damaged,
        vandalized, or terrorized M-Net in any way. Last summer I did take a
        bug in the Yapp conferencing system to my advantage to compromise root
        priviledges. Trex was notified and it was patched up quickly. And yes,
        I am also the one who put a backdoor in the newuser program.

        Recently I have been using the system for E-mail, though before the
        crash I still had root access via another bug I discovered. There are
        many bugs, including ones which allow users to become a patron (as
        found by a friend of mine).

        I was using these root priviledges simply to erase my presence from
        M-Net each time I logged in. Certain people I was in contact with on
        the system did not like me too well, so I would make myself harder to
        find :)

        My name is not "Jason", that is my pseudo real name since many people
        seem to think it is my real name. I appeared at the Board of Directors
        meeting simply to meet' The People' as I like to call it. To show them
        that I am not the un-skilled and immature person I seem to be.

        A few days after the meeting, my account vanished without a trace.
        Thats weird. I figured this would happen but I asked myself; 'Why would
        they remove me if I had helped them in the past and was not doing
        anything wrong? After all, this is a PUBLIC ACCESS Unix System'.

        So I got scared, I did not know what 'The People' were up to. I grabbed
        the copy of OpenSSH modified for BSDI and proceeded to modify it a bit
        more in such a way that I could have semi-unlogged remote root access
        and the ability to record incomming users' passwords. I wanted to gain
        access to 'The People's home machines and find out exactly what was
        going on. (reading e-mails and looking for files that could contain
        information about me, any investigation, or whatnot).

        Then I get information from an anonymous source telling me that someone
        from the University of Maryland (You know who you are) was looking for
        me. Why? I asked. M-Net is a PUBLIC ACCESS Unix System, why would
        someone want to go this far as to possibly get law enforcement
        involved? And why would the law enforcement even care?

        I dont remember the date, but I logged into this person's machine and
        started looking around. A FreeBSD 5.0 current system, really nice
        setup. While reading his mail I found many things that made me feel
        uneasy about his personality. He seemed like the anal retentive type
        (no offence to this person). For example, every time someone spammed
        him, he would send a message back demanding $500 USD (which you can do
        by law). But how often does this actually happen? And who would want to
        go through the trouble of going through the courts instead of just
        deleting the message?

        This gave me the idea that this guy was not one to mess around with.
        One with absolutly zero tolerance. Intimidated? I bet you are (person).

        He logged in so I sent him a message, I asked why he was looking for me
        but did not say who I was. He said 'curiosity'. I then knew he was up
        to somthing. And my connection halted. M-Net was dead, what the hell
        happened?

        About a week later I tried to connect to M-net again, this time the
        authorative DNS servers were down so I couldn't even get M-net's IP
        address. I thought they must have taken it down. But WHY? I really
        started to get scared.

        And that leaves us to the present time. What happened? I read some of
        the mail from the Grex web conferencing system and it does not look
        good. Apparently everyone thinks 'M-net was attacked by a cyber-vandal
        by the name of xdr'. This is not true. I DO NOT cause damage to any
        system(s).

        -xdr

response 20 of 45:

Jun 9 02:47 UTC 2000

user6122  ttyp7    209.104.155.59   Thu Jun  8 21:57 - 22:18  (00:20)
user6122  ttysc    209.104.155.59   Thu Jun  8 05:06 - 05:14  (00:07)



C:\WINDOWS\Profiles\Kevin\Desktop>tracert 209.104.155.59

Tracing route to prec01.iocenter.net [209.104.155.59]
over a maximum of 30 hops:

  1    15 ms    13 ms    12 ms  10.1.4.1
  2    60 ms   252 ms    14 ms  216.93.15.145
  3    28 ms    28 ms    28 ms  169.207.224.113
  4     *       30 ms    32 ms  Serial0-0-1.GW5.CHI6.ALTER.NET
[157.130.109.233]

  5    29 ms    27 ms    28 ms  116.ATM2-0.XR1.CHI6.ALTER.NET
[146.188.209.154]

  6    46 ms    27 ms    31 ms  195.ATM6-0.XR1.CHI4.ALTER.NET
[146.188.208.113]

  7    39 ms    58 ms    37 ms  195.ATM8-0-0.GW1.DET1.ALTER.NET
[146.188.208.193
]
  8  157.130.96.18  reports: Destination net unreachable.

Trace complete.


You'd think an 3733t h4x0r would do a better job of covering up his tracks
from work.

response 22 of 45:

Jun 9 08:09 UTC 2000

That'd be like that story about the babysitter who was recieving 
fucked up phone calls from the upstiars bedroom.

response 24 of 45:

Jun 9 12:17 UTC 2000

Huh? Is he dead?

response 26 of 45:

Jun 9 16:38 UTC 2000

it would be more like fight club.

response 28 of 45:

Jun 9 16:52 UTC 2000

        so Darwin deserves a Darwin award?

response 30 of 45:

Jun 9 19:49 UTC 2000

Buzzard, I'd have to say that you are MUCH stupider
than XDR. I mean, he hacked your precious system.
What have you ever done?

response 32 of 45:

Jun 10 00:25 UTC 2000

Monday night.
Lasagna. 
Mark your calender.
Hey, by the way, Tim, you owuldn't by chance have seen the
3/4 " extension for my hair clippers, wouldjLove,
Foo-foo

response 34 of 45:

Jun 10 04:18 UTC 2000

I'm sorry. I am troo busy not caring.
But for some reason, the last response I entered didn't come out
right and wouldjlove foo-foo
is pretty goddamn funny.

response 36 of 45:

Jun 10 16:49 UTC 2000

#35:  No, to see what that looks like, look for anything posted by
      lkjh/tsty.

response 38 of 45:

Jun 10 17:59 UTC 2000

Don't mistake carelessness for drunkedness.  Usually the tone of the post
is a good indication, too.  In TS's case, for example, he most frequently
appears to be disoriented and confused.

response 40 of 45:

Jun 11 01:08 UTC 2000

TIMBO:
HAVE YOU SEEN THE HAIR CLIPPERS EXTENSION?