TAKEDOWN: Transcripts: February 5-7

Kevin On Demand!

February 5-7, 1995

An important note for sessions 1-5 is that these are from before we had systematic analysis in place, so a lot of stuff was not being seen; it really depended on who was monitoring at the time. For example, the person monitoring session 4 (which happened during our first meeting with the Well folks on Monday night (6 Feb), didn't note the significance of the search strings being used to peruse various people's mail (such as "tsu" and "itni").
A lesson as to the importance of not just collecting data, but looking at it.

Looking around

Start: 1995 Feb 5 10:05:22
Total Run Time: 1:57
From teal.csn.org to well.sf.ca.us.
Checks his buried nuts, peruses Littman's directory. Nothing too exciting. Shows a list of stolen files.

Cleaning up

Start: 1995 Feb 5 11:48:08
Total Run Time: 3:53
From teal.csn.org to well.sf.ca.us.
Inspects and erases his own logfile entries. Looks through Littman's home directory again.

Kevin is a good name

Start: 1995 Feb 5 20:20:21
Total Run Time: 9:50
From teal.csn.org to well.sf.ca.us.
Kevin tries to forge mail to Jon Littman from himself. He's found a message from Capt. Kevin Ziese, of the Air Force Information Warface Center, and altered it slightly. Is this Kevin's secret way of communicating with Jon Littman? This session was altered slightly to preserve the confidentiality of Jon Littman's mail.

He's taken a sudden interest in John Markoff

Start: 1995 Feb 6 20:20:22
Total Run Time: 2:59
From escape.com to well.sf.ca.us.
He looks through John Markoff's mail, in addition to Littman's. He also tries to find out where Markoff actually receives his mail. He finds a pointer to sf1.nyt.com, which is served by Internex.

More cleaning up

Start: 1995 Feb 7 08:13:29
Total Run Time: 3:33
From escape.com to well.sf.ca.us.
Comes back to the Well to cleans himself out of system accounting records. Shows previous connections from Internex.