Amateur Hackers Tripped Up

by Danna Dykstra Coy

San Luis Obispo police have cracked a case of computer hacking. Now they've got to work out the bugs. Officers were still interviewing suspects late Friday linked to a rare case of computer tampering that involved at least four people, two of them computer science majors from Cal Poly.

The hackers were obvious amateurs, according to police. They were caught unknowingly tapping into the computer system in the office of two local dermatologists. The only information they would have obtained, had they cracked the system's entry code, was patient billing records.

Police declined to name names because the investigation is on-going. They don't expect any arrests, though technically, they say a crime has been committed. Police believe the tampering was all in fun, though at the expense of the skin doctors who spent money and time fixing glitches caused by the electronic intrusion.

"Maybe it was a game for the suspects, but you have to look at the bigger picture," said the officer assigned to the case, Gary Nemeth. "The fact they were knowingly attempting to access a computer system without permission is a crime." Because the case is rare in this county, police are learning as they go along. "We will definitely file complaints with the District Attorney's Office," said Nemeth. "They can decide whether we've got enough of a case to go to trial."

Earlier this month San Luis dermatologists James Longabaugh and Jeffrey Herten told police they suspected somebody was trying to access the computer in the office they share at 15 Santa Rosa St. The system, which contains patient records and billing information, continually shut down. The doctors were unable to access their patients' records, said Nemeth, and paid a computer technician at least $1,500 to re-program their modem.

The modem is a device that allows computers to communicate through telephone lines. It can only be accessed when an operator "dials" its designated number by punching the numbers on a computer keyboard. The "calling" computer then asks the operator to punch in a password to enter the system. If the operator fails to type in the correct password, the system may ask the caller to try again or simply hang up. Because the doctors' modem has a built-in security system, several failed attempts causes the system to shut down completely.

The technician who suspected the problems were more than mechanical, advised the doctors to call the police. "We ordered a telephone tap on the line, which showed in one day alone 200 calls were made to that number," said Nemeth. "It was obvious someone was making a game of trying to crack the code to enter the system." The tap showed four residences that placed more than three calls a day to the doctors' computer number. Three of the callers were from San Luis Obispo and one was from Santa Margarita. From there police went to work.

"A lot of times I think police just tell somebody in a situation like that to get a new phone number," said Nemeth, "and their problem is resolved. But these doctors were really worried. They were afraid someone really wanted to know what they had in their files. They wondered if it was happening to them, maybe it was happening to others. I was intrigued."

Nemeth, whose training is in police work and not computer crimes, was soon breaking new ground for the department. "Here we had the addresses, but no proper search warrant. We didn't know what to name in a search warrant for a computer tampering case." A security investigator for Pacific Bell gave Nemeth the information he needed: disks, computer equipment, stereos and telephones, anything that could be used in a computer crime.

Search warrants were served at the San Luis Obispo houses Thursday and Friday. Residents at the Santa Margarita house have yet to be served. But police are certain they've already cracked the case. At all three residences that were searched police found a disk that incorrectly gave the doctors' phone number as the key to a program called "Cygnus XI". "It was a fluke," said Nemeth. "These people didn't know each other, and yet they all had this same program". Apparently when the suspects failed to gain access, they made a game of trying to crack the password, he said. "They didn't know whose computer was hooked up to the phone number the program gave them," said Nemeth. "So they tried to find out."

Police confiscated hundreds of disks containing illegally obtained copies of software at a residence where two Cal Poly students lived, which will be turned over to a federal law enforcement agency, said Nemeth.

Police Chief Jim Gardner said he doesn't expect this type of case to be the department's last, given modern technology. "What got to be a little strange is when I heard my officers talk in briefings this week. It was like `I need more information for the database'." "To think 20 years ago when cops sat around and talked all you heard about was `211' cases and dope dealers."

***

This article appeared in the Telegram-Tribune Newspaper, San Luis Obispo, CA. March 23, 1991. Permission to electronically reproduce this article was given by the newspaper's senior editor.

***

Follow-up from enigma:

I happened to know the people involved. What actually happened was that a BBS that had been in operation in San Luis Obispo for years shut down and the sysop moved out of town. A few months later, the number was reassigned to a dermatologist's office who just happened to attach the line to a modem on their computer that contained billing records.

So, everyone in town who had a modem at that time used their modems to call BBSes and everyone in town who used BBSes passed around lists of BBS numbers for people to call. Anyone new to the BBS scene in SLO, like a new crop of freshman at Cal Poly, would start dialing BBSes, find a list of other BBS numbers, and start dialing those.

When the dermatologist saw INBOUND calls coming in on the modem line, he freaked out and called the police, absolutely positive that hackers were trying to crack into his billing system. SLO cops are some of the meanest, stupidest cops in the world. (I once got pulled over by two SLO squad cars for walking when the light was green, but the crosswalk sign said "don't walk"...) They put a trace on the line and tracked down half a dozen people who dialed the old BBS number with their modems -- the cops thought they'd encountered a whole ring of hackers, even though the people involved didn't know one another.

Despite calls from every BBSer and sysop in town explaining what was going on, the D.A. (another prime idiot) refused to drop the charges. I do not know how the case finally ended.

- enigma