📸 Photo

to any particular user. It was quickly realized they had all been originated ‘out-of-hours’, at times when normally no authorized users would be active. Further investigation showed that some new user IDs and passwords had been added to their system, ones that no one could account for. The implications, Gliss said, were all too obvious: hackers must have penetrated SCICON security, and were using their computers as a launching pad to get to other systems.

What Gliss now needed to know was if Steffen had any idea who might be involved. The entire contract with the German government was at risk if SCICON couldn’t guarantee the security of the system. Hackers roaming around did not bode well. Gliss needed to find out who they were, how they got on and how to stop it. Contacting Steffen was a long shot, but he was a leading member of Chaos and knew most hackers in Germany. Perhaps he could make some calls.

Steffen thought about it. He reasoned that because the hackers were breaking into the SCICON site in Hamburg they were probably based in the city. It made sense to call a nearby computer; that way the phone bills were cheaper. He would make inquiries.

Two days later Steffen called Gliss and said that he had identified the hackers. They were two Hamburg students. They had agreed to meet Gliss and help – provided Gliss promised not to prosecute. Gliss gave his word.

Later that week Gliss met the two students, code-named Bach and Handel,² in Hamburg. Their story was worrying: the two students had exploited a devastatingly simple flaw in the VMS operating system used on VAX. The machines, like most computer systems, required users to log in their ID and then type their password to gain access. If the ID or the password was wrong, the VMS system had been designed to show an ‘error’ message and bar entry. But the two hackers told Gliss that if they simply ignored all the ‘error’ messages, they could walk straight into the system – provided they continued with the log-on as though everything was in order. When confronted with the ‘error’ message after keying in a fake ID, they would press ‘enter’, which would take them to the password prompt. They would then type in a phoney password, bringing up a second, equally ineffectual ‘error’ message. By ignoring it and pressing enter again, they