It was time to get out of this system, but not before leaving in a blaze of glory. A prank left as a small present.
CERT had written back to the admins acknowledging the incident and providing a case number. Posing as one of the admins, Anthrax drafted a letter to CERT. To make the thing look official, he added the case number `for reference'. The letter went something like this:
`In regard to incident no. XXXXX, reported on this date, we have since carried out some additional investigations on the matter. We have discovered the security incident was caused by a disgruntled employee who was fired for alcoholism and decided to retaliate against the company in this manner.
`We have long had a problem with alcohol and drug abuse due to the stressful nature of the company environment. No further investigation is necessary.'
At his computer terminal, Anthrax smiled. How embarrassing was that going to be? Try scraping that mud off. He felt very pleased with himself.
Anthrax then tidied up his things in the company's computer, deleted the sniffer and moved out.
Things began to move quickly after that. He logged into System X later to check the sniffer records, only to find that someone had used his login patch password on that system as well. He became very nervous. It was one thing goofing around with a commercial site, and quite another being tracked from a military computer.
A new process had been added to System X, which Anthrax recognised. It was called `-u'. He didn't know what it did, but he had seen it before on military systems. About 24 hours after it appeared, he found himself locked out of the system. He had tried killing off the -u process before. It disappeared for a split-second and reappeared. Once it was in place, there was no way to destroy it.
Anthrax also unearthed some alarming email. The admin at a site upstream from both System X and the company's system had been sent a warning letter: `We think there has been a security incident at your site'. The circle was closing in on him. It was definitely time to get the hell out. He packed up his things in a hurry. Killed off the remaining sniffer. Moved his files. Removed the login patch. And departed with considerable alacrity.
After he cut his connection, Anthrax sat wondering about the admins. If they knew he was into their systems, why did they leave the sniffers up and running? He could understand leaving the login patch. Maybe they wanted to track his movements, determine his motives, or trace his connection. Killing the patch would have simply locked him out of the only door the admins could watch. They wouldn't know if he had other backdoors into their system. But the sniffer? It didn't make any sense.