The Stakkato Intrusions: What Happened and What Have We Learned?

During 15 months, from late 2003 until early 2005, hundreds of supercomputing sites, universities and companies worldwide were hit in a series of intrusions, with the perpetrator leapfrogging from site to site using harvested ssh passwords. The damage has been estimated to exceed $100 million in the United States alone. These are known as the Stakkato intrusions. This talk will cover case studies of performed intrusions, an analysis of why Stakkato could be so successful, and the story of how the suspect was finally tracked down and caught.