Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker (48 page)

to set the esn, enter debug mode.

the command is #49 NN SSSSSSSS

NN is 01 or 02

SSSSSSSS is new ESN# in hex

set security code to 000000 for easier access!

It appeared that Lottor and Shimomura had reverse-engineered and built a special version of the firmware that allowed the phone user to easily change the ESN from the keypad. There could be only one purpose for doing this: to clone to another cell phone number. I had to smile and shake my head. Here was an even bigger puzzle: Why would the federally indicted hacker and the security expert want to clone cell phones? It was something I never did figure out.

In any case, I had come up empty-handed on my real objective: finding source code from the manufacturer, OKI. In looking through Lottor’s files, I discovered that Shimomura had written an 8051 “disassembler” program that Lottor was using for reverse-engineering the firmware. I also read numerous emails between Lottor and Shimomura discussing their OKI reverse-engineering project. In one interesting email, Lottor sent Shimomura a console application named “modesn.exe.”

OKI ESN Modifier. Copyright (C) 1994 Network Wizards.

The name said it all: the program was designed to modify the ESN on the OKI cell phone. Very interesting. Again, I could think of only one potential purpose: fraud.

I archived and compressed all the files related to cell phones, including his email communications with Shimomura. But the process took
too long. During the file transfer, my connection was suddenly dropped. Lottor must have come home and noticed that something was going on. Apparently he had pulled the network cable, stopping the transfer. Damn! And then he took his machine off the Internet.

His server was back online the next day, after he had changed all the server passwords. Undiscouraged, I looked for another way in and found he was supporting some servers at “
pagesat.com
,” a high-speed news service. It took less than a day to get root and install a sniffer.

I kept watching the sniffer. Within hours, Mark logged in to pagesat, and from there connected to his own server and logged in. My sniffer grabbed his log-in credentials.

I was stoked. Waiting anxiously until 6:00 a.m., when I figured he was likely to be fast asleep, I connected to his server and got in once again. Incredible: the file I had attempted to transfer the day before was
still there
. Thirty minutes later, I had copied the file to one of my hacked accounts at Netcom.

From the email and file exchanges between them, it appeared that Lottor was the project lead, while Shimomura was working on it at his leisure. It was obvious that Tsutomu would also have the OKI code on his machine, and maybe even more information than I’d been able to grab from Lottor. I was determined to find out. At some point, I needed to get back into Shimomura’s computers.

I guess I sometimes don’t do a very good job of hiding my feelings. After I’d been working on the Help Desk at the Virginia Mason Medical Center for three months, my boss said to me one day, “We know you’re bored here.”

“Yeah, you’re right,” I said. “I’ll go find something else.”

Even though this left me jobless and with no income, I was glad not to face that boredom each day. Life, as they say, is too short.

So it was back to Kinko’s, to make up some new phony résumés. I had brought along my handheld RadioShack Pro-43 scanner, which I had loaded with the radio frequencies used by the FBI, DEA, Bureau of Prisons, and U.S. Marshals Service, as well as the Secret Service because, as I’ve said before, the Feds sometimes “borrow” other agencies’ frequencies if they suspect their target might be listening. The scanner’s squelch was set to pick up only nearby conversations.

The new résumés were taking shape when I heard my radio crackle with voices. I opened the squelch a bit and waited. Moments later, radio traffic began on one of the Secret Service frequencies.

“Any activity?”

“Nothing here.”

Very interesting. Some Federal agency was apparently conducting a surveillance operation. I increased the volume and propped the scanner on top of the computer to get better reception.

Soon the scanner began buzzing with voices: it sounded like the buildup to the climax of a television cop show. Obviously a raid was being set up.

“No activity here,” one voice said.

“We’re in the alley covering the back,” another answered.

A girl working at the next PC asked what I was listening to. I smiled and said it was the Secret Service, then laughed as I added, “Sounds like somebody’s going to have a bad night.” She laughed, too. We both listened intently to see what would happen next.

“Could he be at the computer store?” came blurting out from the radio.

Now, that was
weird
. “Computer store”—did their target work in a computer store, or could it be a customer?

No response.

I started to get a bit anxious and worried—could it be
me
they were waiting for? I stopped working on the computer and paid closer attention to the radio.

But then I heard, “What kind of car does our guy drive?”

So it couldn’t be me they were after: I was using public transportation. But I was still wondering about the computer store thing.

Twenty minutes, and then, “We’re going in now.”

And then radio silence.

I continued working hard, drafting about fifteen résumés for as many different businesses in the Seattle area, as usual tailoring them to meet 90 percent of the advertised requirements, my best shot at landing an interview.

Still nothing on the radio. The girl next to me got up, smiled, and wished me a good night. We both looked at the scanner and laughed, wondering what had happened to the guy they were waiting for.

A little after midnight, I finished writing up all my résumés and cover letters. I waited in a long line of mostly students to have the résumés printed on ivory linen stock. Then, when it was finally my turn, I was told that my print job wouldn’t be completed until morning. Damn! I wanted to get them out in the mail straightaway. The clerk told me to try another Kinko’s, a few blocks away. I walked over to the other store but got the same story there: “We won’t have your print job ready until the morning.” Fine. I said I’d pick it up in the morning, though I knew I’d likely be online all night, would sleep through the morning, and not get back to Kinko’s until sometime in the afternoon.

It didn’t turn out like that.

On the way home I stopped at the twenty-four-hour Safeway near my apartment and bought some groceries plus a turkey sandwich and some potato chips for a late-night dinner.

It was a little after 1:00 a.m. when I got back to my apartment building. The Secret Service operation I’d heard over my scanner had left me feeling a bit jittery. Like a character in a spy novel, I took the precaution of walking down the opposite side of the street so I could look for any suspicious cars, and to make sure my apartment lights were still on.

But they weren’t. The apartment was dark. Not good—I always left some lights on. Had I forgotten this time, or was it something else? There was a red truck parked on the street, and I could see two figures in the front seat: a man and a woman, kissing. That conjured up a funny notion: could it be two Federal agents, making out as a cover? Not likely, but the thought relieved my tension a little.

I walked straight up to the truck and asked the passenger, “Hey, sorry to interrupt, but I was supposed to meet my buddy here. Did you see anyone hanging out around here waiting?”

“No, but people were carrying boxes out of that apartment”—as she pointed to the windows of
my
apartment. What the fuck? I thanked her and said that wasn’t where my friend lived.

I bolted up the stairs to the apartment of the building manager, David, and rang his doorbell, even though I knew I’d be waking him up. A drowsy voice shouted out,
“Who is it?”
When I didn’t answer, he opened the door a crack. “Oh, hi, Brian,” he said in a sleepy, irritated voice.

I tried my best to hide my anxiety. “Did you let anyone into my apartment?”

His answer was a stunner, something I could never have expected:

“No, but the cops and the Secret Service busted down your door. The Seattle Police left a search warrant and a business card saying you should call them right away.”

Starting to wake up enough to be truly annoyed now, he added, “And you’re going to pay for the door—
right?
”

“Yeah, sure.”

I told him I was going to call them right away.

Sweating, with a sour taste of panic in my mouth and a sinking feeling in my stomach, I bolted back down the stairs and through the alley, looking for some sign of trouble—an unmarked car, movement on the roof, anything.

Nothing. Nobody.

One small blessing: if it was the Seattle Police, not the FBI, then they were looking for the Brian Merrill who had been making unauthorized cell phone calls, not for fugitive hacker Kevin Mitnick.

Drews had said the Seattle Police and Secret Service searched my place and then just left. Surely they wouldn’t be lame enough to toss my place without staying around to make the arrest.

I walked away fast, knowing I didn’t dare run, sure the manager must already be on the phone calling the cops or Feds to report that I had shown up and then split.

Still carrying the briefcase I had thankfully left the house with hours earlier—it contained all my paperwork for new identities—I was expecting to see a police or unmarked car any second. I dropped my bag of groceries into someone’s trash.

My heart was starting to beat faster and faster. I walked as fast as I could without breaking into a jog, staying away from major streets until I was a couple blocks away from my apartment. I kept thinking about all the stuff in my briefcase, including those blank but certified birth certificates from South Dakota.

But I couldn’t ditch those documents. I would need them more than ever now. My new “permanent” identity had just flown out the window, forever useless. So I hung on to the briefcase. I was sure that a team of Feds was lurking nearby waiting for me. In one of the parked cars? Behind some trees? In the doorway of an apartment building down the block?

My mouth started to get very dry, as if I hadn’t drunk any water in a
few days. I was so nervous I was beginning to feel dizzy. Sweat was dripping down my face.

I reached a bar, huffing and puffing, way out of place among the noisy, laughing people partying, drinking it up, having a good time. I hid in a stall in the men’s room. I wanted to call my mom but didn’t dare use the cell phone, so I just sat there thinking out my options. Call a cab and get the hell out of the area as soon as possible? The Secret Service could be driving around looking for me. I just wanted to disappear into the crowd.

When I had rested long enough to get my breath back, I took to the sidewalk again, looking for a taxi to take me out of the area. A bus rolled past.

A bus! A ticket out of the neighborhood!

I ran my ass off to catch it at the stop in the next block. Where it was going didn’t matter. Just away from here.

I stayed on for an hour, to the end of the line, then got off and walked in the cool air to clear my head.

At a 7-Eleven, I called my mom’s pager from the pay phone, sending her a code 3—“Emergency.” I waited, giving her time to get up, get dressed, drive to a casino, and page me back to let me know where she was. After about forty minutes, my pager buzzed, showing me the phone number for Caesar’s Palace. I called the hotel and had her paged, waiting impatiently until she picked up.

As you might imagine, it wasn’t easy to tell her about my close call, and that I didn’t dare go back to my apartment. I was depressed, but it could have been worse, I pointed out: I could be sitting in some jail cell.

When we hung up, I picked a motel from the Yellow Pages with an address in downtown Seattle near Pike Place Market, where the first Starbucks opened. I called a cab and had the driver stop at an ATM, where I withdrew the maximum amount, $500.

The name I put on the registration form at the motel was Eric Weiss, the old identity that I still had documents for in my briefcase.

The next morning I would be out of there, gone from Seattle without a trace—I hoped.

I went to bed feeling a huge sense of loss. The only possessions I still had were the clothes on my back, a couple of things at the dry cleaners, and the briefcase full of identity documents. Everything else was still in that apartment.

I was an early riser the next morning.

The raid had been at night. I was hoping that the Feds had knocked off after filing the paperwork and logging all the evidence—that they hadn’t bothered to start looking through my computer or papers, where they would have found a receipt from the dry cleaners and a checkbook showing where I kept my stash of cash.

First stop, because it opened early, was the dry cleaners, to pick up the only clothes I would have besides the jeans, black leather jacket, and Hard Rock T-shirt I was wearing.