The Cuckoo's Egg: How a 75-Cent Error Exposed a KGB-Linked Hacker

In the summer of 1986, an astronomer at the Lawrence Berkeley Laboratory in California was handed an odd job: work out why the lab's computer accounting system was off by 75 cents. The astronomer, Clifford Stoll, did not expect the task to take more than an afternoon. It took him most of a year, and it led to one of the first documented cases of computer espionage.

A tiny discrepancy

Stoll was an astronomer who had moved into helping run the lab's computers. The lab billed its researchers for computer time, and its accounting program kept records for each user. The books showed a shortfall of 75 cents. Stoll traced it to computer time that had been used with no billing record attached. Someone was using the machines, and no one could say who.

It was a small clue, but it told him that an unknown person had gained access to the system and had used privileges to add an account.

Watching the intruder

Stoll decided to watch rather than simply lock the intruder out. He set up monitors on the incoming lines, wired up printers so that every keystroke typed by the intruder was recorded on paper, and logged the sessions. He discovered that the intruder was using a flaw in the GNU Emacs mail-handling software to obtain superuser privileges, and was then searching the lab's machines and, through them, other networks, including those of US military sites.

He noticed what the intruder was interested in. The visitor searched for words such as nuclear and SDI, the Strategic Defense Initiative. To keep the intruder connected long enough to trace, Stoll created a collection of fictitious documents about an invented project, which would take a long time to read. This early example of what is now called a honeypot is among the best-known in the history of the field.

The long trace

Tracing a connection in 1986 was slow. The intruder came in over telephone lines and international data networks, and each link in the chain belonged to a different organisation. Stoll worked with phone companies, with the FBI, and with German authorities. The calls were eventually traced to Hannover, in what was then West Germany.

The path was not easy. Law enforcement agencies were at first reluctant to take a case with so little financial loss, and the legal framework for computer crime was thin. Stoll's persistence kept the investigation alive.

The intruder turned out to be part of a small group of German hackers who sold information they had obtained to agents of the Soviet KGB. The best-known of them was Markus Hess. German authorities moved against the group from 1987 onwards, and in 1990 Hess and two other members were convicted of espionage and received suspended sentences. The case showed that the stakes of computer intrusion could go well beyond pranks.

The book and its influence

Stoll first described the investigation in a 1988 article in the journal Communications of the ACM titled "Stalking the Wily Hacker". In 1989 he published a book about the story, The Cuckoo's Egg, which became a bestseller and introduced a wide audience to computer security. The title refers to the cuckoo, a bird that lays its eggs in other birds' nests, a fitting image for an uninvited guest hiding inside someone else's system.

For many security professionals, the book is still required reading. It captures what real incident response looks like: long stretches of boredom, careful note-taking, and the persistence to follow small anomalies.

What the story teaches

• Anomalies matter. A 75-cent gap was the only visible symptom of a serious breach.
• Logs are evidence. Stoll solved the case because he had records and kept more.
• Attackers follow patterns. Once you watch their behaviour, you can learn what they want.
• Cooperation is required. No single organisation had the whole picture.

A patient method

What stands out in Stoll's account is the method. He kept a logbook, wrote down every observation with the time, and refused to guess. When the intruder appeared, he recorded what was typed, in what order, and how long each step took. That discipline is what turned a vague suspicion into evidence that police and intelligence agencies could act on. It is also why the case is still taught in security courses: the technology has changed, but the habits of a good investigator have not.

Stoll also showed a willingness to be wrong in public. He tried several explanations that did not hold up, such as the idea that the intruder was a student on campus, before the real picture emerged. Treat your own early theories about a problem as hypotheses, and keep checking them against the logs.

For a wider baseline of measures, see the security page.

The lesson for site owners today

Most compromises of small websites do not start with an alarm. They start with something slightly wrong: a file you do not recognise, an administrator account you did not create, a sudden spike in outgoing mail, or traffic from a country where you have no customers. Make a habit of looking. Check your user list, look at recently changed files, and read the summary of your server logs now and then, not only when something breaks.

Setting up even basic monitoring, such as an alert when your site goes down or changes unexpectedly, gives you a chance to notice a problem while it is still small.

With Plesk on every plan, you can see your logs, users and scheduled tasks in one place. Our knowledgebase shows how to find them, and the security page explains how we approach protecting accounts. If you suspect something is already wrong, contact us and describe what you see.