ALI HEREIN UNELASSIFIED 12 31 1936 a FEDERAL BUREAU OF INVESTIGATION copies of Request For Information letters sent to One copy of response from NAVCIRT regarding pOSSible material related to captioned matter Details Enclosed for Cincinnati are copies of documents generated by or directed to the National Infrastructure Protection Center NIPC regarding captioned matter These documents are being forwarded to Cincinnati for inclusion in the original case file 00 Precedence ROUTINE Date 08 24 1998 To Cincinnati Attn From NSD Contact SSA Approved By Drafted By Case ID Pending Title UNITED STATES AIR FORCE INSTITUTE OF TECHNOLOGY CITA COMPUTER OO CINCINNATI Synopsis This communication is to forward documents to the original case file Referral Censult SEARCHED a 'v'I ERIE 03 86 2812 E f ME 445% ALL EEFEIH I3 GATE 3 3w w23i2 35332sir'U g Emaf hx'ni U S Department of Justice in Federal Bureau of Investigation Washington D C 20535-0001 August 4 1998 D631 ReferralfCensult This letter is to request information frorr databases and published reports that may be relevant to an ongoing FBI criminal investigation 16 investigation centers on a series of intrusions into computer systems located at Wright Patterson Air Force Base The intrusions appear to originate from a series of Internet service providers located in the Russian Federation It also appears that the intruder is connecting to the ISPs through a dial-up connection which suggests a local Russian point of origin The FBI currently possesses no information indicating that the attacker is a U S person Technical information relevant to this request is provided in the enclosure which also speci es an operational point of contact in the FBI As additional tec 'r'91 if ormation becomes available it will be forwarded to the operational point of contact at The FBI legal contact point for this matter is Assistant General Counsel Please do not hesitate to call him if you require additional information Thank you for your assmtance in this matter Sincerely Associate General Counsel for National Security Affairs CC mount 1 The Wright Patterson Air Force Base WPAFB a key educational and research and development base has documented numerous intrusions into approximately eight of their systems The attacks primarily come through computers located in the computer lab at the University of Cincinnati Hov'vever attacks have been seen om Wright University located in Dayton OH and Aticorpnet located in Charleston SC The intrusions into these U S systems appears to be originating from a dialup connection to four Internet Service Providers ISPs located in Russia The hacking occurs Monday through Friday midnight and approximately 9 00 am EDT The following are thei involved 1b 7 The following passwords or environment variables have been used during the intrusions 3 275 The followmg are usernames software authors or tool names Iis the name ofl Istudent whose account is being used at I Our information indicates she is a non US person The following les are known to have been taken by the hacker om WPAFB 7 3 3b 6 NIPC Operational POC is SSA ALE HEELE BATE 653335 535513amiaabfaia a U S Department of Justice Federal Bureau of Investigation Washington D C 20535-0001 August 3 1998 ReferralfConsult Dea This letter is to request information from databases and published reports that may be relevant to an ongoing FBI criminal investlgation The investigation centers on a series of intrusions into computer systems located at Wright Patterson Air Force Base The intrusions appear to originate from a series of Internet service providers located in the Russian Federation It also appears that the intruder is connecting to the ISPs through a dial-up connection which suggests a local Russian point of origin The FBI currently possesses no information indicating that the attacker is a U S person Technical information relevant to this request is provided in the enclosure which also speci es an operational point of contact in the FBI As additional tech nal infmnation becomes available it will be forwarded to the operational point of contact a The FBI legal contact point for this matter is Assistant General Counsel I Please do not hesitate to call him if you require additional information Thank you for your assistance in this matter Sincerely Assocmte General counsel Ior ational Security Affairs cc NSA 5033 HIDE US Department of Justice Federal Bureau of Investigation Washington D C 20535-0001 August 31 1998 Win Dear ReferraliConsult This letter is to request technical assistance in conjunction with an ongoing FBI criminal investigation The investlgatron centers on a series of intrusions into computer systems located at Wright Patterson Air Force Base The intrusions appear to originate from a series of Internet service providers located in the Russian Federation It also appears that the intruderis connecting to the ISPs through a dia1-up connection which suggests a local Russian p ointrof origin The FBI currently possesses no information indicating that the attacker is a US person Tih ls already made in an August 21 1998 letter addressed to Acting General Counse a standard Request for Information in connection with this investigation The purpose of this letter is to add a technical assistance request so tha expert personnel can-assisttheFBI i vestigators on certain technical questions relating to 6 computer data collected by the'FB'I'r b7 The FBI legal contact point for this matter is Assistant General Counsel Please do not hesitate to call him if you require additional information thank you tor your in this matter U Sincerely 7 Associate General Counsel for National Security Affairs Referral Consult cc Den Mu urces scant Li 351 Fiji 77