Book Review: The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage

The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage is one of the best books I have read in a long time. In it, Cliff Stoll tells the true story of how an investigation into a 75 cent accounting error at Lawrence Berkeley Laboratory in California led him to track an international computer hacker, into a world of money, drugs, and computer espionage. Despite being set in the mid 1980s, Stoll’s story still has great value today. With “cyber-warfare” and “cyber-terrorism” being at the top of many Western countries’ agendas, and in the wake of the recent Stuxnet and Flame viruses, the issues raised here are as relevant now as they have ever been.

ITGS students will also find the book helps cement their understanding of many technical concepts. ITGS students will be familiar with networking and security, but Stoll really brings these alive, clearly explaining how the hacker moved from machine to machine, country to country, and why it was so hard to trace him. No technical background is assumed, and Stoll makes it easy to understand complex systems such as the hierarchical structure of networks or the encryption systems used for password security. Even the hacker’s primary attack method – exploiting a bug in the Emacs editor to perform an elevation of privileges attack – is easy to understand on the first read.

The Cuckoo’s Egg is also an excellent example of how law enforcement often fails to keep up with modern technology. At the time of the attacks – the mid 1980s – computer hacking was not a crime in many places, and as Stoll homes in on the hacker he meets constant indifference from the FBI, the CIA, and even the NSA – in part because of the legal difficulties of prosecuting a person in one country for a computer crime committed in another. Echoes of this can be seen in the current Gary McKinnon case.

Perhaps The Cuckoo’s Egg’s greatest value is the removal of the mystique surrounding computer hacking. Stoll describes how the attacker gained access to networks not through any kind of technological magic, but through exploiting security holes such as poor or non-existent passwords, or old accounts that were not disabled – problems that exist on many machines even today. Stoll’s accounts of system managers who are warned of security breaches but fail to patch their software, or repeatedly deny security problems exist, would not be out of place in many modern organisations.

The next time an ITGS student asks me “How do you hack into a computer?”, I will hand them a copy of this book. Thoroughly recommended.

The Cuckoo’s Egg is available from Amazon (including a Kindle version and even an audio version) and from Book Depository (who have free worldwide shipping).

Summary

Reviewer

Stuart Gray

Review Date

2012-08-12