28 February 2003

See also: http://cryptome.org/cryptome-hack2.htm

Add follow up message from Jogchem de Groot.

27 February 2003

Restoration of Cryptome's deleted files is about 80% complete and should be finished later today.

Verio, Cryptome's ISP, has traced the source of the hack to the last hop, which was from a proxy apparently in Germany. The original source has not yet been determined. Cryptome received this:

Status:  U
Return-Path: <bighawk@kryptology.org>
Received: from mail5-sh.home.nl ([213.51.128.16])
	by hazard.mail.atl.earthlink.net (Earthlink Mail Service) with ESMTP id 18O4iu22T3Nl3qG0
	for <jya@pipeline.com>; Wed, 26 Feb 2003 11:20:42 -0500 (EST)
Received: from kryptology.org ([212.120.80.87]) by mail5-sh.home.nl
          (InterMail vM.5.01.05.17 201-253-122-126-117-20021021) with ESMTP
          id <20030226161822.LBYZ21571.mail5-sh.home.nl@kryptology.org>
          for <jya@pipeline.com>; Wed, 26 Feb 2003 17:18:22 +0100
Message-ID: <3E5CE841.5070808@kryptology.org>
Date: Wed, 26 Feb 2003 17:16:01 +0100
From: Jogchem de Groot <bighawk@kryptology.org>
User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.2.1) Gecko/20030109
X-Accept-Language: en-us, en
MIME-Version: 1.0
To:  jya@pipeline.com
Subject: Regarding cryptome.org defacement.
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Good afternoon,

Today the defacement of cryptome.org was brought under my attention. And 
i was unpleasently surprised that this was done under my internet-identity. 
bighawk / bighawk@kryptology.org. Most likely as an attempt to bring me into 
discredit, or to get me into trouble.

I have absolutely nothing to do with this breach. And i really regret 
that this happened and that it happened falsely with statements that i 
am behind this.

Since a few months, a few individuals have been constantly trying to 
bring me into discredit. I believe this was their next step. Until now 
these attempts were relatively innocent and could be easily ignored. 
Criminal actions as these i did not expect.

As i mentioned, i have an idea on what individuals are behind this and i 
would like to offer you all information i have which could eventually 
help identifying the responsibles.

I hope i have informed you enough with this and i hope the actual 
responsible individual(s) will be identified asap.

If you need any additional information, or if you are interested to hear 
in what information i might be able to obtain related to this. Please 
let me hear.

Kind regards,
    Jogchem

_____

Cryptome was hacked this morning, 26 February 2003. All files were deleted. They will be restored later today.

Here are automatic mirrors of Cryptome for bookmarking:

www.eu.cryptome.org
www.nl.cryptome.org
www.at.cryptome.org

Anonymous operators of these mirrors swear no access logs are kept, not even for the usual undisclosed purposes, so be sure to protect yourself there and here and all around the Net.

John Young
Cryptome Administrator
251 West 89th Street
New York, NY 10024
212-873-8700