Tsutomu Shimomura: A Christmas Break-In and the Mitnick Hunt
On Christmas Day 1994, while Tsutomu Shimomura was skiing at Lake Tahoe, somebody broke into his computers in San Diego with an attack most of the internet had only read about in theory.
Shimomura was a physicist, not a cop. He'd studied under Richard Feynman, built parallel computers at Los Alamos and testified to Congress about how easy it was to eavesdrop on cell phones. But he took the break-in personally.
Seven weeks later he was standing in a Raleigh apartment complex at two in the morning with a cellular-frequency scanner, and the FBI was knocking on the door of the most wanted hacker in America.
Tsutomu Shimomura at a Glance
- Born in Nagoya, Japan, in 1964 and raised in Princeton, New Jersey, Shimomura is the son of Osamu Shimomura, the chemist who shared the 2008 Nobel Prize for discovering green fluorescent protein.
- He studied physics at Caltech with Feynman, joined Los Alamos National Laboratory as a staff physicist in 1984 and moved to the San Diego Supercomputer Center in 1989.
- In 1992 he testified before a congressional committee on the lack of privacy and security in cellular telephones.
- On December 25, 1994, an intruder used IP spoofing and TCP sequence prediction to get into his home systems and steal his files and email.
- Shimomura published the technical details, and when his stolen files surfaced on The Well in Sausalito, he set up shop there and followed the intruder to Netcom and then to a cellular modem near Raleigh, North Carolina.
- Kevin Mitnick, a fugitive since 1992, was arrested in Raleigh on February 15, 1995, with Shimomura in the room at his first hearing.
- He co-wrote Takedown with John Markoff in 1996. The 2000 film version, with Russell Wong playing him, was disowned even by Markoff.
- He later founded Neofocal Systems, a fabless chip company for addressable LED lighting, and has kept a low profile since.
The Life of Tsutomu Shimomura
Shimomura's Princeton Years
Tsutomu Shimomura was born on October 23, 1964, in Nagoya, Japan, and grew up in Princeton, New Jersey, where his father, Osamu, was a research chemist. Osamu Shimomura's work on the glowing jellyfish protein GFP would win him a share of the Nobel Prize in Chemistry in 2008.
The son went to Princeton High School and then to Caltech, where he studied physics with Richard Feynman and worked with Stephen Wolfram. In the summer of 1984 he was designing disk systems for Thinking Machines, the Cambridge parallel-computing startup, and that fall he became a staff physicist at Los Alamos National Laboratory.
At Los Alamos he worked with Brosl Hasslacher on lattice gas automata, a new way of simulating fluid flow that took advantage of massively parallel machines. In 1989 he moved to the University of California, San Diego, as a research scientist and a senior fellow at the San Diego Supercomputer Center.
The Cellphone Hearing
Security was a sideline that grew. Shimomura consulted for government agencies on computer crime, and in 1992 he testified before a congressional committee chaired by Representative Edward Markey on the lack of privacy and security in cellular telephones.
He was, in other words, exactly the kind of person a certain fugitive phone phreak would want to learn from. Kevin Mitnick had been on the run from a federal probation violation since November 1992, breaking into phone companies and software firms and collecting cellular phone software along the way.
Christmas Day 1994
The attack started at 14:09 Pacific time on December 25, 1994, with probes from a machine at toad.com. Shimomura's own packet logs later showed what came next: the attacker forged packets that appeared to come from a trusted machine, guessed the TCP sequence numbers his diskless workstation would use, and slipped in as a trusted host.
Once inside with root access, the intruder hijacked an existing connection with a loadable kernel module and copied off Shimomura's files, tools and email. It was one of the first documented uses of IP spoofing in the wild, a technique Steve Bellovin had warned about years earlier.
Shimomura was in Lake Tahoe planning to spend the winter skiing. A colleague called from Tennessee to say there'd been a break-in, and they headed back to San Diego to pick through the logs.
Rather than hide the embarrassment, Shimomura presented the attack at a security conference in Sonoma on January 11, 1995, and then posted the full technical details, packet dumps and all, to Usenet. CERT issued an advisory. John Markoff wrote it up in the New York Times on January 23.
The intruder, meanwhile, left taunting voicemails.
"Ah Tsutomu, my learned disciple," one said, "I see that you put my voice on the Net. I'm very disappointed, my son." Shimomura put those online too.
The Hunt
In late January, Shimomura's stolen files turned up in an account on The Well, the Sausalito online community. He was called in, set up monitoring and watched the intruder work in real time.
- The world's most wanted hacker tells how he social-engineered his way into phone companies and software giants while the FBI closed in. Reads like a heist movie.
The trail led to Netcom, an internet provider in San Jose, where Shimomura analyzed the traffic and found the connections were coming in through a cellular modem. Working with a Sprint Cellular engineer in Raleigh, North Carolina, he correlated the data until the source was narrowed to within a kilometer.
On Sunday, February 12, he flew to Raleigh and helped phone company technicians and federal agents home in on the signal with cellular-frequency scanners. There were delays with the warrants, but at 2 a.m. on February 15, 1995, after a 24-hour stakeout, the FBI arrested Kevin Mitnick in his apartment in the suburb of Duraleigh Hills.
- The genuine RTL-SDR Blog dongle with TCXO, bias tee and metal case, plus a dipole antenna kit so you can start decoding pagers, aircraft and satellites today. Receive only.
At the hearing that day, Mitnick, in handcuffs and a black sweat suit, turned to the man he'd never met.
"Hello, Tsutomu," he said. "I respect your skills." Shimomura, 30, nodded solemnly.
Takedown
Shimomura and Markoff turned the story into Takedown: The Pursuit and Capture of America's Most Wanted Computer Outlaw, published by Hyperion in January 1996. Jonathan Littman published a rival account, The Fugitive Game, the same day, with a far more sympathetic Mitnick and a pointed suggestion that Markoff had hyped the case.
The arguments got louder when Miramax made a movie. Track Down, with Skeet Ulrich as Mitnick and Russell Wong as Shimomura, was shown in France in 2000 and features Shimomura in a brief cameo.
Markoff called it "a fundamentally dishonest movie." Mitnick settled a defamation suit over it, and Littman sued Miramax, claiming scenes had been lifted from his book.
- Published the same day as Takedown, Jonathan Littman's book draws on his own phone calls with Mitnick on the run and argues that Markoff and Shimomura oversold the case. Read both and pick a side.
Mitnick spent nearly five years in custody, pleaded guilty in 1999 and walked out of prison on January 21, 2000. He died in 2023 as a celebrated security consultant, which is one of the stranger second acts in the whole saga.
After the Chase
Shimomura never became a security celebrity, though the voicemails made him an unlikely meme: "my kung fu is stronger than yours" entered hacker folklore and the movie script. He went back to being a physicist who happened to understand networks better than most people.
He later founded Neofocal Systems, a fabless semiconductor company making chipsets for networks of individually addressable "smart LEDs" that carry power and control over a single wire, and served as its chief executive and chief technologist.
He's given few interviews since. The technical post from January 1995, still mirrored on university servers, remains the best thing ever written about the attack that started it all.
Tsutomu Shimomura: My Kung Fu Is Stronger
The Mitnick hunt is usually told as a duel between two hackers. It was really the moment the people who ran the internet discovered that the attacks in the academic papers were real, and that one angry expert with packet logs could find a ghost that the FBI had chased for more than two years.
Shimomura took his bow, wrote his book and walked away from the spotlight, which is exactly what you'd expect from a physicist who only got involved because someone touched his files.
Mitnick said it best, in handcuffs: "I respect your skills."
Kevin Mitnick: The Fugitive Who Tracked the FBI Agents Hunting Him
IP Spoofing: How Can It Be Prevented?
QUOTE:
"Amateurs hack systems, professionals hack people."