17/11/2025
Let me tell you a story about the time I was involved in a cyber security investigation long before that was even a thing.
It was 1990 and I was working at Sun Microsystems in Milpitas, California. I was a Failure Analysis technician working on new products in a production environment. One morning I came to work and checked my email only to find a scathing, anonymous critique of one of my colleagues. The email was not just harsh, it was cruel. The author had written a scathing take-down of this gentle, unassuming fellow we worked with. This email was sent to everyone on our team on swing shift the evening before. Another fellow I worked with was as irritated by this anonymous critique as much as I was, so we became determined to find the culprit.
Anonymity in this situation was achieved by sending this cruel email missive from one of the failure analysis test benches. Each work bench had two diskless (network boot) clients and two local boot systems. This way a CPU could be placed into a test rack and quickly booted for testing purposes. These systems were also on the real network, meaning that someone could log in as root and then send an email to a real email address on the network. The sender of such an email might show up as something like root@bench12, where "bench12" is a diskless client assigned to a particular work bench.
Now normally finding the author would just be a matter of figuring out which workbench was assigned this diskless client, then finding out who was working at that bench. However, this email was sent from a diskless client associated with the thermal test station. This station was used by everyone.
First we asked around. We knew what time the email had been authored (something like 9:00 PM), so we asked if anyone knew who was working there at that time. But sadly, no one had noticed.
Next we booted a CPU on that diskless client. With that system up, we were able to retrieve the boot logs by issuing the dmesg command. This printed to the screen the boot logs. We were quickly able to find the boot log that immediately preceded the email, but what could we do with that? Well, it did reveal one item of interest, the MAC address, a unique 12 character identifier associated with the network interface.
With the MAC address we were able to take the next step. We had access to an internal database that associated a MAC address with a particular CPU's serial number. This was used when the real time clock had to be replaced, as the clock also held battery-backed memory where the MAC address was stored.
Now with the board's serial number in hand, we were able to take the next step. We logged into the Shop Floor System (SFS) to find that CPU board. Through this system we were able to find the manufacturing ID of the person who had ordered this board from the failed inventory the night before. This manufacturing ID was something like mfg4 and was unique to an individual. This didn't though reveal the person's name.
The final step was to retrieve the list of manufacturing IDs from one of the supervisors, which they gladly shared. With this we had our name.
We sent an email to the entire group connecting the dots. The culprit did finally admit to sending the email. I don't know if anyone in management spoke to him about it, but I don't think he ever apologized. There was some satisfaction though in exposing him.
I hope you enjoyed this story.
