The Cuckoo’s Egg: How a 75-Cent Error Exposed a KGB Hacker

Hackers & Hooks | Season 1, Episode 1

In 1986, an astronomer named Cliff Stoll was helping run the computers at Lawrence Berkeley Laboratory in California when his supervisor handed him a small chore: figure out why the lab’s computer usage accounts were off by 75 cents. Someone had used about nine seconds of computer time and never paid for it. Most people would have shrugged and moved on. Stoll kept pulling the thread, and it led him to a hacker in West Germany who was breaking into U.S. military computers and selling what he found to the KGB.

Stoll told the story in his 1989 book, The Cuckoo’s Egg, and it is the subject of the very first episode of Hackers & Hooks. Nick Gipson and Isaac Reed walk through what happened, why it still matters, and why the same mistakes keep showing up in small and midsize businesses four decades later.

A 75-Cent Mystery That Ended With a KGB Spy

Stoll was not a security professional. He was a scientist who learned to manage computers because his research depended on them. In 1986 there were no security vendors to call and no monitoring products to buy, so he improvised. He connected a teleprinter to the phone line the intruder was using so he could see and record every command, kept a daily logbook, and spent roughly ten months following the trail.

The trail was long. The intruder was using the lab as a stepping stone, searching other systems for files containing words like “nuclear” and “SDI” (the Strategic Defense Initiative), and reaching military computers across the United States and as far away as Okinawa, Japan. Stoll traced the connections through a defense contractor’s network in Virginia, then across the Atlantic to West Germany.

To keep the hacker online long enough for a trace, Stoll built what we would now call a honeypot: a fake account stuffed with official-sounding documents about a made-up defense project. The hacker took the bait. German authorities located Markus Hess at his home in Hanover. Hess had been selling what he found to the KGB, and he was convicted of espionage in 1990.

“Really, the smallest anomalies matter. That’s kind of the point of this entire thing.”

Isaac Reed, Hackers & Hooks

One detail stands out to Nick and Isaac. When Stoll first asked the FBI for help, the bureau showed little interest because no large sum of money was involved. A 75-cent problem did not look like a crisis. It turned out to be an international espionage case.

Default Passwords, Missing Records, and Warnings Nobody Acted On

The hacker in The Cuckoo’s Egg was persistent, but he was not a mastermind. Mostly, he walked through doors that were already open. Many administrators had never changed the factory default passwords on their systems, and on some military computers he could log in as “guest” with no password at all. He copied password files so he could guess weak passwords at his leisure, and he used a bug in a popular text editor’s mail feature to give himself full administrator control.

Just as important, the trail only existed because Stoll chose to record it. Without his printouts and logbook, there would have been nothing to follow. Nick sums up the human side of the problem this way: given the chance, people take the path of least resistance, and that is usually the least secure way to do something.

History repeated itself in 2013, when attackers got into Target’s network using credentials belonging to an outside heating and air conditioning contractor. A 2014 Bloomberg Businessweek investigation reported that the company’s security tools flagged the malware, but the alerts were not acted on. Different decade, same pattern: an easy way in, and warning signs that nobody followed up on.

For a small business today, those same gaps turn into real costs: an account that is quietly misused for months, customer data that walks out the door, downtime while systems are rebuilt, and an insurance claim that is harder to support when there is no record of what happened. Nick, who once landed a 10-pound bass in an unremarkable industrial park retention pond, put it in fishing terms: the big ones do not always live in the pretty water, and attackers rarely kick down the front door. They hide where nobody is looking.

“If I come to your network and I’m starting to do an investigation and you don’t have logs, I can’t help you. Plain and simple.”

Nick Gipson, Hackers & Hooks

Lessons for Small Businesses

• Treat small oddities as clues. A sign-in at 3 a.m., an invoice nobody recognizes, or a mailbox rule nobody remembers creating deserves a second look. Stoll’s whole case started with 75 cents.
• Turn on logging and keep it. Make sure email activity, user sign-ins, file access, and firewall traffic are being recorded and kept long enough to investigate. Without records, no one can tell you what was taken or how an attacker got in.
• Change every default password. Routers, cameras, printers, and new software often ship with a default login. Replace them, use long and unique passwords, and turn on multi-factor authentication (a second check, like a code on your phone) wherever it is offered.
• Know who and what connects to your network. Keep a simple list of the systems, vendors, and remote access tools that touch your environment, and remove access that is no longer needed. The Target breach began with a vendor’s login.
• Make sure a person owns the alerts. Security tools only help if someone reviews what they flag and acts on it, including nights, weekends, and holidays.

How Gipson Cyber Helps

Most small businesses do not have a Cliff Stoll on staff, and they should not need one. Gipson Cyber’s Business SOCaaS provides 24/7 cybersecurity monitoring for small business, with real human responders reviewing what your systems flag instead of letting alerts pile up. We work with the tools you already have, alongside your existing IT team or MSP rather than in place of them, and we report what we find in clear, plain language.

If something has already gone wrong, our Business DFIR team provides small business incident response: helping contain the threat, preserving evidence, and working out what happened so you can make informed decisions about recovery. If you think you are being hacked right now, go to 800cyber.com.

No one can promise that an attacker will never get in. What you can control is whether someone is watching and whether you have the records to understand what happened.