California hacker charged, the rest are at large

July 20, 2004

A 20-year-old man from California State has been charged with hacking government computers, including two agencies within the Defense Department, and breaking into government Web sites.

Robert Lyttle was indicted by a federal grand jury on Thursday. He is accused of unlawfully accessing computer systems of the Department of Defense's Defense Logistic Information Service and Office of Health Affairs and NASA's Ames Research Center in April 2002.

The maximum sentence is 10 years in prison and a fine of USD250,000. Lyttle is back before Judge Maria-Elena James on Monday for arraignment - he will familiarize himself with the charges brought against him and enter a plea. The case is being overseen by the Computer Hacking and Intellectual Property unit of the US Attorney's office, and follows an FBI investigation.

In April 2002, the Deceptive Duo claimed to be a hacking group on a mission to expose the lack of security within the U.S. government's networks as well as other private-sector computer systems. The group said it had gained access to classified and non-classified systems.

The government has charged Lyttle with gaining unauthorized accessed to DLIS computers in Battle Creek, Michigan for the purpose of obtaining files that he later used to deface an OHA website hosted on computers in San Antonio, Texas. Furthermore, Lyttle is accused of hacking into the NASA ARC computer at Moffett Field, California, to obtain information that he then used to deface a Web site hosted on the computer. The US government estimates the cost of repairing the damage at USD70,000.

At the time the hacking took place, the Deceptive Duo said it had used a default password to logon to sites using Microsoft Corp.'s SQL servers. It also breached systems by using the NetBIOS Brute Force attack method, it which a hacker has to repeatedly guess passwords to gain entry into a system using the NetBIOS protocol, the group said.

In separate event, Benjamin Stark, Lyttle's alleged hacking partner, was charged in May and pleaded guilty to 11 offences. He will be sentenced in September as he faces 24 to 30 months in custody. They dubbed themselves "the Deceptive Duo." Lyttle could not be reached for comment.