--- title: The Cuckoo's Egg link: https://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg_(book) source: lobste-rs published: 2026-09-30T08:48:43Z updated: 2026-09-30T08:48:43Z first_seen: 2026-10-01T19:33:44.897168732Z authors: - en.wikipedia.org via atmosx labels: - book - security summary: Comments content: extracted html: 2026-09-30-the-cuckoo-s-egg.html preview: file: 2026-09-30-the-cuckoo-s-egg.preview-b7039683e56b.webp width: 173 height: 256 color: '#381b20' images: - source: https://upload.wikimedia.org/wikipedia/en/2/28/The_Cuckoo%27s_Egg.jpg?utm_source=en.wikipedia.org&utm_campaign=index&utm_content=thumbnail_unscaled original: file: 2026-09-30-the-cuckoo-s-egg.image-e6603b9ca81c.jpg width: 260 height: 384 color: '#010102' - source: https://upload.wikimedia.org/wikipedia/en/2/28/The_Cuckoo%27s_Egg.jpg?utm_source=en.wikipedia.org&utm_campaign=parser&utm_content=thumbnail_unscaled original: file: 2026-09-30-the-cuckoo-s-egg.image-e6603b9ca81c.jpg width: 260 height: 384 color: '#010102' --- From Wikipedia, the free encyclopedia This article is about the cybersecurity book by Clifford Stoll. For other uses, see [Cuckoo's egg](https://en.wikipedia.org/wiki/Cuckoo's_egg_\(disambiguation\) "Cuckoo's egg (disambiguation)"). The Cuckoo's Egg | Author | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [![](https://upload.wikimedia.org/wikipedia/en/2/28/The_Cuckoo%27s_Egg.jpg?utm_source=en.wikipedia.org&utm_campaign=parser&utm_content=thumbnail_unscaled)](https://en.wikipedia.org/wiki/File:The_Cuckoo's_Egg.jpg) | | English | | [Doubleday](https://en.wikipedia.org/wiki/Doubleday_\(publisher\) "Doubleday (publisher)") | | 1989 | | United States | | Print | | 326 | | [0-385-24946-2](https://en.wikipedia.org/wiki/Special:BookSources/0-385-24946-2 "Special:BookSources/0-385-24946-2") | | [43977527](https://www.worldcat.org/oclc/43977527) | | 364.16/8/0973 21 | | UB271.R92 H477 2000 | ***The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage*** is a 1989 book written by [Clifford Stoll](https://en.wikipedia.org/wiki/Clifford_Stoll "Clifford Stoll"). It is his [first-person](https://en.wikipedia.org/wiki/First-person_narrative "First-person narrative") account of the hunt for [Markus Hess](https://en.wikipedia.org/wiki/Markus_Hess "Markus Hess"), a [computer hacker](https://en.wikipedia.org/wiki/Hacker_\(computer_security\) "Hacker (computer security)") who broke into a computer at [Lawrence Berkeley National Laboratory](https://en.wikipedia.org/wiki/Lawrence_Berkeley_National_Laboratory "Lawrence Berkeley National Laboratory") (LBNL). Stoll's use of the term extended the metaphor [*cuckoo's egg*](https://en.wikipedia.org/wiki/Cuckoo's_egg_\(metaphor\) "Cuckoo's egg (metaphor)") from [brood parasitism](https://en.wikipedia.org/wiki/Brood_parasitism "Brood parasitism") in birds to [malware](https://en.wikipedia.org/wiki/Malware "Malware"). Author Clifford Stoll, an [astronomer](https://en.wikipedia.org/wiki/Astronomer "Astronomer") by training, managed computers at [Lawrence Berkeley National Laboratory](https://en.wikipedia.org/wiki/Lawrence_Berkeley_National_Laboratory "Lawrence Berkeley National Laboratory") (LBNL) in California. One day in 1986 his supervisor asked him to resolve an accounting error of 75 cents in the computer usage accounts. Stoll traced the error to an unauthorized user who had apparently used nine seconds of computer time and not paid for it. Stoll eventually realized that the unauthorized user was a hacker who had acquired [superuser](https://en.wikipedia.org/wiki/Superuser "Superuser") access to the LBNL system by exploiting a vulnerability in the [movemail](https://en.wikipedia.org/wiki/Movemail "Movemail") function of the original [GNU Emacs](https://en.wikipedia.org/wiki/GNU_Emacs "GNU Emacs"). Early on, and over the course of a long weekend, Stoll rounded up fifty terminals, as well as [teleprinters](https://en.wikipedia.org/wiki/Teleprinter "Teleprinter"), mostly by "borrowing" them from the desks of co-workers away for the weekend. He physically attached them to the fifty incoming phone lines at LBNL. When the hacker dialed in that weekend, Stoll located the phone line used, which was coming from the [Tymnet](https://en.wikipedia.org/wiki/Tymnet "Tymnet") routing service. With the help of Tymnet, he eventually tracked the intrusion to a call center at [MITRE](https://en.wikipedia.org/wiki/Mitre_Corporation "Mitre Corporation"), a defense contractor in [McLean, Virginia](https://en.wikipedia.org/wiki/McLean,_Virginia "McLean, Virginia"). Over the next ten months, Stoll spent enormous amounts of time and effort tracing the hacker's origin. He saw that the hacker was using a 1200 [baud](https://en.wikipedia.org/wiki/Baud "Baud") connection and realized that the intrusion was coming through a telephone [modem](https://en.wikipedia.org/wiki/Modem "Modem") connection. Stoll's colleagues, Paul Murray and Lloyd Bellknap, assisted with the phone lines. After returning his "borrowed" terminals, Stoll left a teleprinter attached to the intrusion line in order to see and record everything the hacker did. He watched as the hacker sought — and sometimes gained — unauthorized access to military bases around the United States, looking for files that contained words such as "nuclear" or "[SDI](https://en.wikipedia.org/wiki/Strategic_Defense_Initiative "Strategic Defense Initiative")" (Strategic Defense Initiative). The hacker also copied password files (in order to make [dictionary attacks](https://en.wikipedia.org/wiki/Dictionary_attack "Dictionary attack")) and set up [Trojan horses](https://en.wikipedia.org/wiki/Trojan_horse_\(computing\) "Trojan horse (computing)") to find passwords. Stoll was amazed that on many of these high-security sites the hacker could easily guess passwords, since many [system administrators](https://en.wikipedia.org/wiki/System_administrator "System administrator") had never bothered to change the passwords from their factory [defaults](https://en.wikipedia.org/wiki/Default_password "Default password"). Even on military bases, the hacker was sometimes able to log in as "guest" with no password. This was one of the first—if not *the* first—documented cases of a computer break-in, and Stoll seems to have been the first to keep a daily logbook of the hacker's activities. Over the course of his investigation, Stoll contacted various agents at the [Federal Bureau of Investigation](https://en.wikipedia.org/wiki/Federal_Bureau_of_Investigation "Federal Bureau of Investigation") (FBI), the [Central Intelligence Agency](https://en.wikipedia.org/wiki/Central_Intelligence_Agency "Central Intelligence Agency") (CIA), the [National Security Agency](https://en.wikipedia.org/wiki/National_Security_Agency "National Security Agency") (NSA), and the [United States Air Force Office of Special Investigations](https://en.wikipedia.org/wiki/United_States_Air_Force_Office_of_Special_Investigations "United States Air Force Office of Special Investigations") (OSI). At the very beginning there was confusion as to jurisdiction and a general reluctance to share information; the FBI in particular was uninterested as no large sum of money was involved and no [classified information](https://en.wikipedia.org/wiki/Classified_information "Classified information") host was accessed. Studying his log book, Stoll saw that the hacker was familiar with [VAX/VMS](https://en.wikipedia.org/wiki/VAX/VMS "VAX/VMS"), as well as [AT&T Unix](https://en.wikipedia.org/wiki/Unix "Unix"). He also noted that the hacker tended to be active around the middle of the day, [Pacific time](https://en.wikipedia.org/wiki/Pacific_Time_Zone "Pacific Time Zone"). Eventually Stoll hypothesized that, since modem bills are cheaper at night and most people have school or a day job and would only have a lot of free time for hacking at night, the hacker was in a time zone some distance to the east, likely beyond the US East Coast. With the help of Tymnet and agents from various agencies, Stoll found that the intrusion was coming from [West Germany](https://en.wikipedia.org/wiki/West_Germany "West Germany") via satellite. The West German post office, the *[Deutsche Bundespost](https://en.wikipedia.org/wiki/Deutsche_Bundespost "Deutsche Bundespost")*, had authority over the phone system there, and traced the calls to a university in [Bremen](https://en.wikipedia.org/wiki/Bremen "Bremen"). In order to entice the hacker to reveal himself, Stoll set up an elaborate hoax—known today as a [honeypot](https://en.wikipedia.org/wiki/Honeypot_\(computing\) "Honeypot (computing)")—by inventing a fictitious department at LBNL that had supposedly been newly formed by an "SDI" contract, also fictitious. When he realized the hacker was particularly interested in the faux SDI entity, he filled the "SDInet" account (operated by an imaginary secretary named "Barbara Sherwin") with large files full of impressive-sounding [bureaucratese](https://en.wikipedia.org/wiki/Administratium "Administratium"). The ploy worked, and the *Deutsche Bundespost* finally located the hacker at his home in [Hanover](https://en.wikipedia.org/wiki/Hanover "Hanover"). The hacker's name was [Markus Hess](https://en.wikipedia.org/wiki/Markus_Hess "Markus Hess"), and he had been engaged for some years in selling the results of his hacking to the [Soviet Union](https://en.wikipedia.org/wiki/Soviet_Union "Soviet Union")'s civilian intelligence agency, the [KGB](https://en.wikipedia.org/wiki/KGB "KGB"). There was ancillary proof of this when a Hungarian [agent](https://en.wikipedia.org/wiki/Espionage "Espionage") contacted the fictitious SDInet at LBNL by mail, based on information he could only have obtained through Hess. Apparently this was the KGB's method of double-checking to see if Hess was just making up the information he was selling. Stoll later flew to West Germany to testify at the trial of Hess. ## References in popular culture \[ [edit](https://en.wikipedia.org/w/index.php?title=The_Cuckoo%27s_Egg_\(book\)&action=edit§ion=2 "Edit section: References in popular culture")\] - The book was chronicled in an episode of [WGBH](https://en.wikipedia.org/wiki/WGBH-TV "WGBH-TV")'s *[NOVA](https://en.wikipedia.org/wiki/Nova_\(American_TV_series\) "Nova (American TV series)")* entitled "The KGB, the Computer, and Me", which aired on [PBS](https://en.wikipedia.org/wiki/Public_Broadcasting_Service "Public Broadcasting Service") stations on October 3, 1990. Stoll and several of his co-workers participated in re-enactments of the events described.\[*[citation needed](https://en.wikipedia.org/wiki/Wikipedia:Citation_needed "Wikipedia:Citation needed")*\][^1] - Another documentary, *Spycatcher*, was made by [Yorkshire Television](https://en.wikipedia.org/wiki/Yorkshire_Television "Yorkshire Television").[^1] - The number sequence mentioned in Chapter 48 has become a popular math puzzle, known as the Cuckoo's Egg, the Morris Number Sequence, or the [look-and-say sequence](https://en.wikipedia.org/wiki/Look-and-say_sequence "Look-and-say sequence"). - In the summer of 2000 the name "Cuckoo's Egg" was used to describe a file sharing hack attempt that substituted white noise or sound effects files for legitimate song files on Napster and other networks.[^2] - These events are referenced in [Cory Doctorow](https://en.wikipedia.org/wiki/Cory_Doctorow "Cory Doctorow")'s [speculative fiction](https://en.wikipedia.org/wiki/Speculative_fiction "Speculative fiction") short story "The Things that Make Me Weak and Strange Get Engineered Away", as "(a) [sysadmin](https://en.wikipedia.org/wiki/Sysadmin "Sysadmin") who'd tracked a $0.75 billing anomaly back to a foreign spy-ring that was using his systems to hack his military."[^3] - [Cyberpunk: Outlaws and Hackers on the Computer Frontier](https://en.wikipedia.org/wiki/Cyberpunk:_Outlaws_and_Hackers_on_the_Computer_Frontier "Cyberpunk: Outlaws and Hackers on the Computer Frontier")   – 1991 nonfiction book by Katie Hafner and John Markoff - *[23](https://en.wikipedia.org/wiki/23_\(film\) "23 (film)")*—a film made from the hackers' viewpoint - [Digital footprint](https://en.wikipedia.org/wiki/Digital_footprint "Digital footprint") - [Karl Koch (hacker)](https://en.wikipedia.org/wiki/Karl_Koch_\(hacker\) "Karl Koch (hacker)") - [Image of 1st Edition Cover—Doubleday](https://www.nlm.nih.gov/archive/20120104/onceandfutureweb/database/secb/case5-artifacts/photo10.html) - ["Stalking the Wily Hacker"](http://pdf.textfiles.com/academics/wilyhacker.pdf)—The author's original article about the trap - [*Booknotes* interview with Stoll on *The Cuckoo's Egg*, December 3, 1989](https://www.c-span.org/video/?10122-1/cuckoos-egg) - [Reference to the book on Internet Storm Center](http://isc.sans.org/diary.php?storyid=1996) - [West German hackers use Columbia's Kermit software to break into dozens of US military computers and capture information for the KGB](http://www.columbia.edu/cu/computinghistory/#cuckoosegg), Columbia University Computing History, 1986-1987 section. [^1]: [Richard Stoll's Personal Webpage on TV adaptations](http://www.ocf.berkeley.edu/~stoll/nova_show.html)( [Archived](https://web.archive.org/web/20110806122326/http://www.ocf.berkeley.edu/~stoll/nova_show.html) August 6, 2011, at the [Wayback Machine](https://en.wikipedia.org/wiki/Wayback_Machine "Wayback Machine")) [^2]: ["Cuckoo's Egg Project Home Page"](http://www.hand-2-mouth.com/). *www.hand-2-mouth.com*. [^3]: ["The Things that Make Me Weak and Strange Get Engineered Away"](http://www.tor.com/2008/08/06/weak-and-strange/). Tor.com. Edited 2015-06-24.