Prior to meeting the agents, Bach and Handel prepared a report, dated August 17, 1987, detailing all the installations that had been penetrated by the VAXbusters. The list comprised 135 sites in total, all on SPAN, and included nineteen installations at NASA, including two VAX sites at their headquarters in Washington, D.C., six at the Goddard Space Flight Center, and ten at the Marshall Space Flight Center. It also included a large number of systems at CERN in Switzerland, and others at the European Space Agency in the Netherlands, the Meudon Observatory and the Institut d'Astrophysique in Paris, and various Max Planck Institute sites in Germany.
There was a full exchange of information at the meeting, and in return for Bach and Handel's cooperation, the authorities declined to prosecute. The secret service then contacted the CIA in Bonn, as well as NASA, DEC, and other groups that the agency felt should be informed.
In the hope of defusing the situation for the VAXbusters, it was decided that their story should be released to the press on September 15th. The delay, it was thought, would give all the affected sites enough time to repair their defenses. Gliss would cover the technical aspects in the Datenschutz-Berater and two journalists who were known to Wernery would handle the media. On the designated day, the journalists told the full story on the evening news; the next morning it made newspaper headlines around the country.
A few days later the two journalists had a second chance at the story when it was realized that NASA had still not removed the VAXbusters' programs (the "trap" programs) from its two computers at its Washington headquarters. Nor had it installed the mandatory patches. So another event was staged for German television audiences. This time, in front of the cameras, Bach and Handel broke into the two NASA computers in Washington, D.C., and installed the mandatory patches that DEC had issued four months earlier. It took a matter of minutes in each case. The hackers had fixed the security flaw that NASA could not be bothered to fix for itself.
A spokesman for NASA in Washington, D.C., was not impressed. The loophole in the operating system was not a "security flaw," he insisted. The information on the computers was not classified: it was just scientific data, for the use of scientists. The two computers were, he said, "like a public library."
The VAXbusters knew differently. With the higher privileges they had been able to manipulate from the multitude of IDs and passwords they had copied, they had the authority of the chief librarian in NASA's library. They had roamed through the offlimits sections of the shelves; one of the files they had copied was a fifty-two-page document outlining the security within the entire NASA computer system.
The story, despite the Americans' professed indifference, got heavy play. Steffen found himself on television more than once, explaining the arcana of hacking and his own role in the VAXbuster saga. Eventually the media interest waned; and that, Steffen assumed, was that. He was not aware of the Illuminati.
The French were less phlegmatic than the Americans They had been suffering some "very serious" hacking incidents that had begun in 1986 and were still continuing in 1987. The incidents included the theft and destruction of important programs and data from VAX computers at Philips-France and SGS-Thom son--the two French companies targeted by the KGB. Their total losses, they claimed, reached an astronomical level, some hundreds of millions of dollars.
When the French authorities were told about the VAXbusters they became convinced that the German hackers were the culprits. The penetration techniques used on the French VAXen were the same as those described in the August report made by the German secret service. The same back door and the same sort of program to collect legitimate user IDs and passwords were used.
