Tracing the path was simple: all emails addressed to his "nyt.com" address were sent to Internex, a small Internet service provider in Northern California. After probing the Internex Solaris server for a few minutes, I sighed with relief. The idiot administrating the system exported everyone’s home directory (using Sun’s Network File System) to everyone on the Internet, meaning I could remotely mount any user’s home directory—that is, make the entire directory accessible to my local system. I uploaded a .rhosts file to a user’s directory—which I configured to trust any user connecting in from any host, meaning I was able to log in to his or her account without needing a password. Once logged in, I was able to exploit another vulnerability to gain root access. It took a total of ten minutes. I almost wanted to send the system admin a thank-you letter for leaving the system wide open.