Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I remember that Clifford Stoll wrote a book called "The Cuckoo's Egg".

In the book, the reader follows him as he pursues a hacker through networks across the world. I seem to recall that the title phrase actually has some meaning with regards to his or the hacker's actions. However, I can't remember exactly what it means.

What is the meaning of "Cuckoo's Egg" in the context of IT Security? Is it a term in common use, or was it more likely something created out of artistic license? Google hasn't been any help to me.

share|improve this question

closed as off topic by Iszi, Ninefingers, Scott Pack, Rory Alsop Aug 14 '12 at 13:18

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question. – user11080 Jul 6 '12 at 4:47

The term has two meanings.

In it's original meaning in the book, it is a malware program that an attacker uses to replace a legitimate program - like a cuckoo laying it's eggs in another bird's nest .
More specifically, it was a replacement for atrun, which is executed every 5 minutes - meaning the attacker had to wait at most 5 minutes before his malicious code was executed. Stoll refers to this as the "hatching" of the cuckoo's egg.

From pg 123 of "The Cuckoo's Egg":

I watched the cuckoo lay its egg: once again, he manipulated the files in my computer to make himself super-user. His same old trick: use the Gnu-Emacs move-mail to substitute his tainted program for the system's atrun file. Five minutes later, shazam! He was system manager.

The other meaning of the term is a music file that has a contents other than it's title suggests, put on file-sharing networks in an effort to combat piracy. See the footnote in the Wikipedia article about Stoll's book.

In both meanings, it is a file whose contents is different from what is expected.

share|improve this answer
Good answer. I'd like to see some elaboration though, with regards to whether or not this term is in actual use within the global IT Security community. It may also be nice to add in some explanation as to how the behavior in the first definition actually resembles the real Cuckoo's behavior in nature, for those unfamiliar with it. – Iszi Jul 6 '12 at 12:45
@Iszi Thanks! I have added the info about cuckoos. I'm pretty sure people use "Trojan" instead of "cuckoo's egg" these days, but I cannot back that up. – S.L. Barth Jul 6 '12 at 13:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.