6:20:09 A.M. EST
At about six in the morning, Mark Zuckerberg searches for "universal facebook” on Google,
finding the Universal Face Book on the Quincy House houseSYSTEM web site.
roam175-29.student.harvard.edu - - [06/Jan/2004:06:20:09 -0500] "GET /facebook/ HTTP/1.1" 200 5436
"http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=universal+facebook&btnG=Google+Search"
"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5) Gecko/20031007 Firebird/0.7"
Then he knows about the search term because of the referrer being logged in his HTTP server logs. This is the standard Combined Log Format. http://httpd.apache.org/docs/1.3/logs.html#combined describes each field if you're curious about the others.
Thanks! I guess now I don't understand how he was able to associate roam175-29.student.harvard.edu with Zuckerberg. But probably that is a small deduction game for such a hacker! (No sarcasm, just in case.)
Comments
In the timeline you present, how did you get access to the Google sarches Zuckerberg did while he was a student?
If you're talking about the following:
Then he knows about the search term because of the referrer being logged in his HTTP server logs. This is the standard Combined Log Format. http://httpd.apache.org/docs/1.3/logs.html#combined describes each field if you're curious about the others.Thanks! I guess now I don't understand how he was able to associate roam175-29.student.harvard.edu with Zuckerberg. But probably that is a small deduction game for such a hacker! (No sarcasm, just in case.)
When a member signed in their hostname was recorded in the database with a timestamp. The Apache logs, database fields and database timestamps match.