Copy Link
Add to Bookmark
Report
Phrack Inc. Volume 02 Issue 21 File 10
==Phrack Inc.==
Volume Two, Issue 21, File 10 of 11
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
PWN The Legacy... ...Lives On PWN
PWN Phrack World News PWN
PWN Issue XXI/1 PWN
PWN PWN
PWN Created by Knight Lightning PWN
PWN PWN
PWN Written and Edited by PWN
PWN Knight Lightning and Epsilon PWN
PWN PWN
PWN The Future... ...Is Forever PWN
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
On The Edge Of Forever November 4, 1988
~~~~~~~~~~~~~~~~~~~~~~
Greetings and welcome to Phrack World News Issue XXI! As most of you have
realized, Taran King and I are back to stay and the tradition of Phrack Inc.
lives on. November 17, 1988 marks the Three Year Anniversary of Phrack Inc.
and we have never been prouder of our efforts to bring you the best magazine
possible.
However, we can not do it alone. Both Taran King and I have been reduced to
completely legal status and can not afford the luxury of calling bulletin
boards or contacting all the people we would like too.
Epsilon has been helping us a lot by acting as the collection agency for many
of the files for Phrack and several news articles as well. Please, if you have
a file for Phrack Inc. or an article for PWN contact him or leave mail for The
Mentor. And speaking of The Mentor, The Phoenix Project has a new number;
(512) 441-3088. Be sure to give it a call.
The article about Pacific Bell in this issue may contain some information that
has been seen before. Regardless of that, PWN is a place where such
information can be indexed for later reference and helps keep important events
and happenings in a certain continuity which is beneficial to everyone.
This issue of Phrack features the Second Special Presentation of Phrack World
News, which contains the abridged edition of the WGN Radio Show that dealt with
computer hackers and features John Maxfield.
With regard to the file about Teleconnect Long Distance. Hatchet Molly says
that now Teleconnect "flags" suspect bulletin boards and if a Teleconnect
calling card is used to call one, the card number is cancelled and a new card
is mailed to the customer within three days. What a wonderful company policy
that is.
For the months ahead, I am working on a file about hackers abroad, mostly
focusing on the Chaos Computer Club, which I have begun to have strong
relations with, and some other hacker instances in Europe and other parts of
the world.
Scheduled for January/February is a file series on the Wide Area Networks;
Bitnet and quite possibly ARPAnet, MILInet, NSFnet, IBM's VNET, CCnet, UUCP,
CSnet, SPAN, JANet, JUNet, and the list goes on. The main emphasis will be on
Bitnet though with secondary emphasis on UUCP and the other networks.
Hope you enjoy this issue and remember... "The Future Is Forever"
:Knight Lightning
_______________________________________________________________________________
Pacific Bell Means Business October 6, 1988
~~~~~~~~~~~~~~~~~~~~~~~~~~~
The following information originally appeared in WORM Newsletter, a publication
produced and distributed by Sir Francis Drake. The series of memos presented
here are shown to enable the members of today's hacking community to fully
understand the forces at work that seek to bring them down. The memo(s) have
been edited for this presentation. -KL
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Copy For: Roland Donaldson August 3, 1987
Subject: Unauthorized Remote Computer Access
San Francisco, July 29, 1987
Case Nos.: 86-883, 87-497
T. M. CASSANI, Director-Electronic Operations:
Electronic Operations recently investigated two cases involving a number of
sophisticated hackers who were adept at illegally compromising public and
private sector computers. Included among the victims of these hackers was
Pacific Bell, as well as other local exchange carriers and long distance
providers.
Below is a synopsis of the two cases (87-497 and 86-883), each of which
demonstrate weaknesses in Pacific Bell's remote access dial-up systems.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Case No. 87-497
---------------
On May 14, 1987, Electronic Operations received a court order directing Pacific
Bell to place traps on the telephone numbers assigned to a company known as
"Santa Cruz Operations." The court order was issued in order to identify the
telephone number being used by an individual who was illegally entering Santa
Cruz Operations' computer and stealing information.
On May 28, 1987, a telephone number was identified five separate times making
illegal entry into Santa Cruz Operations' computer. The originating telephone
number was 805-PRE-SUFF, which is listed to Jane Doe, 8731 W. Cresthill Drive,
Apt. 404, Thousand Oaks, California.
On June 3, 1987, a search warrant was served at 8731 W. Cresthill Drive, Apt
404, Thousand Oaks, California. The residents of the apartment, who were not
at home, were identified as Jane Doe, a programmer for General Telephone, and
Kevin Hacker, a known computer hacker. Found inside the apartment were three
computers, numerous floppy disks and a number of General Telephone computer
manuals.
Kevin Hacker was arrested several years ago for hacking Pacific Bell, UCLA and
Hughes Aircraft Company computers. Hacker was a minor at the time of his
arrest. Kevin Hacker was recently arrested for compromising the data base of
Santa Cruz Operations.
The floppy disks that were seized pursuant to the search warrant revealed
Mitnick's involvment in compromising the Pacific Bell UNIX operation systems
and other data bases. The disks documented the following:
o Hacker's compromise of all Southern California SCC/ESAC computers. On
file were the names, log-ins, passwords, and home telephone numbers for
Northern and Southern ESAC employees.
o The dial-up numbers and circuit identification documents for SCC computers
and Data Kits.
o The commands for testing and seizing trunk testing lines and channels.
o The commands and log-ins for COSMOS wire centers for Northern and Southern
California.
o The commands for line monitoring and the seizure of dial tone.
o References to the impersonation of Southern California Security Agents and
ESAC employees to obtain information.
o The commands for placing terminating and originating traps.
o The addresses of Pacific Bell locations and the Electronic Door Lock
access codes for the following Southern California central offices ELSG12,
LSAN06, LSAN12, LSAN15, LSAN23, LSAN56, AVLN11, HLWD01, HWTH01, IGWD01,
LOMT11, AND SNPD01.
o Inter-company Electronic Mail detailing new login/password procedures and
safeguards.
o The work sheet of an UNIX encryption reader hacker file. If successful,
this program could break into any UNIX system at will.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Case No. 86-883
---------------
On November 14, 1986, Electronic Operations received a search warrant directing
Pacific Bell to trap calls being made to the Stanford University computer. The
Stanford Computer was being illegally accessed and was then being used to
access other large computer systems throughout the country.
The calls to the Stanford Computer were routed through several different common
carriers and through numerous states. Through a combination of traps, traces
and sifting through information posted on the Stanford computer, several
suspects were identified throughout the United States.
The group of computer hackers who illegally accessed the Stanford computer
system were known as "The Legion of Doom." Subsequent investigation indicated
that the Legion of Doom was responsible for:
o The use of Stanford University high-speed mainframes to attack and hack
ESAC/SCC mini compuuters with an UNIX password hacker file. Password
files were then stored on the Stanford systems for other members of the
Legion of Doom to use. Login and passwords for every local exchange
carrier as well as AT&T SCC/ESAC mini computers were on file.
o The Legion of Doom used the Stanford computers to enter and attack other
institutions and private contractors' computers. Some of the contractors'
computers were used for national defense research.
On July 21, 1987, eight search warrants were served in three states at homes
where members of the Legion of Doom reside. Three of the searches were
conducted in California. Steve Dougherty, Senior Investigator-Electronic
Operations, accompanied Secret Service agents at the service of a search
warrant at 2605 Trousdale Drive, Burlingame, California, which was the
residence of Stan QUEST, a sixteen-year-old member of the Legion of Doom.
(Correction - Oryan QUEST has never been a member of the Legion Of Doom. -KL)
Dougherty interviewed QUEST, who had used the pseudonym "O'Ryan Quest," (Oryan
QUEST) when accessing computers. During the interview, QUEST admitted the
following:
o The entering of central offices, (Burlingame, San Mateo, San Bruno,
Millbrae) disguised as a Federal Express deliveryman. The entries were
done to case out the CO's for the purpose of finding computer terminals
with telephones, the locations of switches and bays, the names of
Comtechs, and materials related to the operations of the central office.
QUEST also claimed to have been in the AT&T Administration office on
Folsom Street, San Francisco.
o QUEST's telephone service had been disconnected twice for nonpayment, and
twice he had his service restored by impersonating a service
representative.
o Learning to test circuits and trunks with his computer by using ROTL and
CAROT test procedures.
o Members of the Legion of Doom often accessed test trunks to monitor each
other's lines for fun.
o On several occasions QUEST would post the telephone number of a public
coin phone for access to his BBS, Digital IDS. He would then access teh
Millbrae COSMOS wire center and add call forwarding to the coin phone. He
would activate the call forwarding to his home telephone number, securing
the identity of his location.
o QUEST would impersonate an employee who had authorization to use a Data
Kit and have it turned on for him. When he was done, he would call back
and have the Data Kit turned off.
o QUEST also would use his knowledge to disconnect and busyout the telephone
services of individuals he did not like. Further, he would add several
custom calling features to their lines to create larger bills.
o It was very easy to use the test trunks with his computer to seize another
person's dial tone and make calls appear on their bills. QUEST did not
admit charging 976 calls to anyone, but he knew of others who did.
o When the Legion of Doom attacked a computer system, they gave themselves
five minutes to complete the hacking. If they were not successful in five
minutes, they would attempt another system. The Legion of Doom was able
to crack a computer in under five minutes approximately 90% of the time.
o QUEST would impersonate employees to get non-published telephone listings.
QUEST received the non-published listing for Apple Computer Founder, Steve
Wozniak, and members of The Beastie Boys rock group.
o QUEST told Dougherty of one New York member of the Legion of Doom, "Bill
from Arnoc," (Bill From RNOC) who has been placing his own traps in New
York. Bill from Arnoc (Bill From RNOC) helped QUEST place traps in
Pacific Bell.
(Gee Stan, you forgot to admit sneaking over the border. -KL)
The review of the evidence seized at QUEST's residence tends to corroborate all
QUEST's statements.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Conclusions
-----------
There are some important conclusions that can be drawn from the above two cases
regarding future computer system concerns.
o The number of individuals capable of entering Pacific Bell operating
systems is growing.
o Computer Hackers are becoming more sophisticated in their attacks.
o Dial-up ports will always be a target for computer entry by a hacker.
o Even dial-up ports with remote callbacks and manually controlled modems
can be compromised.
o A hacker can place a central office off-line by overloading a SCC mini
computer by improperly placing traps or by putting traps on several DID
multi-trunk groups such as MCI or Sprint groups.
o Terrorist or Organized Crime organizations could use this underground
computer technology against Pacific Bell or to their own advantage.
o Pacific Bell proprietary data bases such as PTT ESAC or PB2 ESAC could be
compromised.
o The integrity of accurate customer billing statements have been
compromised through access to the CEBS (Computerized Electronic Billing
System) and will remain questionable. A customer can dispute large
direct-dialed calls and claim his telephone was accessed by a computer
hacker.
- - -
o Oryan QUEST has a really BIG mouth and would dick over anyone and everyone
to overcome his inferiority complex from being an illegal alien without a
green card. Outside of the Dan The Operator/Maxfield incident, I have
never seen such a mass admission of guilt. To make matters worse, QUEST
probably made up most of the incidents to make himself sound like a really
big time hacker.
- - -
Recommendations
---------------
The information gained as a result of the above investigations should be shared
with those individuals responsible for the integrity of our computer systems.
Further, an ongoing business partnership between security and the individuals
responsible for the integrity of our computer systems should be initiated and
maintained to ensure prompt, effective resolution of future computer related
security issues.
JOHN E. VENN
Manager-Electronic Operations
Special Thanks To Sir Francis Drake
_______________________________________________________________________________
He's Really Just Out Of Control PostCon'88
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"I would SHRED everything, because
we get so much information
out of the dumpster,
it's UNREAL..."
-- Control C
Over the last few months there has been a lot of controversy about the
mysterious cricumstances regarding Michigan Bell and Control C. To set the
record straight, ^C gave me the full details of what happened so I could pass
it on to you.
Just prior to leaving Chicago, where ^C had been going to school, he had
illegally accessed an AOL system belonging to Michigan Bell. The system
operator broke in on him and ^C tried unsuccessfully to pass himself off as a
legitimate user. When this did not work, he hung up and did not give it a
second thought. Upon returning home to Detroit, he had a message waiting for
him to contact the sysop of the AOL system. He calling him and they,
accompanied by Michigan Bell security, went out to lunch. To avoid being
prosecuted, Control C had to give up all of the information he had on that
system and explain how he had gotten in. Since he had cooperated, they let him
go without further hassle. Unfortunately, Control C was soon busted again for
breaking into his Central Office, but this time he was not going to get off so
easily. He had to agree to making a talk show movie and a poster (quoted in
the beginning of the article) for Michigan Bell. Both of these items have been
distributed across the country to better illustrate the hacker mind-set and as
a reminder to destroy important documents that were being thrown away.
While being interrogated by Michigan Bell security department, Control C was
shown a list of recently busted hackers from the July 21, 1987 sweep of the
country. On this list was Sir Francis Drake, which is how the rumor about SFD
being busted last year got started. However, what Control C and Michigan Bell
did not know was that when Mark Gerardo was apprehended last year, he was
believed to be SFD and as such was entered in their files incorrectly.
Information Provided by Control C
With a little help figuring out the SFD mixup from me and Taran King
:Knight Lightning
_______________________________________________________________________________
North Dakota Nightmare September 10, 1988
~~~~~~~~~~~~~~~~~~~~~~
"For Kracking Crue's Docs Avage The Game Is Over"
In March of 1987, the North Dakota members of Kracking Crue (Docs Avage and
SpyroGyra (also known as Ractor)) found a local extender and were able to hack
out a code. They both lived on campus at North Dakota State University and
were able to abuse the code without the worry of being caught because of the
campus's Dimension phone system giving them a high degree of anonymity.
They used this code for the entire rest of the school year and nothing had
happened to prevent them from abusing it. Because of this lack of security, DA
and SG began to believe that the code would be safe for them to use anywhere.
The school year ended and the members of the Crue went home. Eventually the
Crue discovered a 1-800 number for the long distance service they had been
abusing and began to use it once again. However, they were soon to discover
that they were not half as safe as they thought.
The LD company had indeed been watching that code, but could not do anything to
catch the Crue because of the Dimension system on NDSU campus. Docs Avage
started to use the code from his apartment to call SpyroGyra and a few other
people and the company got his line tapped and kept a record of where all his
calls went to.
In Docs Avage's own words;
"On July 27th, 1988, I arrived back at my apartment after spending a
weekend with my parents at their home. I found it rather interesting to
discover three extra cars in the parking lot, one of which was a Dodge
Diplomat.
I walked into my apartment and discover two police detectives, two phone
officials, and two "computer experts" blissfully dismantling my Apple and
all my peripherals. One of my roommates was handcuffed and seated in a
chair and my other roommate was kept closely watched as he was sitting in
the kitchen. I was asked who I was, and read my rights. I agreed to
cooperate. I was busted on a dialup.
The dialup being the one I had hacked out several months before, and
gotten quite greedy with it (ok, I overabused the darn thing). In my
apartment, I placed around a $1000 worth of calls with it. I had made
calls with it before, but not to that extent.
I remained very cooperative, and talked to several phone security
representatives, including those from AT&T and U.S. Sprint (I had a
printout of 4 Sprint Codes, never had used them, just had them). The
phone security people are experts at adverse psychology, and I can
successfully say that they did a very good job of scaring me.
Nevertheless, I knew that they were trying to play with my brain, so it
wasn't as bad as it could have been.
My roommate had been charged with the same offense as myself, Class C
Felony Theft of Services (max 5 years/$5000). However, the only thing he
contributed to the whole matter was the fact that the telephone account
was in his name. The charges were dropped against him.
After almost two months of waiting, the sentence date came. I plead
guilty, playing on a deal that my lawyer had made with the state's
attorney. The sentence included restitution (which hasn't been determined
yet). The phone company is desparately trying to stick me with a large
bill, for services that cannot be proven that I had anything to do with; a
bill that could stretch up to $5000 (like hell if I'm paying that much),
and a very nice little clause called Deferment of Imposition. Basically,
I remain on probation until I pay back the restitution, at that time I can
go through hearings and prove that I haven't been involved in such
activities as for what I was convicted and the charges will not be placed
on my record. For the time being however, it's turning out to be monthly
payments with supervised probation. Needless to say, I, Docs Avage is
retired, at least as as retired as someone in my position can get."
Docs said that he had been looking to retire for some time and that this
incident was the final straw. He also added that he was questioned about
Jester Sluggo, Phrack Inc., and the Legion of Doom. He did not know anything.
Information Provided by Docs Avage and SpyroGyra
_______________________________________________________________________________
