Freaks Macintosh Archive

home *** CD-ROM | disk | FTP | other *** search

/ Freaks Macintosh Archive / Freaks Macintosh Archive.bin / Freaks Macintosh Archives / Textfiles / zines / Phrack / Phrack Issue 16.sit / Phrack Issue 16

Wrap

Text File | 1997-02-22 | 68KB | 1,718 lines

<head> <title>Phrack Magazine Issue 16, File 1 of 1 </title> <head> <body> <pre> ===== Phrack Magazine presents Phrack 16 ===== ===== File 1 of 12 : Phrack 16 Intro ===== Greetings, and welcome to Phrack #16, we are a bit late, but bigger then ever. I think you will find this issue very interesting. Enjoy and have Phun Elric of Imrryr - Editor Contents this issue: 16.1 Phrack 16 Intro by Elric of Imrryr 2K 16.2 BELLCORE Information by The Mad Phone-Man 11K 16.3 A Hacker's Guide to Primos: Part 1 by Cosmos Kid 11K 16.4 Hacking GTN by The Kurgan 7K 16.5 Credit Card Laws Laws by Tom Brokow 7K 16.6 Tapping Telephone Lines by Agent Steal 9K 16.7 Reading Trans-Union Credit Reports by The Disk Jockey 6K Phrack World News: 16.8 The Story Of the West German Hackers by Shooting Shark 3K 16.9 The Mad Phone-Man and the Gestapo by The Mad Phone-Man 2K 16.10 Flight of the Mad Phone-Man by The Mad Phone-Man 2K 16.11 Shadow Hawk Busted Again by Shooting Shark 2K 16.12 Coin Box Thief Wanted by The $muggler 2K Submission to Phrack may be sent to the following BBSes: Unlimited Reality 313-489-0747 Phrack The Free World 301-668-7657 Phrack Inc. (*) The Executive Inn 915-581-5145 Phrack Lunatic Labs UnLtd. 415-278-7421 Phrack (*) House of the Rising Sun 401-789-1809 Phrack * You will get the quickest reply from these systems. ===== Phrack Magazine presents Phrack 16 ===== ===== File 2 of 12 ===== -------------------------------------------------------------------- BELLCORE Information by The Mad Phone-man -------------------------------------------------------------------- So, you've broken into the big phone box on the wall, and are looking at a bunch of tags with numbers and letters on them. Which one is the modem line? Which one is the 1-800 WATS line? Which one is the Alarm line? Bell has a specific set of codes that enable you to identify what you're looking at. These are the same codes the installer gets from the wire center to enable him to set up the line, test it, and make sure it matches the customers order. Here are some extracts from the Bellcore book. First lets take a hypothetical line number I'm familiar with: 64FDDV 123456 ------------------------------------------------------------- The serial number format: Prefix + service code + modifier + serial number + digits: 1,2 3,4 5,6 7,8,9,10,11,12 continued ------------------------------------------------------------------------- Suffix + CO assigning circuit number + segment digits: 13,14,15 16,17,18,19 20,21,22 ------------------------------------------------------------------------- The important shit is in the 3rd thru 6th digit. SERVICE CODES Intra or Inter LATA Block 1-26 ------------- AA- Packet analog access line AB- Packet switch trunk AD- Attendant AF- Commercial audio fulltime AI- Automatic identified outward dialing AL- Alternate services AM- Packet, off-network access line AN- Announcement service AO- International/Overseas audio (full time) AP- Commercial audio (part time) AT- International/Overseas audio (part time) AU- Autoscript BA- Protective alarm (CD) BL- Bell & lights BS- Siren control CA- SSN Access CB- OCC Audio facilities CC- OCC Digital facility-medium speed CE- SSN Station line CF- OCC Special facility CG- OCC Telegraph facility CH- OCC Digital facility high-speed CI- Concentrator Identifier trunk CJ- OCC Control facility CK- OCC Overseas connecting facility wide-band CL- Centrex CO line CM- OCC Video facility CN- SSN Network trunk CO- OCC Overseas connecting facility CP- Concentrator identifier signaling link CR- OCC Backup facility CS- Channel service CT- SSN Tie trunk CV- OCC Voice grade facility CW- OCC Wire pair facility CZ- OCC Access facility DA- Digital data off-net extension DB- HSSDS 1.5 mb/s access line DF- HSSDS 1.5 mb/s hub to hub DG- HSSDS 1.5 mb/s hub to earth station DH- Digital service DI- Direct-in dial DJ- Digit trunk DK- Data link DL- Dictation line DO- Direct-out dial DP- Digital data-2 4 kb/s DQ- Digital data-4 8 kb/s DR- Digital data-9.6 kb/s DW- Digital data-56 kb/s DY- Digital service (under 1 mb/s) EA- Switched access EB- ENFIA II end office trunk EC- ENFIA II tandem trunk EE- Combined access EF- Entrance facility-voice grade EG- Type #2 Telegraph EL- Emergency reporting line EM- Emergency reporting center trunk EN- Exchange network access facility EP- Entrance facility-program grade EQ- Equipment only-(network only) assignment ES- Extension service-voice grade ET- Entrance facility-telegraph grade EU- Extension service-telegraph grade EV- Enhanced Emergency reporting trunk EW- Off network MTS/WATS equivalent service FD- Private line-data FG- Group-supergroup spectrum FR- Fire dispatch FT- Foreign exchange trunk FW- Wideband channel FV- Voice grade facility FX- Foreign exchange HP- Non-DDS Digital data 2.4 kb/s HQ- Non-DDS Digital data 4.8 kb/s HR- Non-DDS Digital data 9.6 kb/s HW- Non-DDS Digital data 56 kb/s IT- Intertandem tie trunk LA- Local area data channel LL- Long distance terminal line LS- Local service LT- Long distance terminal trunk MA- Cellular access trunk 2-way MT- Wired music NA- CSACC link (EPSCS) NC- CNCC link (EPSCS) ND- Network data line OI- Off premises intercommunication station line ON- Off network access line OP- Off premises extension OS- Off premises PBX station line PA- Protective alarm (AC) PC- Switched digital-access line PG- Paging PL- Private line-voice PM- Protective monitoring PR- Protective relaying-voice grade PS- MSC constructed spare facility PV- Protective relaying-telegraph grade PW- Protective relaying-signal grade PX- PBX station line PZ- MSC constructed circuit QU- Packet asynchronous access line QS- Packet synchronous access line RA- Remote attendant RT- Radio landline SA- Satellite trunk SG- Control/Remote metering signal grade SL- Secretarial line SM- Sampling SN- Special access termination SQ- Equipment only-customer premises SS- Dataphone select-a-station TA- Tandem tie-trunk TC- Control/Remote metering-telegraph grade TF- Telephoto/Facsimile TK- Local PBX trunk TL- Non-tandem tie trunk TR- Turret or automatic call distributor (ACD) trunk TT- Teletypewriter channel TU- Turret or automatic call distributor (ACD) line TX- Dedicated facility VF- Commercial television (full time) VH- Commercial television (part time) VM- Control/Remote metering-voice grade VO- International overseas television VR- Non-commercial television (7003,7004) WC- Special 800 surface trunk WD- Special WATS trunk (OUT) WI- 800 surface trunk WO- WATS line (OUT) WS- WATS trunk (OUT) WX- 800 service line WY- WATS trunk (2-way) WZ- WATS line (2-way) ZA- Alarm circuits ZC- Call and talk circuits ZE- Emergency patching circuits ZF- Order circuits, facility ZM- Measurement and recording circuits ZP- Test circuit, plant service center ZQ- Quality and management circuits ZS- Switching, control and transfer circuits ZT- Test circuits, central office ZV- Order circuits, service SERVICE CODES FOR LATA ACCESS --------------------------------------------------- HC- High capacity 1.544 mb/ps HD- High capacity 3.152 mb/ps HE- High capacity 6.312 mb/ps HF- High capacity 6.312 HG- High capacity 274.176 mb/s HS- High capacity subrate LB- Voice-non switched line LC- Voice-switched line LD- Voice-switched trunk LE- Voice and tone-radio landline LF- Data low-speed LG- Basic data LH- Voice and data-PSN access trunk LJ- Voice and data SSN access LK- Voice and data-SSN-intermachine trunk LN- Data extension, voice grade data facility LP- Telephoto/Facsimile LQ- Voice grade customized LR- Protection relay-voice grade LZ- Dedicated facility MQ- Metallic customized NQ- Telegraph customized NT- Protection alarm-metallic NU- Protection alarm NV- Protective relaying/Telegraph grade NW- Telegraph grade facility-75 baud NY- Telegraph grade facility- 150 baud PE- Program audio, 200-3500 hz PF- Program audio, 100-5000 hz PJ- Program audio, 50-8000 hz PK- Program audio, 50-15000 hz PQ- Program grade customized SB- Switched access-standard SD- Switched access-improved SE- Special access WATS-access-std SF- Special access WATS access line improved SJ- Limited switched access line TQ- Television grade customized TV- TV Channel one way 15khz audio TW- TV Channel one way 5khz audio WB- Wideband digital, 19.2 kb/s WE- Wideband digital, 50 kb/s WF- Wideband digital, 230.4 kb/s WH- Wideband digital, 56 kb/s WJ- Wideband analog, 60-108 khz WL- Wideband analog 312-552 khz WN- Wideband analog 10hz-20 khz WP- Wideband analog, 29-44 khz WR- Wideband analog 564-3064 khz XA- Dedicated digital, 2.4 kb/s XB- Dedicated digital, 4.8 kb/s XG- Dedicated digital, 9.6 kb/s XH- Dedicated digital 56. kb/s Now the last two positions of real importance, 5 & 6 translate thusly: Modifier Character Position 5 ------------------------------ INTRASTATE INTERSTATE ------------------------------------- A B Alternate data & non data ------------------------------------- C Customer controlled service ------------------------------------- D E Data ------------------------------------- N L Non-data operation ------------------------------------- P Only offered under intra restructured private line (RPL) tariff ------------------------------------- S T Simultaneous data & non-data ------------------------------------- F Interexchange carriers is less than 50% ------------------------------------- G Interstate carrier is more than 50% usage ============================================================================== MODIFIER CHARACTER POSITION 6 -------------------------------------------------------------- TYPE OF SERVICE Intra LATA -------------------------------------- ALL EXCEPT US GOVT US GOVERNMENT -------------------------------------- T M Circuit is BOC customer to BOC customer all facilities are TELCO provided -------------------------------------- C P Circuit is BOC/BOC and part of facilities or equipment is telco provided -------------------------------------- A J Circuit is BOC/BOC all electrically connected equip is customer provided -------------------------------------- L F Circuit terminates at interexchange carrier customers location -------------------------------------- Z Official company service -------------------------------------- Interlata S S Circuit terminates at interexchange carriers point of term (POT) -------------------------------------- V V Circuit terminates at an interface of a radio common carrier (RCC) -------------------------------------- Z Official company service -------------------------------------- Corridor Y X Corridor circuit -------------------------------------- International K H Circuit has at least 2 terminations in different countries -------------------------------------- Interexchange carrier Y X Transport circuit between interexchange carrier terminals. ---------------------------------------- So 64FDDV would be a private line data circuit terminating at a radiocommon carrier. Other examples can be decoded likewise. Enjoy this information as much as I've had finding it. -= The Mad Phone-man =- ===== Phrack Magazine presents Phrack 16 ===== ===== File 3 of 12 ===== ========================================== ==== Cosmos Kid Presents... ==== ==== A Hacker's Guide To: PRIMOS ==== ==== Part I ==== ==== (c) 1987 by Cosmos Kid ==== ========================================== Author's Note: -------------- This file is the first of two files dealing with PRIMOS and its operations. The next file will be in circulation soon so be sure to check it out at any good BBS. Preface: -------- This file is written in a form to teach beginners as well as experienced Primos users about the system. It is written primarily for beginners however. PRIMOS, contrary to popular belief can be a very powerful system if used correctly. I have outlined some VERY BASIC commands and their use in this file along with some extra commands, not so BASIC. Logging On To A PRIMOS: ----------------------- A PRIMOS system is best recognized by its unusual prompts. These are: 'OK', and 'ER!'. Once connected, these are not the prompts you get. The System should identify itself with a login such as: Primenet V2.3 -or- Primecom Network The system then expects some input from you,preferably: LOGIN. You will then be asked to enter your user identification and password as a security measure. The login onto a PRIMOS is as follows: CONNECT Primenet V 2.3 (system) LOGIN<CR> (you) User id? (system) AA1234 (you) Password? (system) KILLME (you) OK, (system) Preceding the OK, will be the systems opening message. Note that if you fail to type login once connected, most other commands are ignored and the system responds with: Please Login ER! Logging Off Of A PRIMOS: ------------------------ If at any time you get bored with Primos, just type 'LOGOFF' to leave the system. Some systems have a TIMEOUT feature implemented meaning that if you fail to type anything for the specified amount of time the system will automatically log you out, telling you something like: Maximum Inactive Time Limit Exceeded System Prompts: --------------- As stated previously, the prompts 'ER!' and 'OK,' are used on Primos. The 'OK,' denotes that last command was executed properly and it is now waiting for your next command. The 'ER!' prompt denotes that you made an error in typing your last command. This prompt is usually preceded by an error message. Special Characters: ------------------- Some terminals have certain characteristics that are built in to the terminal. key CONTROL-H Deletes the last character typed. Other Special Characters: ------------------------- RETURN: The return key signals PRIMOS that you have completed typing a command and that you are ready for PRIMOS to process the command. BREAK/CONTROL-P: Stops whatever is currently being processed in memory and will return PRIMOS to your control. To restart a process, type: START (abbreviated with S). CONTROL-S: Stops the scrolling of the output on your terminal for viewing. CONTROL-Q: Resumes the output scrolling on your terminal for inspection. SEMICOLON ';': The logical end of line character. The semicolon is used to enter more than one command on one line. Getting Help: ------------- You can get on-line information about the available PRIMOS commands by using the 'HELP' command. The HELP system is keyword driven. That is, all information is stored under keywords that indicate the content of the help files. This is similar to VAX. Entering the single command 'HELP' will enter the HELP sub-system and will display an informative page of text. The next page displayed will provide you with a list of topics and their keywords. These topics include such items as PRIME, RAP, MAIL, and DOC. If you entered the MAIL keyword, you would be given information concerning the mail sub- system available to users on P simply enter PRIME to obtain information on all PRIMOS commands. You could then enter COPY to obtain information on that specific topic. Files And Directories: ---------------------- The name of a file or sub-directory may have up to 32 characters. The filename may contain any of the following characters, with the only restriction being that the first character of the filename may not be a digit. Please note that BLANK spaces are NOT allowed ANYWHERE: A-Z .....alphabet 0-9 .....numeric digits & .....ampersand # .....pound sign $ .....dollar sign - .....dash/minus sign * .....asterisk/star . .....period/dot / .....slash/divide sign Naming Conventions: ------------------- There are very few restrictions on the name that you may give a file. However, you should note that many of the compilers (language processors) and commands on the PRIME will make certain assumptions if you follow certain guidelines. File name suffixes help to identify the file contents with regard to the language the source code was written in and the contents of the file. For instance, if you wrote a PL/1 program and named the file containing the source code 'PROG1.PL1' (SEGmented loader) would take the binary file, link all the binary libraries that you specify and produce a file named 'PROG1.SEG', which would contain the binary code necessary to execute the program. Some common filename suffixes are: F77, PAS, COBOL, PL1G, BASIC, FTN, CC, SPIT (source files). These all denote separate languages and get into more advanced programming on PRIMOS. (e.g. FTN=Fortran). BIN=the binary code produced by the compiler LIST=the program listing produced by the compiler SEG=the linked binary code produced by SEG Some files which do not use standard suffixes may instead use the filename prefixes to identify the contents of the file. Some common filename prefixes are: B Binary code produced by the compiler L source program Listing C Command files $ Temporary work files (e.g. T$0000) # Seg files Commands For File Handling: ---------------------------- PRIMOS has several commands to control and access files and file contents. These commands can be used to list the contents of files and directories, and to copy, add, delete, edit, and print the contents of files. The capitalized letters of each are deleted. A LIST must be enclosed in parenthesis. Close arg ....Closes the file specified by 'arg'. 'Arg' could also be a list of PRIMOS file unit numbers, or the word 'ALL' which closes all open files and units. LIMITS ....Displays information about the login account, including information about resources allocated and used, grantor, and expiration date. Edit Access ....Edits the Access rights for the named directories and files. CName arg1 arg2 ....Changes the Name of 'arg1' to 'arg2'. The arguments can be files or directories. LD ....The List Directory command has several arguments that allow for controlled listing format and selection of entries. Attach arg ....allows you to Attach to the directory 'arg' with the access rights specified in the directory Access Control List. DOWN <arg> ....allows you to go 'DOWN into' a sub-ufd (directory). You can specify which one of several sub-ufds to descend into with the optional 'arg'. UP <arg> ....allows you to go 'UP into' a higher ufd (directory). You can specify which one of several to climb into with the optional 'arg'. WHERE ....Displays what the current directory attach point is and your access rights. CREATE arg ....CREATES a new sub-directory as specified by 'arg'. COPY arg1 arg2 ....COPIES the file or directory specified by 'arg1' into a file by the same name specified by 'arg2'. Both 'arg1' and 'arg2' can be filename with the SPOOL command, whose format is: SPOOL filename -AT destination where filename is the name of the file you want printed, and destination is the name of the printer where you want the file printed. For example if you want the file 'HACK.FTN' printed at the destination 'LIB' type: SPOOL HACK.FTN -AT LIB PRIMOS then gives you some information telling you that the file named was SPOOLed and the length of the file in PRIMOS records. To see the entries in the SPOOL queue, type: SPOOL -LIST PRIMOS then lists out all the files waiting to be printed on the printers on your login system. Also included in this information will be the filename of the files waiting to print, the login account name of the user who SPOOLed the file, the time that the file was SPOOLed, the size of the file in PRIMOS records, and the printer name where the file is to print. Changing The Password Of An Account: ------------------------------------ If you wish to change the password to your newly acquired account you must use the 'CPW' command (Change PassWord). To do this enter the current password on the command line followed by RETURN. PRIMOS will then prompt you for your desired NEW password and then ask you to confirm your NEW password. To change your password of 'JOE' to 'SCHMOE' then type: OK, (system) CPW JOE (you) New Password? (system) You can save a copy of your terminal session by using the COMO (COMmand Output) command. When you type: COMO filename Everything which is typed or displayed on your terminal is saved (recorded) into the filename on the command line (filename). If a file by the same name exists, then that file will be REPLACED with NO WARNING GIVEN! When you have finished doing whatever it was you wanted a hardcopy of, you type: COMO -End which will stop recording your session and will close the COMO file. You can now print the COMO file using the SPOOL command as stated earlier. Conclusion: ----------- This concludes this first file on PRIMOS. Please remember this file is written primarily for beginners, and some of the text may have seemed BORING! However, this filewaswrittenin a verbose fashion to FULLYINTRODUCEPRIMOS to beginners. Part II will deal with more the several languages on PRIMOS and some other commands. Author's Endnote: ----------------- I would like to thank the following people for the help in writing this file: AMADEUS (an oldie who is LONG GONE!) The University Of Kentucky State University Of New York (SUNY) Primenet And countless others..... Questions, threats, or suggestions to direct towards me, I can be found on any of the following: The Freeworld ][.........301-668-7657 Digital Logic............305-395-6906 The Executive Inn........915-581-5146 OSUNY BBS................914-725-4060 -=*< Cosmos Kid >*=- ======================================== ===== Phrack Magazine presents Phrack 16 ===== ===== File 4 of 12 ===== Hacking the Global Telecommunications Network Researched and written by: The Kurgan Compiled on 10/5/87 Network Procedure Differences The Global Telecommunications Network (GTN) is Citibanks's international data network, which allows Citicorp customers and personnel to access Citibank's worldwide computerized services. Two different sign on procedures exist: Type A and Type B. All users, except some in the U.S., must use Type B. (U.S. users: the number you dial into and the Welcome Banner you receive determine what sign-on procedure to follow.) Welcome banners are as follows: TYPE A: WELCOME TO CITIBANK. PLEASE SIGN ON. XXXXXXXX @ PASSWORD = @ TYPE B: PLEASE ENTER YOUR ID:-1-> PLEASE ENTER YOUR PASSWORD:-2-> CITICORP (CITY NAME). KEY GHELP FOR HELP. XXX.XXX PLEASE SELECT SERVICE REQUIRED.-3-> Type A User Commands User commands are either instructions or information you send to the network for it to follow. The commands available are listed below. User Action: Purpose: @ (CR) To put you in command mode (mode in which you can put your currently active service on hold and ask the network for information, or log-off the service). (NOTE: This symbol also serves as the network prompt; see Type A messages.) BYE (CR) To leave service from command mode. Continue (CR) To return to application from command mode (off hold) D (CR) To leave service from command mode. ID To be recognized as a user by the network (beginning of sign on procedure), type ID, then a space and your assigned network ID. (Usually 5 or 6 characters long) Status (CR) To see a listing of network address (only from @ prompt). You need this address when "reporting a problem." Type A messages The network displays a variety of messages on your screen which either require a user command or provide you with information. Screen shows: Explanation: @ Network prompt -- request for Network ID. BAD PASSWORD Network does not except your password. <address> BUSY The address is busy, try back later. WELCOME TO CITIBANK. Network welcome banner. Second line provides address PLEASE SIGN ON. # to be used when reporting "problems." XXX.XXX <address> ILLEGAL You typed in an address that doesn't exist. <address> CONNECTED Your connection has been established. DISCONNECTED Your connect has been disconnected. NOT CONNECTED You're not connected to any service at the time. NUI REQUIRED Enter your network user ID. PASSWORD = Request for your assigned password. STILL CONNECTED You are still connected to the service you were using. ? Network doesn't understand your entry. Type B User Commands and Messages Since the Type B procedure is used with GTN dial-ups, it requires fewer commands to control the network. There is only 1 Type B command. Break plus (CR) allows you to retain connection to one service, and connect with another. Screen Shows: Explanation: CITICORP (CITY NAME). Network Welcome banner. Type in service address. PLEASE SELECT SERVICE COM Connection made. DER The port is closed out of order, or no open routes are available. DISCONNECTED You have disconnected from the service and the network. ERR Error in service selected. INV Error in system. MOM Wait, the connection is being made. NA Not authorized for this service. NC Circuits busy, try again. NP Check service address. OCC Service busy, try again. Sign-on Procedures: There are two types of sign on procedures. Type A and Type B. Type A: To log onto a system with type A logon procedure, the easiest way is through Telenet. Dial your local Telenet port. When you receive the "@" prompt, type in the Type-A service address (found later in the article) then follow the instructions from there on. Type-B: Dial the your GTN telephone #, then hit return twice. You will then see: "PLEASE ENTER YOUR ID:-1->" Type in a network ID number and hit return. You will then see "PLEASE ENTER YOUR PASSWORD:-2->" Type in Network Password and hit return. Finally you will see the "CITICORP (city name)" welcome banner, and it will ask you to select the service you wish to log onto. Type the address and hit return. (A list of addresses will be provided later) Trouble Shooting: If you should run into any problems, the Citicorp personnel will gladly help their "employees" with any questions. Just pretend you work for Citibank and they will give you a lot. This has been tried and tested. Many times, when you attempt to log on to a system and you make a mistake with the password, the system will give you a number to call for help. Call it and tell them that you forgot your pass or something. It usually works, since they don't expect people to be lying to them. If you have any questions about the network itself, call 305-975-5223. It is the Technical Operations Center (TOC) in Pompano, Florida. Dial-Ups: The following list of dial-ups is for North America. I have a list of others, but I don't think that they would be required by anyone. Remember: Dial-ups require Type-B log-on procedure. Type-A is available on systems accessible through Telenet. Canada Toronto 416-947-2992 (1200 Baud V.22 Modem Standard) U.S.A. Los Angeles 213-629-4025 (300/1200 Baud U.S.A. Modem Standard) Jersey City 201-798-8500 New York City 212-269-1274 212-809-1164 Service Addresses: The following is a VERY short list of just some of the 100's of service addresses. In a later issue I will publish a complete list. Application Name: Type-A Type-B CITIADVICE 2240001600 CADV CITIBANKING ATHENS 2240004000 :30 CITIBANKING PARIS 2240003300 :33 CITIBANKING TOKYO 2240008100 :81 CITICASH MANAGER INTERNATIONAL 1 (NAFG CORP) 2240001200 CCM1 INTERNATIONAL 7 (DFI/WELLS FARGO) 2240013700 CCM7 COMPMARK ON-LINE 2240002000 CS4 ECONOMIC WEEK ON-LINE 2240011100 FAME1 INFOPOOL/INFOTEXT 2240003800 IP EXAMPLE OF LOGON PROCEDURE: THE FOLLOWING IS THE BUFFERED TEXT OF A LOG-ON TO CITIBANKING PARIS THROUGH TELENET. CONNECT 1200 TELENET 216 13.41 TERMINAL=VT100 @2240003300 223 90331E CONNECTED ENTER TYPE NUMBER OR RETURN TYPE B IS BEEHIVE DM20 TYPE 1 IS DEC VT100 TYPE A IS DEC VT100 ADV VIDEO TYPE 5 IS DEC VT52 TYPE C IS CIFER 2684 TYPE 3 IS LSI ADM 3A TYPE L IS LSI ADM 31 TYPE I IS IBM 3101 TYPE H IS HP 2621 TYPE P IS PERKIN ELMER 1200 TYPE K IS PRINTER KEYBOARD TYPE M IS MAI BASIC 4 TYPE T IS TELEVIDEO 9XX TYPE V IS VOLKER CRAIG 4404 TYPE S IS SORD MICRO WITH CBMP RELEASE BSC9.5 - 06JUN85 FOR 300 BAUD KEY ! AND CARRIAGE RETURN CONFIG. K1.1-I11H-R-C-B128 ENTER TYPE NUMBER OR RETURN K CONNECTED TO CITIBANK PARIS - CBP1 ,PORT 5 Have fun with this info, and remember, technology will rule in the end. ===== Phrack Magazine presents Phrack 16 ===== ===== File 5 of 12 ===== ---------------------------------------------------------------------------- | The Laws Governing Credit Card Fraud | | | | Written by Tom Brokaw | | September 19, 1987 | | | | Written exclusively for: | | Phrack Magazine | | | ---------------------------------------------------------------------------- (A Tom Brokaw/Disk Jockey Law File Production) Introduction: ------------ In this article, I will try to explain the laws concerning the illegal use of credit cards. Explained will be the Michigan legislative view on the misuse and definition of credit cards. Definition: ---------- Well, Michigan Law section 157, defines a credit card as "Any instrument or device which is sold, issued or otherwise distributed by a business organization identified thereon for obtaining goods, property, services or anything of value." A credit card holder is defined as: 1) "The person or organization who requests a credit card and to whom or for whose benefit a credit card is subsequently issued" or 2) "The person or organization to whom a credit card was issued and who uses a credit card whether the issuance of the credit card was requested or not." In other words, if the company or individual is issued a card, once using it, they automatically agree to all the laws and conditions that bind it. Stealing, Removing, Retaining or Concealment: -------------------------------------------- Michigan Law states, that it is illegal to "steal, knowingly take or remove a credit card from a card holder." It also states that it is wrongful to "conceal a credit card without the consent of the card holder." Notice that it doesn't say anything about carbons or numbers acquired from BBSes, but I think that it could be considered part of the laws governing the access of a persons account without the knowledge of the cardholder, as described above. Possession with Intent to Circulate or Sell ------------------------------------------- The law states that it is illegal to possess or have under one's control, or receive a credit card if his intent is to circulate or sell the card. It is also illegal to deliver, circulate or sell a credit card, knowing that such a possession, control or receipt without the cardholders consent, shall be guilty of a FELONY. Notice again, they say nothing about possession of carbons or numbers directly. It also does not clearly state what circulation or possession is, so we can only stipulate. All it says is that possession of a card (material plastic) is illegal. Fraud, forgery, material alteration, counterfeiting. ---------------------------------------------------- However, it might not be clearly illegal to possess a carbon or CC number. It IS illegal to defraud a credit card holder. Michigan law states that any person who, with intent to defraud, forge, materially alter or counterfeit a credit card, shall be guilty of a felony. Revoked or cancelled card, use with intent to defraud. ------------------------------------------------------ This states that "Any person who knowingly and with intent to defraud for the purpose of obtaining goods, property or services or anything of value on a credit card which has been revoked or cancelled or reported stolen by the issuer or issuee, has been notified of the cancellation by registered or certified mail or by another personal service shall be fined not more than $1,000 and not imprisoned not more than a year, or both. However, it does not clearly say if it is a felony or misdemeanor or civil infraction. My guess is that it would be dependant on the amount and means that you used and received when you defraud the company. Usually, if it is under $100, it is a misdemeanor but if it is over $100, it is a felony. I guess they figure that you should know these things. The People of The State of Michigan vs. Anderson (possession) ------------------------------------------------ On April 4, 1980, H. Anderson attempted to purchase a pair of pants at Danny's Fashion Shops, in the Detroit area. He went up to the cashier to pay for the pants and the cashier asked him if he had permission to use the credit card. He said "No, I won it last night in a card game". The guy said that I could purchase $50 dollars worth of goods to pay back the debt. At the same time, he presumed the card to be a valid one and not stolen. Well, as it turned out it was stolen but he had no knowledge of this. Later, he went to court and pleased guilty of attempted possession of a credit card of another with intent or circulate or sell the same. At the guilty hearings, Mr. Anderson stated that the credit card that he attempted to use had been acquired by him in payment of a gambling debt and assumed that the person was the owner. The trial court accepted his plea of guilty. At the sentencing, Mr. Anderson, denied that he had any criminal intent. Anderson appealed the decision stating that the court had erred by accepting his plea of guilty on the basis of insufficient factual data. Therefore, the trial court should not have convicted him of attempted possession and reversed the charges. The People of the State of Michigan vs. Willie Dockery ------------------------------------------------------ On June 23, 1977, Willie Dockery attempted to purchase gas at a Sears gas station by using a stolen credit card. The attendant noticed that his driver's license picture was pasted on and notified the police. Dockery stated that he had found the credit card and the license at an intersection, in the city of Flint. He admitted that he knowingly used the credit card and driver's license without the consent of the owner but he said that he only had purchased gasoline on the card. It turns out that the credit card and driver's license was stolen from a man, whose grocery store had been robbed. Dockery said that he had no knowledge of the robbery and previous charges on the cardwhich totalled$1,373.21. He admitted that he did paste his picture on the driver's license. Butagain the court screws up, they receive evidence that the defendant had a record of felonies dating back to when he was sixteen and then assumed that he was guilty on the basis of his prior offenses. The judge later said that the present sentence could not stand in this court so the case was referred to another court. Conclusion ---------- I hope that I have given you a better understanding about the law, that considers the illegal aspects of using credit cards. All this information was taken from The Michigan Compiled Laws Annotated Volume 754.157a-s and from The Michigan Appeals Report. In my next file I will talk about the laws concerning Check Fraud. -Tom Brokaw ===== Phrack Magazine presents Phrack 16 ===== ===== File 6 of 12 ===== ****************************************************************************** * * * Tapping Telephone Lines * * * * Voice or Data * * * * For Phun, Money, and Passwords * * * * Or How to Go to Jail for a Long Time. * * * ****************************************************************************** Written by Agent Steal 08/87 Included in this file is... * Equipment needed * Where to buy it * How to connect it * How to read recorded data But wait!! There's more!! * How I found a Tymnet node * How I got in ************* THE EQUIPMENT ************* First thing you need is an audio tape recorder. What you will be recording, whether it be voice or data, will be in an analog audio format. >From now on, most references will be towards data recording. Most standard cassette recorders will work just fine. However, you are limited to 1 hour recording time per side. This can present a problem in some situations. A reel to reel can also be used. The limitations here are size and availability of A.C. Also, some reel to reels lack a remote jack that will be used to start and stop the recorder while the line is being used. This may not present a problem. More later. The two types of recorders I would advise staying away from (for data) are the micro cassette recorders and the standard cassette recorders that have been modified for 8 to 10 hour record time. The speed of these units is too unstable. The next item you need, oddly enough, is sold by Radio Shack under the name "Telephone recording control" part # 43-236 $24.95. See page 153 of the 1987 Radio Shack catalog. ***************** HOW TO CONNECT IT ***************** The Telephone recording control (TRC) has 3 wires coming out of it. #1 Telco wire with modular jack. Cut this and replace with alligator clips. #2 Audio wire with miniature phone jack (not telephone). This plugs into the microphone level input jack of the tape recorder. #3 Audio wire with sub miniature phone jack. This plugs into the "REM" or remote control jack of the tape recorder. Now all you need to do is find the telephone line, connect the alligator clips, turn the recorder on, and come back later. Whenever the line goes off hook, the recorder starts. It's that simple. **************** READING THE DATA **************** This is the tricky part. Different modems and different software respond differently but there are basics. The modem should be connected as usual to the telco line and computer. Now connect the speaker output of the tape player directly to the telephone line. Pick up the phone and dial the high side of a loop so your line doesn't make a lot of noise and garble up your data. Now, command your modem into the answer mode and press play. The tape should be lined up at the beginning of the recorded phone call, naturally, so you can see the login. Only one side of the transmission between the host and terminal can be monitored at a time. Going to the originate mode you will see what the host transmitted. This will include the echoes of the terminal. Of course the password will be echoed as ####### for example, but going to the answer mode will display exactly what the terminal typed. You'll understand when you see it. A couple of problems you might run into will be hum and garbage characters on the screen. Try connecting the speaker output to the microphone of the hand set in your phone. Use a 1 to 1 coupling transformer between the tape player input and the TRC audio output. These problems are usually caused when using A.C. powered equipment. The common ground of this equipment interferes with the telco ground which is D.C. based. I was a little reluctant to write this file because I have been unsuccessful in reading any of the 1200 baud data I have recorded. I have spoke with engineers and techs. Even one of the engineers who designs modems. All of them agree that it IS possible, but can't tell me why I am unable to do this. I believe that the problems is in my cheap ass modem. One tech told me I needed a modem with phase equalization circuitry which is found in most expensive 2400 baud modems. Well one of these days I'll find $500 lying on the street and I'll have nothing better to spend it on! Ha! Actually, I have a plan and that's another file..... I should point out one way of reading 1200 baud data. This should work in theory, however, I have not attempted it. Any fully Hayes compatible modem has a command that shuts off the carrier and allows you to monitor the phone line. The command is ATS10. You would then type either answer or originate depending on who you wanted to monitor. It would be possible to write a program that records the first 300 or so characters then writes it to disk, thus allowing unattended operation. ************** HOW CRAZY I AM ************** PASSWORDS GALORE!!!! After numerous calls to several Bell offices, I found the one that handled Tymnet's account. Here's a rough transcript: Op: Pacific Bell priority customer order dept. How may I help you? Me: Good Morning, this is Mr. Miller with Tymnet Inc. We're interested in adding some service to our x town location. Op: I'll be happy to help you Mr. Miller. Me: I need to know how many lines we have coming in on our rotary and if we have extra pairs on our trunk. We are considering adding ten additional lines on that rotary and maybe some FX service. Op: Ok....What's the number this is referenced to? Me: xxx-xxx-xxxx (local node #) Op: Hold on a min....Ok bla, bla, bla. Well you get the idea. Anyway, after asking her a few more unimportant questions I asked her for the address. No problem, she didn't even hesitate. Of course this could have been avoided if the CN/A in my area would give out addresses, but they don't, just listings. Dressed in my best telco outfit, Pac*Bell baseball cap, tool belt and test set, I was out the door. There it was, just an office building, even had a computer store in it. After exploring the building for awhile, I found it. A large steel door with a push button lock. Back to the phone. After finding the number where the service techs were I called it and talked to the tech manager. Mgr: Hello this is Joe Moron. Me: Hi this is Mr. Miller (I like that name) with Pacific Bell. I'm down here at your x town node and we're having problems locating a gas leak in one of our Trunks. I believe our trunk terminates pressurization in your room. Mgr: I'm not sure... Me: Well could you have someone meet me down here or give me the entry code? Mgr: Sure the code is 1234. Me: Thanks, I'll let you know if there's any trouble. So, I ran home, got my VCR (stereo), and picked up another TRC from Trash Shack. I connected the VCR to the first two incoming lines on the rotary. One went to each channel (left,right). Since the volume of calls is almost consistent, it wasn't necessary to stop the recorder between calls. I just let it run. I would come back the next day to change the tape. The VCR was placed under the floor in case a tech happened to come by for maintenance. These nodes are little computer rooms with air conditioners and raised floors. The modems and packet switching equipment are all rack mounted behind glass. Also, most of the nodes are unmanned. What did I get? Well a lot of the logins were 1200, so I never found out what they were. Still have 'em on tape though! Also a large portion of traffic on both Tymnet and Telenet is those little credit card verification machines calling up Visa or Amex. The transaction takes about 30 secs and there are 100's on my tapes. The rest is as follows: Easylink CompuServe Quantumlink 3Mmail PeopleLink Homebanking USPS Chrysler parts order Yamaha Ford Dow Jones And a few other misc. systems of little interest. I'm sure if I was persistent, I'd get something a little more interesting. I spent several months trying to figure out my 1200 baud problem. When I went back down there the code had been changed. Why? Well I didn't want to find out. I was out of there! I had told a couple of people who I later found could not be trusted. Oh well. Better safe than sorry. ************************************** Well, if you need to reach me,try my VMS at 415-338-7000 box 8130. But no telling how long that will last. And of course there's always P-80 systems at 304-744-2253. Probably be there forever. Thanks Scan Man, whoever you are. Also read my file on telco local loop wiring. It will help you understand how to find the line you are looking for. It should be called Telcowiring.Txt <<< AGENT STEAL >>> ===== Phrack Magazine presents Phrack 16 ===== ===== File 7 of 12 ===== ------------------------------------------------------------------------ - The Disk Jockey - - presents: - - - - Reading Trans-Union Reports: - - A lesson in terms used - - (A 2af presentation) - ------------------------------------------------------------------------ This file is dedicated to all the phreaks/hacks that were busted in the summer of 1987, perhaps one of the most crippling summers ever for us. Preface: ------- Trans-Union is a credit service much like CBI, TRW or Chilton, but offers more competitive rates, and is being used more and more by many credit checking agencies. Logging in: ---------- Call one of the Trans Union dial-ups at 300,E,7,1, Half Duplex. Such a dial-up is 314-XXX-XXXX. After connecting, hit Ctrl-S. The system will echo back a 'GO ' and then awaits you to begin the procedure of entering the account and password, then mode, i.e.: S F1111,111,H,T. The system will then tell you what database you are logged on to, which is mostly insignificant for your use. To then pull a report, you would type the following: P JONES,JIM* 2600,STREET,CHICAGO,IL,60604** <Ctrl-S>. The name is Jim Jones, 2600 is his street address, street is the street name, Chicago is the city, IL is the state, 60604 is the zip. The Report: ---------- The report will come out, and will look rather odd, with all types of notation. An example of a Visa card would be: SUB NAME/ACCT# SUB# OPEND HICR DTRP/TERM BAL/MAX.DEL PAY.PAT MOP CITIBANK B453411 3/87 $1000 9/87A $0 12111 R01 4128XXXXXXXXX $1500 5/87 $120 Ok, Citibank is the issuing bank. B453411 is their subscriber code. 3/87 is when the account was opened. HICR is the most that has been spent on that card. 9/87 is when the report was last updated (usually monthly if active). $1000 is the credit line. $0 is the current balance. 12111 is the payment pattern, where 1=pays in 30 days and 2=pays in 60 days. R01 means that it is a "Revolving" account, meaning that he can make payments rather than pay the entire bill at once. 4128-etc is his account number (card number). $1500 is his credit line. 5/87 is when he was late on a payment last. $120 is the amount that he was late with. Here is a list of terms that will help you identify and understand the reports better: ECOA Inquiry and Account Designators ------------------------------------ I Individual account for sole use of applicant C Joint spousal contractual liability A Authorized user of shared account P Participant in use of account that is neither C nor A S Co-signer, not spouse M Maker primarily liable for account, co-signer involved T Relationship with account terminated U Undesignated N Non-Applicant spouse inquiry Remarks and FCBA Dispute Codes ------------------------------ AJP Adjustment pending BKL Bankruptcy loss CCA Consumer counseling account CLA Placed for collection CLO Closed to further purchases CTS Contact Subscriber DIS Dispute following resolution DRP Dispute resolution pending FCL Foreclosure MOV Moved, left no forwarding address ND No dispute PRL Profit and loss write-off RFN Account refinanced RLD Repossession, paid by dealer RLP Repossession, proceeds applied towards debt RPO Repossession RRE Repossession, redeemed RS Dispute resolved RVD Returned voluntarily, paid by dealer RVN Returned voluntarily RVP Returned voluntarily, proceeds go towards debt RVR Returned voluntarily, redeemed SET Settled for less than full balance STL Plate (card) stolen or lost TRF Transferred to another office Type of Account --------------- O Open account (30 or 90 days) R Revolving or option account (open-end) I Installment (fixed number of payments) M Mortgage C Check credit (line of credit at a bank) Usual Manner of Payment ----------------------- 00 Too new to rate; approved, but not used or not rated 01 Pays (or paid) within 30 days of billing, pays accounts as agreed 02 Pays in more than 30 days, but not more than 60 days 03 Pays in more than 60 days, but not more than 90 days 04 Pays in more than 90 days, but not more than 120 days 05 Pays in 120 days or more 07 Makes payments under wage earner plan or similar arrangement 08 Repossession 8A Voluntary repossession 8D Legal repossession 8R Redeemed repossession 09 Bad debt; placed for collection; suit; judgement; skip 9B Placed for collection UR Unrated UC Unclassified Kinds of Business Classification ------------------------------- A Automotive B Banks C Clothing D Department and variety F Finance G Groceries H Home furnishings I Insurance J Jewelry and cameras K Contractors L Lumber, building materials M Medical and related health N National credit card O Oil and national credit card P Personal services other than medical Q Mail order houses R Real estate and public accommodations S Sporting goods T Farm and garden supplies U Utilities and fuel V Government W Wholesale X Advertising Y Collection services Z Miscellaneous Type of Installment Loan ------------------------ AF Appliance/Furniture AP Airplane AU Automobile BT Boat CA Camper CL Credit line CM Co-maker CO Consolidation EQ Equipment FH FHA contract loan FS Finance statement HI Home improvement IN Insurance LE Leases MB Mobile home MC Miscellaneous MT Motor home PI Property improvement plan PL Personal loan RE Real estate ST Student loan SV Savings bond, stock, etc. US Unsecured VA Veteran loan Date Codes ---------- A Automated, most current information available C Closed date F Repossessed/Written off M Further updates stopped P Paid R Reported data S Date of last sale V Verified date Employment Verification Indicator --------------------------------- D Declined verification I Indirect N No record R Reported, but not verified S Slow answering T Terminated V Verified X No reply Hope this helps. Anyone that has used Trans-Union will surely appreciate this, as the result codes are sometimes hard to decipher. -The Disk Jockey #### PHRACK PRESENTS ISSUE 16 #### ^*^*^*^Phrack World News, Part 1^*^*^*^ **** File 8 of 12 **** >From the 9/16 San Francisco Chronicle, page A19: GERMAN HACKERS BREAK INTO NASA NETWORK (excerpted) Bonn A group of West German computer hobbyists broke into an international computer network of the National Aeronautics and Space Administration and rummaged freely among the data for at least three months before they were discovered, computer enthusiasts and network users said yesterday. An organization in Hamburg called the Chaos Computer Club, which claimed to be speaking for an anonymous group that broke into the network, said the illicit users managed to install a "Trojan horse," and gain entry into 135 computers on the European network. A "Trojan Horse" is a term for a permanent program that enables amateur computer enthusiasts [as opposed to professionals?], or "hackers," to use a password to bypass all the security procedures of a system and gain access to all the data in a target computer. [Actually, this type of program is a 'back door' or a 'trap door.' The group may very well have *used* a Trojan horse to enable them to create the back door, but it probably wasn't a Trojan horse per se. A Trojan horse is a program that does something illicit and unknown to the user in addition to its expected task. See Phrack xx-x, "Unix Trojan Horses," for info on how to create a Trojan horse which in turn creates a trap door into someone's account.] The NASA network that was broken into is called the Space Physics Analysis Network [ooh!] and is chiefly designed to provide authorized scientists and organizations with access to NASA data. The security system in the network was supplied by an American company, the Digital Equipment Corp. [Probably DECNET. Serves them right.] Users said the network is widely used by scientists in the United States, Britain, West Germany, Japan and five other countries and does not carry classified information. A Chaos club spokesman, Wau Holland, denied that any data had been changed. This, he said, went against "hacker ethics." West German television reports said that computer piracy carries a penalty of three years in prison in West Germany. The government has not said what it plans to do. The Chaos club clearly views its break-in as a major coup. Holland, reached by telephone in Hamburg, said it was "the most successful running of a Trojan horse" to his knowledge, and the club sent a lengthy telex message to news organizations. It said the "Trojan horse" was spotted by a user in August, and the infiltrating group then decided to go public because "they feared that they had entered the dangerous field of industry espionage, economic crime, East- West conflict...and the legitimate security interests of high-tech institutions." The weekly magazine Stern carried an interview with several anonymous hobbyists who showed how they gained access to the network. One described his excitement when for the first time he saw on his screen, "Welcome to the NASA headquarters VAX installation." According to Chaos, the hobbyists discovered a gap in the Digital VAX systems 4.4 and 4.5 and used it to install their "Trojan Horse." [Excerpted and Typed by Shooting Shark. Comments by same.] #### PHRACK PRESENTS ISSUE 16 #### ^*^*^*^Phrack World News, Part 2^*^*^*^ **** File 9 of 12 **** [Ed's Note: CertainThings in the article have been blanked (XXXXX) at the request of the author] The Story of the Feds on XXXXXXX BBS By The Mad Phone Man Returninghome one afternoon with a friend, I knew something wasn't right when I walked into the computer room. I see a "Newuser" on the board... and the language he's using is... well "Intimidating"... "I want you all to know I'm with the OCC task force and we know who you are... we are going to have a little get-together and 'talk' to you all." Hmmm... a loser?... I go into chat mode... "Hey dude, what's up?" I ask. "Your number asshole" he says.... Well, fine way to log on to a board if I do say.... "Hey, you know I talked to you and I know who you are.." "Oh yeah...Who am I?." he hesitates and says... "Well uh.. you used to work for Sprint didn't you?" I say, "No, you've got me confused with someone else I think, I'm a junior in high school." "Ohyeah?.. You got some pretty big words for a high school kid," he says.... "Well, in case you didn't know, they teach English as a major these days...." He says... "Do you really want to know which LD company I'm with?" I say "NO, but if it will make you happy, tell me." He says MCI. (Whew! I don't use them)... "Well you're outta luck asshole, I pay for my calls, and I don't use MCI." He's dumbfounded. I wish him the worst as he asks me to leave his rather threatening post up on my board and we hang up on him. Now, I'm half paralyzed... hmmm.... Check his info-form... he left a number in 303... Denver.... I grab the phone and call it.. It's the Stromberg Telephone company... Bingo.. I've got him. I search my user files and come up with a user called "Cocheese" from there, and I voice validated him, and he said he worked for a small telco called Stromberg... I'm onto him now. Later in the week, I'm in a telco office in a nearby major city, I happen to see a book, marked "Confidential Employee Numbers for AT&T." I thumb thru and lo and behold, an R.F. Stromberg works at an office of AT&T in Denver, and I can't cross reference him to an office. (A sure sign he's in security). Well, not to be out-done by this loser... I dial up NCIC and check for a group search for a driver's licence for him... Bingo. Licence number, cars he owns, his SS number, and a cross reference of the licence files finds his wife, two kids and a boat registered to him. I've never called him back, but If I do have any trouble with him, I'm gonna pay a little visit to Colorado.... #### PHRACK PRESENTS ISSUE 16 #### ^*^*^*^Phrack World News, Part 3^*^*^*^ **** File 10 of 12 **** [Ed's Note: Certain names have been change in the article to protect the author] The Flight of The Mad Phone-Man's BBS to a Friendly Foreign Country Using my knowledge that the pigs grab your computer when they bust you,I got real worried about losing a BIG investment I've got in my IBM. I decide there's a better way.... Move it! But where? Where's safe from the PhBI? Well in the old days, to escape the draft, you went to Canada, why not expatriate my board.... Well the costs of a line are very high, let's see what's available elsewhere. One afternoon, I'm working at a local hospital,(one I do telecom work for) and I ask the comm mgr if they have any links to Canada? He says why yes, we have an inter-medical link over a 23ghz microwave into the city just across the border. I ask to see the equipment. WOW! My dreams come true, it's a D4 bank (Rockwell) and it's only got 4 channel cards in it. Now, being a "nice" guy, I offer to do maintenance on this equipment if he would let me put up another channel...he agrees. The plot thickens. I've got a satellite office for a business near the hospital on the other side, I quickly call up good ole Bell Canada, and have them run a 2 wire line from the equipment room to my office. Now the only thing to get is a couple of cards to plug into the MUX to put me on the air. A 2 wire E&M card goes for bout $319, and I'd need two. Ilook around the state, and find one bad one in Rochester.... I'm on my way that afternoon via motorcycle. The card is mine, and the only thing I can find wrong is a bad voltage regulator. I stop by the Rockwell office in suburban Rochester and exchange the card, while I'm there, I buy a second one (Yeah, on my card) and drive home.... by 9pm that night the circuit is up, and we are on the air. Results- Very good line, no noise, can be converted with another card for a modest fee if I want the bandwidth. So that's the story of how the board went to a "friendly foreign country." The Mad Phone-Man #### PHRACK PRESENTS ISSUE 16 #### ^*^*^*^Phrack World News, Part 4^*^*^*^ **** File 11 of 12 **** Shadow Hawk Busted Again ======================== As many of you know, Shadow Hawk (a/k/a Shadow Hawk 1) had his home searched by agents of the FBI, Secret Service, and the Defense Criminal Investigative Services and had some of his property confiscated by them on September 4th. We're not going to reprint the Washington Post article as it's available through other sources. Instead, a summary: In early July, SH bought an AT&T 3B1 ("Unix PC") with a 67MB drive for a dirt-cheap $525. He got Sys V 3.5 for another $200 but was dissatisfied with much of the software they gave him (e.g. they gave him uucp version 1.1). When he was tagged by the feds, he had been downloading software (in the form of C sources) from various AT&T systems. According to reports, these included the Bell Labs installations at Naperville, Illinois and Murray Hill, New Jersey. Prosecutors said he also gained entry to (and downloaded software from) AT&T systems at a NATO installation in Burlington, North Carolina and Robins AFB in Georgia. AT&T claims he stole $1 million worth of software. Some of it was unreleased software taken from the Bell Labs systems that was given hypothetical price tags by Bell Labs spokespersons. Agents took his 3B1, two Atari STs he had in his room, and several diskettes. SH is 17 and apparently will be treated as a minor. At the time of this writing, he will either be subject to federal prosecution for 'computer theft' or will be subject to prosecution only by the State of Illinois. SH's lawyer, Karen Plant, was quoted as saying that SH "categorically denies doing anything that he should not have been doing" and that he "had absolutely no sinister motives in terms of stealing property." As we said, he was just collecting software for his new Unix PC. When I talked to Ms. Plant on September 25th, she told me that she had no idea if or when the U.S. Attorney would prosecute. Karen Plant can be reached at (312) 263-1355. Her address is 134 North LaSalle, #306, Chicago, Illinois. --------- On July 9th SH wrote: So you see, I'm screwed. Oh yeah, even worse! In my infinite (wisdom || stupidity, take your pick 8-)) I set up a local AT&T owned 7300 to call me up and send me their uucp files (my uucp works ok for receive) and guess what. I don't think I've to elaborate further on THAT one... (holding my breath, so to type) (_>Sh<_ --- #### PHRACK PRESENTS ISSUE 16 #### ^*^*^*^Phrack World News, Part 5^*^*^*^ **** File 12 of 12 **** "Phone Companies Across U.S. Want Coins Box Thief's Number" From the Tribune - Thursday, Nov. 5, 1987 SAN FRANCISCO - Seven telephone companies across the country, including Pacific Bell, are so frazzled by a coin box thief that they are offering a reward of $25,000 to catch him. He's very clever, telephone officials say, and is the only known suspect in the country that is able to pick the locks on coin boxes in telephone booths with relative ease. He is believed responsible for stealing hundreds of thousands of dollars from coin boxes in the Bay Area and Sacramento this year. The suspect has been identified by authorities as James Clark, 47, of Pennisula, Ohio, a machinist and tool-and-die maker, who is believed responsible for coin box thefts in 24 other states. Other companies sharing in the reward are Ohio Bell, Southern Bell, South Carolina Bell, South Central Bell, Southwestern Bell, Bell Telephone of Pennsylvania and U.S. West. Clark allegedly hit pay phones that are near freeways and other major thoroughfares. Clark, described as 5 feet 9 inches tall, with shoulder length brown hair and gold-rimmed glasses, is reported to be driving a new Chevrolet Astro van painted a dark metallic blue. He was recently in Arizona but is believed to be back in California. Written by a Tribune Staff Writer Typed by the $muggler </pre> </body>