Freaks Macintosh Archive

home *** CD-ROM | disk | FTP | other *** search

/ Freaks Macintosh Archive / Freaks Macintosh Archive.bin / Freaks Macintosh Archives / Textfiles / zines / Phrack / Phrack Issue 17.sit / Phrack Issue 17

Wrap

Text File | 1997-02-22 | 130KB | 2,658 lines

<head> <title>Phrack Magazine Issue 17, File 1 of 1 </title> <head> <body> <pre> % = % = % = % = % = % = % = % = = % P h r a c k X V I I % = = % = % = % = % = % = % = % = % Phrack Seventeen 07 April 1988 File 1 of 12 : Phrack XVII Introduction It's been a long time, but we're back. After two successful releases under the new editorship, Taran King told us that with his vacation from school, he'd be able to put Phrack Seventeen together. His plans soon changed, and Seventeen was now our responsibility again. Procrastination set in, and some difficulty was encountered in compiling the files, but we finally did it and here it is. There's a lot of good material in this issue, and we're lucky enough to have PWN contributions from several sources, making it a true group effort. Since The Mad Chemist and Sir Francis Drake, as well as myself, are moving on to other things, the editorship of Phrack Inc. may be changing with the release of Phrack Eighteen. Regardless of what direction the publication takes, I know that I will have no part in the creation of the next issue, so I'd like to mention at this time that my involvement with the magazine, first as a contributor and later as a contributing editor, has been fun. Phrack will go on, I'm sure, for another seventeen issues at least, and will continue to be a primary monument to the vitality of the hacker culture. -- Shooting Shark Contributing Editor Phrack XVII Table of Contents ----------------------------- # Title Author Size ---- ----- ------ ---- 17.1 Phrack XVII Introduction Shooting Shark 3K 17.2 Dun & Bradstreet Report on AT&T Elric of Imrryr 24K 17.3 D&B Report on Pacific Telesis Elric of Imrryr 26K 17.4 Nitrogen-Trioxide Explosive Signal Substain 7K 17.5 How to Hack Cyber Systems Grey Sorcerer 23K 17.6 How to Hack HP2000's Grey Sorcerer 3K 17.7 Accessing Government Computers The Sorceress 9K 17.8 Dial-Back Modem Security Elric of Imrryr 11K 17.9 Data Tapping Made Easy Elric of Imrryr 4K 17.10 PWN17.1 Bust Update Sir Francis Drake 3K 17.11 PWN17.2 "Illegal" Hacker Crackdown The $muggler 5K 17.12 PWN17.3 Cracker are Cheating Bell The Sorceress 8K % = % = % = % = % = % = % = % = = % P h r a c k X V I I % = = % = % = % = % = % = % = % = % Phrack Seventeen 07 April 1988 File 2 of 12 : Dun & Bradstreet Report on AT&T AT&T Credit File, taken from Dun & Bradstreet by Elric of Imrryr DUN'S FINANCIAL RECORDS COPYRIGHT (C) 1987 DUN & BRADSTREET CREDIT SERVICE Name & Address: AMERICAN TELEPHONE AND TELEGRAPH Trade-Style Name: 550 Madison Ave AT & T NEW YORK, NY 10022 Telephone: 212-605-5300 DUNS Number: 00-698-0080 Line of Business: TELECOMMUNICATIONS SVCS TELE Primary SIC Code: 4811 Secondary SIC Codes: 4821 3661 3357 3573 5999 Year Started: 1885 (12/31/86) COMBINATION FISCAL Employees Total: 317,000 Sales: 34,087,000,000 Employees Here: 1,800 Net Worth: 14,462,000,000 This is a PUBLIC company 12/31/86 COMBINATION FISCAL (Figures are in THOUSANDS) FINANCIALS % COMPANY INDST COMPANY CHANGE % NORM % Cash. . . . . . . . . . . . . 2,602,000 17.5 6.7 9.0 Accounts Receivable . . . . . 7,820,000 (13.1) 20.1 5.7 Notes Receivable. . . . . . . ---- ---- ---- 0.2 Inventory . . . . . . . . . . 3,519,000 (26.1) 9.1 1.3 Other Current Assets. . . . . 1,631,000 72.0 4.2 5.8 Total Current Assets. . . . . 15,572,000 (8.0) 40.0 22.0 Fixed Assets. . . . . . . . . 21,078,000 (4.7) 54.2 35.6 Other Non-current Assets. . . 2,233,000 55.9 5.7 42.4 Total Assets. . . . . . . . . 38,883,000 (3.9) 100.0 100.0 Accounts Payable. . . . . . . 4,625,000 (6.4) 11.9 4.2 Bank Loans. . . . . . . . . . ---- ---- ---- 0.2 Notes Payable . . . . . . . . ---- ---- ---- 1.0 Other Current Liabilities . . 6,592,000 0.8 17.0 6.2 Total Current Liabilities . . 11,217,000 (2.4) 28.8 11.6 Other Long Term Liab. . . . . 13,204,000 38.2 34.0 46.8 Deferred Credits. . . . . . . ---- ---- ---- 6.4 Net Worth . . . . . . . . . . 14,462,000 (1.2) 37.2 35.2 Total Liabilities & Worth. . 38,883,000 (3.9) 100.0 100.0 Net Sales . . . . . . . . . . 34,087,000 (2.4) 100.0 100.0 Gross Profit. . . . . . . . . 15,838,000 ---- 46.5 40.1 Net Profit After Tax. . . . . 139,000 (91.1) 0.4 15.3 Dividends/Withdrawals . . . . 1,371,000 (0.9) 4.0 7.7 Working Capital . . . . . . . 4,355,000 (19.8) ---- ---- RATIOS % ---INDUSTRY QUARTILES--- COMPANY CHANGE UPPER MEDIAN LOWER (SOLVENCY) Quick Ratio . . . . . . . . . 0.9 (10.0) 2.9 1.2 0.6 Current Ratio . . . . . . . . 1.4 (6.7) 4.9 2.2 1.0 Curr Liab to Net Worth (%). . 77.6 (1.1) 13.2 26.4 38.1 Curr Liab to Inventory (%). . 318.8 32.1 244.8 475.8 675.0 Total Liab to Net Worth (%) . 168.9 (4.3) 127.4 180.2 297.2 Fix Assets to Net Worth (%) . 145.7 (3.6) 144.9 215.0 263.0 (EFFICIENCY) Coll Period (days). . . . . . 83.7 (11.1) 31.9 46.7 61.6 Sales to Inventory. . . . . . 9.7 32.9 56.2 33.8 20.0 Assets to Sales (%) . . . . . 114.1 (1.6) 210.5 266.1 373.4 Sales to Net Working Cap. . . 7.8 21.9 6.3 2.3 1.1 Acct Pay to Sales (%) . . . . 13.6 (4.2) 4.9 8.7 13.8 (PROFITABILITY) Return on Sales (%) . . . . . 0.4 (91.1) 20.1 14.6 11.3 Return on Assets (%). . . . . 0.4 (89.5) 7.2 5.7 3.7 Return on Net Worth (%) . . . 1.0 (90.6) 19.0 15.9 12.8 Industry norms based on 469 firms, with assets over $5 million. 12/31/85 COMBINATION FISCAL (Figures are in THOUSANDS) FINANCIALS % COMPANY INDST COMPANY CHANGE % NORM % Cash. . . . . . . . . . . . . 2,213,700 3.4 5.5 7.5 Accounts Receivable . . . . . 8,996,100 (4.0) 22.2 5.6 Notes Receivable. . . . . . . ---- ---- ---- 0.4 Inventory . . . . . . . . . . 4,759,300 (0.6) 11.8 1.2 Other Current Assets. . . . . 948,500 (8.2) 2.3 5.1 Total Current Assets. . . . . 16,917,600 (2.4) 41.8 19.8 Fixed Assets. . . . . . . . . 22,112,900 5.2 54.7 39.2 Other Non-current Assets. . . 1,432,000 (3.2) 3.5 41.0 Total Assets. . . . . . . . . 40,462,500 1.6 100.0 100.0 Accounts Payable. . . . . . . 4,942,800 (11.4) 12.2 4.9 Bank Loans. . . . . . . . . . ---- ---- ---- 0.3 Notes Payable . . . . . . . . 2,100 ---- ---- 0.8 Other Current Liabilities . . 6,542,600 15.5 16.2 5.9 Total Current Liabilities . . 11,487,500 2.2 28.4 11.9 Other Long Term Liab. . . . . 9,553,200 2.7 23.6 46.8 Deferred Credits. . . . . . . 4,788,500 18.9 11.8 6.8 Net Worth . . . . . . . . . . 14,633,300 (4.1) 36.2 34.5 Total Liabilities & Worth. . 40,462,500 1.6 100.0 100.0 Net Sales . . . . . . . . . . 34,909,500 5.2 100.0 100.0 Gross Profit. . . . . . . . . ---- ---- ---- 33.7 Net Profit After Tax. . . . . 1,556,800 13.6 4.5 14.0 Dividends/Withdrawals . . . . 1,382,900 3.7 4.0 13.0 Working Capital . . . . . . . 5,430,100 (10.8) ---- ---- RATIOS % ---INDUSTRY QUARTILES--- COMPANY CHANGE UPPER MEDIAN LOWER (SOLVENCY) Quick Ratio . . . . . . . . . 1.0 ---- 2.5 1.1 0.6 Current Ratio . . . . . . . . 1.5 ---- 3.8 1.9 0.9 Curr Liab to Net Worth (%). . 78.5 6.5 15.8 29.4 43.9 Curr Liab to Inventory (%). . 241.4 2.8 285.7 485.5 790.6 Total Liab to Net Worth (%) . 176.5 9.6 134.4 190.1 320.9 Fix Assets to Net Worth (%) . 151.1 9.7 148.4 219.0 289.5 (EFFICIENCY) Coll Period (days). . . . . . 94.1 (8.7) 31.5 47.2 63.8 Sales to Inventory. . . . . . 7.3 5.8 52.3 31.4 18.0 Assets to Sales (%) . . . . . 115.9 (3.4) 217.1 277.8 356.8 Sales to Net Working Cap. . . 6.4 16.4 6.0 2.7 1.6 Acct Pay to Sales (%) . . . . 14.2 (15.5) 6.1 10.4 15.7 (PROFITABILITY) Return on Sales (%) . . . . . 4.5 9.8 19.0 13.6 9.5 Return on Assets (%). . . . . 3.8 11.8 6.9 5.3 3.4 Return on Net Worth (%) . . . 10.6 17.8 19.7 15.8 12.7 Industry norms based on 605 firms, with assets over $5 million. 12/31/84 COMBINATION FISCAL (Figures are in THOUSANDS) FINANCIALS COMPANY INDST COMPANY % NORM % Cash. . . . . . . . . . . . . 2,139,900 5.4 6.6 Accounts Receivable . . . . . 9,370,800 23.5 6.3 Notes Receivable. . . . . . . ---- ---- 0.4 Inventory . . . . . . . . . . 4,789,200 12.0 1.2 Other Current Assets. . . . . 1,033,100 2.6 4.1 Total Current Assets. . . . . 17,333,000 43.5 18.6 Fixed Assets. . . . . . . . . 21,015,000 52.8 45.0 Other Non-current Assets. . . 1,478,600 3.7 36.4 Total Assets. . . . . . . . . 39,826,600 100.0 100.0 Accounts Payable. . . . . . . 5,580,300 14.0 5.2 Bank Loans. . . . . . . . . . ---- ---- 0.2 Notes Payable . . . . . . . . ---- ---- 1.0 Other Current Liabilities . . 5,663,300 14.2 5.5 Total Current Liabilities . . 11,243,600 28.2 11.9 Other Long Term Liab. . . . . 9,300,200 23.4 47.8 Deferred Credits. . . . . . . 4,026,000 10.1 6.5 Net Worth . . . . . . . . . . 15,256,800 38.3 33.8 Total Liabilities & Worth. . 39,826,600 100.0 100.0 Net Sales . . . . . . . . . . 33,187,500 100.0 100.0 Gross Profit. . . . . . . . . 16,436,200 49.5 28.1 Net Profit After Tax. . . . . 1,369,900 4.1 14.1 Dividends/Withdrawals . . . . 1,333,800 4.0 7.3 Working Capital . . . . . . . 6,089,400 ---- ---- RATIOS ---INDUSTRY QUARTILES--- COMPANY UPPER MEDIAN LOWER (SOLVENCY) Quick Ratio . . . . . . . . . 1.0 2.3 1.0 0.6 Current Ratio . . . . . . . . 1.5 3.4 1.6 0.9 Curr Liab to Net Worth (%). . 73.7 17.7 30.6 43.5 Curr Liab to Inventory (%). . 234.8 312.5 491.6 754.3 Total Liab to Net Worth (%) . 161.0 139.2 193.7 314.9 Fix Assets to Net Worth (%) . 137.7 161.5 228.9 295.3 (EFFICIENCY) Coll Period (days). . . . . . 103.1 34.3 51.6 67.8 Sales to Inventory. . . . . . 6.9 52.1 32.6 20.1 Assets to Sales (%) . . . . . 120.0 216.7 268.2 353.0 Sales to Net Working Cap. . . 5.5 7.2 3.1 1.7 Acct Pay to Sales (%) . . . . 16.8 6.2 10.9 15.4 (PROFITABILITY) Return on Sales (%) . . . . . 4.1 18.5 13.1 9.8 Return on Assets (%). . . . . 3.4 7.0 5.3 3.3 Return on Net Worth (%) . . . 9.0 19.7 15.7 12.6 Industry norms based on 504 firms, with assets over $5 million. END OF DOCUMENT Name & Address: AMERICAN TELEPHONE AND Trade-Style Name: 550 Madison Ave At & T NEW YORK, NY 10022 Telephone: 212-605-5300 DUNS Number: 00-698-0080 Line of Business: TELECOMMUNICATIONS SVCS TELE Primary SIC Code: 4811 Secondary SIC Codes: 4821 3661 3357 3573 5999 Year Started: 1885 (12/31/86) COMBINATION FISCAL Employees Total: 317,000 Sales: 34,087,000,000 Employees Here: 1,800 Net Worth: 14,462,000,000 This is a PUBLIC company HISTORY 04/20/87 JAMES E. OLSON, CHB-CEO+ ROBERT E. ALLEN, PRES-COO+ RANDALL L TOBIAS, V CHM+ CHARLES MARSHALL, V CHM+ MORRIS TANENBAUM, V CHM+ S. LAWRENCE PRENDERGAST, V PRES- TREAS C. PERRY COLWELL, V PRES- CONTROLLER DIRECTOR(S): The officers identified by (+) and Howard H. Baker Jr, James H. Evans, Peter F. Haas, Philip M. Hawley, Edward G. Jefferson, Belton K. Johnson, Juanita M. Kreps, Donald S. Perkins, Henry B. Schacht, Michael I. Sovern, Donald F. McHenry, Rawleigh Warner Jr, Joseph D. Williams and Thomas H. Wyman. Incorporated New York Mar 3 1885. Authorized capital consists of 1,200,000,000 shares common stock $1 par value and 100,000,000 shares preferred stock $1 par value. Outstanding Capital Stock at Feb 28 1987: 1,071,904,000 common shares and at Dec 31 1986 preferred stock outstanding consisted of redeemable preferred shares composed of 8,500,000 shares of $3.64 preferred stated value $50; 8,800,000 shares of $3.74 preferred, stated value $50 and 25,500 shares of $77.50 preferred, stated value $1,000. Business started 1885. The company's common stock is listed on the New York, Boston, Midwest, Philadelphia and Pacific Coast Stock Exchanges under the symbol "ATT". At Dec 31 1986 there were 2,782,102 common shareholders. At Jan 1 1986 officers and directors as a group owned less than 1% of the outstanding common stock with the remainder owned by the public. OLSON, born 1925. 1950 Univ of North Dakota, BSC. Also attended Univ of Pennsylvania. 1943-1946 United States Army Air Force. 1960-1970 Northwestern Bell Telephone Co, V Pres-Gen Mgr. 1970-1974 Indiana Bell Telephone Co, Pres. 1974-1977 Illinois Bell Telephone Co, Pres. 1977 to date AT&T, 1979 V Chb-Dir; Jun 1985 President, 1986 CHM. MARSHALL, born 1929, married. 1951 Univ of Illinois, BS; also attended Bradley Univ; 1953-present AT&T; 1980 Asst Treas, 1976 Vice Pres-Treas; 1985 Exec Vice President, 1986 V-CHM. TANENBAUM, born 1928 married. 1949 Johns Hopkins Univ, BA chemistry. 1950 Princeton Univ, MA chemistry. 1952 PhD in physical chemistry. 1952 to date AT&T, various positions, 1985 Ex Vice Pres, 1986 V-CHM. PRENDERGAST, born 1941 married. 1963 Brown Univ, BA. 1969 New York Univ, MBA. 1963-1973 Western Electric Company; 1973 to date AT&T, 1980 Asst Treas, 1984 V Pres-Treas. COLWELL, born 1927. Attended AT&T Institute of Technology. 1945-1947 U S Army. Employed by AT&T and its subsidiaries since 1948 in various positions. 1984 Vice Pres & Contr, AT&T Technologies Inc (subsidiary); 1985-present V Pres-Contr. ALLEN born 1935 married. 1957 Wabash College BA. Has held a vareity of executive position with former Bell Operating subsidiaries and AT&T subsidiaries. Appointed to current position in 1986. TOBIAS born 1943. 1964 Indiana University with a BS in Marketing. Has held a variety of management and executive positions with former Bell Operating subsidiaries and AT&T subsidiaries. Elected to current position in 1986. OTHER OFFICERS: James R. Billingsley, Sr V Pres Federal Regulation; Michael Brunner, Ex V Pres Federal Systems; Harold Burlingame, Sr V Pres Public Relations and Employee Information; Vittorio Cassoni, Sr V Pres Data Systems Division; Richard Holbrook, Sr V Pres Business Sales; Robert Kavner, Sr V Pres & CFO; Gerald Lowrie, Sr V Pres Public Affairs; John Nemecek, Ex V Pres Components & Electronic Systems; John O'Neill, Ex V Pres National Systems Products; Alfred Partoll, Sr V Pres External Affairs; John Segall, Sr V Pres Corporate Strategy & Development; Alexander Stack, Sr V Pres Communications Systems; Paul Villiere, Ex V Pres Network Systems Marketing and Customer Operations; John Zegler, Sr V Pres and General Counsel; and Lydell Christensen, Corp V Pres and Secretary. DIRECTORS: MCHENRY, research professor, Georgetown University. BAKER JR, partner, Vinson & Elkins and Baker, Worthington, Crossley, Stansberry & Woolf, attorneys. EVANS, former Chairman, Union Pacific Corporation. HAAS, Chairman, Levi Strauss & Company. HAWLEY, Chairman, Carter Hawley Hale Stores Inc. JEFFERSON, former Chairman, E.I. du Pont de Nemours and Company. JOHNSON, private investor and owner of The Chaparrosa Ranch. KREPS, former United States Secretary of Commerce. PERKINS, former Chairman, Jewel Companies Inc. SCHACHT, Chairman, Cummins Engine Company Inc. SOVERN, President, Columbia University. WARNER JR, former Chairman, Mobil Corporation. WILLIAMS, Chairman, Warner Lambert Company. WYMAN, former Chairman, CBS Inc. As a result of an antitrust action entered against American Telephone and Telegraph Company (AT&T) by the Department of Justice, AT&T agreed in Jan 1982 to break up its holdings. In Aug 1982, the U. S. District Court-District of Columbia, entered a consent decree requiring AT&T to divest itself of portions of its operations. The operations affected consisted of exchange telecommunications, exchange access functions, printed directory services and cellular radio telecommunications services. AT&T retained ownership of AT&T Communications Inc, AT&T Technologies Inc, Bell Telephone Laboratories Incorporated, AT&T Information Systems Inc, AT&T International Inc and those portions of the 22 Bell System Telephone Company subsidiaries which manufactured new customer premises equipment. The consent decree, with modifications, was agreed to by AT&T and the U. S. Department of Justice and approved by the U. S. Supreme Court in Feb 1983. In Dec 1982, AT&T filed a plan of reorganization, outlining the means of compliance with the divestiture order. The plan was approved by the court in Aug 1983 The divestiture completed on Jan 1 1984, was accomplished by the reorganization of the 22 principal AT&T Bell System Telephone Company subsidiaries under 7 new regional holding companies. Each AT&T common shareowner of record as of Dec 10 1983 received 1 share of common stock in each of the newly formed corporations for every 10 common shares of AT&T. AT&T common shareowners retained their AT&T stock ownership. The company has an ownership interest in certain ventures to include: (1) Owns 22% of the voting stock of Ing C. Olivetti & C., S.p.A. of Milan, Italy with which the company develops and markets office automation products in Europe. (2) Owns 50% of a joint venture with the N. V. Philips Company of the Netherlands organized to manufacture and market switching and transmission systems in Europe and elsewhere. (3) Owns 44% of a joint venture with the Goldstar Group of the Republic of Korea which manufactures switching products and distributes the company's 3B Family of Computers in Korea. The company also maintain stock interests in other concerns. In addition to joint venture activities described above, intercompany relations have also included occasional advances from subject. OPERATION 04/20/87 Through subsidiaries, provides intrastate, interstate and international long distance telecommunications and information transport services, a broad range of voice and data services including, Domestic and Long Distance Service, Wide Area Telecommunications Services (WATS), 800 Service, 900 Dial It Services and a series of low, medium and high speed digital voice and data services known as Accunet Digital Services. Also manufactures telephone communications equipment and apparatus, communications wire and cable, computers for use in communications systems, as well as for general purposes, retails and leases telephone communications equipment and provides research and development in information and telecommunications technology. The company is subject to the jurisdiction of the Federal Communications Commission with respect to interstate and international rates, lines, services and other matters. Terms: Net 30, cash and contract providing for progress payments with final payment upon completion. The company's AT&T Communications Inc subsidiary provides interstate and intrastate long distance communications services for 80 million residential customers and 7 million businesses. Sells to a wide variety of businesses, government agencies, individuals and others. Nonseasonal. EMPLOYEES: 317,000 including officers. 1,800 employed here. FACILITIES: Owns premises in multi story steel building in good condition. Premises neat. LOCATION: Central business section on main street. BRANCHES: The company's subsidiaries operate 19 major manufacturing plants located throughout the United States containing a total 26.2 million square feet of space of which 1.49 million square feet were in leased premises. There are 7 regional centers and 24 distribution centers. In addition, there are numerous domestic and foreign branch offices. SUBSIDIARIES: The company had numerous subsidiaries as of Dec 31 1986. Subsidiaries perform the various services and other functions described above. Its unconsolidated finance subsidiary, AT&T Credit Corporation, provides financing to customers through leasing and installment sales programs and purchases from AT&T's subsidiaries the rights to receivables under long-term service agreements. Intercompany relations consists of parent making occasional advances to subsidiaries and service transactions settled on a convenience basis. A list of principal subsidiaries as of Dec 31 1986 is on file at the Millburn, NJ office of Dun & Bradstreet. 08-27(9Z0 /61) 00703 001 678 NH Chemical Bank, 277 Park Ave; Marine Midland Bank, 140 Broadway; Chase Manhattan Bank, 1 Chase Manhattan Plaza 12/31/86 COMBINATION FISCAL (Figures are in THOUSANDS) FINANCIALS % COMPANY INDST COMPANY CHANGE % NORM % Total Current Assets. . . . . 15,572,000 (8.0) 40.0 22.0 Fixed Assets. . . . . . . . . 21,078,000 (4.7) 54.2 35.6 Other Non-current Assets. . . 2,233,000 55.9 5.7 42.4 Total Assets. . . . . . . . . 38,883,000 (3.9) 100.0 100.0 Total Current Liabilities . . 11,217,000 (2.4) 28.8 11.6 Other Long Term Liab. . . . . 13,204,000 38.2 34.0 46.8 Net Worth . . . . . . . . . . 14,462,000 (1.2) 37.2 35.2 Total Liabilities & Worth. . 38,883,000 (3.9) 100.0 100.0 Net Sales . . . . . . . . . . 34,087,000 (2.4) 100.0 100.0 Gross Profit. . . . . . . . . 15,838,000 ---- 46.5 40.1 RATIOS % ---INDUSTRY QUARTILES--- COMPANY CHANGE UPPER MEDIAN LOWER Quick Ratio . . . . . . . . . 0.9 (10.0) 2.9 1.2 0.6 Current Ratio . . . . . . . . 1.4 (6.7) 4.9 2.2 1.0 Total Liab to Net Worth (%) . 168.9 (4.3) 127.4 180.2 297.2 Sales to Inventory. . . . . . 9.7 32.9 56.2 33.8 20.0 Return on Sales (%) . . . . . 0.4 (91.1) 20.1 14.6 11.3 Return on Assets (%). . . . . 0.4 (89.5) 7.2 5.7 3.7 Return on Net Worth (%) . . . 1.0 (90.6) 19.0 15.9 12.8 Industry norms based on 469 firms, with assets over $5 million. End_of_File. % = % = % = % = % = % = % = % = = % P h r a c k X V I I % = = % = % = % = % = % = % = % = % Phrack Seventeen 07 April 1988 File 3 of 12 : Dun & Bradstreet Report on Pacific Telesis Pacific Telesis Credit File, taken from Dun & Bradstreet by Elric of Imrryr Name & Address: PACIFIC TELESIS GROUP (INC) 140 New Montgomery St SAN FRANCISCO, CA 94105 Telephone: 415-882-8000 DUNS Number: 10-346-0846 Line of Business: TELECOMMUNICATION SERVICES Primary SIC Code: 4811 Secondary SIC Codes: 2741 5063 5732 6159 Year Started: 1906 (12/31/86) COMBINATION FISCAL Employees Total: 74,937 Sales: 8,977,300,000 Employees Here: 2,000 Net Worth: 7,753,300,000 This is a PUBLIC company 12/31/86 COMBINATION FISCAL (Figures are in THOUSANDS) FINANCIALS % COMPANY INDST COMPANY CHANGE % NORM % Cash. . . . . . . . . . . . . 200,600 671.5 1.0 9.0 Accounts Receivable . . . . . 1,390,700 (3.8) 6.8 5.7 Notes Receivable. . . . . . . ---- ---- ---- 0.2 Inventory . . . . . . . . . . 116,300 (4.4) 0.6 1.3 Other Current Assets. . . . . 448,700 18.6 2.2 5.8 Total Current Assets. . . . . 2,156,300 9.3 10.6 22.0 Fixed Assets. . . . . . . . . 17,244,900 1.6 84.9 35.6 Other Non-current Assets. . . 919,300 53.8 4.5 42.4 Total Assets. . . . . . . . . 20,320,500 4.0 100.0 100.0 Accounts Payable. . . . . . . 1,760,300 74.1 8.7 4.2 Bank Loans. . . . . . . . . . 21,800 847.8 0.1 0.2 Notes Payable . . . . . . . . ---- ---- ---- 1.0 Other Current Liabilities . . 623,000 (35.8) 3.1 6.2 Total Current Liabilities . . 2,405,100 21.3 11.8 11.6 Other Long Term Liab. . . . . 5,564,600 (7.6) 27.4 46.8 Deferred Credits. . . . . . . 4,597,500 9.0 22.6 6.4 Net Worth . . . . . . . . . . 7,753,300 6.0 38.2 35.2 Total Liabilities & Worth. . 20,320,500 4.0 100.0 100.0 Net Sales . . . . . . . . . . 8,977,300 5.6 100.0 100.0 Gross Profit. . . . . . . . . ---- ---- ---- 40.1 Net Profit After Tax. . . . . 1,079,400 16.2 12.0 15.3 Dividends/Withdrawals . . . . 654,100 10.0 7.3 7.7 Working Capital . . . . . . . 248,800 (999.9) ---- ---- RATIOS % ---INDUSTRY QUARTILES--- COMPANY CHANGE UPPER MEDIAN LOWER (SOLVENCY) Quick Ratio . . . . . . . . . 0.7 ---- 2.9 1.2 0.6 Current Ratio . . . . . . . . 0.9 (10.0) 4.9 2.2 1.0 Curr Liab to Net Worth (%). . 31.0 14.4 13.2 26.4 38.1 Curr Liab to Inventory (%). . 999.9 26.9 244.8 475.8 675.0 Total Liab to Net Worth (%) . 162.1 (2.9) 127.4 180.2 297.2 Fix Assets to Net Worth (%) . 222.4 (4.1) 144.9 215.0 263.0 (EFFICIENCY) Coll Period (days). . . . . . 56.5 (9.0) 31.9 46.7 61.6 Sales to Inventory. . . . . . 77.2 10.6 56.2 33.8 20.0 Assets to Sales (%) . . . . . 226.4 (1.5) 210.5 266.1 373.4 Sales to Net Working Cap. . . ---- ---- 6.3 2.3 1.1 Acct Pay to Sales (%) . . . . 19.6 64.7 4.9 8.7 13.8 (PROFITABILITY) Return on Sales (%) . . . . . 12.0 10.1 20.1 14.6 11.3 Return on Assets (%). . . . . 5.3 10.4 7.2 5.7 3.7 Return on Net Worth (%) . . . 13.9 9.4 19.0 15.9 12.8 Industry norms based on 469 firms, with assets over $5 million. 12/31/85 COMBINATION FISCAL (Figures are in THOUSANDS) FINANCIALS % COMPANY INDST COMPANY CHANGE % NORM % Cash. . . . . . . . . . . . . 26,000 550.0 0.1 7.5 Accounts Receivable . . . . . 1,446,200 20.6 7.4 5.6 Notes Receivable. . . . . . . ---- ---- ---- 0.4 Inventory . . . . . . . . . . 121,700 ---- 0.6 1.2 Other Current Assets. . . . . 378,300 (8.3) 1.9 5.1 Total Current Assets. . . . . 1,972,200 22.1 10.1 19.8 Fixed Assets. . . . . . . . . 16,968,400 6.1 86.8 39.2 Other Non-current Assets. . . 597,700 29.4 3.1 41.0 Total Assets. . . . . . . . . 19,538,300 8.1 100.0 100.0 Accounts Payable. . . . . . . 1,011,100 14.6 5.2 4.9 Bank Loans. . . . . . . . . . 2,300 ---- ---- 0.3 Notes Payable . . . . . . . . ---- ---- ---- 0.8 Other Current Liabilities . . 969,900 18.6 5.0 5.9 Total Current Liabilities . . 1,983,300 (1.0) 10.2 11.9 Other Long Term Liab. . . . . 6,021,700 0.8 30.8 46.8 Deferred Credits. . . . . . . 4,216,300 16.6 21.6 6.8 Net Worth . . . . . . . . . . 7,317,000 12.9 37.4 34.5 Total Liabilities & Worth. . 19,538,300 8.1 100.0 100.0 Net Sales . . . . . . . . . . 8,498,600 8.6 100.0 100.0 Gross Profit. . . . . . . . . ---- ---- ---- 33.7 Net Profit After Tax. . . . . 929,100 12.1 10.9 14.0 Dividends/Withdrawals . . . . 594,400 11.9 7.0 13.0 Working Capital . . . . . . . 11,100 ---- ---- ---- RATIOS % ---INDUSTRY QUARTILES--- COMPANY CHANGE UPPER MEDIAN LOWER (SOLVENCY) Quick Ratio . . . . . . . . . 0.7 16.7 2.5 1.1 0.6 Current Ratio . . . . . . . . 1.0 25.0 3.8 1.9 0.9 Curr Liab to Net Worth (%). . 27.1 (12.3) 15.8 29.4 43.9 Curr Liab to Inventory (%). . 999.9 ---- 285.7 485.5 790.6 Total Liab to Net Worth (%) . 167.0 (6.7) 134.4 190.1 320.9 Fix Assets to Net Worth (%) . 231.9 (6.0) 148.4 219.0 289.5 (EFFICIENCY) Coll Period (days). . . . . . 62.1 11.1 31.5 47.2 63.8 Sales to Inventory. . . . . . 69.8 ---- 52.3 31.4 18.0 Assets to Sales (%) . . . . . 229.9 (0.5) 217.1 277.8 356.8 Sales to Net Working Cap. . . ---- ---- 6.0 2.7 1.6 Acct Pay to Sales (%) . . . . 11.9 5.3 6.1 10.4 15.7 (PROFITABILITY) Return on Sales (%) . . . . . 10.9 2.8 19.0 13.6 9.5 Return on Assets (%). . . . . 4.8 4.3 6.9 5.3 3.4 Return on Net Worth (%) . . . 12.7 (0.8) 19.7 15.8 12.7 Industry norms based on 605 firms, with assets over $5 million. 12/31/84 COMBINATION FISCAL (Figures are in THOUSANDS) FINANCIALS COMPANY INDST COMPANY % NORM % Cash. . . . . . . . . . . . . 4,000 ---- 6.6 Accounts Receivable . . . . . 1,198,800 6.6 6.3 Notes Receivable. . . . . . . ---- ---- 0.4 Inventory . . . . . . . . . . ---- ---- 1.2 Other Current Assets. . . . . 412,400 2.3 4.1 Total Current Assets. . . . . 1,615,200 8.9 18.6 Fixed Assets. . . . . . . . . 15,999,500 88.5 45.0 Other Non-current Assets. . . 461,800 2.6 36.4 Total Assets. . . . . . . . . 18,076,500 100.0 100.0 Accounts Payable. . . . . . . 882,100 4.9 5.2 Bank Loans. . . . . . . . . . ---- ---- 0.2 Notes Payable . . . . . . . . 304,000 1.7 1.0 Other Current Liabilities . . 817,600 4.5 5.5 Total Current Liabilities . . 2,003,700 11.1 11.9 Other Long Term Liab. . . . . 5,973,500 33.0 47.8 Deferred Credits. . . . . . . 3,617,000 20.0 6.5 Net Worth . . . . . . . . . . 6,482,300 35.9 33.8 Total Liabilities & Worth. . 18,076,500 100.0 100.0 Net Sales . . . . . . . . . . 7,824,300 100.0 100.0 Gross Profit. . . . . . . . . ---- ---- 28.1 Net Profit After Tax. . . . . 828,500 10.6 14.1 Dividends/Withdrawals . . . . 531,200 6.8 7.3 Working Capital . . . . . . . 388,500 ---- ---- RATIOS ---INDUSTRY QUARTILES--- COMPANY UPPER MEDIAN LOWER (SOLVENCY) Quick Ratio . . . . . . . . . 0.6 2.3 1.0 0.6 Current Ratio . . . . . . . . 0.8 3.4 1.6 0.9 Curr Liab to Net Worth (%). . 30.9 17.7 30.6 43.5 Curr Liab to Inventory (%). . ---- 312.5 491.6 754.3 Total Liab to Net Worth (%) . 178.9 139.2 193.7 314.9 Fix Assets to Net Worth (%) . 246.8 161.5 228.9 295.3 (EFFICIENCY) Coll Period (days). . . . . . 55.9 34.3 51.6 67.8 Sales to Inventory. . . . . . ---- 52.1 32.6 20.1 Assets to Sales (%) . . . . . 231.0 216.7 268.2 353.0 Sales to Net Working Cap. . . ---- 7.2 3.1 1.7 Acct Pay to Sales (%) . . . . 11.3 6.2 10.9 15.4 (PROFITABILITY) Return on Sales (%) . . . . . 10.6 18.5 13.1 9.8 Return on Assets (%). . . . . 4.6 7.0 5.3 3.3 Return on Net Worth (%) . . . 12.8 19.7 15.7 12.6 Industry norms based on 504 firms, with assets over $5 million. END OF DOCUMENT Name & Address: PACIFIC TELESIS GROUP (INC) 140 New Montgomery St SAN FRANCISCO, CA 94105 Telephone: 415-882-8000 DUNS Number: 10-346-0846 Line of Business: TELECOMMUNICATION SERVICES Primary SIC Code: 4811 Secondary SIC Codes: 2741 5063 5732 6159 Year Started: 1906 (12/31/86) COMBINATION FISCAL Employees Total: 74,937 Sales: 8,977,300,000 Employees Here: 2,000 Net Worth: 7,753,300,000 This is a PUBLIC company HISTORY 09/01/87 DONALD E GUINN, CHB PRES+ THEODORE J SAENGER, V CHB GROUP PRES+ SAM L GINN, V CHB+ JOHN E HULSE, V CHB CFO+ ROBERT V R DALENBERG, EX V PRES BENTON W DIAL, EX V PRES-HUM GEN COUNSEL SEC RESOURCES ARTHUR C LATNO JR, EX V PRES THOMAS G CROSS, V PRES TREAS FRANK V SPILLER, V PRES COMPTROLLER DIRECTOR(S): The officers identified by (+) and Norman Barker Jr, William P Clark, Willaim K Coblentz, Myron Du Bain, Herman E Gallegos James R Harvey, Ivan J Houston, Leslie L Luttgens, E L Mc Neely, S Donley Ritchey, Willaim French Smith & Mary S Metz. Incorporated Nevada Oct 26 1983. Authorized capital consists of 505,000,000 shares common stock, $.10 par value. OUTSTANDING CAPITAL STOCK: Consists of following at Dec 31 1986: 215,274,878 common shares at a stated value of $21.5 million plus additional paid in capital of $5,068.5 million. The stock is publicly traded on the New York, Pacific and Midwest Stock Exchanges. There were 1,170,161 common shareholders at Feb 1 1987. Officers and directors as a group hold less than 1% of stock. No other entity owned more than 5% of the common stock outstanding. The authorized capital stock was increased to $1,100,000,000 shares in 1987 by Charter Amendment. In addition, the company declared a two-for-one stock split in the form of a 100% stock dividend effective Mar 25 1987. BACKGROUND: This business was founded in 1906 as a California Corporation. The Pacific Telephone & Telegraph Company formed Dec 31 1906. Majority of the stock was held by American Telephone & Telegraph Co (A T & T), New York, NY, prior to divestiture. DIVESTITURE: Pursuant to a court oder of the U S District Court for the Distirict of Columbia, A T & T divested itself of the exchange, telecommunications, exchange access and printing directory advertising portions of its 22 wholly-owned subsidiary operating telephone companies, including the Pacific Telephone & Telegraph Company. A T & T retains ownership of the former A T & T long lines interstate organization, as well as those portions of the subsidiaries that provide interchange services and customer premises equipment. To accomplish the divestiture, this regional holding company was formed, which took over the applicable operations and assets of the Pacific Telephone & Telegraph Company and its subsidiary, Bell Telephone Company of Nevada. Stock in the subject was distributed to the shareholders of A T & T, who also retained their existing A T & T Stock. The divestiture was accomplished on Jan 1 1984. RECENT EVENTS:During Jun 1986, the company completed the acquisition of Communications Industries Inc, Dallas, TX. In Dec 1986, the company's wholly-owned subsidiary Pac Tel Cellular Inc of Michigan signed an agreement to purhcase five cellular telephone properties for $316 million plus certain contingent payments. These five systems operate under the name of Cellular One. This acquaition is subject to regulatory and court approval and final legal review. ------------------------OFFICERS------------------------. GUINN born 1932 married. 1954 received BSCE from Oregon State University. 1954-60 with The Pacific Telephone & Telegraph Company, San Francisco, CA. 1960-64 with Pacific Northwest Bell Telephone Co, Seattle, WA, as vice president. 1964-70 with A T & T. 1970-76 with Pacific Northwest Bell. 1976-80 with A T & T as vice president-network service. 1980 chairman and chief executive officer of The Pacific Telephone & Telegraph Company. 1984 with Pacific Telesis Group as chairman, president and chief executive officer. SAENGER born 1928 married. 1951 received BS from the University of California. 1946-47 in the U S Army. 1951-52 secretary and manager for the Oakland Junior Chamber of Commerce. 1950-70 held various positions with The Pacific Telephone & Telegraph Company. 1970-71 traffic operations director for Network Administration in New York, A T & T. 1971 with The Pacific Telephone & Telegraph Company. 1974 vice president. 1977 president. 1984 with Pacific Telesis Group as vice chairman and president, Pacific Bell. GINN born 1937 married. 1959 graduated from Auburn University. 1969 received MS from Stanford University. 1959-60 in the U S Army Signal Corps as captain. 1960 joined A T & T Long Lines. 1977 vice president-staff for A T & T Long Lines. 1978 joined The Pacific Telephone & Telegraph Company as executive vice president-network. 1983 vice chairman. 1984 with Pacific Telesis Group as vice chairman and group president, PacTel Companies. HULSE born 1933 married. 1955 received BS from the University of South Dakota. 1956-58 in the U S Army. 1958 joined Northwestern Bell Telephone Co. 1980 joined The Pacific Telephone & Telegraph Company as executive vice president and chief financial officer. 1983 vice chairman. 1984 with Pacific Telesis Group as vice chairman and chief financial officer. LATNO born 1929 married. Received BS degree from the University of Santa Clara. 1952 with Pacific Telephone & Telegraph Co. 1972 vice president-regulatory. 1975 executive vice president-external affairs. 1984 with Pacific Telesis Group as executive vice president-external affairs. DALENBERG born 1930 married. Graduated from the University of Chicago Law School and Graduate School of Business. 1956 admitted to practice at the Illinois Bar and in 1973 the California Bar. 1957-67 private law practice in Chicago, IL. 1967-72 general attorney for Illinois Bell. 1972-75 general attorney for The Pacific Telephone & Telegraph Company. 1975 associate general counsel. 1976 vice president and secretary-general counsel. 1984 with Pacific Telesis Group as executive vice president and general counsel-secretary. CROSS. Vice President and Treasurer and also Vice President of Pacific Bell. DIAL born 1929 married. 1951 received BA from Whittier College. 1961 received MS from California State University. 1951-53 in the U S Army. 1954 with The Pacific Telephone & Telegraph Company. 1973 vice president-regional staff and operations service for Southern California. 1976 vice president-customer operations in Los Angeles, CA. 1977 vice president-corporate planning. 1980 vice president-human resources. 1984 with Pacific Telesis Group as executive vice president-human resources. SPILLER born 1931 married. 1953 received BS from the University of California, San Francisco. 1954-56 in the U S Army as a second lieutenant. 1953 with The Pacific Telephone & Telegraph Company. 1977 assistant comptroller. 1981 assistant vice president-finance management. 1981 vice president and comptroller. 1984 with Pacific Telesis Group as vice president and comptroller. ---------------------OTHER DIRECTORS---------------------. BARKER. Retired chairman of First Interstate Bank Ltd. CLARK. Of counsel to the law firm of Rogers & Wells. COBLENTZ. Senior Partner in Coblentz, Cahen, Mc Cabe & Breyer, Attorneys, San Francisco, CA. DU BAIN. Chairman of SRI International. GALLEGOS. Management consultant. HARVEY. Chairman, and chief executive officer of Transamerica Corporation, San Francisco, CA. HOUSTON. Chairman and chief executive officer of Golden State Mutual Life Insurance Co. LUTTGENS. Is a community leader. MC NEELY. Chairman and chief executive officer of Oak Industries, Inc, San Diego, CA. RITCHEY. Retired Chairman of Lucky Stores Inc. SMITH. Partner in Gibson, Dunn & Crutcher, Attorneys. METZ. President of Mills College. OPERATION 09/01/87 Pacific Telesis Group is a regional holding company whose operations are conducted by subsidiaries. The company's two major subsidiaries, Pacific Bell and Nevada Bell, provide a wide variety of communications services in California and Nevada, including local exchange and toll service, network access and directory advertising, and provided over 90% of total 1986 revenues. Other subsidiaries, as noted below, are engaged in directory publishing, cellular mobile communications and services, wholesaling of telecommunications products, integrated systems and other services, retails communications equipment and supplies, financing services for products of affiliated customers, real estate development, and consulting. Specific percentages of these operations are not available but in the aggregate represent approximately 10%. Terms are net 30 days. Has over 11,000,000 accounts. Sells to the general public and commercial concerns. Territory :Worldwide. EMPLOYEES: 74,937 including officers. 2,000 employed here. Employees are on a consolidated basis as of Dec 31 1986. FACILITIES: Owns over 500,000 sq. ft. in 20 story concrete and steel building in good condition. Premises neat. LOCATION: Central business section on side street. BRANCHES: The subject maintains minor additional administrative offices in San Francisco, CA, but most operating branches are conducted by the operating subsidiaries, primarily Pacific Bell and Nevada Bell in their respective states. SUBSIDIARIES: Subsidiaries: The Company has the following principal operating subsidiaries, all wholly-owned either directly or indirectly. The telephone subsidiaries account for over 90% of the operating results. (1) Pacific Bell (Inc) San Francisco CA. Formed 1906 as a California corporation. Acquired in 1984 as part of the divestiture of AT&T. It is the company's largest subsidiary . It provides telecommunicaton services within its service area in California. (2) Nevada Bell (Inc) Reno NV. Incorporated in 1913. acquired from Pacific Bell in 1984 by the divestiture of its stock. Provides telecommunications, services in Nevada. (3) Pac Tel Cellular Inc, TX. Renamed subsidiary formerly known as Comminications Industries Inc. Acquired in 1986. Operates as a marketer of cellular and paging services. This subsidiary, in turn, has several primary subsidiaries as follows:. (a) Gen Com Incorporated. Provides personal paging services. (b) Multicom Incorporated. Markets paging services. (4) Pac Tel Personal Communications. Formed to eventually hold all of the company's cellular and paging operations. It is the parent of the following:. (c) Pac Tel Cellular supports the company's cellular activities. (d) Pac Tel Mobile Services-formed to rent and sell cellular CPE and paging equipment and resell cellular services, is now largely inactive. (5) Pac Tel Corporation, San Francisco CA began operations in Jan 1986 as a direct holding company subsidiary. It owns the stock of the following companies:. (e) Pac Tel Communications Companies-operates two primary divisions, Pac Tel Info Systems and Pac Tel Spectrum Services. (f) Pac Tel Finance-provides lease financing services. (g) Pac Tel Properties-engages in real estate transactions holding real estate valued at approximately $140 million at Dec 31 1986. (h) Pac Tel Publishing -inactive at present. (i) Pacific Telesis International-manages and operates telecommunicatin businesses in Great Britain, Japan, South Korea, Spain and Thailand. (6) Pac Tel Capital Resources, San Francisco, CA -provides funding through the sale of debt securities. INTERCOMPANY RELATIONS: Includes common management, intercompany services, inventory and equipment transactions, loans and advances. In addition, the debt of Pac Tel Capital Resources is backed by a support agreement from the parent with the debt unconditionally guaranteed for repayment without recourse to the stock or assets of the telephone subsidiaries or any interest therein. 08-27(1Z2 /27) 29709 052678678 H ANALYST: Dan Quinn 12/31/86 COMBINATION FISCAL (Figures are in THOUSANDS) FINANCIALS % COMPANY INDST COMPANY CHANGE % NORM % Total Current Assets. . . . . 2,156,300 9.3 10.6 22.0 Fixed Assets. . . . . . . . . 17,244,900 1.6 84.9 35.6 Other Non-current Assets. . . 919,300 53.8 4.5 42.4 Total Assets. . . . . . . . . 20,320,500 4.0 100.0 100.0 Total Current Liabilities . . 2,405,100 21.3 11.8 11.6 Other Long Term Liab. . . . . 5,564,600 (7.6) 27.4 46.8 Net Worth . . . . . . . . . . 7,753,300 6.0 38.2 35.2 Total Liabilities & Worth. . 20,320,500 4.0 100.0 100.0 Net Sales . . . . . . . . . . 8,977,300 5.6 100.0 100.0 Gross Profit. . . . . . . . . ---- ---- ---- 40.1 RATIOS % ---INDUSTRY QUARTILES--- COMPANY CHANGE UPPER MEDIAN LOWER Quick Ratio . . . . . . . . . 0.7 ---- 2.9 1.2 0.6 Current Ratio . . . . . . . . 0.9 (10.0) 4.9 2.2 1.0 Total Liab to Net Worth (%) . 162.1 (2.9) 127.4 180.2 297.2 Sales to Inventory. . . . . . 77.2 10.6 56.2 33.8 20.0 Return on Sales (%) . . . . . 12.0 10.1 20.1 14.6 11.3 Return on Assets (%). . . . . 5.3 10.4 7.2 5.7 3.7 Return on Net Worth (%) . . . 13.9 9.4 19.0 15.9 12.8 Industry norms based on 469 firms, with assets over $5 million. % = % = % = % = % = % = % = % = = % P h r a c k X V I I % = = % = % = % = % = % = % = % = % Phrack Seventeen 07 April 1988 File 4 of 12 : Nitrogen-Trioxide Explosives ------------------------------------------------------------------------------ Working notes on Nitrogen Tri-Iodide (NI-3) By: Signal Sustain INTRODUCTION This particular explosive is a real loser. It is incredibly unstable, dangerous to make, dangerous to work with, and you can't do much with it, either. A string of Black Cats is worth far more. At least you can blow up anthills with those. NI-3 is basically a compound you can make easily by mixing up iodine crystals and ammonia. The resulting precipitate is very powerful and very unstable. It is semi stable when wet (nothing you want to trust) and absolutely unstable when dry. When dry, anything will set it off, such as vibration, wind, sun, a fly landing on it. It has to be one of the most unstable explosives you can deal with. But it's easy to make. Anyone can walk into a chem supply house, and get a bottle of iodine, and and a supermarket, and get clear ammonia. Mix them and you're there. (See below for more on this) So, some of you are going to try it, so I might as well pass on some tips from hard experience. (I learned it was a loser by trying it). Use Small Batches First, make one very small batch first. Once you learn how powerful this stuff is, you'll see why. If you're mixing iodine crystals (that's right, crystals, iodine is a metal, a halogen, and its solid form is crystals; the junk they sell as "iodine" in the grocery store is about 3% iodine in a bunch of solvents, and doesn't work for this application), you want maybe 1/4 teaspoonful MAX, even less maybe. 1/4 TSP of this stuff is one hellacious bang; it rattled the windows for a block around when it went off in my back yard. So go with 1/4 TSP, if I can talk you into it. The reason is the instability of this compound. If you mix up two teaspoonfuls and it goes off in your hand, kiss your hand goodbye right down to the wrist. A bucketful would probably level any house you'll find. But 1/4 teaspoon, you might keep your fingers. Since I know you're not going to mix this stuff up with remote tools, keep the quantities small. This stuff is so unstable it's best to hedge your bets. Note: When holding NI3, try to hold with remote tools -- forceps? But if you have to pick it up, fold your thumb next to your first finger, and grip around with your fingers only. Do not grip the flask the conventional way, fingers on one side, thumb of the other. This way, if it goes, you may still have an opposing thumb, which is enough to get by with. The compound is far more stable when wet, but not certain-stable. That's why companies that make explosives won't use it; even a small chance of it blowing up is too dangerous. (They still lose dynamite plants every now and then, too, which is why they're fully automated). But when this stuff gets dry, look out. Heinlein says "A harsh look will set it off", and he isn't kidding. Wind, vibration, a breath across it, anything will trigger it off. (By the way, Heinlein's process, from SF book "Farnham's Freehold", doesn't work, either -- you can't use iodine liquid for this. You must use iodine crystals.) Don't Store It What's so wickedly dangerous is if you try to store the stuff. Say you put it in a cup. After a day, a crust forms around the rim of the liquid, and it dries out. You pick up the cup, kabang!, the crust goes off, and the liquid goes up from the shock. Your fingers sail into your neighbor's lawn. If you make this, take extreme pains to keep it all wet. At least stopper the testtube, so it can't evaporate. Making It Still want to make it? Okay. Get some iodine crystals at a chem supply store. If they ask, say you need to purify water for a camping trip, and they'll lecture you on better alternatives (halazone) but you can still get it. Or, tell them you've been elected to play Mr. Wizard, and be honest -- you'll probably get it too. Possession is not illegal. Get as little as possible. You need little and it's useless once you've tried it once. Aim for 1/4 teaspoonful. Second, get some CLEAR, NON SUDSY ammonia at the store, like for cleaning purposes (BUT NO SUDS! They screw things up, it doesn't make the NI-3). Third, pour ammonia in a bowl. Peeew! Nice smell. Fourth, add 1/4 TSP or less of iodine crystals. Note these crystals, which looks like instant coffee, will attack other metals, so look out for your tableware. Use plastic everything (Bowl, spoon) if you can. These crystals will also leave long-standing iodine stains on hands, and that's damned incriminating if there was just an NI-3 explosion and they're looking for who did it. Rubber gloves, please, dispose after use. Now the crystals will sort of spread out. Stir a little if need be. Be damned careful not to leave solution on the spoon that might dry. It'll go off if you do, believe me. (Experience). Let them spread out and fizzz. They will. Then after an hour or so there will be left some reddish-brown glop in the bottom of the clear ammonia. It's sticky like mud, hard to handle.. That's the NI-3. It is safe right now, as it is wet. (DO NOT LET A RIM FORM ON THE AMMONIA LIQUID!) Using It Now let's use up this junk right away and DON'T try to store it. Go put it outside someplace safe. In my high school, someone once sprinkled tiny, tiny bits (like individual crystals) in a hallway. Works good, it's like setting off a cap under someone's shoe after the stuff dries. You need far less than 1/4 TSP for this, too. Spread it out in the sun, let it dry. DO NOT DISTURB. If you hear a sudden CRACK!, why, it means the wind just blew enough to set it off, or maybe it just went off by itself. It does that too. It must be thoroughly dry to reach max instability where a harsh look sets it off. Of course the top crystals dry first, so heads up. Any sharp impact will set it off, wet or dry. While you're waiting for it to dry, go BURN the plastic cup and spoon you made it with. You'll hear small snapping noises as you do; this is the solution drying and going off in the flames. After two hours or so, toss rocks at the NI3 from a long ways away, and you'll see it go off. Purplish fumes follow each explosion. It's a sharp CRACK, you can't miss it. Anyway. Like I say, most people make this because the ingredients are so easily available. They make it, say what the hell do I do now?, and sprinkle tiny crystals in the hallway. Bang bang bang. And they never make it again, because you only get one set of fingers per hand, and most people want to keep them. Or they put it in door locks (while still in the "sludge" form), and wait for it to try. Next person who sticks a key in there has a big surprise. (This is also why most high school chem teachers lock up the iodine crystals.) Getting Rid Of It If you wash the NI-3 crystals down your kitchen sink, then you have to only wait for them to dry out and go off. They'll stick to the pipe (halogen property, there). I heard a set of pipes pop and crackle for days after this was done. I'd recommend going and throwing the mess into a vacant lots or something, and trying to set it off so no one else does accidentally. If you do this, good luck, and you've been warned. -- Signal Sustain ------------------------------------------------------------------------------ % = % = % = % = % = % = % = % = = % P h r a c k X V I I % = = % = % = % = % = % = % = % = % Phrack Seventeen 07 April 1988 File 5 of 12 : How to Hack Cyber Systems How To Hack A CDC Cyber By: ** Grey Sorcerer Index: 1. General Hacking Tips 2. Fun with the card punch 3. Getting a new user number the easy way 4. Hacking with Telex and the CDC's batch design 5. Grabbing a copy of the whole System 6. Staying Rolled In with BREAK 7. Macro Library 8. RJE Status Checks 9. The Worm 10. The Checkpoint/Restart Method to a Better Validation I'm going to go ahead and skip all the stuff that's in your CDC reference manuals.. what's a local file and all that. If you're at the point of being ready to hack the system, you know all that; if not, you'll have to get up to speed on it before a lot of this will make sense. Seems to me too many "how to hack" files are just short rewrites of the user manuals (which you should get for any serious penetration attempt anyway, or you'll miss lots of possibilities), without any tips on ways to hack the system. General hacking tips: Don't get caught. Use remote dialups if possible and never never use any user number you could be associated with. Also never re-use a user number. Remember your typical Cyber site has a zillion user numbers, and they can't watch every one. Hide in numbers. And anytime things get "hot", lay off for awhile. Magtapes are great. They hold about 60 Meg, a pile of data, and can hold even more with the new drives. You can hide a lot of stuff here offline, like dumps of the system, etc., to peruse. Buy a few top quality ones.. I like Black Watch tapes my site sells to me the most, and put some innocuous crap on the first few records.. data or a class program or whatever, then get to the good stuff. That way you'll pass a cursory check. Remember a usual site has THOUSANDS of tapes and cannot possibly be scanning every one; they haven't time. One thing about the Cybers -- they keep this audit trail called a "port log" on all PPU and CPU accesses. Normally, it's not looked at. But just remember that *everything* you do is being recorded if someone has the brains and the determination (which ultimately is from you) to look for it. So don't do something stupid like doing real work on your user number, log off, log right onto another, and dump the system. They WILL know. Leave No Tracks. Also remember the first rule of bragging: Your Friends Turn You In. And the second rule: If everyone learns the trick to increasing priority, you'll all be back on the same level again, won't you? And if you show just two friends, count on this: they'll both show two friends, who will show four... So enjoy the joke yourself and keep it that way. Fun With The Card Punch Yes, incredibly, CDC sites still use punch cards. This is well in keeping with CDC's overall approach to life ("It's the 1960's"). The first thing to do is empty the card punch's punchbin of all the little punchlets, and throw them in someone's hair some rowdy night. I guarantee the little suckers will stay in their hair for six months, they are impossible to get out. Static or something makes them cling like lice. Showers don't even work. The next thing to do is watch how your local installation handles punch card decks. Generally it works like this. The operators love punchcard jobs because they can give them ultra-low priority, and make the poor saps who use them wait while the ops run their poster-maker or Star Trek job at high priority. So usually you feed in your punchcard deck, go to the printout room, and a year later, out comes your printout. Also, a lot of people generally get their decks fed in at once at the card reader. If you can, punch a card that's completely spaghetti -- all holes punched. This has also been known to crash the cardreader PPU and down the system. Ha, ha. It is also almost certain to jam the reader. If you want to watch an operator on his back trying to pick pieces of card out of the reader with tweezers, here's your chance. Next, the structure of a card deck job gives lots of possibilities for fun. Generally it looks like this: JOB card: the job name (first 4 characters) User Card: Some user number and password -- varies with site EOR card: 7-8-9 are punched Your Batch job (typically, Compile This Fortran Program). You know, FTN. LGO. (means, run the Compiled Program) EOR card: 7-8-9 are punched The Fortran program source code EOR card: 7-8-9 are punched The Data for your Fortran program EOF card: 6-7-8-9 are punched. This indicates: (end of deck) This is extremely typical for your beginning Fortran class. In a usual mainframe site, the punchdecks accumulate in a bin at the operator desk. Then, whenever he gets to it, the card reader operator takes about fifty punchdecks, gathers them all together end to end, and runs them through. Then he puts them back in the bin and goes back to his Penthouse. GETTING A NEW USER NUMBER THE EASY WAY Try this for laughs: make your Batch job into: JOB card: the job name (first 4 characters) User Card: Some user number and password -- varies with site EOR card: 7-8-9 are punched COPYEI INPUT,filename: This copies everything following the EOR mark to the filename in this account. EOR Card: 7-8-9 are punched. Then DO NOT put an EOF card at the end of your job. Big surprise for the job following yours: his entire punch deck, with, of course, his user number and password, will be copied to your account. This is because the last card in YOUR deck is the end-of-record, which indicates the program's data is coming next, and that's the next person's punch deck, all the way up to -his- EOF card. The COPYEI will make sure to skip those pesky record marks, too. I think you can imagine the rest, it ain't hard. Hacking With Telex When CDC added timeshare to the punch-card batch-job designed Cyber machines, they made two types of access to the system: Batch and Telex. Batch is a punch-card deck, typically, and is run whenever the operator feels like it. Inside the system, it is given ultra low priority and is squeezed in whenever. It's a "batch" of things to do, with a start and end. Telex is another matter. It's the timeshare system, and supports up to, oh, 60 terminals. Depends on the system; the more RAM, the more swapping area (if you're lucky enough to have that), the more terminals can be supported before the whole system becomes slug-like. Telex is handled as a weird "batch" file where the system doesn't know how much it'll have to do, or where it'll end, but executes commands as you type them in. A real kludge. Because the people running on a CRT expect some sort of response, they're given higher priority. This leads to "Telex thrashing" on heavily loaded CDC systems; only the Telex users get anywhere, and they sit and fight over the machine's resources. The poor dorks with the punch card decks never get into the machine, because all the Telex users are getting the priority and the CPU. (So DON'T use punch cards.) Another good tip: if you are REQUIRED to use punch cards, then go type in your program on a CRT, and drop it to the automatic punch. Sure saves trying to correct those typos on cards.. When you're running under Telex, you're part of one of several "jobs" inside the system. Generally there's "TELEX," something to run the line printer, something to run the card reader, the mag tape drivers (named "MAGNET") and maybe a few others floating around. There's limited space inside a Cyber.. would you believe 128K 60-bit words?.. so there's a limited number of jobs that can fit. CDC put all their effort into "job scheduling" to make the best of what they had. You can issue a status command to see all jobs running; it's educational. Anyway, the CDC machines were originally designed to run card jobs with lots of magtape access. You know, like IRS stuff. So they never thought a job could "interrupt," like pressing BREAK on a CRT, because card jobs can't. This gives great possibilities. Like: Grabbing a Copy Of The System For instance. Go into BATCH mode from Telex, and do a Fortran compile. While in that, press BREAK. You'll get a "Continue?" verification prompt. Say no, you'd like to stop. Now go list your local files. Whups, there's a new BIG one there. In fact, it's a copy of the ENTIRE system you're running on -- PPU code, CPU code, ALL compilers, the whole shebang! Go examine this local file; you'll see the whole bloody works there, mate, ready to play with. Of course, you're set up to drop this to tape or disk at your leisure, right? This works because the people at CDC never thought that a Fortran compile could be interrupted, because they always thought it would be running off cards. So they left the System local to the job until the compile was done. Interrupt the compile, it stays local. Warning: When you do ANYTHING a copy of your current batch process shows up on the operator console. Typically the operators are reading Penthouse and don't care, and anyway the display flickers by so fast it's hard to see. But if you copy the whole system, it takes awhile, and they get a blow-by-blow description of what's being copied. ("Hey, why is this %^&$^ on terminal 29 copying the PPU code?") I got nailed once this way; I played dumb and they let me go. ("I thought it was a data file from my program"). Staying "Rolled In" When the people at CDC designed the job scheduler, they made several "queues." "Queues" are lines. There's: 1. Input Queue. Your job hasn't even gotten in yet. It is standing outside, on disk, waiting. 2. Executing Queue. Your job is currently memory resident and is being executed, although other jobs currently in memory are competing for the machine as well. At least you're in memory. 3. Timed/Event Rollout Queue: Your job is waiting for something, usually a magtape. Can also be waiting for a given time. Yes, this means you can put a delayed effect job into the system. Ha, ha. You are on disk at this point. 4. Rollout Queue: Your job is waiting its turn to execute. You're out on disk right now doing nothing. Anyway, let's say you've got a big Pascal compile. First, ALWAYS RUN FROM TELEX (means, off a CRT). Never use cards. If you use cards you're automatically going to be low man on the priority schedule, because the CPU doesn't *have* to get back to you soon. Who of us has time to waste? Okay, do the compile. Then do a STATUS on your job from another machine. Typically you'll be left inside the CPU (EXECUTE) for 10 seconds, where you'll share the actual CPU with about 10-16 other jobs. Then you'll be rolled-out (ROLLOUT), at which time you're phucked; you have to wait for your priority to climb back up before it'll execute some more of your job. This can take several minutes on a deeply loaded system. (All jobs have a given priority level, which usually increments every 10 sec or so, until they start executing). Okay, do this. Press BREAK, then at the "Continue?" prompt, say yes. What happened? Telex had to "roll your job in" to process the BREAK! So you get another free 10 seconds of CPU -- which can get a lot done. If you sit and hit BREAK - Y <return> every 10 sec or so during a really big job, you will just fly through it. Of course, everyone else will be sitting and staring at their screen, doing nothing, because you've got the computer. If you're at a school with a Cyber, this is how to get your homework done at high speed. Macro Library If you have a typical CDC site, they won't give you access to the "Macro library." This is a set of CPU calls to do various things -- open files, do directory commands, and whatnot. They will be too terrified of "some hacker." Reality: The dimbulbs in power don't want to give up ANY of their power to ANYONE. You can't really do that much more with the Macro library, which gives assembly language access to the computer, than you can with batch commands.. except what you do leaves lots less tracks. They REALLY have to dig to find out what your program did if you use Macro calls.. they have to go to PPU port logs, which is needle in a haystack sort of stuff, vs. batch file logs, which are real obvious. Worry not. Find someone at Arizona State or Minnesota U. that's cool, and get them to send you a tape of the libraries. You'll get all the code you can stand to look at. By the way they have a great poster tape... just copy the posters to the line printer. Takes a long time to print them but it's worth it. (They have all the classic ones.. man on the moon, various playmates, Spock, etc. Some are 7 frames wide!). With the Macro library, you can do many cool things. The best is a demon scanner. All CDC user numbers have controlled access for other users to individual files -- either private, (no access to anyone else), semiprivate (others can read it but a record is made), or public (anyone can diddle your files, no record). What you want is a program (fairly easy to do in Fortran) that counts through user numbers, doing directory commands. If it finds anything, it checks for non semi-private (so no records are made), then copies it to you. You'll find the damnedest stuff, I guarantee it. Try to watch some system type signing in and get the digits of his user number, then scan variations beginning with that user #. For instance, if he's a SYS1234, then scan all user #'s beginning with SYS (sysaaaa to sys9999). Since it's all inside the Fortran program, the only record, other than hard-to-examine PPU logs, is a "Run Fortran Program" ("LGO.") on the batch dayfile. If you're not giving the overworked system people reason to suspect that commonplace, every-day student Fortran compile is anything out of the ordinary, they will never bother to check -- the amount of data in PPU logs is OVERWHELMING. But you can get great stuff. There's a whole cool library of Fortran-callable routines to do damned near anything a batch command could do in the Minnesota library. Time to get some Minnesota friends -- like on UseNet. They're real cooperative about sending out tapes, etc. Generally you'll find old files that some System Type made public one day (so a buddy could copy them) then forgot about. I picked off all sorts of stuff like this. What's great is I just claimed my Fortran programs were hanging into infinite loops -- this explained the multi-second CPU execution times. Since there wasn't any readily available record of what I was up to, they believed it. Besides, how many idiot users really DO hang into loops? Lots. Hide in numbers. I got Chess 4.2 this way -- a championship Chess program -- and lots of other stuff. The whole games library, for instance, which was blocked from access to mere users but not to sysfolk. Again, they *can* track this down if you make yourself obnoxious (it's going to be pretty obvious what you're doing if there's a CAT: SYSAAAA CAT: SYSAAAB CAT: SYSAAAC .. etc. on your PPU port log) so do this on someone else's user number. RJE Status Checks Lots of stupid CDC installations.. well, that doesn't narrow the field much.. have Remote Job Entry stations. Generally at universities they let some poor student run these at low pay. What's funny is these RJE's can do a status on the jobs in the system, and the system screeches to a halt while the status is performed. It gets top priority. So, if you want to incite a little rebellion, just sit at your RJE and do status requests over and over. The system will be even slower than usual. The Worm Warning: This is pretty drastic. It goes past mere self-defense in getting enough priority to get your homework done, or a little harmless exploration inside your system, to trying to drop the whole shebang. It works, too. You can submit batch jobs to the system, just as if you'd run them through the punchcard reader, using the SUBMIT command. You set up a data file, then do SUBMIT datafile. It runs separate from you. Now, let's say we set up a datafile named WORM. It's a batch file. It looks like this: JOB USER,blah (whatever -- a user number you want crucified) GET,WORM; get a copy of WORM SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system SUBMIT,WORM.; send it to system (16 times) (end of file) Now, you SUBMIT WORM. What happens? Worm makes 16 copies of itself and submits those. Those in turn make 16 copies of themselves (now we're up to 256) and submit those. Next pass is 4096. Then 65536. Then... Now, if you're really good, you'll put on your "job card" a request for high priority. How? Tell the system you need very little memory and very little CPU time (which is true, Submit takes almost nothing at all). The scheduler "squeezes" in little jobs between all the big ones everyone loves to run, and gives ultra-priority to really tiny jobs. What happens is the system submits itself to death. Sooner or later the input queue overflows .. there's only so much space .. and the system falls apart. This is a particularly gruesome thing to do to a system, because if the guy at the console (count on it) tries the usual startup, there will still be copies of WORM in the input queue. First one of those gets loose, the system drops again. With any luck the system will go up and down for several hours before someone with several connected brain cells arrives at the operator console and coldstarts the system. If you've got a whole room full of computer twits, all with their hair tied behind them with a rubber band into a ponytail, busily running their Pascal and "C" compiles, you're in for a good time. One second they will all be printing -- the printers will be going weep-weep across the paper. Next second, after you run, they will stop. And they will stay stopped. If you've done it right they can't get even get a status. Ha, ha. The faster the CPU, the faster it will run itself into the ground. CDC claims there is a limit on the number of jobs a user number can have in the system. As usual they blew it and this limit doesn't exist. Anyway, it's the input queue overflow that kills things, and you can get to the input queue without the # of jobs validation check. Bear in mind that *anything* in that batch file is going to get repeated ten zillion times at the operator console as the little jobs fly by by the thousands. So be sure to include some charming messages, like: job,blah user,blah * eat me! get,worm submit,worm .. etc. There will now be thousands of little "eat me!"'s scrolling across the console as fast as the console PPU can print them. Generally at this point the operator will have his blood pressure really spraying out his ears. Rest assured they will move heaven and earth to find you. This includes past dayfiles, user logs, etc. So be clean. Remember, "Revenge is a dish best served cold." If you're mad at them, and they know it, wait a year or so, until they are scratching their heads, wondering who hates them this much. Also: make sure you don't take down a really important job someone else is doing, okay? Like, no medical databases, and so forth. Now, for a really deft touch, submit a timed/event job. This "blocks" the job for awhile, until a given time is reached. Then, when you're far, far away, with a great alibi, the job restarts, the system falls apart, and you're clear. If you do the timed/event rollout with a Fortran program macro call, it won't even show up on the log. (Remember that the System Folk will eventually realize, in their little minds, what you've done. It may take them a year or two though). CHECKPOINT / RESTART I've saved the best for last. CDC's programmers supplied two utilities, called CheckPoint and Restart, primarily because their computers kept crashing before they would finish anything. What Checkpoint does is make a COMPLETE copy of what you're doing - all local files, all of memory, etc. -- into a file, usually on a magtape. Then Restart "restarts" from that point. So, when you're running a 12 hour computer job, you sprinkle checkpoints throughout, and if the CDC drops, you can restart from your last CKP. It's like a tape backup of a hard disk. This way, you only lose the work done on your data between the last checkpoint and now, rather than the whole 12 hours. Look, this is real important on jobs that take days -- check out your local IRS for details.. Now what's damned funny is if you look closely at the file Checkpoint generates, you will find a copy of your user validations, which tell everything about you to the system, along with the user files, memory, etc. You'll have to do a little digging in hex to find the numbers, but they'll match up nicely with the display you of your user validations from that batch command. Now, let's say you CKP,that makes the CKP file. Then run a little FORTRAN program to edit the validations that are inside that CKP-generated file. Then you RESTART from it. Congratulations. You're a self made man. You can do whatever you want to do - set your priority level to top, grab the line printer as your personal printer, kick other jobs off the system (it's more subtle to set their priority to zilch so they never execute), etc. etc. You're the operator. This is really the time to be a CDC whiz and know all sorts of dark, devious things to do. I'd have a list of user numbers handy that have files you'd like made public access, so you can go in and superzap them (then peruse them later from other signons), and so forth. There's some gotchas in here.. for instance, CKP must be run as part of a batch file out of Telex. But you can work around them now that you know the people at CDC made RESTART alter your user validations. It makes sense in a way. If you're trying to restart a job you need the same priority, memory, and access you had when trying to run it before. Conclusion There you have it, the secrets of hacking the Cyber. They've come out of several years at a college with one CDC machine, which I will identify as being somewhere East. They worked when I left; while CDC may have patched some of them, I doubt it. They're not real fast on updates to their operating system. ** Grey Sorcerer % = % = % = % = % = % = % = % = = % P h r a c k X V I I % = = % = % = % = % = % = % = % = % Phrack Seventeen 07 April 1988 File 6 of 12 : How to Hack HP2000's How to Hack an HP 2000 By: ** Grey Sorcerer Okay, so you've read the HP-2000 basic guides, and know your way around. I will not repeat all that. There's two or three things I've found that allow you through HP 2000 security. 1. When you log in, a file called HELLO on the user number Z999 is run. A lot of time this file is used to deny you access. Want in? Well, it's just a BASIC program, and an be BREAKed.. but, usually the first thing they do in that program is turn Breaks (interrupts) off by the BRK(0) function. However, if you log in like this: HELLO-D345,PASS (return) (break) With the break nearly instantly after the return, a lot of time, you'll abort the HELLO program, and be home free. 2. If you can create a "bad file", which takes some doing, then anytime you try to CSAVE this file (compile and save), the system will quickly fade into a hard crash. 3. How to make a bad file and other goodies: The most deadly hole in security in the HP2000 is the "two terminal" method. You've got to understand buffers to see how it works. When you OPEN a file, or ASSIGN it (same thing), you get 256 bytes of the file -- the first 256. When you need anymore, you get 256 more. They are brought in off the disk in discrete chunks. They are stored in "buffers." So. Save a bunch of junk to disk -- programs, data, whatever. Then once your user number is full, delete all of it. The effect is to leave the raw jumbled data on disk. Pick a time when the system is REAL busy, then: 1. Have terminal #1 running a program that looks for a file to exist (with the ASSIGN) statement as quickly as it can loop. If it finds the file there, it goes to the very end of the file, and starts reading backwards, record by record, looking for data. If it finds data, it lets you know, and stops at an input prompt. It is now running. 2. Have terminal #2 create a really huge data file (OPEN-FILE, 3000) or however it goes. What happens is terminal #2's command starts zeroing all the sectors of the file, starting at file start. But it only gets so far before someone else needs the processor, and kicks #2 out. The zeroing stops for a sec. Terminal #1 gets in, finds the file there, and reads to the end. What's there? Old trash on disk. (Which can be mighty damned interesting by the way -- did you know HP uses a discrete mark to indicate end-of-buffer? You've just maybe got yourself a buffer that is as deep as system memory, and if you're clever, you can peek or poke anywhere in memory. If so, keep it, it is pure gold). But. Back to the action. 3. Terminal #2 completes the OPEN. He now deletes the file. This leaves Terminal #1 with a buffer full of data waiting to be dumped back to disk at that file's old disk location. 4. Terminal #2 now saves a load of program files, as many as are required to fill up the area that was taken up by the deleted big file. 5. You let Terminal #1 past the input prompt, and it writes its buffer to disk. This promptly overlays some program just stored there. Result: "bad program." HPs are designed with a syntax checker and store programs in token; a "bad program" is one that the tokens are screwed up in. Since HP assumes that if a program is THERE, it passed the syntax check, it must be okay... it's in for big problems. For a quick thrill, just CSAVE it.. system tries to semi-compile bad code, and drops. Really, the classier thing to do with this is to use the "bottomless buffer" to look through your system and change what you don't like.. maybe the password to A000? Write some HP code, look around memory, have a good time. It can be done. ** Grey Sorcerer % = % = % = % = % = % = % = % = = % P h r a c k X V I I % = = % = % = % = % = % = % = % = % Phrack Seventeen 07 April 1988 File 7 of 12 : Accessing Government Computers +++++++++++++++++++++++++++++++++++++++ + ACCESSING GOVERNMENT COMPUTERS + + (LEGALLY!) + +-------------------------------------+ + Written by The Sorceress + + (The Far Side 415/471-1138) + +++++++++++++++++++++++++++++++++++++++ Comment: I came across this article in Computer Shopper (Sept. 1987) and it talked about citizens access government computers since we do pay for them with our taxpayers monies. Since then, I have had friends and gone on a few myself and the databases are full of information for accessing. One thing, you usually have to call the sysop for access and give him your real name, address and the like. They call you back and verify your existence. Just a word of warning; crashing a BBS is a crime, so I wouldn't fool with these since they are government based. ----------------------------------------------------------------------------- National Bureau of Standards - Microcomputers Electronic Information Exchange. Sysops: Ted Landberg & Lisa Carnahan Voice: 301-975-3359 Data: 301-948-5717 300/1200/2400 This BBS is operated by the Institute for Computer Sciences and Technology which is one of four technical organizations within the National Bureau of Standards. This board also contains information on the acquisition, management, security, and use of micro computers. ----------------------------------------------------------------------------- Census Bureau - Census Microcomputer and Office Technology Center, Room 1065 FB-3 Washington, D.C. (Suitland, MD) Sysop: Nevins Frankel Voice: 301-763-4494 Data: 301-763-4576 300/1200 The purpose of this BBS is to allow users to access the following: Census Microcomputer and office technology information center bulletins and catalogues, software and hardware evaluations, Hardware and software inventories, Census computer club library, Public Domain software, etc. ----------------------------------------------------------------------------- Census Bureau - Census Microcomputer and Office Technology Center, Personnel Division, Washington DC. Voice: 301-763-4494 Data: 301-763-4574 300/1200/2400 The purpose of this board is to display Census Bureau vacancies from entry level to senior management. ----------------------------------------------------------------------------- Department of Commerce - Office of the Under Secretary for Economic Affairs, Office of Business Analysis, Economic Bulletin Board. Sysop: Ken Rogers Voice: 202-377-0433 Data: 202-377-3870 300/1200 This is another well run BBS with in-depth news about the Department of Commerce Economic Affairs Agencies including current press releases and report summaries. ----------------------------------------------------------------------------- COE BBS - Manpower and Force Management Division, Headquarters, U.S. Army Corps of Engineers, 20 Massachusetts Ave. NW, Washington, DC. Sysop: Rich Courney Voice: 202-272-1646 Data: 202-272-1514 300/1200/2400 The files database was one of the largest they ever seen. Directory 70 has programs for designing masonry and retaining walls using Lotus's Symphony. ----------------------------------------------------------------------------- General Services Administration - Information Resources Service Center. Data: 202-535-8054 300 bps Data: 202-535-7661 1200 bps GSA's Information Resources Service Center provides information on contracts, schedules, policies, and programs. One of the areas that is interesting was the weekly supplement to the consolidated list of debarred, suspended and ineligible contractors. ----------------------------------------------------------------------------- Budget and Finance Board of the Office of Immigration Naturalization Service. DO NOT CALL THIS BBS DURING WORKING HOURS. Sysop: Mike Arnold Data: 202-787-3460 300/1200/2400 The system is devoted to the exchange of information related to budget and financial management in the federal government. It is a 'working' system for the Immigration and Naturalization Service personnel. ----------------------------------------------------------------------------- Naval Aviation News Computer Information (NANei) - Supported by: Naval Aviation News Magazine, Bldg. 159E, Navy Yard Annex, Washington, DC 20374. Sysop: Commander Howard Wheeler Voice: 202-475-4407 Data: 202-475-1973 300/1200 Available from 5 pm to 8 am. weekdays 5pm Friday to 8 am Monday This is a large BBS with lots of Navy related information and programs. NANci is for those interested in stories, facts, and historical information related to Naval Aviation. ----------------------------------------------------------------------------- Federal National Mortgage Association - Sysop: Ken Goosens Data: 202-537-7475 202-537-7945 300/1200 This BBS is in transition. Ken Gossens will be running a new BBS at 703-979-6360. The BBS maybe become a closed board under the new sysop. This BBS has/had one of largest collections of files for downloading. ----------------------------------------------------------------------------- The World Bank, Information, Technology and Facilities Department, Office System Division, Washington DC. Sysop: Ashok Daswani Voice: 202-473-2237 Data: 202-676-0920 300/1200 Basically a software exchange BBS, but has other information about the use of microcomputers and software supported by World Bank. IBM product announcements also kept up to date. ----------------------------------------------------------------------------- National Oceanic Atmospheric Administration (NOAA), National Meteorological Center. * You must obtain a password from the SYSOP to log on to this BBS. Sysop: Vernon Patterson Voice: 301-763-8071 Data: 301-899-0825 300 bps 301-899-0830 1200 bps This is one of the most useful databases available on-line. With it you can access meteorological data collected form 6000 locations throughout the world. It can also display crude, but useful graphic maps of the US illustration temperatures, precipitation and forecasts. ----------------------------------------------------------------------------- National Weather Service, US Dept. of Commerce, East Coast Marine Users BBS * You must obtain a p/w from the SYSOP to logon this BBS. Sysop: Ross Laporte Voice: 301-899-3296 Data: 301-454-8700 300bps Use this BBS to obtain info about marine weather and nautical info about coastal waterways including topical storm advisories. ----------------------------------------------------------------------------- NARDAC, Navy Regional Data Automation Center, Norfolk, VA. 23511-6497 Sysop: Jerry Dew Voice: 804-445-4298 Data: 804-445-1627 300 & 1200 bps A basic Utilitarian system developed to support the informational needs of NARDAC. The Dept. of Defense mag., CHIPS is available in the files section of this BBS. There are also Navy and IBM related articles to read. ----------------------------------------------------------------------------- Veterans Administration, Info Technology Bulletin Board. Data: 202-376-2184 300/1200 bps The content of this BBS ranges from job opening listings to information computer security. ----------------------------------------------------------------------------- Dept. of Energy, Office of Civilian Radioactive Waste Management, Infolink. Sysop: Bruce Birnbaum Voice: 202-586-9707 Data: 202-586-9359 300/1200 bps This BBS has press leases, fact sheets, backgrounders, congressional questions, answers, speeches & testimony, from the Office of Civilian Radioactive Waste Management. ----------------------------------------------------------------------------- I skipped listing a few of the BBSes in this article if the chances were slim to get on or if the BBS got a bad review. Most of the ones listed seemed to have lot of informative files for downloading and viewing pleasure. This article carried a very strong word of warning about tampering/crashing these since they are run by the govt. and a volunteer Sysop. Since you can get on these legally why not use it? The Sorceress % = % = % = % = % = % = % = % = = % P h r a c k X V I I % = = % = % = % = % = % = % = % = % Phrack Seventeen 07 April 1988 File 8 of 12 : Dialback Modem Security In article <906@hoptoad.uucp> gnu@hoptoad.UUCP writes: >Here are the two messages I have archived on the subject... >[I believe the definitive article in that discussion was by Lauren Weinstein, >vortex!lauren; perhaps he has a copy. What follows is the original article that started the discussion. I do not know whether it qualifies as the "definitive article" as I think I remember Lauren and I both posted further comments. - Dave ** ARTICLE FOLLOWS ** ------------------------------------------------------------------------------ An increasingly popular technique for protecting dial-in ports from the ravages of hackers and other more sinister system penetrators is dial back operation wherein a legitimate user initiates a call to the system he desires to connect with, types in his user ID and perhaps a password, disconnects and waits for the system to call him back at a prearranged number. It is assumed that a penetrator will not be able to specify the dial back number (which is carefully protected), and so even if he is able to guess a user-name/password pair he cannot penetrate the system because he cannot do anything meaningful except type in a user-name and password when he is connected to the system. If he has a correct pair it is assumed the worst that could happen is a spurious call to some legitimate user which will do no harm and might even result in a security investigation. Many installations depend on dial-back operation of modems for their principle protection against penetration via their dial up ports on the incorrect presumption that there is no way a penetrator could get connected to the modem on the call back call unless he was able to tap directly into the line being called back. Alas, this assumption is not always true - compromises in the design of modems and the telephone network unfortunately make it all too possible for a clever penetrator to get connected to the call back call and fool the modem into thinking that it had in fact dialed the legitimate user. The problem areas are as follows: Caller control central offices Many older telephone central office switches implement caller control in which the release of the connection from a calling telephone to a called telephone is exclusively controlled by the originating telephone. This means that if the penetrator simply failed to hang up a call to a modem on such a central office after he typed the legitimate user's user-name and password, the modem would be unable to hang up the connection. Almost all modems would simply go on-hook in this situation and not notice that the connection had not been broken. If the same line was used to dial out on as the call came in on, when the modem went to dial out to call the legitimate user back the it might not notice (there is no standard way of doing so electrically) that the penetrator was still connected on the line. This means that the modem might attempt to dial and then wait for an answerback tone from the far end modem. If the penetrator was kind enough to supply the answerback tone from his modem after he heard the system modem dial, he could make a connection and penetrate the system. Of course some modems incorporate dial tone detectors and ringback detectors and in fact wait for dial tone before dialing, and ringback after dialing but fooling those with a recording of dial tone (or a dial tone generator chip) should pose little problem. Trying to call out on a ringing line Some modems are dumb enough to pick up a ringing line and attempt to make a call out on it. This fact could be used by a system penetrator to break dial back security even on joint control or called party control central offices. A penetrator would merely have to dial in on the dial-out line (which would work even if it was a separate line as long as the penetrator was able to obtain it's number), just as the modem was about to dial out. The same technique of waiting for dialing to complete and then supplying answerback tone could be used - and of course the same technique of supplying dial tone to a modem which waited for it would work here too. Calling the dial-out line would work especially well in cases where the software controlling the modem either disabled auto-answer during the period between dial-in and dial-back (and thus allowed the line to ring with no action being taken) or allowed the modem to answer the line (auto-answer enabled) and paid no attention to whether the line was already connected when it tried to dial out on it. The ring window However, even carefully written software can be fooled by the ring window problem. Many central offices actually will connect an incoming call to a line if the line goes off hook just as the call comes in without first having put the 20 hz. ringing voltage on the line to make it ring. The ring voltage in many telephone central offices is supplied asynchronously every 6 seconds to every line on which there is an incoming call that has not been answered, so if an incoming call reaches a line just an instant after the end of the ring period and the line clairvoyantly responds by going off hook it may never see any ring voltage. This means that a modem that picks up the line to dial out just as our penetrator dials in may not see any ring voltage and may therefore have no way of knowing that it is connected to an incoming call rather than the call originating circuitry of the switch. And even if the switch always rings before connecting an incoming call, most modems have a window just as they are going off hook to originate a call when they will ignore transients (such as ringing voltage) on the assumption that they originate from the going-off-hook process. [The author is aware that some central offices reverse battery (the polarity of the voltage on the line) in the answer condition to distinguish it from the originate condition, but as this is by no means universal few if any modems take advantage of the information supplied] In Summary It is thus impossible to say with any certainty that when a modem goes off hook and tries to dial out on a line which can accept incoming calls it really is connected to the switch and actually making an outgoing call. And because it is relatively easy for a system penetrator to fool the tone detecting circuitry in a modem into believing that it is seeing dial tone, ringback and so forth until he supplies answerback tone and connects and penetrates system security should not depend on this sort of dial-back. Some Recommendations Dial back using the same line used to dial in is not very secure and cannot be made completely secure with conventional modems. Use of dithered (random) time delays between dial in and dial back combined with allowing the modem to answer during the wait period (with provisions made for recognizing the fact that this wasn't the originated call - perhaps by checking to see if the modem is in originate or answer mode) will substantially reduce this window of vulnerability but nothing can completely eliminate it. Obviously if one happens to be connected to an older caller control switch, using the same line for dial in and dial out isn't secure at all. It is easy to experimentally determine this, so it ought to be possible to avoid such situations. Dial back using a separate line (or line and modem) for dialing out is much better, provided that either the dial out line is sterile (not readily traceable by a penetrator to the target system) or that it is a one way line that cannot accept incoming calls at all. Unfortunately the later technique is far superior to the former in most organizations as concealing the telephone number of dial out lines for long periods involves considerable risk. The author has not tried to order a dial out only telephone line, so he is unaware of what special charges might be made for this service or even if it is available. A final word of warning In years past it was possible to access telephone company test and verification trunks in some areas of the country by using mf tones from so called "blue boxes". These test trunks connect to special ports on telephone switches that allow a test connection to be made to a line that doesn't disconnect when the line hangs up. These test connections could be used to fool a dial out modem, even one on a dial out only line (since the telephone company needs a way to test it, they usually supply test connections to it even if the customer can't receive calls). Access to verification and test ports and trunks has been tightened (they are a kind of dial-a-wiretap so it ought to be pretty difficult) but in any as in any system there is always the danger that someone, through stupidity or ignorance if not mendacity will allow a system penetrator access to one. ** Some more recent comments ** Since posting this I have had several people suggest use of PBX lines that can dial out but not be dialed into or outward WATS lines that also cannot be dialed. Several people have also suggested use of call forwarding to forward incoming calls on the dial out line to the security office. [This may not work too well in areas served by certain ESS's which ring the number from which calls are being forwarded once anyway in case someone forgot to cancel forwarding. Forwarding is also subject to being cancelled at random times by central office software reboots] And since posting this I actually tried making some measurements of how wide the incoming call window is for the modems we use for dial in at CRDS. It appears to be at least 2-3 seconds for US Robotics Courier 2400 baud modems. I found I could defeat same-line-for-dial-out dialback quite handily in a few dozen tries no matter what tricks I played with timing and watching modem status in the dial back login software. I eventually concluded that short of reprogramming the micro in the modem to be smarter about monitoring line state, there was little I could do at the login (getty) level to provide much security for same line dialback. Since it usually took a few tries to break in, it is possible to provide some slight security improvement by sharply limiting the number of unsuccessful callbacks per user per day so that a hacker with only a couple of passwords would have to try over a significant period of time. Note that dialback on a dedicated dial-out only line is somewhat secure. David I. Emery Charles River Data Systems 617-626-1102 983 Concord St., Framingham, MA 01701. uucp: decvax!frog!die -- David I. Emery Charles River Data Systems 983 Concord St., Framingham, MA 01701 (617) 626-1102 uucp: decvax!frog!die % = % = % = % = % = % = % = % = = % P h r a c k X V I I % = = % = % = % = % = % = % = % = % Phrack Seventeen 07 April 1988 File 9 of 12 : Data-Tapping Made Easy --FEATURE ARTICLES AND REVIEWS- TAPPING COMPUTER DATA IS EASY, AND CLEARER THAN PHONE CALLS ! BY RIC BLACKMON, SYSOP OF A FED BBS Aquired by Elric of Imrryr & Lunatic Labs UnLtd Note from Elric: This file was written by the sysop of a board for computer security people (run on a CoCo), as far as I know the board no longer exists, it was being crashed by hackers too much... (hehe). --------------------- FOR SEVERAL YEARS, I ACCEPTED CERTAIN BITS OF MISINFORMATION AS TECHNICALLY ACCURATE, AND DIDN'T PROPERLY PURSUE THE MATTER. SEVERAL FOOLS GAVE ME FOOLISH INFORMATION, SUCH AS: A TAP INTERRUPTS COMPUTER DATA TRANSMISSIONS; DATA COULD BE PICKED UP AS RF EMANATIONS BUT IT WAS A MASS OF UNINTELLIGIBLE SIGNAL CAUSED BY DATA MOVING BETWEEN REGISTERS; ONE HAD TO BE IN 'SYNC' WITH ANY SENDING COMPUTER; DATA COULDN'T BE READ UNLESS YOU HAD A DIRECT MATCH IN SPEED, PARITY & BIT PATTERN; AND ONLY A COMPUTER OF THE SAME MAKE AND MODEL COULD READ THE SENDING COMPUTER. THIS IS ALL PLAIN SWILL. IT IS IN FACT, AN EASIER CHORE TO TAP A COMPUTER THAN A TELEPHONE. THE TECHNIQUE AND THE EQUIPMENT IS ALMOST THE SAME, BUT THE COMPUTER LINE WILL BE MORE ACCURATE (THE TWO COMPUTERS INVOLVED, HAVE ERROR CORRECTING PROCEDURES) AND CLEARER (DIGITAL TRANSMISSIONS HAVE MORE DISTINCT SIGNALS THAN ANALOG TRANSMISSIONS). FIRST, RECOGNIZE THAT NEARLY ALL DATA TRANSMISSIONS ARE SENT IN CLEARTEXT ASCII SIGNALS. THE LINES CARRYING OTHER BIT-GROUPS OR ENCIPHERED TEXTS ARE RARE. SECOND, THE SIGNAL APPEARS ON GREEN AND RED (WIRES) OF THE PHONE LINE ('TIP' AND 'RING'). THE DATA IS MOST LIKELY ASYNCHRONOUS SERIAL DATA MOVING AT 300 BAUD. NOW THAT 1200 BAUD IS BECOMING MORE CHIC, YOU CAN EXPECT TO FIND A GROWING USE OF THE FASTER TRANSMISSION RATE. FINALLY, YOU DON'T NEED TO WORRY ABOUT THE PROTOCOL OR EVEN THE BAUD RATE (SPEED) UNTIL AFTER A TAPED COPY OF A TRANSMISSION IS OBTAINED. IN A SIMPLE EXPERIMENT, A TAPED COPY OF A DATA TRANSMISSION WAS MADE WITH THE CHEAPEST OF TAPE RECORDERS, TAPPING THE GREEN AND RED LINES BEYOND THE MODEM. THE RECORDING WAS THEN PLAYED INTO A MODEM AS THOUGH IT WERE AN ORIGINAL TRANSMISSION. AT THAT POINT, HAD IT BEEN NECESSARY, THE PROTOCOL SETTINGS ON RECEIVING TERMINAL COULD HAVE BEEN CHANGED TO MATCH THE TAPE. NO ADJUSTMENTS WERE NECESSARY AND A NICE, CLEAR ERROR-FREE DOCUMENT WAS RECEIVED ON THE ILLICIT VIDEO SCREEN AND A NEAT HARD-COPY OF THE DOCUMENT CAME OFF THE PRINTER. THE MESSAGE WAS INDEED CAPTURED, BUT HAD IT BEEN AN INTERCEPTION INSTEAD OF A SIMPLE MONITORING, IT COULD HAVE BEEN ALTERED WITH A SIMPLE WORD PROCESSOR PROGRAM, TO SUIT ANY PURPOSE, AND PLACED BACK ON THE WIRE. WERE I TO HAVE AN INTEREST IN INFORMATION ORIGINATING FROM A PARTICULAR COMPANY, AGENCY, OR OFFICE, I THINK THAT I WOULD FIND IT FAR MORE PRODUCTIVE TO TAP A DATA TRANSMISSION THAN TO TAP A VOICE TRANSMISSION, AND EVEN MORE REWARDING THAN GETTING HARDCOPY DOCUMENTS. *SIGNIFICANT & IMPORTANT INFORMATION IS MORE CONCENTRATED IN A DATA TRANSMISSION. *SIGNIFICANT & IMPORTANT INFORMATION IS MORE EASILY LOCATED IN DATA TRANSMISSIONS THAN IN MASSES OF FILES OR PHONE CALLS. *TRANSMITTED DATA IS PRESUMED TRUE, AND WHEN ALTERATION IS DISCOVERED, IT'S READILY BLAMED ON THE EQUIPMENT. *THE LAWS CONCERNING TAPS ON UNCLASSIFIED AND NON-FINANCIAL COMPUTER DATA ARE EITHER QUITE LACKING OR ABJECTLY STUPID. THE POINT OF ALL THIS IS THAT THE PRUDENT MANAGER REALLY OUGHT TO ENCRYPT ALL DATA TRANSMISSIONS. ENCRYPTION PACKAGES ARE CHEAP (A 'DES' PROGRAM IS NOW PRICED AT $30) AND ARE EASY TO USE. ------------------------------- #### PHRACK PRESENTS ISSUE 17 #### ^*^*^*^ Phrack World News, Part 1 ^*^*^*^ **** File 10 of 12 **** - P H R A C K W O R L D N E W S - (Mainly Compiled By Sir Francis Drake) 2/1/88 BUST UPDATE =========== All the people busted by the Secret Service last July were contacted in September and asked if they "wanted to talk." No one but Solid State heard from the S.S. after this. Solid State was prosecuted and got one year probation plus some required community service. The rest: Ninja NYC, Bill >From RNOC, Oryan QUEST, etc. are still waiting to hear. Some rumors have gone around that Oryan QUEST has cooperated extensively with the feds but I have no idea about the validity of this. The following is a short interview with Oryan QUEST. Remember that QUEST has a habit of lying. PHRACK: Did you hear from the SS in September? It seems everybody else has. QUEST: No. I haven't heard from them since I was busted. Maybe they forgot me. P: What's your lawyer think of your case? Q: He says lay low. He says it's no problem because of my age. P: What do your parents think? Q: They were REALLY pissed for about a week but then they relaxed. I mean I think my parents knew I went through enough... I mean I felt like shit. P: Do you plan to keep involved in Telecom legit or otherwise? Q: Uhh, I wanna call boards... I mean I can understand why a sysop wouldn't give me an access but... I'm thinking of putting a board up, a secure board just to stay in touch ya know? Cause I had a lot of fun I mean I just don't want to get busted again. P: Any further words of wisdom? Q: No matter what anyone says I'm *ELITE*. NOOOO don't put that. P: Yes I am. Q: No I don't want people to think I'm a dick. P: Well... Q: You're a dick. - On a completely different note, Taran King who as some of you know was busted, is going to be writing a file for Phrack about what happened real soon now. MEDIA ===== The big media thing has been scare stories about computer viruses, culminating in a one page Newsweek article written by good old Sandza and friends. John Markoff of the San Francisco Examiner wrote articles on viruses, hacking voice mailboxes, and one that should come out soon about the July Busts (centering on Oryan QUEST). A small scoop: He may be leaving for the New York Times or the San Jose Mercury. Phreak media wise things have been going downhill. Besides PHRACK (which had a bad period but hopefully we're back for good) there is 2600, and Syndicate Report. Syndicate Report is dead, although their voice mail system is up. Sometimes. 2600 has gone from a monthly magazine to a quarterly one because they were losing so much money. One dead and 2 wounded. MISCELLANEOUS ============= Taran King and Knight Lightning are having a fun time in their fraternity at University of Missouri. Their respective GPA's are 2.1 and 2.7 approximately.... Phantom Phreaker and Doom Prophet are in a (punk/metal) band... Lex Luthor is alive and writing long articles for 2600... Sir Francis Drake sold out and wrote phreak articles for Thrasher... Jester Sluggo has become vaguely active again... CONCLUSION ========== Less and less people are phreaking, the world is in sorry shape, and I'm going to bed. Hail Eris. sfd #### PHRACK PRESENTS ISSUE 17 #### ^*^*^*^ Phrack World News, Part 2 ^*^*^*^ **** File 11 of 12 **** "Illegal Hacker Crackdown" from the California Computer News - October 1987 Article by Al Simmons - CCN Editor Hackers beware! Phone security authorities, the local police, and the Secret Service have been closing down on illegal hacking - electronic thievery - that is costing the long-distance communications companies and their customers millions of dollars annually. In the U.S., the loss tally on computer fraud, of all kinds, is now running between $3 billion and $5 a year, according to government sources. "San Francisco D.A. Gets First Adult Conviction for Hacking" (After about 18 years, it's a about time!) San Francisco, District Attorney Arlo Smith recently announced the first criminal conviction in San Francisco Superior Court involving an adult computer hacker. In a report released August 31, the San Francisco District Attorney's office named defendant Steve Cseh, 25, of San Francisco as having pled guilty earlier that month to a felony of "obtaining telephone services with fraudulent intent" (phreaking) by means of a computer. Cseh was sentenced by Superior Court Judge Laurence Kay to three years probation and ordered to preform 120 hours of community service. Judge Kay reduced the offense to a misdemeanor in light of Cseh's making full restitution to U.S. Sprint - the victim phone company. At the insistence of the prosecuting attorney, however, the Court ordered Cseh to turn his computer and modem over to U.S. Sprint to help defray the phone company's costs in detecting the defendant's thefts. (That's like big money there!) A team of investigators from U.S. Sprint and Pac Tel (the gestapo) worked for weeks earlier this year to detect the hacking activity and trace it to Cseh's phone line, D.A. Arlo Smith said. The case centered around the use of a computer and its software to illegally acquire a number of their registered users to make long-distance calls. Cseh's calls were monitored for a three-week period last March. After tracing the activity to Cseh's phone line, phone company security people (gestapo stormtroopers) were able to obtain legal authority, under a federal phone communications statute, to monitor the origin and duration of the illegal calls. Subsequently, the investigators along with Inspector George Walsh of the San Francisco Police Dept. Fraud Detail obtained a search warrant of Cseh's residence. Computer equipment, a software dialing program, and notebooks filled with codes and phone numbers were among the evidence seized, according to Asst. D.A. Jerry Coleman who prosecuted the case. U.S Sprint had initially reported more than $300,000 in losses from the use of their codes during the past two years; however, the investigation efforts could only prove specific losses of a lesser amount traceable to Cseh during the three-week monitoring period. "It is probable that other computer users had access to the hacked Sprint codes throughout the country due to dissemination on illegal computer bulletin boards," added Coleman (When where BBS's made illegal Mr. Coleman?) "Sacramento Investigators Breakup Tahoe Electronic Thefts" Meanwhile, at South Shore Lake Tahoe, Secret Service and phone company investigators arrested Thomas Gould Alvord, closing down an electronic theft ring estimated to have rung up more than $2 million in unauthorized calls. A Sacramento Bee story, filed by the Bee staff writers Ted Bell and Jim Lewis, reported that Alvord, 37, was arrested September 9, on five felony counts of computer hacking of long-distance access codes to five private telephone companies. Alvord is said to have used an automatic dialer, with computer programmed dialing formulas, enabling him to find long-distance credit card numbers used by clients of private telephone companies, according to an affidavit filed in Sacramento's District Court. The affidavit, filed by William S. Granger, a special agent of the Secret Service, identified Paula Hayes, an investigator for Tel-America of Salt Lake City, as the undercover agent who finally brought an end to Alvord's South Shore Electronic Co. illegal hacking operation. Hayes worked undercover to purchase access codes from Alvord. Agent Garanger's affidavit lists U.S. Sprint losses at $340,000 but Sprint spokesman Jenay Cottrell said that figure "could grow considerably," according to the Bee report. One stock brokerage firm, is reported to have seen its monthly Pacific Bell telephone bill climb steadily from $3,000 in April to $72,000 in August. The long-distance access codes of the firm were among those traced to Alvord's telephones, according to investigators the Bee said. Alvord was reportedly hacking access codes from Sprint, Pacific Bell, and other companies and was selling them to truck drivers for $60 a month. Alvord charged companies making overseas calls and larger businesses between $120 and $300 a month for the long-distance services of his South Shore Electronics Co. >From The $muggler #### PHRACK PRESENTS ISSUE 17 #### ^*^*^*^ Phrack World News, Part 3 ^*^*^*^ **** File 12 of 12 **** +-------------------------------------------------------------------------+ -[ PHRACK XVII ]----------------------------------------------------------- "The Code Crackers are Cheating Ma Bell" Typed by the Sorceress from the San Francisco Chronicle Edited by the $muggler The Far Side..........................(415)471-1138 Underground Communications, Inc.......(415)770-0140 +-------------------------------------------------------------------------+ In California prisons, inmates use "the code" to make free telephone calls lining up everything from gun running jobs to visits from grandma. In a college dormitory in Tennessee, students use the code to open up a long-distance line on a pay phone for 12 straight hours of free calls. In a phone booth somewhere in the Midwest, a mobster uses the code to make untraceable calls that bring a shipment of narcotics from South America to the United States. The code is actually millions of different personal identification numbers assigned by the nation's telephone companies. Fraudulent use of those codes is now a nationwide epidemic that is costing America's phone companies more than $500 million each year. In the end, most of that cost is passed on to consumers, in the form of higher phone rates, analysts say. The security codes range form multidigit access codes used by customers of the many alternative long-distance companies to the "calling card" numbers assigned by America Telephone & Telegraph and the 22 local phone companies, such as Pacific Bell. Most of the loss comes form the activities of computer hackers, said Rene Dunn, speaking for U.S. Sprint, the third-largest long-distance company. These technical experts - frequently bright, if socially reclusive, teenagers - set up their computers to dial the local access telephone number of one of the alternative long-distance firms, such as MCI and U.S. Sprint. When the phone answers, a legitimate customer would normally punch in a secret personal code, usually five digits, that allows him to make his call. Hackers, however, have devised computer programs that will keep firing combinations of numbers until it hits the right combination, much like a safecracker waiting for the telltale sound of pins and tumblers meshing. Then the hacker- known in the industry as a "cracker" because he has cracked the code- has full access to that customer's phone line. The customer does not realize what has happened until a huge phone bill arrives at the end of the month. By that time, his access number and personal code have been tacked up on thousands of electronic bulletin boards throughout the country, accessible to anyone with a computer, a telephone and a modem, the device that allows the computer to communicate over telephone lines. "This is definitely a major problem," said one telephone security expert, who declined to be identified. "I've seen one account with a $98,000 monthly bill." One Berkeley man has battled the telephone cheats since last fall, when his MCI bill showed about $100 in long-distance calls he had not made. Although MCI assured him that the problem would be taken care of, the man's latest bill was 11 pages long and has $563.40 worth of long-distance calls. Those calls include: [] A two-hour call to Hyattsville, Maryland, on January 22. A woman who answered the Hyattsville phone said she had no idea who called her house. [] Repeated calls to a dormitory telephone at UCLA. The student who answered the phone there said she did not know who spent 39 minutes talking to her, or her roommate, shortly after midnight on January 23. [] Calls to dormitory rooms at Washington State University in Pullman and to the University of Colorado in Boulder. Men who answered the phones there professed ignorance of who had called them or of any stolen long-distance codes. The Berkeley customer, who asked not to be identified, said he reached his frustration limit and canceled his MCI account. The phone companies are pursing the hackers and other thieves with methods that try to keep up with a technological monster that is linked by trillions of miles of telephone lines. The companies sometimes monitor customers' phone bills. If a bill that averages about $40 or $50 a month suddenly soars to several hundred dollars with calls apparently placed from all over the country on the same day, the phone company flags the bill and tries to track the source of the calls. The FBI makes its own surveillance sweeps of electronic bulletin boards, looking for stolen code numbers. The phone companies occasionally call up these boards and post messages, warning that arrest warrants will be coming soon if the fraudulent practice does not stop. Reputable bulletin boards post their own warnings to telephone hackers, telling them to stay out. Several criminal prosecutions are already in the works, said Jocelyne Calia, the manager of toll fraud for U.S. Sprint. If the detectives do not want to talk about their methods, the underground is equally circumspect. "If they (the companies) have effective (prevention) methods, how come all this is still going on?" asked one computer expert, a veteran hacker who says he went legitimate about 10 years ago. The computer expert, who identified himself only as Dr. Strange, said he was part of the original group of electronic wizards of the early 1970s who devised the "blue boxes" complex instruments that emulate the tones of a telephone and allowed these early hackers to break into the toll-free 800 system and call all over the world free of charge. The new hacker bedeviling the phone companies are simply the result of the "technology changing to one of computers, instead of blue boxes" Dr. Strange said. As the "phone company elevates the odds... the bigger a challenge it becomes," he said. A feeling of ambivalence toward the huge and largely anonymous phone companies makes it easier for many people to rationalize their cheating. A woman in a Southwestern state who obtained an authorization code from her boyfriend said, through an intermediary, that she never really thought of telephone fraud as a "moral issue." "I don't abuse it," the woman said of her newfound telephone privilege. "I don't use it for long periods of time - I never talk for more than an hour at a time - and I don't give it out to friends." Besides, she said, the bills for calls she has been making all over the United States for the past six weeks go to a "large corporation that I was dissatisfied with. It's not as if an individual is getting the bills." There is one place, however, where the phone companies maybe have the upper hand in their constant war with the hackers and cheats. In some prisons, said an MCI spokesman, "we've found we can use peer pressure. Let's say we restrict access to the phones, or even take them out, and there were a lot of prisoners who weren't abusing the phone system. So the word gets spread to those guys about which prisoner it was that caused the telephones to get taken out. Once you get the identification (of the phone-abusing prisoner) out there, I don't think you have to worry much" the spokesman said. "There's a justice system in the prisons, too." </pre> </body>