Power Hacker 2003

home *** CD-ROM | disk | FTP | other *** search

/ Power Hacker 2003 / Power_Hacker_2003.iso / E-zine / Magazines / ch4x / ch4x-1.txt next >

Wrap

Text File | 2002-05-27 | 48.6 KB | 1,147 lines

"yes, we know we are askee artists. suck my left fucking nut if you dont like our styles." .------------------------------. | ch4x - issue one | | canada h4xor | | [v.1.0]| |------------------------------| | chr1stm45 sp3c14l 12/25/1998| `------------------------------' +---============================================@ | TABLE OF CONTENTS (lame phont, phear.. 8) : //. .[t0p!c) =|_0---''''''''';;;;;;;;......------- . ......( s3ct10n.]--. | | | Preliminaries /dev/null | | Blue Boxing CCITT5 Trunks - demos un | | DATAPAC Tutorial - phaceman deux | | Why I'm an Asshole - phacemasta2000 trois | | How to get 0-day exploits - radead quatre | | OHIP, EDT and j00! - phacedu0d0 cinq | | later skaters - phacewh0r3 six | `-----------------------------------------------------------------------' [ SECTION /dev/null: Preliminaries ]-------------------------------------- ... comment est-ce qu'on nous contactez? ... web page : http://sdf.lonestar.org/~rounded IRC : DALnet : #ch4x EFnet : #ch4x / #BlueBox / #fosc *note "faceman != phaceman. I am phaceman on irc, not faceman." * .., what the fux0r!!!!!111111!! ,.. welcome dear friends to ch4x numero 1. In case you're stupid, we are a canadian group. we've heard enough bullchit from the elite american groups, now it's our turn to rock your socks off. Only ch4x doesn't regurgitate texts from 1983, and we don't talk about making drugs with rat poison and call it h/p. we're always looking for members, if you've got the skills to thrills. You do not qualify if because you can hack ops on irc, or can BO your school network. this issue was released early. without warning. so all our members did not get a chance to contribute. but it still kicks the shit out of other magazines (i need not name names). comments are always welcome, enjoy. phaceman('_') [your friendly neighbourhood asshole] .., membuhz ,... .---------------.----------------------------.-----------------------. | name | email | desc. | |---------------+----------------------------+-----------------------| | demos | demos@sdf.lonestar.org | big geek | | phaceman | faceman@idirect.ca | has zits on zits | | rounded | rounded@idirect.ca | backne problems | | mrfly | -- | bottle capped glasses | | mojo | -- | slack-jawed | | radead | radead@shaw.wave.ca | sackne problems | `---------------^----------------------------^-----------------------' : failed applicants who couldnt pass the test : : ; - oroku - - majestic12 - ; | [better luck next time, d00dicles!!!!!] | `------------------------------------------------------------------' [ SECTION un : Blue Boxing CCITT5 Trunks ]-------------------------------- BlueBoxing C5 Trunks (c) demos -Turn The Other Cheek And I'll Break Your Fucking Chin- ch4x 1998. Canada h4xor. [ What Do you Mean? ]----------------------------------------------------- As we do know, Blue Boxing is the proceedure of emitting tones into your phone's reciever, in order to sieze a trunk, and gain the status of being able to dial out from that trunk. Whats a trunk? My definition for a trunk is the virtual circuit which connects you to the rest of the CO's / telephone networks from your local CO. >Your Home Phone ---Dialing---> CO1 ---TS---> ---CO2--> Your Home Phone, is self explanitory. As you dial, you are put through to your local Central Office (CO1), which makes a trunk selection(TS), which connects you to the Central Office where your dialed party is located (CO2). [ But All My K-RAD Friends At 2600 Meets Say BlueBoxing Don't Work! ]----- Well, what these elite d00dz are thinking is that you want to be boxing trunks off your local CO. With this being the 1990's, most CO's in Canada run DMS-100 (Bell Canada) Switching, and do not allow blueboxing. With under-developed countries running old standards for their switching (CCITT5), blueboxing is possible. [ I Dont Want To Dial Over-Seas To Bluebox! ]------------------------------ Well, one day, while trying to dial collect over-seas, I could not do so, for oversea's calls require a '011' before dialing. On top of that, to dial collect, i had to have another '0' to do so. The string I was dialing was 0-011-Country-City-Number, which simply connected me with the local operator. I was stumped on how to make a collect call overseas - until one friendly Bell Canada operator told me about Home Country Direct lines, which are inward WATS (+1-800), which are used to place collect calls. Most overseas countries offer these lines, which are toll free! [ So, Now What Do I Do? ]-------------------------------------------------- Now that you understand how overseas collect calls function with inward WATS lines, you might want to consider how you can actually box them. Most of these Home Country Directs use old sets of standards, known as CCITT5, which are boxable. So, how do you find these HCDs? Simple, dial Toll Free directory (usually 1-800-555-1212), and ask them for the number of the Home Country Direct for the country you feel is liable to Blue Boxing. Most countries liable for Blue Boxing are those of South American countries (from my experience). [ How Do I Know If This HCD Is C5?! ]-------------------------------------- Well, as you compile your list of suspectable HCDs for boxing, give them a ring. If you hear a chirp, most likely it is C5. [ Lets Sieze These Dirty Foreigners' Trunks! ]----------------------------- I will tell you now, that I will not release delays and lengths, but I will tell you the freq's used to sieze most C5 HCDs' trunks. From my experience, they have been a mixture of 2400 / 2600 hz, then a 2400 hz freq. Now, if you find the lengths and delays, and get a sieze, you will use KP1 to start dialing, 0-city-localnumber then ST to stop dialing. Remember, when dialing off a C5 trunk, yur gonna need the C5 dialsets, which have the same function of DTMF, but use different frequencies, and work on C5 trunks. [ Now, How Do I Generate These Tones? ]------------------------------------ You are going to need a dialer. I recommend : Break Machine / Linux / http://c5.hakker.com Scavenger / DOS / http://??? Both these dialers have the same interface, yet, run off different operating systems. Read their FAQ's for information on running them. Both these dialers offer different signalling dialsets, an HCD list menu, tone player (in which you specify frequencies and timings yourself), timing/freq scanner, and a dialing list. [ SECTION deux : datapac for the lame and crippled ]----------------------- the dastardly tucker's guide to haX0ring on datapac (c) phaceman -your friendly neighbourhood d00dicle- ch4x 1998. Canada h4xor. [ prepubescent intros ]---------------------------------------------------- sep.25.98 DISCLAIMER: I'm not responsible for anything. I'm not your babysitter, so don't point to me if you land your ass in jail. All info that I give to you is for information purposes only. This is by no means a complete text on Datapac. I don't claim to be a Datapac hacker extraordinaire, and you shouldn't assume that everything you read here will be the case in the real world. Things change, people are wrong, so live with it. This is a short introductory document to help datapac haX0r wannabes out. I wrote this text because there's absolutely nothing on Datapac on the net. I made this as short as possible, because everyone knows that the amount of bullshit and the length of a document are directly proportional... 8). Read, learn, explore, and teach. [ Why Hack Datapac? ]------------------------------------------------------ Firstly, I realize that Datapac isn't one of the more popular topic discussed in the wide world of hacking. The reason for this is simple. People are too lame to use datapac nowadays. It's all ping of death this, nuke to hell that, suck my ass whatnot. "Hacking" programs are a dime a mother fucking dozen, and it takes no skill to use these programs. Backdoor Orifice is a simple example. Sure, it may be fun to load up a program that can boot a lamer off irc in a simple keystroke. But that's not all there is to hacking. Many people forget that the very beginnings of hacking come from the discovery of servers and systems penetration. And if this is why you've come here to read my article, then let me be the first to give you a good old pat on your damn back. What is the main difference between haX0ring through the normal means (phone line or Internet) and using Datapac? Simple. Datapac's a packet-switching network that hooks you up to thousands and thousands of mad servers. The beauty of this is that Datapac is, by design, a system with less security than that of the Internet or even phone lines. It's a nice place to start hacking and exposing yourself (put your weenie back in your pants you dirty-ass mofo!) to as many different servers a possible, without leading the pigity-pigs right to your doorstep. Well, enough with the damn rambling. I smell a new section... [ Get me on, you mofo!]---------------------------------------------------- Relax. Getting on Datapac is easy as passing gas. There are two methods that one uses to connect onto Datapac. You could use a datapac dial-up, or hop in through another PSN like Sprintnet. Only the first method will be described in this document. There are three things you need in order to dial up to datapac: 1. a modem: If you don't have one, you suck the bag. 2. a phone book: yeah. you read correctly. 3. a terminal program: set to VT100 (or VT102), 8N1. There should be dialups in all major Canadian cities for datapac. There's no way in hell I'm gonna list them all. It's not my job to be your ass swaddler, so go out and get your own info. You can get the dialup for datapac in your area by grabbing your yellow pages, and looking for "datapac". The "ITI" dialup is the one for you. Toronto hackers (like me) can use this number: (416)868-4498. Write this number down, because you'll be using it often. There is no charge for calling this number, other than the normal long distance charges, if they apply. I always call with *67 (call block). It's also a wise idea to divert your call through a local extender. If you're some fancy-ass hacker with mad info, divert out of the NPA, and back in. That'll make tracing difficult. I've never had troubles with dialing datapac. It's heavy usage makes it hard to log all hackers exploring the datapac system. Just be prepared, because you never know when the admins will be watching. w0000000.... [ Logging on is hard to do. If you suck ass... ]-------------------------- Now dial. You should see: atdt*67,8684498 CONNECT 19200/REL DATAPAC: 4680 0019 The first two lines, i trust you are familiar with...8). However, the third line is our ticket to k-raddidity. This line will not show up until you press three periods (...) followed by a carriage return (enter, you dolt). This means we've connected to Datapac. The numbers Datapac spat out indicate to us our port address and the nodenumber. It's format is like so: #### #### port node See? That's not so hard. By default, echo to your terminal will be off. I find it helps to turn local echo on for my term proggie, until I connect to a server. Which leads us to our next section... [ Hook me up, G. ]--------------------------------------------------------- Now that you're connected, you can boast to all your friends that you are a true hacker. Unfortunately, if you do this in #416 or any other h/p channel, we'll boot your ass faster than you can say "3y3 w4nt w4r3ZZZzzz!". The nest logical step on our journey to understanding datapac is to see how the system's address system works. This explanation is simplified because i'm getting tired of all this typing.. 8). Datapac works using (mostly) 8 digit NUAs (Network User Address, sometimes called NUIs - Network User Identification). Once you are connected to datapac, it waits for you to enter a vacation destination point. This destination is an NUI, obviously, so therefore you must give datapac an 8 digit number. There are too many valid NUAs to count, so I'm not gonna try. You can test out the datapac help server by typing: 92100086 [enter] You should then see: ---[snip] DATAPAC: call connected to 9210 0086 (002) (n, remote charging, packet size: 256) WELCOME to the Datapac Information System. Your previous session was 1998-09-09 21:28:10 EST *************************************************************************** W E L C O M E T O T H E D A T A P A C I N F O R M A T I O N S Y S T E M ( D I S ) *************************************************************************** The DIS keeps you up on all the latest Datapac news and information free of charge. If you need Datapac assistance, simply call us on our Datapac Customer Assistance hotline 1-800-267-6574. We operate Monday to Friday from 8:00 a.m. to 5:00 p.m. Eastern Time. ---[snap] ...or something to that effect. For completeness' sake, this is what the top part means. You'll rarely need it. 8) DATAPAC: call connected to 9210 0086 | `- you've connected to this addy. (002) (n, remote charging, packet size: 256) | | | | | | | `-- 256 chars/packet sent. | | | | | `-- they're paying for this call.. 8) | | | `-- normal call. can also be a 'p'riority call. 'p' | increases the cost of the call. | `-- logical channel used for this call. All this information is bullshit. The only important thing you need to know is about "remote charging", which we'll go into later. Now then, we know how to get places. But where are the places to go? [ Places to go, NUAs to see... ]------------------------------------------- You're not gonna get very far using datapac unless you have a large supply of NUAs (and therefore servers) to fiddle with. This means you're gonna need a way to find NUAs, and at mad speeds. Enter: Datapac NUA Scanners. There are two of them. One sucks. The other doesn't work. I suggest you write your own scanner. If a datapac scanner ever comes across my box, I'll put info on the program in here. I know that not having a scanner to find NUAs really sucks. But if you have some friends that also play with datapac, chances are they'll also hold a hefty list of NUAs for you to play with. You could also just punch in random 8 digit numbers. I find this works about 20% of the time, which isn't a bad percentile. Your favorite NUA should be the datapac help line. Learn it well, because it'll teach you things I don't even begin to cover in this text file. It's your own job to find NUAs. That's one of the fun parts of datapac. [ Why Remote Charging lowers your blood pressure ]------------------------- Remote Charging is the equivalent of making a "collect call" on datapac. This means that the party you are calling gets billed for the call, not you. When you are using datapac, there are two types of calls: 1. Remote Charging 2. Pay Through Your Ass Charging Remote charging usually works with large servers. However, there also exists the non-remote charging kind. We'll call this asshole charging. This means that datapac bills the call back to you. "wait a minute", you ask. "How can they bill me, if they don't know who I am?". Easy. They bill you through your NUA, if you have one. Of course, for most purposes you won't need one. But there are some servers that require you to own an NUA in order to functions. The obvious example are the datapac outdials. To create a Datapac NUA, check out their help system for info. If you happen to come across an NUA and its password by some chaotic mistake, you can make a reverse call by typing this at the Datapac prompt (or lack of prompt, in dpac's case...): NUI <your nui> It will then ask you for a password. Then you can connect to a NUA as usual, but your NUA will be billed for the call. You can turn this off by typing 'NUI off' at the Datapac prompt. Prompts is our next topic. [ prompt=$p$g? not anymore. ]--------------------------------------------- While connected to a session, you can always break out into Datapac 'mode' again. This helps if you want to instantly disconnect from that NUA, set parameters, or something along those lines. The break key is ^p (control-pee). From there, you can issue the following commands (not a complete list): CLR : this will disconnect you from the current NUA. SET : sets a value for a particular set of parameters. For example, typing 'set 2:0 <enter>' would turn echo off. There are many other parameters to play with. None of which are important now, really.. 8) I will put the whole list in the next section. The first number indicates the parameter the set. The number following the colon is the parameter's new value. INT : sends an 'interrupt' packet to the destination's computer. There are many more commands. I'm not gonna go through them all. It'd bore the fuck out of you and me.. 8) Speaking of fucking boring shit, SETtable parameters are next on the list (gag). [ enough parameters to shrivel your asshole ]------------------------------ Param. No. What it is Values Defaults -------------------------------------------------------------------------- 1 Escape to command mode? 0 - not allowed 1 (using control-p) 1 - allowed 2 Echo 0 - off 0 1 - on 3 Data forwarding signal (when 0 - none 2 this key is typed, send a 2 - <enter> packet) 126 - all control keys and <delete> 4 Idle Timer (sends a packet 0 - none 0 after this time, if PAD 1 to 255 - delay in buffer is not empty) 20ths of a second 5 Auxiliary Device Control (^S, 0 - off 0 ^Q hand shaking) 1 - for a.d. control 2 - for intelligent terminals 6 Suppress network messages 0 - suppress 1 1 - transmit 7 Action on receipt of a BREAK 0 - nothing 21 1 - interrupt host 2 - reset call 4 - send BREAK 8 - enter command mode 16 - discard output 21 - interrupt, send BREAK indication, discard output. 8 Discard Output (send-only 0 - normal 0 terminal) 1 - discard 9 Padding 0 to 255 - number of 2 pad chars. 10 Line folding 0 - none 0 1 to 255 - # chars per 0 line 11 Transmission Speed (read only) 0 - 110 bps variable 2 - 300 bps 3 - 1200 bps 4 - 600 bps 12 - 2400 bps 13 - 4800 bps 14 - 9600 bps 12 XON flow control 0 - off 0 1 - on 13 Linefeed insertion 0 - none 4 1 - add LF to terminal on CR from host 4 - echo LF to terminal when CR is typed 5 - echo LF to terminal when typed or received from host 14 Number of padding characters 0 to 31 - number of 0 to insert after a linefeed (LF) NULs to be inserted 15 Enable editing functions for 0 - disable 0 parameters 16, 17, 18 1 - enable 16 Character delete 0 - none 127 (del) 1 to 127 - ascii code of signal 17 Line delete 0 - none 24 (^X) 1 to 127 - ascii code of signal 18 Line display (retype line) 0 - none 18 (^R) 1 to 127 - ascii code of signal 19 Editing service signals (what 0 - nothing 2 is echoed when editing char. 1 - <bs> for line del is recieved) 2 - <bs><spc><bs> for each deleted char. 8 - <bs> for each deleted character 32 to 126 - send that ascii char. 20 Echo mask: set of characters 0 - all echoed 0 not to be echoed to terminal 1 - no echo of <cr> 2 - no echo of <lf> 4 - no echo of <vt>, <ht>,<ff> 8 - no echo of <bel>, <bs> 16 - no echo of <esc>, <enq> 32 - no echo of <ack>, <nak>,<stx>,<soh>, <etd>,<etb>,<etx> 64 - no echo of editing characters 128 - no echo of control chars. and <del>, except those above 21 Parity detected/checked 0 - no check 3 2 - generate 3 - checked 22 Page wait 0 - no page wait 0 1 to 255 - size of page 121 Additional data forwarding 0 - none 0 & signals (ascii codes to 1 to 127 - ascii code 122 terminate a packet) of signal 125 Output pending timer (when to 0 - no delay 0 send a packet if no other 1 to 255 - delay in signal seen) seconds -------------------------------------------------------------------------- Mother fuck that was a lot to type and format.... Most of you will never (sob) need to above. But when and if you do, you won't find the above information in no LOD technical manual or the 2600... 8) If I haven't scared you away yet, let me go on with the some information on PADs... [ The Grand ass-PADdling ]------------------------------------------------- To finish off this longer-than-I-expected textfile, I wanna introduce you all to the wonderful world of PADs. PADs are to datapac what diverters are to phone lines. They will sometimes allow you to reach asshole charging NUAs, by taking in the cost of the connection. Of course, this will require that you find out a password or two. But that's beyond the scope of this document. How will you know if you've found a PAD and not a simple server? Here's a tip from Faceman. Most PADs are by GANDALF. They can be STARMASTERs, XMUX, whatever. If it's by GANDALF, it's probably a PAD. This isn't always the case, though. PADs will aid your life immensely, and it's in your best interest to get a hold of PAD access as soon as possible. PADs will allow you to make use of the datapac OUTDIALS in the next section, as well as a number of other neat uses that you can find by playing around with the server. [ Dialing Out with those OutDialing sons of Bitches ]---------------------- This list was taken from a text file printed long ago. Many still work, though I haven't tested them all out. They should all be asshole chargable, because a remote charging outdial would be incredibly stupid.. 8) OUTDIAL PORT ADDRESSES OUTDIAL PORT CITY (PROVINCE) SPEED ADDRESS --------------- ----- ------- Calgary (ALTA) 300 63300900 1200 63300901 Clarkson (ONT) 300 91900900 1200 91900901 Edmonton (ALTA) 300 58700900 1200 58700901 Halifax (NS) 300 76101900 1200 76101901 Hamilton (ONT) 300 38500900 1200 38500901 Kitchener (ONT) 300 33400900 1200 33400901 London (ONT) 300 35600900 1200 35600901 Montreal (QUE) 300 82700902 1200 82700903 Ottawa (ONT) 300 85700901 1200 85700902 Quebec City (QUE) 300 48400900 1200 48400901 Regina (SASK) 300 72100900 1200 72100901 St-John's (NB) 300 74600900 1200 74600901 Saskatoon (SASK) 300 71100900 1200 71100901 St. John (NFLD) 300 78100900 1200 78100901 St-John's (NB) 300 74600900 1200 74600901 Saskatoon (SASK) 300 71100900 1200 71100901 St. John (NFLD) 300 78100900 1200 78100901 Toronto (ONT) 300 91600901 1200 91600902 Vancouver (BC) 300 67100900 1200 67100901 Windsor (ONT) 300 29500900 1200 29500901 Winnipeg (MAN) 300 69200902 1200 69200901 ...notice that the baud rate for these outdials leave something to be desired.. 8). Many of these have been upgraded by now to at least 14.4 modems. Outdials provide you to a link to the phone network. But what about other networks, you ask? Here goes, Mac-Daddy. [ International Connectivity ]--------------------------------------------- Datapac is a Canadian network. This of course, means that not many people from the States or England could call in, without racking up a large bill, and vice versa. Enter: International Access. The following networks are connected to Datapac. You connect to an NUA on the other networks in the following format: 1 DNIC ADDRESS The '1' means international, much like dialing '1' for a long distance call. the DNIC (data network identification code) is 4 digits long. The list of valid DNICs are be provided below. The Address format differs from network to network. They can range from 8 to 10 digits long. Check up on other networks in order to learn how their addressing system works. .--------DNICS TO (AB)USE:-. | | These networks operate much like Datapac, and | Accunet..........3134 | in many instances use the same technology. |ADP Autonet..........3126 | They will have many of the same types of | BT Tymnet..........3106 | servers as found on datapac, due to the | Bell South..........3143 | generic usages of PSNs. | Centrel..........3148 | | Express..........3139 | | Fedex..........3138 | | NYNex..........3144 | There's not much else to learn about the | Sprintnet..........3110 | datapac. I've schooled you hardcore, and | US West..........3147 | cram-styles. You should be able to work `--------------------------' your way around datapac like you 0wn. [ Capping it all off ]----------------------------------------------------- I'm not gonna lie to you. Datapac isn't God's gift to hackers. Use it carefully and you won't be caught. Use it like a fool and you'll be busted in no time. Datapac's attractive lies mainly is the servers that are connected to it: Many of them pretty much forget they're on datapac, because the internet has taken over.... 8). I've logged onto systems that haven't had a datapac connection in 4 years! Many servers connected to datapac are oldschool. Old systems tend to have many flaws and exploits that you can use to your advantage. Have fun, use datapac wisely. One more tidbit of information that doesn't fit elsewhere: The datapac customer assistance hotline is 1(800)267-6574. This is an automated answering machine. If you found this text useful, don't hesitate to tell me, because it will encourage me to share more information with you. If you find a mistake, error, lie, whatever, mail me. My e-mail address and web page can be found at the top of this document. Later y'all, ('_') faceman ('_') [ SECTION trois : ch4x assh0les ]------------------------------------------ Why I'm an Asshole (c) phaceman -your friendly neighbourhood d00dicle- ch4x 1998. Canada h4xor. [ ( * ) ]------------------------------------------------------------------ dec.23.98 There are lots of reasons as to why i'm as asshole. ask diffrent, people and you'll get a lot of different answers. but let's talk about h/p assholes, like me. whenever i pick up a copy of any zine or ezine, at least one letter per publication goes something along the lines of "i'm new and i am interested in learning, but everyone always kicks me and bans me and you should pity me and i'm a pedo, etc, etc..." You get the idea. At first, i used to pity these jerks, and help them out. I'd school them for hours. I remember i sat down and chatted with this new guy on my old bbs about hacking basics for at least 6 hours once, non stop. I used to be a real nice guy. Then one day i just realized that when i'd been doing was stupid. like, what the fuck. Why the hell should i help anyone else? "knowledge is power" "information should be shared", i've heard those comments from lamers too many times to count. What the fuck, am i supposed to read those societal sayings and go "hey faceman, you were wrong, let's help out AOLKidd13 to become a great hacker"? No, i think not. I read them and i snort loudly because the person who said that is a fucking moron. no one schooled me, and i don't owe anybody in the h/p scene anything, especially new comers. everything (or, what little, according to some) i've learned came from my own experimentation and reading. Why the fuck should it be any different for the next generation of hacker wannabes? Whoever made the rule of helping those lesser than you was a fucking tool. The people that i've schooled have either: i. gone on to become absolutely nothing, or ii. turned into egofilled fucks who spend 20 hours a day on irc gloating. No, i've learned my lesson, and i'm never schooling anyone who asks for help again. To those that are new to the scene: learn from reading. I don't mean reading the 2600, because that's just a load of superficial bullchit that's not worth the paper it's printed on. I'm referring to reading underground files, like this zine, keen veracity isn't bad, phrack, b4b0, and others like these. It's where the goldmine of h/p information is kept, and it's where you're likely to learn chit. Sure, i'm a nice du0d0 when it comes down to it. But my treatment of newcomers is always cruel, no matter who they are. And I believe it's justified. And i don't think people should shit on you for being a dickwad to newcomers, because you don't owe them a single fucking thing. So the next time a newbie asks you how to 'rm -rf /*' a box or something stupid like that, go ahead and tell them to fuck the hell off, compliments of me. have a great day. [ SECTION quatre : How to leech 0-day exploits ]--------------------------- How to leech 0-day exploits (c) radead -wit da mad GNU warez, get getz da ladys starez- ch4x 1998. Canada h4xor. [ ... ]-------------------------------------------------------------------- Well, I know all of you want to gno how I get all my madd 0 day sploitz, so I wrote this text file to help you linx them up for j00rselves. First of all, you gotta make a conf or get on a conf. An 800 one if you want the elitest sploitz. Then you gotta invite some elite people from #phrack or #hack to come on. Make sure they are anti-social and really like attention. Then you act really cool and bring along the subject of haxoring. e.g. me on irc <radead> yo p-wind0wz get on this conf, its leet <p-wind0wz> sure, i have no friends irl me on conf: radead: yo p-windowz sup man p-wind0wz: yo man! radead: yo, where're you from? btw, do you have any elite 0 day sploitz? p-wind0wz: <insert city name>, yeah sure! i'll just dcc them to you.... At this point p-wind0wz will dcc me the elite exploits. The basis of this method is that on conferences people become amazingly willing to give shit out. Sometimes it takes a bit of work, for example radead: yo send me that 2 minute old exploit you just coded p-wind0wz p-wind0wz: i dunno man, its pretty elite, i can't give it out radead: come onnnnnn i won't give it to anyone p-wind0wz: ok sure <dccs> So, basically tahts how you wrack up the madd elite exploitz without having to possess any skillz yourself other than being able to get on a conf! Well that about wraps it up, next issue i'll show you how to get quarters out of coke machines! Dj RaDeAdY [ SECTION cinq : ohip, edt and j00! ]-------------------------------------- the dastardly tucker's guide to OHIP and EDT (c) phaceman -your friendly neighbourhood d00dicle- ch4x 1998. Canada h4xor. [ prepubescent intros ]---------------------------------------------------- oct.18.98 DISCLAIMER: I'm not responsible for anything. I'm not your babysitter, so don't point to me if you land your ass in jail. All info that I give to you is for information purposes only. e-mail faceman: faceman@idirect.ca (try me first) faceman@sdf.lonestar.org (try me not first) web page: http://sdf.lonestar.org/~faceman This is a document put together from bits and pieces of information gathered from my many romps and frollicks into the fun world of OHIP and the MOH. If you don't know what OHIP (Ontario Health Insurance Plan) and MOH (Ministry of Health) are, you should probably throw this out. I'm not calling you an idiot (snicker), but it's useless to you unless you *really* do care about the MOH and its billing processes. [ ... the fuhq is edt? ]--------------------------------------------------- Well, my well-endowed friends, i'm glad you asked. EDT is an acronym. Specifically, it stands for "Eletronic Data Transfer". Alone, it means absolutely diddily-squat. But teamed up with the powers of the Ontario MOH, we're rocking like a bunch of cockrockers from aerosmith (or guns'n roses, whichever you prefer to detest). EDT is a new service which the MOH will bring into play sometime in the near future. It is owned by GONet (Government of Ontario Network), which means, hax0r at your own risk... I know you're all itching in your undies to know what EDT will do for you, so let me get to the point: NOTHING. "whadafuq?" yeah, nothing. EDT will benefit you absolutely 0%. Get over it. This document is only for those who are really interested in how billing takes place for doctors and other medical professionals. EDT is just a new method of billing for doctors and the sort. They will now be able to send in their bi-monthly billing tabulations via a dialup rather than on floppy disk. This document also contains some mad info on OHIP billing formats, in case the EDT doesn't tickle your gonads. Enjoy. [ the meat of the issue ]-------------------------------------------------- EDT greatly reduces stress on the already stressful lives of doctors and other various rich bastards. Through, EDT, medical personnel will now be able to: (ph33r my straight-out-from-pamphlet-skillz.. 8) - submit fee-for-service claims in current machine readable input (MRI) format, from your computer system, to the MOH's mainframe claims processing system. - recieve reports, such as the Remottance Advice (RA) and the Error Report on yor computer system. - Send other files, such as referrals and consultation reports, to other EDT users. - Validate groups of health card numbers through an Overnight Batch Eligibility Checking system (OBEC). - Receive MOH business communications (e.g., bulletins) electronically in the future. EDT has been in use in the pharmaceutical business world for some time. They use datapac like there's no tomorrow to transfer prescriptions and the sort. As a matter of fact, every single transaction that takes place at the pharmacy for prescription drugs is sent through datapac to the main server to be processed before medicine can be dispensed. This differs from say, doctors, in that they only need to connect to the MOH server once a day. [ meet the server ]-------------------------------------------------------- The MOH server will most definately be capable of handling several hundred logins at once, due to the vast number of doctors in Ontario. This means, no more dialups. You can be certain that the MOH will choose the more cost-effective method to communicate, which is via network, namely, datapac. How do I know this yet-to-be-publicly-announced-information? Just because. If you are familiar with datapac, then you will find the next tidbit of information most ridiculous. If not, may i suggest you read my datapac document, which can be found on my website? Datapac requires cash. Either the server pays, or the user pays. Unfortunately for doctors, the new EDT service will be paid for by an NUI. This means that every doctor in Ontario who wishes to subscribe to the EDT system will need to purchase a NUI to which they can bill their calls. This is a great capitalist line of thought, isn't it? Let's just figure it out, for the sake of fun. datapac -----> owned partly by government (versus) MOH -----> owned by government Hrrmmm..... The slimy bastards sitting in office have it all figured out. Why pay the phone company for dialins, when they can get doctors to put money in the government's wallets? Nice deal. What other shit is there to know? Hrm.. i dunno. hell, i dunno who the fuck's gonna even read this article anyhow. [ How to Bill ]------------------------------------------------------------ The following may disturb you: I don't know how billing files work. Well, I do. But... well,.... you know. I need to verify a few things because i don't wanna shoot any crap in my documents to pretend i'm smarter than I really am. I will fill this section very soon, i promise.. 8) However, i do know this... [ How to Get Money ]------------------------------------------------------- Right now, a billing disk is sent to OHIP for claiming money. This disk contains a file. As i said above, more details to come.. 8) (sorry). A bit later (a month or so), a disk is mailed to the doctor. On this disk contains a file. This file is numbered as so: LL######.001 e.g., dg123456.001 Of course, there's an algorithm involved. But that's not important. What is important, however, is the contents of this file. Open it up with a file viewer, and whadda we got? TEXT. PLAIN text. Silky, smooth, plain text. I don't think the MOH could have made it easier for us. Of course, strictly speaking, you'll never get your hands on a disk like this unless a doctor throws them out (rare), you work at a doctors office (rare), or you are a doctor (rare). See a pattern? 8). Don't worry. I'll just tell you whats on a typical ass-prankin' RA (recieved accounts) disk. The first line is chock full of heady goodness. Take time to notice conventions, because it's not often that businesses use such a lame way of storing data... 8) .-- this here HRx defines the heading number. .- type of doctor (2 digits) | .--- doctor registration number. | .- doc's initals | | .--- first initial of name | | .- more of them crazy | | | .- mystery numbers | | |--------. mysterio | | | | .- doctor's last name | | | | numbers. | .-+---------.|.--+--. | | | .--+----. .-+----. HR10000012345678A1234567FACEMAN DA AF000994512 99999999 The second line is less interesting: .-- this is line 2 .-- address HR2 22 FACELAND AVE. .--- city .- prov .--- postal code HR3TORONTO ON H0H0H0 After the HR3 (third line, the actual billing begins. This is always such fun. Let's see how the MOH organized billing for us, shall we? .- the mysterious numbers we all know and love. | .-- doc's reggie number (see above) | | .- patient number (on doc's computer) | | | .- province (2 digits) | | | | .- health card no. | | | | | .- 2 digit version | | | | | | code (on card) | | | | | `------. .- "health .-+-------..-+----. .-+-. | .-+------. | |card plan" HR4N8912349123412345678 80009 ON1234567890 FM HCP HR5N8123461023467113841V999A 001050001050 `-+---------------'`-+-' `----------' `- more numbers | `-------- cost (see below.) from the ` treatment code. abyss.. 8) (see below for more mad info.) Sheat.... that's how it's done. This is a list of all patients sent in, and how much OHIP pays for the patient's visit to the doctor's office. The cost is simple. Split the "001050001050" in half. "001050 001050". Now, get rid of beginning zeros, and add a decimal after 2 digits from the right... "10.50 10.50". This means "you claimed, we paid". So Dr. A.Faceman treated a patient for $10.50, and OHIP paid him $10.50 in return. Sometimes there will be rejected claims due to errors, etc, etc. That's not my problem, and i don't want to discuss that... hehe... HR4 means "Patient info", essentially. HR5 means "patient seen by this doctor, who used this treatment, that we must pay for." Treatment codes are another thing that's confusing. Each code pertains to a different treatment. For example, X0001 could be a penile x-ray, and V1003F could be a flu shot to the left asscheek. In the above example "V999A" was a treatment worth $10.50. Simple, eh? Jah. I thought so too. [ summary lists ]---------------------------------------------------------- Summary lists are listed as Header 8. It's not that interesting, just a little text chart for your pleasures. Data is changed by me so no crazy doctor info could be leaked.. 8) HR8********************************************************************** HR8 UTILIZATION ADJUSTMENTS HR8 HR8PROVIDER # FISCAL ELIG FOR REDUCTION THIS MONTH'S FISCAL YTD HR8 YEAR REDUCTIONS RATE REDUCTION REDUCTIONS HR8 HR80000-123456 96/97 $0.00 05.000% $0.00 $1,500.00- HR80000-123456 96/97 $0.00 12.500% $0.00 $3,500.00- HR80000-123456 97/98 $0.00 05.000% $0.00 $2,000.50- HR80000-123456 97/98 $0.00 13.000% $0.00 $1,500.00- HR80000-123456 *95/96 U/A RECON * $0.00 $1,000.00 HR80000-123456 *96/97 U/A RECON * $0.00 $1,000.50- HR8 ------------- ------------- -------------- HR80000-123456 $0.00 $0.00 $6,500.00- HR8********************************************************************** HR8 ******************************************************************* HR8 THE PAYMENT AMOUNT INDICATED MAY BE SUBJECT TO ADJUSTMENT HR8 DUE TO THIRD PARTY REQUEST(S). EG: COURT ORDERS, ASSIGNMENTS, ETC. HR8 IF YOUR PAYMENT AMOUNT IS CHANGED, YOU WILL BE NOTIFIED WITHIN HR8 FIVE BUSINESS DAYS FROM THE DATE OF THIS REMITTANCE. HR8 ******************************************************************* ^Z As you can see, the file ends with a "ctrl-z". The "0000-123456" is simply the doctor's registration number. You can see how much has come and go through OHIP by looking at this graph. Interesting... so some doctors aren't so rich... 8) [ later skaters ]---------------------------------------------------------- Right now you should be feeling discouraged. You spent a LONG time studing this document for absolutely no reason.. hehe... It'll come in handy though, when you hax0r your own NUI and logon to the EDT system... If you found this text useful, don't hesitate to tell me, because it will encourage me to share more information with you. If you find a mistake, error, lie, whatever, mail me. My e-mail address and web page can be found at the top of this document. Later y'all, ('_') faceman ('_') [ SECTION six : the REAL later skaters ]----------------------------------- well, my well-endowed friends, so ends another saga of canada hax0r. We put a lot of effort into this magazine, so you'd best enjoy, lest you phear, dont you interfere, cause we'll... yeah.. you.. yo... uh... fuck it's late. anyhow, you can always reach us at : rounded@idirect.ca . We will answer almost every mail we get. because we are desperate, we have no girlfriends, and we all have acne, backne, and sackne. Until next time, comrades. "sleep tight, and don't let the pedos bite!" / | \ ('_') [x_X] <@_A> face demos radead [your friendly neighbourhood ch4x-1.txt contributors] [ In Next Issue ]---------------------------------------------------------- * All about the +1-416-215 NXX - demos * Scans From various NXX's in the 416 NPA - demos * New articles from Phaceman * Tips on jerking from Radead * other stuff we can't make up right now [ *EOF* ]