The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / n_z / nfx_3.txt < prev next >

Wrap

Text File | 2003-06-11 | 26.3 KB | 540 lines

======================================= T H E N E W F O N E E X P R E S S ======================================= The newsletter of the Society for the Freedom of Information (SFI) Electronic Edition --------------------------------------------------------------------------- The publisher, SFI, distribution site(s), and authors contributing to the NFX are protected by the Bill of Rights in the U.S. Constitution,which specifically protects freedom of speech and freedom of the press. The information provided in this magazine is for informational purposes only, and the publisher, SFI, distribution site(s) and authors are not responsible for any problems resulting >from the use of this information. Nor is SFI responsible for consequences resulting from authors' actions. This disclaimer is retroactive to all previous issues of the NFX. We accept article submissions of nearly any sort, about hack/phreak/anarchy/ gov't/nets/etc. We will also send the author a free printed issue for each article written. The printed edition of the newsletter is finally available for $24 (U.S.) per year, until we find a cheaper way to reproduce it on paper. Articles may also be submitted to this address. Send mail to the New Fone Express, Box 639, 15405 Michigan Rd., Woodbridge, VA 22191. --------------------------------------------------------------------------- Highlights for Issue #3/August 1991 =================================== * Phones Take Lunch Break ... typed by Silicon Avalanche, edited (see article #1) * SUPPLEMENT: What Happened? * A Pick Tutorial pt.2 ... by Silicon Avalanche (see article #2) * State of Surveillance pt.3 ... by the Cavalier (see article #3) * Altair Wireless LANs ... by the Cavalier (see article #4) * Corrections ... edited (see article #5) * Editorial and Bell IS News ... by the Cavalier (see article #6) ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ Phones Take Lunch Break ... Computer Failure Disables Pa. Phones... ... Outage Linked to Problem That Hit Here ... ... by Cindy Skrzycki and Evelyn Richards ... ... Washington Post Staff Writers ... Telephone service in Pittsburgh and other parts of Pennsylvania was paralyzed yesterday (7/1/91) by the same sort of massive computer software failure that knocked phones out in the Washington area only four days ago (6/29/91). The outage in Pittsburgh interfered with service to about 1 million customers, or about one-third of the state, beginning just after 11 a.m. Service was restored by 5:15 p.m. Later yesterday (7/1/91), service was disrupted for several minutes in San Francisco, which telephone company officials attributed to the same problem. The failures in Pennsylvania happened just as Bell Atlantic Corp., the parent company of both Chesapeake & Potomac Telephone Cos. and Bell of Pennsylvania, was trying to reach some conclusion on the cause of the disruption in Washington, which was probably the most massive collapse in local phone service ever. The Pennsylvania problem was the third major disruption to hit a metropolitan area in less than a week. Last Wednesday, Los Angeles lost phone service for much of the same time that some 6.3 million lines were out in four states served by C&P. Each of the problems, which have telecommunications experts scrambling for explanations, is linked to the same type of computer switch and software that allows phone companies to offer sophisticated services such as Caller ID. The switch and software are manufactured by DSC Communications Corp. of Plano Tex., (214)519-3000, the largest supplier of such equipment. The rash of software-related disruptions confirms the predictions of many telecommunications experts that outages will recur because of the complexity of the new technology. Customers in Pennsylvania, as in Washington, found when the outage hit that they had difficulty calling across town and making toll calls to nearby exchanges. Dessi Plutis, who lives in Pittsburgh, ran up against the problem when she tried to make a call across town. "The line was busy, busy, busy," Plutis said. "I assumed they took the phone off the hook." What really was happening was a near replication of a major software glitch that hit in the Washington area last Wednesday around the same time of day. In that case, a complex computer switching system called Signaling System 7 broke down in Baltimore and quickly affected three other computer switches that route and set up calls for the Washington area. The computers went into overload and shut down after reacting to a flood of maintenance messages in the system. These messages tell computers in the telephone network that some congestion, real or imagined, or some other problem is being experienced. The flood of these messages prevents other calls from going through. In Pennsylvania, an overload of maintenance messages between two Signaling System 7 computers also seems to be the culprit. "When it overloaded, it backed up to the other one," said Eric Rabe, spokesman for Bell of Pennsylvania. What experts find most intriguing is the fact that all of the problems seem to be traceable to the software supplied by DSC. The company recently completed shipment on its hundredth Signaling System 7 switch and counts among its major customers the regional telephone companies and long-distance carriers such as MCI Communications Corp. and US Sprint Communications Co. A spokesman for DSC said Signaling System 7 is "the leading product in the industry. It has run flawlessly for a number of years. We still don't know that it isn't." The spokesman said the computer did what it was supposed to do - shut down when it's overloaded. He said approximately 200 people are working "around the clock" to prevent a recurrence of the outages, and phone companies have been sensitized for what conditions to watch for, as well as how to isolate, stabilize and restore service. "We know the symptoms. We don't know the cause," the DSC spokesman said. The outages on the Eastern seaboard present a major image and reliability problem for Bell Atlantic. All told, the company has had major problems in five of the seven states it serves in the last week. "Obviously, [the breakdown] doesn't help us, but... I hope we've built up a lot of years of understanding that quality is the name of the game," said Anton J. Campanella, president of Bell Atlantic. "We are not going to rest until we find the answer to this one." Bell Atlantic said it is working closely with DSC and that the switch manufacturer has provided software "patches" to prevent the problem from recurring by shutting down maintenance messages. But the company clearly is worried that some element of Signaling System 7 may somehow be inherently flawed. "My tummy gets upset when a manufacturer delivers a product that doesn't work correctly," said Campanella, though he stressed that the problem hasn't been identified. He also said that a virus is not being ruled out since all of the occurrences in the Bell Atlantic network seemed to start around the same time of day. The company has been in contact with the FBI to follow up on that possibility. Pacific Bell, whose problems began on June 10, also has been in close touch with DSC. "We were entirely unhappy with what happened June 10," said Sue Galloway, regional switching manager for Pacific Bell's Southern California network operations. "Even though analysis was going on, we were concerned and we wanted to send a very clear message." The company was so concerned that Pacific Bell called in DSC's chairman to meet with top telephone officials in northern California, a Pacific Bell official said. In San Francisco, a computer began spitting out congestion messages about 11 a.m. Pacific time. Traffic was rerouted and service was restored. The outage in Pennsylvania also caused officials at C&P to rethink an announcement yesterday about how customers in the Washington region might be compensated for their troubles last Wednesday. "It may be premature to make any kind of announcement," said Michael Daley, spokesman for C&P in the District. "We'll talk about what we can do for customers when we get over the hurdles of these phone outages." ... Staff writer John Burgess contributed to this report ... ... Courtesy of Silicon Avalanche of SFI ... ... from The Washington Post, July 2, 1991, pgs. D1 and D4. ... >< ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ What Happened? As far as we could guess, the common denominator in all these cases was a switch that was processing a large number of calls. Due to SS7's capability to pass network traffic off to other switches, it tried to do so, but ended up passing an overload message instead. The second switch then decided that it wanted to be overloaded, and it cascaded through the local network of CCS7-connected switches, thereby locking up the entire SS7-capable network. DSC Communications eventually turned out to be the culprit - another bug in the SS7 software, which was written by the DSC people. We've been told that this is not exactly what happened with the AT&T network crash on Jan. 15, 1990, however: apparently AT&T writes their own STP (signaling transfer point, a module that allows switches to run SS7) software. We would venture a guess that DSC is a vendor of STPs - and a popular one at that. >< ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ A Pick Tutorial A Pick Tutorial - Courtesy of Silicon Avalanche of SFI Installment #2 TICKLE, TICKLE... Well, by now you should have some means of getting in and out of some account on a Pick system, whether it be the TUTOR account, or some other system account. The best place to be is at what is called TCL (pronounced "tickle"), short for 'T'erminal 'C'ommand 'L'evel. This is the main command level, Pick's version of Direct Mode. If you're not there, and you're at a menu or some other place, try "Q", "X", "<ESC>", and other such options, to see which of them may work. Try sending a <BREAK> character, or <CTRL>-"C", this should take you to either the Pick/Basic Debugger or the System Debugger. If this is the case, you should be taken to a prompt similar to: I502 or 274.263 * ! at the prompt, enter END <cr> and hopefully you'll be at TCL. Worst case, you'll be back at the menu you just left. If this is the case, find the way to logoff, and find a new account to use. You've hit a dead end on this one. WHAT CAN I DO NOW? Command / Function & Output ----------------------------------------------------------------------------- LISTFILES / Lists the files available from the account you're in WHO / Tells you what account and port # you're logged onto LISTU / Lists the other users on the system and the accounts / they're logged onto TIME / Gives the system time DATE / Gives the system date LIST GAMES / On many systems, lists a file of games to play LOGON / Log another port onto a specified account LOGOFF / Log another port off LOGTO acct / Change accounts from the current one to 'acct' ----------------------------------------------------------------------------- More Interesting Commands: LIST ONLY SYSTEM <cr> Lists all valid accounts on the system LIST ONLY SYSTEM WITH *A7 = "" <cr> Lists all valid accounts on the system that have NO PASSWORD CHARGE-TO acctname <cr> Makes the system record think you are logged onto another account (acctname). Confusing to explain, but a good thing to do if you're hacking.. ----------------------------------------------------------------------------- ** The PICK Glossary has been dropped from this installment of A Pick Tutorial in the name of brevity. It will be printed in a later installment. ** ----------------------------------------------------------------------------- HOW DO I MAKE MY OWN ACCOUNT? By using the following process, you will create a system-level account that has the same privileges as SYSPROG, the master account on the system. >From the TCL prompt, type ED SYSTEM acctname <cr> where acctname is the name of the account that you want to create to use for access at a later date. The system will respond with something like: NEW ITEM TOP . and the cursor will be positioned to the right of the '.'. Now type I <cr> and the computer will respond with 001+ and will await entry of the lines of information. Type the following EXACTLY AS IT IS WRITTEN! Q <cr> SYSPROG <cr> . <cr> . <cr> . <cr> . <cr> . <cr> SYS2 <cr> L <cr> 10 <cr> <cr> F <cr> RU99/.// <cr> FI <cr> Now you will be back at the TCL prompt. Your account is now created. Type LOGTO acctname <cr> where acctname is the name of the account you just made, and you will be in your new account. If you want to put a password on your new account, type PASSWORD <cr> and you'll be prompted for the account name and password you wish to use. Enter this information, and when prompted for the next account name, hit <cr> and you'll return to the TCL prompt. Passwords can be any length, comprised of virtually any characters, including control codes, as stated in installment #1 of the Pick Tutorial. WHAT NOW? Play around in your new account, see what things do, take as much time as you like. The system does not record logon/logoff or on-line times for this account, because it was not created to track such things. Since this is the case, the only way that your account will be noticed is if someone looks at the SYSTEM file to see all the accounts on the system. WHAT'S NEXT? The next installment of The Pick Tutorial will contain information on a simple Pick Virus, and other methods of wreaking havoc on the system. (For the benevolent ones of you, this will still be useful information.) >< ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ State of Surveillance pt.3 This third installment covers video bugs. First off, we'll start with the video camera. Since walking around pointing shoulder-held video cameras at people tends to be somewhat obvious, companies have made cameras that are the size of matchboxes, being somewhere around an inch and a half square. This is, of course, without power supply or tape. A neat trick for observing people in rooms is to run a fiber optic cable through a lens or two to the camera, and to run the other end through a pinhole in the wall. In this way, the light from the room will enter the fiber optic cable and be recorded on the other end by a camera, conveniently out of sight on the other side of the wall. I've also been told about a fake car antenna that has a similar pinhole and fiber optic assembly leading down to a camera and transmitter under the antenna. The antenna rotates and sends a video image to a briefcase with a receiver and a TV screen. It's supposedly used for stakeouts. Through fiber optics, one can mount the actual camera almost anywhere. Another type of 'video bug,' in a way, is night-vision. There are t wo major commercial approaches to night vision: infrared and image amplification. Infrared vision can be accomplished in one of two ways: active or passive. Active infrared vision consists of an infrared flashlight and a camera or goggles that are sensitive to infrared light. The subjects never know they're being watched, unless they have an infrared-sensitive device. The best way to detect if you are being watched by an active infrared camera is to buy an infrared detector card used for testing remote controls, such as Radio Shack sells for $6.95. Assuming this will be done in the dark, the card should fluoresce when hit by strong infrared light. Passive infrared vision is a little bit more tricky. This type of vision doesn't depend on an infrared light source; therefore, it is a lot harder to detect. This system detects the differences in the amount of heat given off by objects and translates it into a video image. As a side benefit, these systems can be so sensitive that they can detect a handprint up to five minutes after the subject has left, simply because of the heat difference. Passive infrared can't be detected by the above-mentioned card. Image amplification is a technique used for amplifying the amount of visible light incident on the goggles and turning it into a video image. Along with passive infrared vision, image amplification is another technique the United States military uses. As a matter of fact, image amplification was used extensively in the so-called 'Desert Storm conflict,' by forward scouts who needed to see in the dark. Another meaning of 'video bug' can be applied to TEMPEST equipment, or what is sometimes called Van Eck phreaking. Video screens, computers, 'intelligent' keyboards (like those found on IBM/IBM compatibles) all send out immense amounts of what most people regard as RF interference. However, with the proper equipment, these signals can be picked up and read from as far as one kilometer away. The defense against this, of course, is to shield your computer from this type of emission. A few years ago, GRiD Inc. (now part of Tandy) sold some TEMPEST-shielded computer equipment to the Government, so you may wish to contact them. The next installment will cover miscellaneous other counter-surveillance and personal-protection type items, and will supposedly be the last. >< ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ Altair Wireless LANs The Altair wireless LAN system (or the Altair Wireless In-Building Network, or WIN for short, as Motorola likes to say) is probably the most technologically-advanced wireless LAN system on the market. The major difference between the Altair network and other competing wireless products is that the Altair uses the 18-GHz DTS band to transmit, allowing speeds as fast as 15 MBps. Since Ethernet's top speed is 10 MBps, the Altair WIN should easily be able to handle the amount of communication. Also, since the DTS band is quite uncrowded, the LAN doesn't have to deal with as much interference as wireless LANs that operate in the UHF band. Since that band is also allocated to cellular phones, television, FM radio, and 'high- performance' walkie-talkies, they also need to use spread-spectrum transmission. Simply put, this type of transmission will limit the bandwidth to 1.5 - 2 MBps, far too slow for true Ethernet. Infrared LANs only work when the computers in general share a 'common ceiling,' quite literally. Most infrared LANS consist of modules aimed at the ceiling. In this way, the light should bounce of the ceiling and down to another computer. This technology has serious problems when the surface in question is textured or non-flat in any way. A typical Altair LAN consists of one Control Module, or CM, and one or more User Modules, or UMs, per microcell. One CM can have up to 32 Ethernet devices in a microcell, and each UM can be hooked up to a maximum of six Ethernet devices (i.e. workstations, printers, etc.). Data security is exceptional, for three reasons. The first is the frequency at which the data is transmitted. The 18 GHz frequency area is extremely hard to pick up without large, high-priced, ultra-sensitive microwave detection equipment (incidentally, similar to that used to pick up monitor and computer emissions - see "State of Surveillance pt.3," elsewhere in the issue). Signals in this range of the spectrum act like light in that they partially reflect off surfaces, and like radio in that they penetrate non-structural walls (i.e. drywall, and walls that aren't thick concrete, etc.) Because the signal reflects, multipath distortion (similar to that experienced with 'ghosting' on a TV set) would effectively scramble the signals beyond recognition. Not to mention, since the maximum output power is 25 mW, this equipment would have to be positioned very close to the microcell itself. For this reason, one can have another Altair microcell operating independently as close as 200 feet away. A second reason is that the network automatically scrambles data sent between the CMs and UMs. Each UM has a specific scrambling code, similar to an address. This 16-bit code can have one of 65,535 possible values, and is in addition to the slot-assigned 10-bit 1024-combination code, which is changed every time data is sent between modules. The third reason is that the network supervisor can enter a list of 12- digit UM Ethernet addresses from all of the UMs that are supposed to be in the network. The CM will then ignore any UM whose registration number is not on the list. The UM can then neither transmit or receive data, since both operations must be verified by the CM by a slot assignment before they take place. The protocol used is a variant on the 'slotted Aloha' protocol: for every transaction, the UM requests a transmission slot from the CM. When the CM has verified that the UM should exist on the network, the CM executes the request, scrambling per both the 10-bit conversation code and the 16-bit UM ID code. The actual transmission protocol is built into a VLSI ASIC chip, which uses four-level frequency-shift keying (similar to that of 2400 and 9600 baud modems, which split the signal across four 600 or 2400 bps segments) and handles miscellaneous network functions. Since the network is packet-switched, it also handles CRC checksums and CSMA functions, providing a bit error rate of 10 to the negative eighth power (according to Motorola). The ICs that actually transmit and receive the information are five GaAs (gallium arsenide) chips, hooked up to a six-sector antenna. At the beginning of each transmission, the system sweeps through each combination of antennae for transmission and reception, 36 in all. Each antenna occupies a 60-degree arc, so when an obstacle is placed in the path of a transmission the system automatically reconfigures the antenna network for a better path. The system's operating frequencies are the 18.820-18.870 GHz band and the 19.160-19.210 GHz band, both licensed from the FCC under the DTS (Digital Termination Service) designation and well into the microwave range. The Altair WIN will most probably be the wireless LAN technology of the '90s. Using the Altair system, a business can have a microcell on each floor, with the CMs connected through an Ethernet backbone. The security of the LAN is so bulletproof that it would be a lot easier to try to hack into the LAN itself, and businesses will appreciate this. For more information, contact Motorola's Altair division. >< ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ Corrections Silicon Avalanche's handle IS Silicon Avalanche, not "Silicon Lightning" as misprinted in NFX #2. >< ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ Editorial Right before we went to press, it was just announced that the Baby Bell RBOCs have just been allowed to enter the information services business, under pressure from the Dept. of Justice and the FCC. Judge Greene (the judge presiding over the breakup of AT&T in 1982) made the ruling apparently against his will, but he did leave a block of time to allow appeals. Well here we are at the end of the third issue... By the way, sorry about putting the above piece of news in the editorial, but I couldn't find anywhere else to... There is now a way to subscribe to the New Fone Express, or to send articles, if you want - see the header. Also, to download the NFX, there is now an account on Secret Society (see the header on this one, too).. And by the way, no, I'm not the sysop -- the sysop is Grim, and he's been a great help in getting the NFX out. [Thanks!] This one is a little smaller than #2.. we didn't get in that many articles this time around, but that's probably because it's July... I barely even had time to do much either, but I think this one is still better than the first. <grin> I'm saving up a lot of the information for a big Trendwatch column for NFX #4.. I didn't have too much this time around, so I figured it would be better to put it all in a combined one. During a trip to Canada, it was somewhat amusing to visit the Bell Canada building in Toronto -- they were so proud of their Northern Telecom SL-1 switch, they had in on display behind plexiglas in the lobby!.. A little farther out, we ran into more party lines than we knew what to do with, and we promptly kicked ourselves for not bringing some sort of.. tone-generating device, that's it!... Oh well.. BTW, Dr. Logic -- I haven't forgotten you, I'll get back to you ASAP if I haven't already by the time you see this.. And I think that will just about wrap this issue up. Until next time. ><