The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/zines/phrack2/phrack43.020

Text File | 2003-06-11 | 20.9 KB | 394 lines

                              ==Phrack Magazine==

                 Volume Four, Issue Forty-Three, File 20 of 27

[** NOTE:  The following file is presented for informational purposes
           only.  Phrack Magazine takes no responsibility for anyone
           attempting the actions described within. **]

-----------------------------------------------------------------------------

                            The Step-by-Step Guide
                                     to
                              Stealing a Camaro

                                     by

                                  Spy  Ace

                         [e-mail]




PURPOSE:  To describe step-by-step, with specificity, exactly how
the average person might accomplish with skill and alacrity, the
theft of a motor vehicle, particularly 1982-1993 Chevrolet Camaros,
Pontiac Firebirds and similar beasts.

MOTIVE:  While I am a telecommunications enthusiast, I am also a
basically honest, law-abiding working man. In 1989 an individual
driving a borrowed automobile struck my only means of transportation,
a 1986 Chevrolet Camaro, totalling it. My vehicle was parked and
unoccupied at the time. In an amazing feat of legal maneuvering,
and after protracted judicial proceedings, all parties involved
managed to escape liability and I was left without a car or
reimbursement. The insurance companies are lying, cheating scum.
As a result, I took matters into my own hands and stole a
replacement car. I came to the conclusion that the justice system
in this country exists only to protect the strong from the weak,
the haves from the have-nots and the rich from the not rich. It
has nothing to do with rectifying wrongs. It is therefore incumbent
upon all aggrieved parties to seek personal satisfaction when the
American legal system fails to provide it. My motive is thus
twofold:

1.  To see the evil insurance companies screwed some more by
    sharing my knowledge of car-thieving techniques with those
    who might apply them.

2.  To assist the little man in obtaining justice when he/she may
    by confronted with a situation similar to mine.


BACKGROUND:  Before I stole my car, I conducted extensive research
             and talked to a number of individuals in the automotive
             repossession field, law-enforcement, and several auto
             mechanics. I assure the reader that everything
             contained in this file is true to the best of my
             knowledge and that I HAVE ACTUALLY DONE WHAT I AM
             WRITING ABOUT. I am not writing hypothetically; I
             speak from experience. I urge the reader, if he is
             serious about stealing a vehicle, to verify my
             research and find out much of this information for
             himself. Auto shops at local high schools/community
             colleges are excellent places to experiment and
             learn, and auto repossession specialists are invaluable
             sources of information.


------

  So, you've decided to steal a car. How nice. In this article I
will be covering in detail exactly how I stole a 1988 Chevrolet
Camaro to replace the 1986 of mine that was destroyed by an
irresponsible driver. The techniques described herein will work on
1982 thru 1993 Chevy Camaros/Z28s/IROCs/Berlinettas and probably
the same years Pontiac Firebirds and Trans Ams. With regard to
the Pontiacs I cannot say for certain because I only experimented
on Camaro variety cars since that is what I was after. The Pontiacs
are very similar, however, and I believe this information to be
applicable to them.

  There are basically only two stages to obtaining possession of a
vehicle. First, one must gain actual physical access to the inside
of the car and second, one must disable the steering-lock mechanism
and activate the ignition. Once these two things have been
accomplished, the vehicle is yours, subject to the infuriated
efforts of the owner to regain it. It should be noted, of course,
that there may be complications associated with either of these
steps, such as alarm systems or the factory anti-theft mechanisms.
I will deal with both of these in turn.

  First, gaining entrance to the vehicle. This will require one
tool: a 24-inch aluminum "shop" ruler. I tried several and settled
on the Pickett brand ACF-24, available in most art/blueprint supply
stores. It consists of a 1.25x24x1/16 inch piece of aluminum. For
maximum efficiency, it should have two slight bends to it. First,
at 14 inches, bend it subtly to about 15 degrees. Then, at 19
inches on the ruler, bend it back so that the two sections are
parallel. Like this:
                                                        N
                  _________________                   W + E
                                   \_______             S

  Of course, the angle in this diagram is far too steep. Both angles
should only be about 15 degrees. Hopefully, you get the idea. If
not, you probably shouldn't be thinking about stealing a car. In
any case, if you have succeeded in fashioning this, you are now
armed with the only tool necessary to gain keyless entry into your
soon-to-be new Camaro. The application of this tool is simple.
Walk up to a Chevrolet Camaro of a year described above, position
yourself at either door. FIRST: Check to see if the door is
unlocked. You'd be surprised. If it isn't, you will need to insert
the tool straight down, in between the rubber weather-stripping and
the glass, approximately 4-5 inches from the back of the door,
directly in line with the door-lock. Insert the tool such that the
small section (see above diagram) is thrust down into the door (did
I mention that stealing a car is very sexual? Never mind...). The
small section of the tool should be bent TOWARDS you as you stand
at the car. In the above diagram, north is towards the car, west is
straight up in the air, east is straight down towards the inside of
the door, and south is towards you as you stand at the car. Got the
picture? If not, get a friend to explain it to you.

  The tool should go in about 16 inches until it catches the lock
mechanism. If it goes in further than about 17 inches, withdraw and
try again. Drive straight down, don't force, try moving your
position an inch to the right or left. Eventually you will feel
the lock mechanism. It will be rigid but a little spongy (epitome
of GM engineering). Press down hard on the tool and let up. Try
the door handle. Does it open? It probably will. If not, drive a
little harder and keep trying the door. It will give eventually.

WHY THIS WORKS:  Well, this works for two reasons. First of all,
General Motors is run by a bunch of cheap bastards and their
cars are designed by engineers who couldn't find their asses with
both hands. Basically, it's a shitty lock mechanism. It was
designed shitty and the clods who sell us the piece-of-shit cars
couldn't care less if they get stolen so they've never bothered to
redesign the damn thing.

  In order to understand exactly why it works, the curious reader
would be well advised to go to his local library and look in a
Clymer or Chilton automotive repair manual for 1986 (or thereabouts)
Camaro.  In Chapter 12 of the Chilton, under "Body" (page
290 of mine) there is a magnificently concise exploded diagram of
"Outside door lock assembly" which contains all the relevant
information. The lock cylinder itself is connected to some linkage
which activates the locking/unlocking mechanism. After a few
months of normal use, this linkage develops some "slop" in it due
to slight wear of the locking cylinder attachment. By pressing
down on the linkage down inside the door, you are activating the
(un)locking mechanism directly and there is enough play in the
locking cylinder to allow it to give. Take a look at the diagram
and you'll understand completely.

  Once I understood the locking mechanism, the deficiencies
therein, and formulated an approach to overcoming it, I
practiced on a friend's Camaro about a hundred times. If done
properly and carefully, this will in no way harm any part of
the car or locking mechanism. Try it on the driver's side
first; this is usually the easiest because it has the most wear
in the linkage. Then graduate to the passenger side door. Then
try it out about a hundred times, then with your eyes closed,
then while drunk, then with one hand tied behind your back. In
a day or two you'll be able to get into a Camaro in less than
ten seconds.

  A note about alarms: some clever individuals, in an effort to
keep their prized vehicles from being stolen by the likes of you,
have equipped them with a motion sensor or other devious device
which tends to emit a shrill series of tones when aggravated. I
suggest that before trying to open someone else's car, you first
give it a good rocking back and forth in order to set off any
alarm which might be present. Since it is not illegal (though it
may be physically dangerous) to rock someone's car, it's always
best to try this before actually breaking in. If the alarm
screams, go on to some other victim. Personally, I have
encountered very few alarms; the "it won't happen to me" attitude
is still prevalent.

  Once you've gained physical entry into the vehicle, you are
now ready for Step Two, ignition lock bypass. Unfortunately, this
is a difficult step. I did a tremendous amount of research to
determine the best way to deal with this problem and have
developed an approach. It is by no means the only way to breach
the ignition locking mechanism, but in my opinion it is the
best. In developing this method I was most interested in several
goals. First of all, I wanted an elegant solution; that is,
something simple. Minimum tools and work required, and something
that worked ALL THE TIME, not 50%. Second, I wanted an approach
that could be accomplished quickly (for obvious reasons) and with
minimum damage to the vehicle. Ideally, I wanted an attack which
would not even be immediately obvious to someone (such as a cop)
glancing in my car at a stoplight. Spending 30 minutes tearing
apart the steering column might allow you to get the car started,
but it won't meet the above criteria: speed, elegance, reliability,
invisibility.

  The problem is that to do this requires a special tool and to
get this tool one must either send away for it or have access to
a machine shop to fabricate one. Neither of these is quick and
easy, but the preparation is well worth it. Here's the basic
idea. The General Motors vehicle uses an ignition locking
mechanism called a "sidebar." This is basically one nasty piece
of hardened fucking steel which blocks the lock cylinder from
rotating when a properly-fitting key is not in place. It makes
it impossible to simply "shear off the pins" by brute-force
turning with a screwdriver or similar device. The solution is to
use a tool capable of cracking the lock cylinder housing in which
the sidebar sits. The cylinder housing itself is cast aluminum,
which is considerably weaker than the sidebar itself, so when the
proper force is applied it will be the housing which gives, not
the sidebar. But no matter.

  First, get access to a Camaro, or for this exercise, just about
any GM automobile since 1978 (the year they got the bright idea
to put a locking screw in to keep people from just ripping the
whole ignition lockset right out -- but that's a whole different
story...). My favorite place to experiment on cars without being
observed (and in fact legally) is to go to a local self-serve
auto-wrecking "You Pull It" yard. They have these in many cities
around the fruited plains; you pay a buck or two to get in and then
go pluck parts from rotting American classics. If you don't drag
any parts out, you can basically tear apart all the cars you want
for a buck. If you don't have a You-Pluck-It nearby or are
philosophically opposed to vehicular cannibalism, then use the
method previously described to break into someone's Camaro for this.

  Once you have access to a GM (preferably a Camaro), get a
screwdriver out and pry the outer ring off of the ignition set.
The ring I'm talking about is the thing with the two tabs on it
for your fingers to turn when you rotate the ignition to start
the car. Just pry that sucker off of there -- it comes off very
easily as it is affixed by two small gripping tabs. I can usually
remove it by hand, but it's easiest to simply pry gently with a
screwdriver. After you have pried that off of the ignition set,
take a look. You'll see the ignition cylinder (with the keyway),
the outer housing, and the actual ignition activation mechanism,
which has two slots in it (where the outer ring fit into before
you pried it off). This ignition linkage, with the two tabs, is
what turns when a fitting key is inserted into the keyway and then
turned. Note that in a GM ignition set, a fitting key serves only
to withdraw the sidebar to allow the outer ignition mechanism to
turn.

  The problem is to overcome the sidebar which prevents the
ignition from turning. Fortunately, there is a tool for this very
purpose. It is manufactured by Briggs and Stratton (yes, the lawn
mower engine people) who happen to also make the locksets for GM.
They make the locks. They make the tool to break the locks. You
figure it out. Anyway, this neat little device is called a "GM
Force Tool". I got mine from LDM Enterprises in Van Nuys, California
(where else?) and it ran me about $90. Their fone number is
800-451-5950 and you should probably tell them that you're in the
automotive repossession business if you go to order one of these.
If they won't sell you one (because someone at GM read this
article and hopped up and down) then simply go down to a local
repo man and pay him an extra $25 to order one for you. Most of
those guys are pretty sleazy and will do just about anything for
a buck. If you have access to a machine shop and are reasonably
competent, go ahead and make one.

  I will attempt a description. Don't feel stupid if you don't
get this; it's difficult to describe it in text. Drop me E-mail
and I'll send you a .GIF of the fucking thing. Anyway, it looks
basically like a socket with very thin walls and two small tabs
which fit into where the thumb-ring-thing used to go. You tap it
onto the ignition set, into the two slots and the outside walls
of the tool fit very snugly around the outside of the locking
mechanism to keep it from splitting apart as you turn it. On the
other end of the tool is a 1/2 inch square hole for a ratchet.
Got the idea? Tap it onto the ignition, attach a healthy sized
ratchet and turn slowly but forcefully. After about 30 degrees of
turn the sidebar will crack the ignition lock housing and the
whole mechanism will freely turn. If you don't understand this,
take a look at a GM ignition (sans outer ring) and the facts will
become readily apparent. If you have access to a machine shop, it
is a simple matter to make one of these tools. Go to your local
GM dealer and buy a whole ignition set, snap the outer ring off of
there and take your measurements. Remember that the inner wall of
the force tool must fit snugly around the lockset in order to keep
it from splitting apart. That is why a device with simply two tabs
which fit into the ignition linkage will not work (I tried it --
the metal is too soft and tears apart).

  Seem like too much work? Well, of course it is a bit of work,
but preparation is the key! My father always stressed that the
most important part of doing a job is having the right tools. The
tools in this case are KNOWLEDGE of how all these goofy parts fit
together and operate, a properly constructed force tool, and the
patience to apply these two components to bring about the desired
result. With some practice I was able to circumvent a Camaro
ignition in just under 30 seconds. It does very little actual
damage to the vehicle ($11.00 for a new ignition set) and in fact
the thumb-ring-thing can be jammed back on and a key inserted and
it will appear that everything is proper (in case you're pulled
over by the local constable).


V.A.T.S.
--------

  Because of the horrendous problems with car theft, particularly of
Camaros, GM came up with a neat system boldly dubbed the "Vehicle
Anti Theft System". Needless to say, as with most security devices,
VATS accomplished little more than being a nuisance to vehicle owners
and a minor inconvenience to car thieves. Here's how to defeat it.

  First, basic theory of operation. The ignition of a VATS equipped
vehicle (most 1988 and newer GMs, particularly the Camaros/Firebirds)
is the same as the normal GM ignition except that it has an
electronic sensor built in which requires activation by a resistor
pack built in to the owner's key. There are fifteen possible resistor
types, so each different VATS key that you have gives you a 6.7%
chance of being capable of activating the ignition. The catch is that
if you feed it the wrong one it will kill the ignition for 4 minutes.
Thus, if you had a complete set of fifteen VATS keys, it would take
you a maximum of one hour to run through them all. This is GM's
idea of security: annoy the thief.

  If you plan to tackle a VATS-equipped car, get a full set of the
fifteen VATS keys. They're a few bucks each and you can get them
from a locksmith or LDM. Obtain access to your target car in an
area and in such circumstances as will allow you to work for an
hour relatively undisturbed. In practice, this is not very difficult
(more on that later). Once you have access to the vehicle and are
satisfied that you can work unobserved, break the ignition lock
using your force-tool as described above. Insert your first VATS
key blank and attempt to start the vehicle. If it will not activate
the ignition, remove the key, wait four minutes and try the next
one. Eventually you'll hit it. (Median hit time, of course: 30
minutes). Drive away.


Scouting a Victim
-----------------

  An essential element of stealing a car without getting caught
is picking out the right one. Again, preparation is the key. Once
you've mastered the necessary techniques, start looking around for
a good place to pick up a vehicle. The car thieves that I spoke
with told me that their preferred places are mall parking lots at
night: there is a lot of activity so you probably won't be noticed
lurking around waiting for a good prospect to show up. People
usually go into the mall for several hours to buy crap, so you have
time to work. Wait until no one is looking and pounce. Once you are
inside the vehicle (which, with practice, may be accomplished in
15 seconds) you are home free. No one is going to pay any attention
to you screwing around inside the vehicle and you'll be long gone
by the time the owner finishes charging a new Salad Shooter on his
American Express. Another good place is airport parking lots. While
they are often sporadically patrolled, it is in practice a simple
matter to drive around until you spy the right vehicle, then pack
all your necessary tools into a suitcase and walk from the terminal
to the lot like a returning airline passenger. That's how I did it.
The car was not reported stolen for over two weeks (it was in the
long-term lot), giving me plenty of breathing room.

  There are numerous other places. Start noting the places that
you leave your car: supermarket, movie theater, in front of your
house, at work, in a parking garage, etc. Start noticing patterns.
That 1988 IROC you see parked in the same place for five hours
every Tuesday. When you actually commit the deed, BE PREPARED. Do
a dry run. Be calm, work quickly but carefully. Act like you
belong where you are -- don't lurk around nervously. Walk right
up to the car and steal it. If confronted by someone, try to talk
your way out of it. Don't get violent: it's just a thing. A car
is not worth hurting someone over. Don't worry about getting
caught: most cities can't cope with the crime epidemic and do not
bother to do much about auto theft.


What Do I Do With It?
---------------------

  That's up to you. Take it for a joy ride. If you boosted it from
an airport lot you can probably safely cruise around in it for a
week or two. Go pick up bimbos and drive them to Las Vegas. Or
sell the thing to a chop shop (you're on your own finding them; I
have no experience with them). Tear it apart yourself and sell the
parts. Drive it into the lobby of an insurance company building.
Or go buy a Camaro of the same year and model that has been
totalled out and switch the VIN plates once you have clear title.
That's not a particularly difficult affair, although some skill is
required to remove the VIN tags and install them in your new car.
Have fun! Stay out of trouble. If you have any questions, E-mail
me. Above all, keep in mind that two things are essential to steal
a car without getting caught: PRACTICE and PREPARATION. Good luck!

                          -->Spy Ace<--
                   [e-mail]