Hacker Chronicles 1

home *** CD-ROM | disk | FTP | other *** search

/ Hacker Chronicles 1 / HACKER1.ISO / phrk2 / phrack21.3 < prev next >

Wrap

Text File | 1992-09-26 | 26KB | 554 lines

==Phrack Inc.== Volume Two, Issue 21, File 3 of 11 <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> <> <> <> Shadows Of A Future Past <> <> ~~~~~~~~~~~~~~~~~~~~~~~~ <> <> Part One Of The Vicious Circle Trilogy <> <> <> <> A New Indepth Look At A Re-Occurring Problem <> <> by Knight Lightning <> <> <> <> August 6, 1988 <> <> <> <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> The Problem? ~~~~~~~~~~~~ The fate of the entire modem community for the most part is based on the foundation of computer bulletin boards. These realms of information exchange have become centers of learning and trading various information for thousands of hackers across the United States and even the world. However, today's security consultants and law enforcement agencies are smarter than ever too and they know where to strike in order to do the most damage. The concept of creating a bulletin board for the purpose of catching hackers was unheard of until The Phoenix Phortress Incident of 1986. The creation of this bulletin board system enabled Sergeant Dan Pasquale of the Fremont Police Department the ability to penetrate the sacred barrier between the phreak/hack community and the rest of the world. This file will attempt to show the extent of this problem within the community and hopefully will lead readers to discover ways of protecting themselves from the many "venus fly traps" they are likely to encounter. Articles presented in this file are specially edited reprints from past issues of Phrack World News. The Evidence - The unseen truths reside in the shadows of our past and future. ~~~~~~~~~~~~ The following is an excerpt from Phrack World News Issue III; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Phoenix Phortress Stings 7 ~~~~~~~~~~~~~~~~~~~~~~~~~~ On March 5, 1986, the following seven phreaks were arrested in what has come to be known as the first computer crime "sting" operation. Captain Hacker \ Doctor Bob \ Lasertech \ The Adventurer The Highwayman \ The Punisher \ The Warden Many of them or other members of Phoenix Phortress belonged to these groups: High Mountain Hackers \ Kaos Inc. \ Shadow Brotherhood \ The Nihilist Order Of the seven, three were 15 years old; two were 16; one was 17; and one, 19. Their charges include: Several misdemeanors Trafficking in stolen long distance service codes Trafficking in stolen credit card numbers Possession of stolen property Possession of dangerous weapons (a martial arts weapon) Charging mail-order merchandise to stolen credit card numbers Selling stolen property Charging calls internationally to telephone service numbers Other phreak boards mentioned include: Bank Vault (Mainly for credit card numbers and tips on credit card scams) Phreakers Phortress (Mainly of course for phreak codes and other information) After serving search warrants early Wednesday morning on the seven Fremont residences where the young men lived with their parents, police confiscated at least $12,000 worth of equipment such as computers, modems, monitors, floppy disks, and manuals, which contained information ranging from how to make a bomb, to the access codes for the Merrill Lynch and Dean Witter Financial Services Firm's corporate computers. The sysop of Phoenix Phortress was The Revenger, who was supposedly Wally Richards, a 25 year-old Hayward man who "phreaked back east a little" in New Jersey. He took the phone number under the name of Al Davis. However he was really Sgt. Daniel Pasquale of the Fremont Police Department. When he introduced his board to other computer users, he called it the "newest, coolest, phreak board in town." Pasquale said he got the idea for the sting operation after a 16-year old arrested last summer for possession of stolen property "rolled them over (narced) He told us all about their operation." Pasquale used a police department Apple //e computer and equipment, with access codes and information provided by eight corporations, including Wells Fargo Bank, Sprint, and MCI. Pasquale said he received more than 2,500 calls from about 130 regular users around the country. The police started to make their first case three days after the board went up. "We had taken the unlisted phone number under the name Al Davis," Pasquale said. "In six days, these kids had the name on the bulletin board. I would have needed a search warrant to get that information." The arrests were made after five months of investigation by Dan Pasquale. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - The Phoenix Phortress incident only led to the arrest of seven hackers. However, at the same time it enabled the law enforcement agencies to gather information about over one hundred other hackers, systems being discussed, anything transmitted in electronic mail on the bulletin board, and most likely gave them information about hundreds of other hackers, bulletin boards, and so forth. The following is an excerpt from Phrack World News Issue VII; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Maxfield Strikes Again August 20, 1986 ~~~~~~~~~~~~~~~~~~~~~~ Many of you probably remember a system known as "THE BOARD" in the Detroit 313 NPA. The number was 313-592-4143 and the newuser password was "HEL-N555,ELITE,3" (then return). It was kind of unique because it was run off of an HP2000 computer. On August 20, 1986 the following messages began to appear on THE BOARD; - - - - - - - - - - - - - - - - - - - - Welcome to MIKE WENDLAND'S I-TEAM sting board! (Computer Services Provided By BOARDSCAN) 66 Megabytes Strong 300/1200 baud - 24 hours. Three (3) lines = no busy signals! Rotary hunting on 313-534-0400. Board: General Information & BBS's Message: 41 Title: YOU'VE BEEN HAD!!! To: ALL From: HIGH TECH Posted: 8/20/86 @ 12.08 hours Greetings: You are now on THE BOARD, a "sting" BBS operated by MIKE WENDLAND of the WDIV-TV I-Team. The purpose? To demonstrate and document the extent of criminal and potentially illegal hacking and telephone fraud activity by the so-called "hacking community." Thanks for your cooperation. In the past month and a half, we've received all sorts of information from you implicating many of you to credit card fraud, telephone billing fraud, vandalism, and possible break-ins to government or public safety computers. And the beauty of this is we have your posts, your E-Mail and--- most importantly ---your REAL names and addresses. What are we going to do with it? Stay tuned to News 4. I plan a special series of reports about our experiences with THE BOARD, which saw users check in from coast-to-coast and Canada, users ranging in age from 12 to 48. For our regular users, I have been known as High Tech, among other ID's. John Maxfield of Boardscan served as our consultant and provided the HP2000 that this "sting" ran on. Through call forwarding and other conveniences made possible by telephone technology, the BBS operated remotely here in the Detroit area. When will our reports be ready? In a few weeks. We now will be contacting many of you directly, talking with law enforcement and security agents from credit card companies and the telephone services. It should be a hell of a series. Thanks for your help. And don't bother trying any harassment. Remember, we've got YOUR real names. Mike Wendland The I-team WDIV, Detroit, MI. Board: General Information & BBS's Message: 42 Title: BOARDSCAN To: ALL From: THE REAPER This is John Maxfield of Boardscan. Welcome! Please address all letter bombs to Mike Wendland at WDIV-TV Detroit. This board was his idea. The Reaper (a.k.a. Cable Pair) ------------------------------------------------------------------------------- John Maxfield was in general extremely proud of his efforts with THE BOARD and he said that a lot of the people he voice verified should have known it was him. According to John Maxfield, the only reason this sting board was put up was to show "What is currently happening in the phreak/hack community." He said no legal action will be taken at all, and besides, its fattened his "dossiers" on a lot of people! [The news stories for WDIV-TV 4 appeared in Phrack World News Issue IX.] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Now, this is a classic example of people not learning from other people's mistakes. At some point in time prior to this incident, the number for THE BOARD was posted, it was given a lot of hype and eventually it drew in hackers to THE BOARD like flies to a spider web from which the unsuspecting users never broke free. That is the point I am trying to make -- today's phreak/hacker must learn to be more security conscious. What makes anyone think that they can trust someone just because they are running a bulletin board? This blind faith is what will be the downfall of many a hacker until they wise up and start paying attention to what they are doing. Safety first; the stakes in this game are a lot higher than no television after school for a week because once a hacker's phone number falls into the wrong hands, the law enforcement community or organizations like the Communications Fraud Control Association (CFCA) can find out everything about you. I know because I have seen their files and their hacker data base is so incredibly large and accurate...its unbelievable. The following is an excerpt from Phrack World News Issue XIV; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Metalland South: Phreak BBS or MetaliFEDS Inc.? June 2, 1987 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Metalland South BBS, at 404-327-2327, was once a fairly well known bulletin board, where many respected members of the hack/phreak community resided. It was originally operated by two guys from Metal Communications, Inc., but it wasn't an MCI club board. The sysop was Iron Man and the co-sysop was Black Lord. Recently, it has come to the writer's attention, that MLS has come under new management, new policies, and possibly a new idea; Sting. Somewhere around September-October 1986, Iron Man removed all of the hack/ phreak related subboards as well as all G-philes from the system. He was apparently worried about getting busted. The last time this reporter spoke with him, Iron Man said he intended to put the hack/phreak subs back up. Then, not long after this conversation, the number was changed (The original number was 404-576-5166). A person using the alias of The Caretaker was made co-sysop and Iron Man would not reply to feedback. Everything was handled by The Caretaker [TC from now on]. TC did not allow any hack/phreak subs, but said he would put them up if the users would follow STRICT validation procedures. Strict validation on MLS includes: ^*^ Your Real Name ^*^ Your Address ^*^ Your Voice Phone Number ^*^ A Self-Addressed Envelope (in which he will send back with your account number and password.) It is obvious to see the ramifications here. A board or sysop gets busted and then makes a deal to turn over the board to some company or agency. To make sure that they get who they want, you have to give them all this info, and the only you can get a password is to let them mail it to you, thus guaranteeing that if something illegal is posted under that account, you are responsible, no ifs, ands, or buts. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - There was more information that went on to prove that Metalland South was indeed some kind of a trap or sting board and the whole aura of mystery surrounding this system made it not worth calling. Do not EVER give a sysop your address so he can send you your password. There is no need for such information as it can only hurt you severely and would not benefit the sysop in any way that would leave you unharmed. One other item concerning bulletin boards comes from PWN Issue V where mention of yet another hacker sting board named The Tunnel was discovered in Texas. And lets not forget about TMC's P-80, sysoped by Scan Man, that was responsible for the apprehension of Shawn of Phreakers Quest (also known as Capt. Caveman). However, do not fool yourself into believing that bulletin boards are the only places you are likely to run into trouble. Regular systems that you like to work with may be just as dangerous if you are not careful. Druidic Death and Celtic Phrost found this out the hard way on the Unix system at MIT as they nearly succumbed to the power of progressive entrapment which would have doomed them both. The following is an excerpt from Phrack World News Issue XI; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - MIT Unix: Victim or Aggressor? January 23 - February 2, 1987 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Was the MIT system an innocent victim of hacker oppression or simply another trap to capture unsuspecting hackers in the act? It all started like this... [Some posts have been slightly edited to be relevant to the topic] ------------------------------------------------------------------------------ MIT Name: Druidic Death Date: 12:49 am Mon Jan 20, 1986 Lately I've been messing around on MIT's VAX in there Physics Department. Recently some one else got on there and did some damage to files. However MIT told me that they'll still trust us to call them. The number is: 617-253-XXXX We have to agree to the following or we will be kicked off, they will create a "hacker" account for us. <1> Use only GUEST, RODNEY, and GAMES. No other accounts until the hacker one is made. There are no passwords on these accounts. <2> Make sure we log off properly. Control-D. This is a UNIX system. <3> Not to call between 9 AM and 5 PM Eastern Standard Time. This is to avoid tying up the system. <4> Leave mail to GEORGE only with UNIX questions (or C). And leave our handles so he'll know who we are. ------------------------------------------------------------------------------ Unix Name: Celtic Phrost Date: 4:16 pm Mon Jan 20, 1986 Thanks Death for the MIT computer, I've been working on getting into them for weeks. Here's another you can play around with: 617/258-XXXX login:GUEST Or use a WHO command at the logon to see other accounts, it has been a long time since I played with that system, so I am unsure if the GUEST account still works, but if you use the WHO command you should see the GUEST account needed for applying for your own account. -Phrost ------------------------------------------------------------------------------ Unix Name: Celtic Phrost Date: 5:35 pm Mon Jan 20, 1986 Ok, sorry, but I just remembered the application account, its: OPEN Gawd, I am glad I got that off my chest! -(A relieved)Celtic Phrost. Also on that MIT computer Death listed, some other default accounts are: LONG MIKE GREG NEIL DAN Get the rest yourself, and please people, LEAVE THEM UNPASSWORDED! ------------------------------------------------------------------------------ MIT Name: Druidic Death 12 Date: 1:16 am Fri Jan 23, 1987 MIT is pretty cool. If you haven't called yet, try it out. Just PLEASE make sure you follow the little rules they asked us about! If someone doesn't do something right the sysop leaves the gripe mail to me. Check out my directory under the guest account just type "cd Dru". Read the first file. ------------------------------------------------------------------------------ MIT Name: Ctrl C Date: 12:56 pm Sat Jan 24, 1987 MIT Un-Passworded Unix Accounts: 617-253-XXXX ALEX BILL GAMES DAVE GUEST DAN GREG MIKE LONG NEIL TOM TED BRIAN RODNEY VRET GENTILE ROCKY SPIKE KEVIN KRIS TIM And PLEASE don't change the Passwords.... -=>Ctrl C<=- ------------------------------------------------------------------------------ MIT Again Name: Druidic Death Date: 1:00 pm Wed Jan 28, 1987 Ok people, MIT is pissed, someone hasn't been keeping the bargain and they aren't too thrilled about it. There were only three things they asked us to do, and they were reasonable too. All they wanted was for us to not compromise the security much more than we had already, logoff properly, not leave any processes going, and call only during non-business hours, and we would be able to use the GUEST accounts as much as we like. Someone got real nice and added themselves to the "daemon" group which is superusers only, the name was "celtic". Gee, I wonder who that could have been? I'm not pissed at anyone, but I'd like to keep on using MIT's computers, and they'd love for us to be on, but they're getting paranoid. Whoever is calling besides me, be cool ok? They even gave me a voice phone to chat with their sysops with. How often do you see this happen? A little perturbed but not pissed... DRU' ------------------------------------------------------------------------------ Tsk, Celtic. Name: Evil Jay Date: 9:39 am Thu Jan 29, 1987 Well, personally I don't know why anyone would want to be a superuser on the system in question. Once you've been on once, there is really nothing that interesting to look at...but anyway. -EJ ------------------------------------------------------------------------------ In trouble again... Name: Celtic Phrost Date: 2:35 pm Fri Jan 30, 1987 ...I was framed!! I did not add myself to any "daemon" group on any MIT UNIX. I did call once, and I must admit I did hang up without logging off, but this was due to a faulty program that would NOT allow me to break out of it, no matter what I tried. I am sure that I didn't cause any damage by that. -Phrost ------------------------------------------------------------------------------ Major Problems Name: Druidic Death Date: 12:20 pm Sat Jan 31, 1987 OK, major stuff going down. Some unidentified individual logged into the Physics Dept's PDP11/34 at 617-253-XXXX and was drastically violating the "agreement" we had reached. I was the one that made the "deal" with them. And they even gave me a voice line to talk to them with. Well, one day I called the other Physics computer, the office AT and discovered that someone created an account in the superuser DAEMON group called "celtic". Well, I was contacted by Brian through a chat and he told me to call him. Then he proceeded to nicely inform me that "due to unauthorized abuse of the system, the deal is off". He was cool about it and said he wished he didn't have to do that. Then I called George, the guy that made the deal and he said that someone who said he was "Celtic Phrost" went on to the system and deleted nearly a year's worth of artificial intelligence data from the nuclear fission research base. Needless to say I was shocked. I said that he can't believe that it was one of us, that as far as I knew everyone was keeping the deal. Then he (quite pissed off) said that he wanted all of our names so he can report us to the FBI. He called us fags, and all sorts of stuff, he was VERY!! [underline twice] PISSED! I don't blame him. Actually I'm not blaming Celtic Phrost, it very easily could have been a frame up. But another thing is George thinks that Celtic Phrost and Druidic Death are one and the same, in other words, he thinks that *I* stabbed him in the back. Basically he just doesn't understand the way the hacker community operates. Well, the deal is off, they plan to prosecute whoever they can catch. Since George is my best friend's brother I have not only lost a friend, but I'm likely to see some legal problems soon. Also, I can forget about doing my graduate work at MIT. Whoever did this damage to them, I hope you're happy. You really messed things up real nice for a lot of people. Celtic, I don't have any reason to believe you messed with them. I also have no reason to think you didn't. I'm not making an accusation against you, but WHOEVER did this, deserves to be shot as far as I'm concerned. Until this data was lost, they were on the verge of harnessing a laser-lithium produced form of nuclear fission that would have been more efficient than using the standard hydrogen. Well, back to the drawing board now. I realize that it's hard to believe that they would have data like this on this system. But they were quite stupid in many other areas too. Leaving the superuser account with no password?? Think about it. It's also possible that they were exaggerating. But regardless, damage seems to have been done. ------------------------------------------------------------------------------ MIT Name: Phreakenstein Date: 1:31 am Sun Feb 01, 1987 Heck! I dunno, but whoever it was, I think, should let himself (the s00per K-rad elyte d00d he is) be known. I wasn't on MIT, but it was pretty dumb of MIT to even let Hackers on. I wouldn't really worry though, they did let you on, and all you have to prove is that you had no reason to do it. ----Phreak ------------------------------------------------------------------------------ I wonder... Name: Ax Murderer 15 Date: 6:43 pm Sun Feb 01, 1987 I highly doubt that is was someone on this system. Since this is an elite board, I think all the users are pretty decent and know right and wrong things to do. Could be that one of the users on this system called another system and gave it out!?? Ax Murderer ------------------------------------------------------------------------------ It was stupid Name: Druidic Death 12 Date: 9:21 pm Sun Feb 01, 1987 It seems to me, or, what I gathered, they felt that there were going to be hackers on the system to begin with and that this way they could keep themselves basically safe. I doubt that it was Celtic Phrost, I don't think he'd be an asshole like that. But I can't say. When I posted, I was pretty pissed about the whole deal. I've calmed down now. Psychic Warlord said something to me voice the other day that made me stop and think. What if this was a set up right from the start? I mean, MIT won't give me specifics on just what supposedly happened, Celtic Phrost denies everything, and the biggest part of it is what George said to me. "We can forgive you for what you did to us if you'll promise to go straight and never do this again and just tell us who all of your friends are that are on the system". I didn't pay much attention to that remark at first, now I'm beginning to wonder... I, of course, didn't narc on anyone. (Who do I know??? hehe) DRU' ------------------------------------------------------------------------------ Comments... Name: Delta-Master Date: 7:15 am Mon Feb 02, 1987 It wouldn't surprise me if it was some kind of setup, it's been done before. Delta-Master [All posts in this article were taken from ShadowSpawn.] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - The Solution ~~~~~~~~~~~~ What more is there to say? It definitely looks like there was a setup involved and it probably was not the first time and probably will not be the last time either. So how can you protect yourself? As far as the bulletin boards go. There is an unwritten rule somewhere that basically says that to be a good sysop, you first have to be a good user. If the sysop of some mystery board is not someone you have seen around for a long time, then I would not call. However, even if it is someone who has been around, references from someone you feel you can trust is a necessity. It all boils down to the reliability of the information and the persons involved. When dealing with systems like the MIT Unix, remember, if its too good to be true then most likely there will be something that you are not being told. Who in their right mind is going to give free accounts to an important system with delicate information to a group of hackers? Its crazy. This file will hopefully serve as an informative fresh look at an old game. To me, even if the time I spent putting this article together helps out or saves only one phreak/hacker, I feel my job has been done successfully. :Knight Lightning "The Future Is Forever" The Phoenix Project =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Downloaded From P-80 International Information Systems 304-744-2253 12yrs+