307 lines
16 KiB
Plaintext
307 lines
16 KiB
Plaintext
|
||
=================================
|
||
[> HACKERS DIRECTORY VOLUME 3 <]
|
||
[> COMPILED FOR YOU BY, <]
|
||
[> HACKER SUPREME, THE CARTEL <]
|
||
[> And THE 'NIN TEMPLE'. <]
|
||
[> Master - NINJA SQUIRREL /+\ <]
|
||
=================================
|
||
|
||
=======================================
|
||
[ Hack Copyright: Hacker Supreme 1986 ]
|
||
=======================================
|
||
|
||
****************************
|
||
*** HACKING TECHNIQUES ***
|
||
*** By: LOGAN-5 ***
|
||
*** (Hacker Supreme) ***
|
||
*** From the ***
|
||
*** Inner Circle book ***
|
||
****************************
|
||
|
||
1) CALLBACK UNITS:
|
||
|
||
Callback units are a good security device, But with most phone systems,
|
||
it is quite possible for the hacker to use the following steps to get
|
||
around a callback unit that uses the same phone line for both incomming
|
||
and out going calls:First, he calls he callback unit and enters any
|
||
authorized ID code (this is not hard to get,as you'll see in a moment).
|
||
After he enters this ID, the hacker holds the phone line open - he does
|
||
not hang up. When the callback unit picks up the phone to call the user back,
|
||
the hacker is there, waiting to meet it.
|
||
|
||
The ID code as I said, is simple for a hacker to obtain, because these
|
||
codes are not meant to be security precautions.The callback unit itself
|
||
provides security by keeping incomming calls from reaching the computer.
|
||
The ID codes are no more private than most telephone numbers. Some callback
|
||
units refer to the codes as "location identification numbers," and some
|
||
locations are used by several different people,so their IDs are fairly
|
||
well known.I've been told that, in some cases,callback ubits also have
|
||
certain simple codes that are always defined by default. Once the hacker
|
||
has entered an ID code and the callback unit has picked up the phone to
|
||
re-call him,the hacker may or may not decide to provide a dial tone to
|
||
allow the unit to "think" it is calling the correct number. In any event,
|
||
the hacker will then turn on his computer, connect with the system - and
|
||
away he goes.If the however, the hacker has trouble holding the line with
|
||
method,he has an option: the intercept.
|
||
|
||
The Intercept:
|
||
Holding the line will only work with callback units that use the same
|
||
phone lines to call in and to call out.Some callback units use different
|
||
incoming and outgoing lines, numbers 555-3820 through 555-3830 are dedicated
|
||
to users' incoming calls, and lines 555-2020 through 555-2030 are dedicated
|
||
to the computers outgoing calls.The only thing a hacker needs in order to
|
||
get through to these systems is a computer and a little time - he doesn't
|
||
even need an ID code. First,the hacker calls any one of the outgoing phone
|
||
lines, which, of course, will not answer.Sooner or later, though, while the
|
||
hacker has his computer waiting there, listening to the ring, an authorized
|
||
user will call one of the incomming lines and request to be called back.
|
||
It will usually be less than an hours wait, but the hacker's computer
|
||
is perfectly capable of waiting for days, if need be.
|
||
|
||
The callback unit will take the code of the authorized user, hang up,
|
||
verify the code, and pick up the phone line to call back.If the unit
|
||
tries to call out on the line the hacker has dialed, the hacker has his
|
||
computer play a tone that sounds just like a dial tone.The computer will
|
||
then dial the number given that matches up with the user's authorized ID.
|
||
After that,the hacker can just connect his computer as he would in any
|
||
other case.If he is really serious,he will even decode the touch tones
|
||
that the mainframe dialed,figure out the phone number of the user the
|
||
system was calling, call the person, and make a few strange noises that
|
||
sound as though the computer called back but didnt work for some reason.
|
||
|
||
2) TRAPDOORS AS A POSSIBLILITY
|
||
|
||
I haven't heard of this happening, but i think it is possible that a
|
||
callback modem could have a trapdoor built into it.Callback modems are
|
||
run by software, which is written by programmers.An unscrupulous programmer
|
||
could find it very easy to slip in an unpublicized routine, such as,
|
||
"if code =*43*, then show all valid codes and phone numbers." And such a
|
||
routine, of course, would leave security wide open to anyone who found the
|
||
trapdoor.The obvious protection here, assuming the situation ever arises,
|
||
is simply an ethical manufactorer that checks its software thoroughly before
|
||
releasing it.
|
||
|
||
A trapdoor is a set of special instructions embedded in the large
|
||
program that is the operating system of a computer.A permanent,
|
||
hopefully secret "doorway", these special instructions enabe anyone who
|
||
knows about them to bypass normal security procedures and to gain access to
|
||
the computer's files.Although they may sound sinister, trapdoors were not
|
||
invented by hackers, although existing ones are certainly used by hackers
|
||
who find out about them.
|
||
|
||
3) THE DECOY
|
||
|
||
One of the more sophisticated hacking tools is known as the decoy, and it
|
||
comes in three versions.The first version requires that the hacker have an
|
||
account on the system in question. As in my case,the hacker has a
|
||
low-security account,and he tries this method to get higher-security
|
||
account.He will first use his low-security account to write a program that
|
||
will emulate the log-on procedures of the systems in questions.
|
||
This program will do the following:
|
||
|
||
*- Clear the terminal screen and place text on it that makes everything
|
||
look as if the system is in charge.
|
||
|
||
*- Prompt for, and allow the user to enter, both an account name and a password.
|
||
*- Save that information in a place the hacker can access.
|
||
|
||
*- Tell the use the account/password entries are not acceptable.
|
||
|
||
*- turn control of the terminal back over to the system.
|
||
|
||
The user will now assume that the account name or password was mistyped
|
||
and will try again...this time (scince the real operating system is in
|
||
control) with more success.You can see a diagram of the way these steps are
|
||
accomplished
|
||
|
||
___________________
|
||
| Clear Terminal |
|
||
| screen |
|
||
|____________________|
|
||
||
|
||
_________||_________
|
||
| Print Compuserve |
|
||
| Computer |
|
||
|_____ Network ______|
|
||
||
|
||
_________||_________
|
||
| Print "ENTER |
|
||
| PASSWORD" |______
|
||
|____________________| |
|
||
|| |
|
||
_________||_________ |
|
||
| PASSWORD ENTERED? |__NO__|
|
||
|____________________|
|
||
||_YES
|
||
_________||_________
|
||
| SAVE PASSWORD |
|
||
| INFORMATION |
|
||
|____________________|
|
||
||
|
||
_________||_________
|
||
| PRINT "LOGIN |
|
||
| INCORRECT |
|
||
|____________________|
|
||
||
|
||
_________||_________
|
||
| LOG OFF/RETURN |
|
||
| CONTROL TO |
|
||
| OPERATING SYSTEM |
|
||
|____________________|
|
||
|
||
4) CALL FORWARDING
|
||
|
||
Many people use call forwarding by special arrangement with the phone
|
||
company.When a customer requests call forwarding, the phone company uses
|
||
its computer to forward all the customers incomeing calls to another
|
||
number. Lets say, for example, that you want calls that come to your office
|
||
phone to be forwarded to your home phone: A call from you to the phone
|
||
company,some special settings in the phone companys computer, and all
|
||
calls to your office will ring at your home instead.This little bit of help
|
||
from the phone company is another tool used by hackers. Lets say you thought
|
||
that the computer you were hacking into was being watched-because the
|
||
sysop might have seen you and called the fed's and your sort of bugged by
|
||
this nagging feeling that they will trace the next hacker that calls,
|
||
just call the phone company and ask for call forwarding, pick a number,
|
||
(ANY NUMBER) out of the phone book and have your calls forwarded to that
|
||
number,Hea,Hea, the number you picked is the one that will be traced to,
|
||
not yours, so you could be hacking away,they think that they have traced you,
|
||
but actually the number you had your calls forwarded too. they enter chat mode
|
||
and say (YOUR BUSTED!!!!, WE'VE TRACED YOUR PHONE NUMER THE FEDS ARE ON THE
|
||
WAY!!), You could reply (Hea, SURE YA DID! I'D LIKE TO SEE YA TRY AND GET ME!
|
||
GO AHEAD!) ,that wont seem very important to them at the time, but it will
|
||
sure piss them off when they bust the wrong guy!
|
||
|
||
5) RAPID FIRE
|
||
|
||
Memory-location manipulation can be helpful, but there is another, more
|
||
powerful,possibility, in some cases: the Rapid-fire method.To understand how
|
||
this methos works, you have to know something about the way operationg
|
||
systems work.When a user enters a command, the operating system first places
|
||
the command in a holding area, a buffer, where it will sit for a few
|
||
millionths of a second.The system looks at the command and say's "Does this
|
||
person really have authorization to do this, or not?" Then, the command
|
||
sits there a few thousandths of a second while the system runs off to
|
||
check the user's authorization.When the system comes back to the command,
|
||
it will have one of two possible answers: "OK, GO AHEAD," or "SORRY,
|
||
GET PERMISSION FIRST."
|
||
|
||
Once you are on a system that handles things this way, you can use the
|
||
rapid-fire method to change the command while its sitting in the buffer,
|
||
waiting to be executed. If you can do this,you can do anything.You can enter
|
||
a command that you know will be approved, such as "tell me the time." As soon
|
||
as the system runs off to verify your right to know the time,you change
|
||
the command in the buffer to something you know would not be approved-perhaps
|
||
"give me a list of all the passwords." When the system comes back with an
|
||
"OK, go ahead," it responds to your second command, not the first. Of course,
|
||
this exchange has to be done very rapidly,but most systems existing today
|
||
can be fooled by this trick. The question is,how easy is it to do, and how
|
||
much authority do you need? I know of one system that let this one slip.
|
||
|
||
These are certainly not all the hacker's little secret tricks and tool's,
|
||
You will probably figure out some better, more efficiant,hacking techniques.
|
||
|
||
GOOD LUCK!!!!!!
|
||
L O G A N - 5
|
||
------------------------------------------------->
|
||
|
||
How to fight Sprint Security
|
||
|
||
Well friends, Sprint has declared war on the phone phreaks
|
||
and is starting to set traps, trace lines, and question the
|
||
SYSOPs of BBS systems. I thank that this has gone on long
|
||
enough! It time we start to fight back. What I would suggest is
|
||
that everybody find five or ten access codes and put these on a
|
||
flyer with a local access number and instructions on how to use
|
||
the system and how to find more codes. Next, make a LARGE number
|
||
of copies of this flyer and distribute them as widely as
|
||
possible. Put them on cars in the school parking lot, in the
|
||
local phone booths, on bulletin boards around colleges, etc.
|
||
If Sprint starts experiencing a VERY large number of ripoffs
|
||
then a number of things could happen. The bright boy in security
|
||
who decided to start the crack-down may get fired, paying custo-
|
||
mers may get fed up with the huge bills, SPC may make the codes
|
||
longer and thus lose customers because of the inconvenience of
|
||
the longer codes. In any case, SPC will have so many people
|
||
using the system for free that the chances of them getting anyone
|
||
of us is so small as to be insignificant.
|
||
|
||
So, you've decided that you'd like to try to down an RSTS system? Well,
|
||
here's a beginner's guide: The RSTS system has two parts, the Priviledged
|
||
accounts, and the User accounts. The Priviledged accounts start with
|
||
a 1 (In the format [1,1], [1,10], etc. To show the Priv.
|
||
accounts we'll just use the wildcard [1,*].)
|
||
The priviledged accounts are what every RSTS user would
|
||
love to have, because if you have a priviledged account
|
||
you have COMPLETE control of the whole system. How can
|
||
I get a [1,*] account? you may ask....Well, it takes A LOT
|
||
of hard work. Guessing is the general rule. for instance,
|
||
when you first log in there will be a # sign:
|
||
# (You type a [1,*] account, like) 1,2 It will then say Password: (You
|
||
then type anything up to 6 letters/numbers Upper Case only) ABCDEF
|
||
If it says ?Invalid Password, try again ' then you've not done it YET
|
||
Keep trying.
|
||
|
||
Ok, we'll assume you've succeeded. You are now in the priviledged account of
|
||
an RSTS system. The first thing you should do is kick everyone else off
|
||
the system (Well, maybe just the other Priviledged users)....You do this with
|
||
the Utility Program.
|
||
UT KILL (here you type the Job # of the user you'd like to get out of
|
||
your way). If the system won't let you, you'll have to look for the UTILTY
|
||
program. Search for it by typing DIR [1,*]UTILTY.*Now, you've found it and
|
||
kicked off all the important people (If you want you can leave the other people
|
||
on, but it's important to remove all other [1,*] users, even the Detached ones)
|
||
To find out who's who on the system type SYS/P- (That will print out
|
||
all the privileged users). Or type SYS to see Everyone. Next on your agenda is
|
||
to get all the passwords (Of course). Do this by run $MONEY (If it isn't there,
|
||
search for it with DIR[1,*]MONEY.* and run it using the account where you
|
||
found it instead of the $) There will be a few questions, like Reset? and
|
||
Disk? Here's the Important answers.Disk? SY (You want the system password)
|
||
Reset? No (You want to leave everything as it is) Passwords? YES (You want the
|
||
passwords Printed) There are others, but they aren't important, just hit a C/R.
|
||
There is ONE more, it will say something like Output status to? KB: (This is
|
||
important, you want to see it, not send it elsewhere).
|
||
|
||
Ok, now you've got all the passwords in your hands.
|
||
Your next step is to make sure the next time you come you can get in again.
|
||
This is the hard part.
|
||
First, in order to make sure that no one will disturb you, you use the
|
||
UTILTY program to make it so no one can login. Type UT SET NO LOGINS.
|
||
(also you can type UT HELP if you need help on the program)
|
||
Next you have to Change the LOGIN program....I'm sorry, but this part is fuzzy
|
||
Personnally, I've never gotten this far. Theorectically here's what you do:
|
||
Find out where the program is, type DIR [1,*]LOGIN.* If there is LOGIN.BAS
|
||
anyplace, get into that account (Using your password list, and typing HELLO
|
||
and the account you'd like to enter). On the DIR of the program there is a date
|
||
(Like 01-Jan-80). To make it look good you type UT DATE (and the date of the
|
||
program). Next, you make it easy for yourself to access the program. You type
|
||
PIP (And the account and name of the program you are changeing)
|
||
<60>=(again thename of the program).
|
||
Now what you do is OLD the program. Type OLD (Name of the program)
|
||
Now that is all theoretical. If anyone runs into problems, tell me
|
||
about it and I'll see if I can either figure it out or get someoneelse to.
|
||
Next thing you want to do is LIST the program and find out where The
|
||
input of the Account # is. To get this far you have to knwo a lot
|
||
about programming and what to look for..Here is generally the idea, an idea is
|
||
all it is, because I have not been able to field test it yet:
|
||
Add a conditional so that if you type in a code word and an account # it will
|
||
respond with the password. This will take a while to look for, and
|
||
a few minutes to change, but you can do it, you've got that RSTS system
|
||
in your back pocket.
|
||
Let's say you've (Somehow) been able to change the program. The next thing
|
||
you want to do is replace it, so put it back where you got it
|
||
(SAVE Prog-name), and the put it back to the Prot Level (The # in the <###>
|
||
signs) by typing PIP (Prog name)<232>=Progname (Note, in all of this, don't
|
||
use the ()'s they are just used by me to show you what goeswhere).
|
||
Now you've gotten this far, what do you do? I say, experiment! Look at all the
|
||
programs, since you have Privilged status you can analyze every
|
||
program. Look around forthe LOG program, and
|
||
find out what you can do to that. The last thing to do before you
|
||
leave is to set the date back to what it was using
|
||
the UTILTY program again Up DATE (and the current date).
|
||
-----------------------------------------------------------------------------
|
||
Another Great Directory from Hacker Supreme. (Ninja Squirrel /+\, Logan - 5,)
|
||
(Zaphod Breeblebox, Silicon Rat, Lord Vision, Crazy Horse.)
|
||
-----------------------------------------------------------------------------
|
||
|