2976 lines
136 KiB
Plaintext
2976 lines
136 KiB
Plaintext
Ok just a quick note, this is a very early version of the book and
|
||
was later banned. We've done our best in converting it to ASCII.
|
||
It's taken us some time to put it together because of the
|
||
reformatting, so I hope it's appreciated. We have kept to the
|
||
original page numbering for so that the index will be correct.
|
||
|
||
Compliments Electronic Images - Gizmo
|
||
|
||
Century Communications
|
||
|
||
|
||
- T H E -
|
||
|
||
- H A C K E R ' S -
|
||
|
||
- H A N D B O O K -
|
||
|
||
|
||
Copyright (c) Hugo Cornwall
|
||
|
||
All rights reserved
|
||
|
||
First published in Great Britain in 1985 by Century Communications Ltd
|
||
Portland House, 12-13 Greek Street, London W1V 5LE.
|
||
|
||
Reprinted 1985 (four times)
|
||
|
||
ISBN 0 7126 0650 5
|
||
|
||
Printed and bound in Great Britain by Billing & Sons Limited, Worcester.
|
||
|
||
|
||
CONTENTS
|
||
|
||
Introduction vii
|
||
|
||
First Principles
|
||
|
||
2 Computer-to-computer communications 7
|
||
|
||
3 Hackers' Equipment 15
|
||
|
||
4 Targets: What you can find on mainframes 30
|
||
|
||
5 Hackers' Intelligence 42
|
||
|
||
6 Hackers' Techniques 57
|
||
|
||
7 Networks 69
|
||
|
||
8 Viewdata systems 86
|
||
|
||
9 Radio computer data 99
|
||
|
||
10 Hacking: the future 108
|
||
|
||
Appendices
|
||
|
||
I troubleshooting 112
|
||
II Glossary 117
|
||
III CCITT and related standards 130
|
||
IV Standard computer alphabets 132
|
||
V Modems 141
|
||
VI Radio Spectrum 144
|
||
VII Port-finder flow chart 148
|
||
|
||
|
||
|
||
INTRODUCTION
|
||
|
||
The word 'hacker' is used in two different but associated
|
||
ways: for some, a hacker is merely a computer enthusiast of any kind,
|
||
who loves working with the beasties for their own sake, as opposed to
|
||
operating them in order to enrich a company or research project --or
|
||
to play games.
|
||
|
||
This book uses the word in a more restricted sense: hacking is a
|
||
recreational and educational sport. It consists of attempting to make
|
||
unauthorised entry into computers and to explore what is there. The
|
||
sport's aims and purposes have been widely misunderstood; most
|
||
hackers are not interested in perpetrating massive frauds, modifying
|
||
their personal banking, taxation and employee records, or inducing
|
||
one world super-power into inadvertently commencing Armageddon in the
|
||
mistaken belief that another super-power is about to attack it. Every
|
||
hacker I have ever come across has been quite clear about where the
|
||
fun lies: it is in developing an understanding of a system and
|
||
finally producing the skills and tools to defeat it. In the vast
|
||
majority of cases, the process of 'getting in' is much more
|
||
satisfying than what is discovered in the protected computer files.
|
||
|
||
In this respect, the hacker is the direct descendant of the phone
|
||
phreaks of fifteen years ago. Phone phreaking became interesting as
|
||
intra-nation and international subscriber trunk dialling was
|
||
introduced, but when the London-based phreak finally chained his way
|
||
through to Hawaii, he usually had no one there to speak to except the
|
||
local weather service or American Express office, to confirm that the
|
||
desired target had indeed been hit. One of the earliest of the
|
||
present generation of hackers, Susan Headley, only 17 when she began
|
||
her exploits in California in 1977, chose as her target the local
|
||
phone company and, with the information extracted from her hacks, ran
|
||
all over the telephone network. She 'retired' four years later, when
|
||
friends started developing schemes to shut down part of the phone
|
||
system.
|
||
|
||
There is also a strong affinity with program copy-protection
|
||
crunchers. Most commercial software for micros is sold in a form to
|
||
prevent obvious casual copying, say by loading a cassette, cartridge
|
||
or disk into memory and then executing a 'save' on to a
|
||
|
||
** Page VII
|
||
|
||
blank cassette or disk. Copy-protection devices vary greatly in
|
||
their methodology and sophistication and there are those who, without
|
||
any commercial motive, enjoy nothing so much as defeating them. Every
|
||
computer buff has met at least one cruncher with a vast store of
|
||
commercial programs, all of which have somehow had the protection
|
||
removed--and perhaps the main title subtly altered to show the
|
||
cruncher's technical skills--but which are then never actually used
|
||
at all.
|
||
|
||
Perhaps I should tell you what you can reasonably expect from this
|
||
handbook. Hacking is an activity like few others: it is semi-legal,
|
||
seldom encouraged, and in its full extent so vast that no individual
|
||
or group, short of an organisation like GCHQ or NSA, could hope to
|
||
grasp a fraction of the possibilities. So this is not one of those
|
||
books with titles like Games Programming with the 6502 where, if the
|
||
book is any good and if you are any good, you will emerge with some
|
||
mastery of the subject-matter. The aim of this book is merely to give
|
||
you some grasp of methodology, help you develop the appropriate
|
||
attitudes and skills, provide essential background and some
|
||
referencing material--and point you in the right directions for more
|
||
knowledge. Up to a point, each chapter may be read by itself; I have
|
||
compiled extensive appendices, containing material which will be of
|
||
use long after the main body of the text has been absorbed.
|
||
|
||
It is one of the characteristics of hacking anecdotes, like those
|
||
relating to espionage exploits, that almost no one closely involved
|
||
has much stake in the truth; victims want to describe damage as
|
||
minimal, and perpetrators like to paint themselves as heroes while
|
||
carefully disguising sources and methods. In addition, journalists
|
||
who cover such stories are not always sufficiently competent to write
|
||
accurately, or even to know when they are being hoodwink- ed. (A note
|
||
for journalists: any hacker who offers to break into a system on
|
||
demand is conning you--the most you can expect is a repeat
|
||
performance for your benefit of what a hacker has previously
|
||
succeeded in doing. Getting to the 'front page' of a service or
|
||
network need not imply that everything within that service can be
|
||
accessed. Being able to retrieve confidential information, perhaps
|
||
credit ratings, does not mean that the hacker would also be able to
|
||
alter that data. Remember the first rule of good reporting: be
|
||
sceptical.) So far as possible, I have tried to verify each story
|
||
that appears in these pages, but hackers work in isolated groups and
|
||
my sources on some of the important hacks of recent years are more
|
||
remote than I would have liked. In these
|
||
|
||
** Page VIII
|
||
|
||
cases, my accounts are of events and methods which, in all the
|
||
circumstances, I believe are true. I welcome notes of correction.
|
||
|
||
Experienced hackers may identify one or two curious gaps in the
|
||
range of coverage, or less than full explanations; you can chose any
|
||
combination of the following explanations without causing me any
|
||
worry: first, I may be ignorant and incompetent; second, much of the
|
||
fun of hacking is making your own discoveries and I wouldn't want to
|
||
spoil that; third, maybe there are a few areas which are really best
|
||
left alone.
|
||
|
||
Nearly all of the material is applicable to readers in all
|
||
countries; however, the author is British and so are most of his
|
||
experiences.
|
||
|
||
The pleasures of hacking are possible at almost any level of
|
||
computer competence beyond rank beginner and with quite minimal
|
||
equipment. It is quite difficult to describe the joy of using the
|
||
world's cheapest micro, some clever firmware, a home-brew acoustic
|
||
coupler and find that, courtesy of a friendly remote PDP11/70, you
|
||
can be playing with Unix, the fashionable multitasking operating
|
||
system.
|
||
|
||
The assumptions I have made about you as a reader are that you own a
|
||
modest personal computer, a modem and some communications software
|
||
which you know, roughly, how to use. (If you are not confident yet,
|
||
practise logging on to a few hobbyist bulletin boards.) For more
|
||
advanced hacking, better equipment helps; but, just as very tasty
|
||
photographs can be taken with snap-shot cameras, the computer
|
||
equivalent of a Hasselblad with a trolley- load of accessories is not
|
||
essential.
|
||
|
||
Since you may at this point be suspicious that I have vast
|
||
technical resources at my disposal, let me describe the kit that has
|
||
been used for most of my network adventures. At the centre is a
|
||
battered old Apple II+, its lid off most of the time to draw away the
|
||
heat from the many boards cramming the expansion slots. I use an
|
||
industry standard dot matrix printer, famous equally for the variety
|
||
of type founts possible, and for the paper-handling path, which
|
||
regularly skews off. I have two large boxes crammed full of software,
|
||
as I collect comms software in particular like a deranged
|
||
philatelist, but I use one package almost exclusively. As for
|
||
modems--well, at this point the set-up does become unconventional; by
|
||
the phone point are jack sockets for BT 95A, BT 96A, BT 600 and a
|
||
North American modular jack. I have two acoustic couplers, devices
|
||
for plunging telephone handsets into so that the computer can talk
|
||
down the line, at operating speeds of 300/300 and 75/1200. I also
|
||
have three heavy, mushroom coloured 'shoe-boxes', representing modem
|
||
technology of 4 or 5 years ago and operating at various speeds and
|
||
combinations of duplex/half- duplex. Whereas the acoustic coupler
|
||
connects my computer to the line by audio, the modem links up at the
|
||
electrical level and is more accurate and free from error. I have
|
||
access to other equipment in my work and through friends, but this is
|
||
what I use most of the time.
|
||
|
||
** Page IX
|
||
|
||
Behind me is my other important bit of kit: a filing cabinet.
|
||
Hacking is not an activity confined to sitting at keyboards and
|
||
watching screens. All good hackers retain formidable collections of
|
||
articles, promotional material and documentation; read on, and you
|
||
will see why.
|
||
|
||
Finally, to those who would argue that a hacker's handbook must be
|
||
giving guidance to potential criminals, I have two things to say:
|
||
First, few people object to the sports of clay-pigeon shooting or
|
||
archery, although rifles, pistols and crossbows have no 'real'
|
||
purpose other than to kill things--and hackers have their own code of
|
||
responsibility, too. Second, real hacking is not as it is shown in
|
||
the movies and on tv, a situation which the publication of this book
|
||
may do something to correct. The sport of hacking itself may involve
|
||
breach of aspects of the law, notably theft of electricity, theft of
|
||
computer time and unlicensed usage of copyright material; every
|
||
hacker must decide individually each instance as it arises.
|
||
|
||
Various people helped me on various aspects of this book; they
|
||
must all remain unnamed--they know who they are and that they have my
|
||
thanks.
|
||
|
||
** Page X
|
||
|
||
|
||
|
||
CHAPTER 1
|
||
|
||
|
||
First Principles
|
||
|
||
The first hack I ever did was executed at an exhibition stand run
|
||
by BT's then rather new Prestel service. Earlier, in an adjacent
|
||
conference hall, an enthusiastic speaker had demonstrated view-
|
||
data's potential world-wide spread by logging on to Viditel, the
|
||
infant Dutch service. He had had, as so often happens in the these
|
||
circumstances, difficulty in logging on first time. He was using one
|
||
of those sets that displays auto-dialled telephone numbers; that was
|
||
how I found the number to call. By the time he had finished his third
|
||
unsuccessful log-on attempt I (and presumably several others) had all
|
||
the pass numbers. While the BT staff were busy with other visitors to
|
||
their stand, I picked out for myself a relatively neglected viewdata
|
||
set. I knew that it was possible to by-pass the auto-dialler with its
|
||
pre-programmed phone numbers in this particular model, simply by
|
||
picking up the the phone adjacent to it, dialling my preferred
|
||
number, waiting for the whistle, and then hitting the keyboard button
|
||
labelled 'viewdata'. I dialled Holland, performed my little by-pass
|
||
trick and watched Viditel write itself on the screen. The pass
|
||
numbers were accepted first time and, courtesy of...no, I'll spare
|
||
them embarrassment...I had only lack of fluency in Dutch to restrain
|
||
my explorations. Fortunately, the first BT executive to spot what I
|
||
had done was amused as well.
|
||
|
||
Most hackers seem to have started in a similar way. Essentially
|
||
you rely on the foolishness and inadequate sense of security of
|
||
computer salesmen, operators, programmers and designers.
|
||
|
||
In the introduction to this book I described hacking as a sport;
|
||
and like most sports, it is both relatively pointless and filled with
|
||
rules, written or otherwise, which have to be obeyed if there is to
|
||
be any meaningfulness to it. Just as rugby football is not only about
|
||
forcing a ball down one end of a field, so hacking is not just about
|
||
using any means to secure access to a computer.
|
||
|
||
On this basis, opening private correspondence to secure a password
|
||
on a public access service like Prestel and then running around the
|
||
system building up someone's bill, is not what hackers call hacking.
|
||
The critical element must be the use of skill in some shape or form.
|
||
|
||
** Page 1
|
||
|
||
Hacking is not a new pursuit. It started in the early 1960s when
|
||
the first "serious" time-share computers began to appear at
|
||
university sites. Very early on, 'unofficial' areas of the memory
|
||
started to appear, first as mere notice boards and scratch pads for
|
||
private programming experiments, then, as locations for games.
|
||
(Where, and how do you think the early Space Invaders, Lunar Landers
|
||
and Adventure Games were created?) Perhaps tech-hacking-- the
|
||
mischievous manipulation of technology--goes back even further. One
|
||
of the old favourites of US campus life was to rewire the control
|
||
panels of elevators (lifts) in high-rise buildings, so that a request
|
||
for the third floor resulted in the occupants being whizzed to the
|
||
twenty-third.
|
||
|
||
Towards the end of the 60s, when the first experimental networks
|
||
arrived on the scene (particularly when the legendary
|
||
ARPAnet--Advanced Research Projects Agency network-- opened up), the
|
||
computer hackers skipped out of their own local computers, along the
|
||
packet-switched high grade communications lines, and into the other
|
||
machines on the net. But all these hackers were privileged
|
||
individuals. They were at a university or research resource, and they
|
||
were able to borrow terminals to work with.
|
||
|
||
What has changed now, of course, is the wide availability of home
|
||
computers and the modems to go with them, the growth of public-access
|
||
networking of computers, and the enormous quantity and variety of
|
||
computers that can be accessed.
|
||
|
||
Hackers vary considerably in their native computer skills; a basic
|
||
knowledge of how data is held on computers and can be transferred
|
||
from one to another is essential. Determination, alertness,
|
||
opportunism, the ability to analyse and synthesise, the collection of
|
||
relevant helpful data and luck--the pre-requisites of any
|
||
intelligence officer--are all equally important. If you can write
|
||
quick effective programs in either a high level language or machine
|
||
code, well, it helps. A knowledge of on-line query procedures is
|
||
helpful, and the ability to work in one or more popular mainframe and
|
||
mini operating systems could put you in the big league.
|
||
|
||
The materials and information you need to hack are all around
|
||
you--only they are seldom marked as such. Remember that a large
|
||
proportion of what is passed off as 'secret intelligence' is openly
|
||
available, if only you know where to look and how to appreciate what
|
||
you find. At one time or another, hacking will test everything you
|
||
know about computers and communications. You will discover your
|
||
abilities increase in fits and starts, and you must
|
||
|
||
** Page 2
|
||
|
||
be prepared for long periods when nothing new appears to happen.
|
||
|
||
Popular films and tv series have built up a mythology of what
|
||
hackers can do and with what degree of ease. My personal delight in
|
||
such Dream Factory output is in compiling a list of all the mistakes
|
||
in each episode. Anyone who has ever tried to move a graphics game
|
||
from one micro to an almost-similar competitor will already know that
|
||
the chances of getting a home micro to display the North Atlantic
|
||
Strategic Situation as it would be viewed from the President's
|
||
Command Post would be slim even if appropriate telephone numbers and
|
||
passwords were available. Less immediately obvious is the fact that
|
||
most home micros talk to the outside world through limited but
|
||
convenient asynchronous protocols, effectively denying direct access
|
||
to the mainframe products of the world's undisputed leading computer
|
||
manufacturer, which favours synchronous protocols. And home micro
|
||
displays are memory-mapped, not vector-traced... Nevertheless, it is
|
||
astonishingly easy to get remarkable results. And thanks to the
|
||
protocol transformation facilities of PADs in PSS networks (of which
|
||
much more later), you can get into large IBM devices....
|
||
|
||
|
||
The cheapest hacking kit I have ever used consisted of a ZX81, 16K
|
||
RAMpack, a clever firmware accessory and an acoustic coupler. Total
|
||
cost, just over <20>100. The ZX81's touch-membrane keyboard was one
|
||
liability; another was the uncertainty of the various connectors.
|
||
Much of the cleverness of the firmware was devoted to overcoming the
|
||
native drawbacks of the ZX81's inner configuration--the fact that it
|
||
didn't readily send and receive characters in the industry-standard
|
||
ASCII code, and that the output port was designed more for instant
|
||
access to the Z80's main logic rather than to use industry-standard
|
||
serial port protocols and to rectify the limited screen display.
|
||
|
||
Yet this kit was capable of adjusting to most bulletin boards;
|
||
could get into most dial-up 300/300 asynchronous ports,
|
||
re-configuring for word-length and parity if needed; could have
|
||
accessed a PSS PAD and hence got into a huge range of computers not
|
||
normally available to micro-owners; and, with another modem, could
|
||
have got into viewdata services. You could print out pages on the ZX
|
||
'tin-foil' printer. The disadvantages of this kit were all in
|
||
convenience, not in facilities. Chapter 3 describes the sort of kit
|
||
most hackers use.
|
||
|
||
It is even possible to hack with no equipment at all. All major
|
||
banks now have a network of 'hole in the wall' cash machines-- ATMs
|
||
or Automatic Telling Machines, as they are officially
|
||
|
||
** Page 3
|
||
|
||
known. Major building societies have their own network. These
|
||
machines have had faults in software design, and the hackers who
|
||
played around with them used no more equipment than their fingers and
|
||
brains. More about this later.
|
||
|
||
Though I have no intention of writing at length about hacking
|
||
etiquette, it is worth one paragraph: lovers of fresh-air walks obey
|
||
the Country Code; they close gates behind them, and avoid damage to
|
||
crops and livestock. Something very similar ought to guide your
|
||
rambles into other people's computers: don't manipulate files unless
|
||
you are sure a back-up exists; don't crash operating systems; don't
|
||
lock legitimate users out from access; watch who you give information
|
||
to; if you really discover something confidential, keep it to
|
||
yourself. Hackers should not be interested in fraud. Finally, just
|
||
as any rambler who ventured past barbed wire and notices warning
|
||
about the Official Secrets Acts would deserve whatever happened
|
||
thereafter, there are a few hacking projects which should never be
|
||
attempted.
|
||
|
||
On the converse side, I and many hackers I know are convinced of one
|
||
thing: we receive more than a little help from the system managers of
|
||
the computers we attack. In the case of computers owned by
|
||
universities and polys, there is little doubt that a number of them
|
||
are viewed like academic libraries--strictly speaking they are for
|
||
the student population, but if an outsider seriously thirsty for
|
||
knowledge shows up, they aren't turned away. As for other computers,
|
||
a number of us are almost sure we have been used as a cheap means to
|
||
test a system's defences...someone releases a phone number and
|
||
low-level password to hackers (there are plenty of ways) and watches
|
||
what happens over the next few weeks while the computer files
|
||
themselves are empty of sensitive data. Then, when the results have
|
||
been noted, the phone numbers and passwords are changed, the security
|
||
improved etc etc....much easier on dp budgets than employing
|
||
programmers at <20>150/man/ day or more. Certainly the Pentagon has been
|
||
known to form 'Tiger Units' of US Army computer specialists to
|
||
pin-point weaknesses in systems security.
|
||
|
||
Two spectacular hacks of recent years have captured the public
|
||
imagination: the first, the Great Prince Philip Prestel Hack, is
|
||
described in detail in chapter 8, which deals with viewdata. The
|
||
second was spectacular because it was carried out on live national
|
||
television. It occurred on October 2nd 1983 during a follow-up to the
|
||
BBC's successful Computer Literacy series. It's worth reporting here,
|
||
because it neatly illustrates the essence of hacking as a sport...
|
||
skill with systems, careful research, maximum impact
|
||
|
||
** Page 4
|
||
|
||
with minimum real harm, and humour.
|
||
|
||
The tv presenter, John Coll, was trying to show off the Telecom
|
||
Gold electronic mail service. Coll had hitherto never liked long
|
||
passwords and, in the context of the tight timing and pressures of
|
||
live tv, a two letter password seemed a good idea at the time. On
|
||
Telecom Gold, it is only the password that is truly confidential;
|
||
system and account numbers, as well as phone numbers to log on to the
|
||
system, are easily obtainable. The BBC's account number, extensively
|
||
publicised, was OWL001, the owl being the 'logo' for the tv series as
|
||
well as the BBC computer.
|
||
|
||
The hacker, who appeared on a subsequent programme as a 'former
|
||
hacker' and who talked about his activities in general, but did not
|
||
openly acknowledge his responsibility for the BBC act, managed to
|
||
seize control of Coll's mailbox and superimpose a message of his own:
|
||
|
||
Computer Security Error. Illegal access. I hope your television
|
||
PROGRAMME runs as smoothly as my PROGRAM worked out your passwords!
|
||
Nothing is secure!
|
||
|
||
|
||
|
||
Hackers' Song
|
||
|
||
"Put another password in,
|
||
Bomb it out and try again
|
||
Try to get past logging in,
|
||
We're hacking, hacking, hacking
|
||
|
||
Try his first wife's maiden name,
|
||
This is more than just a game,
|
||
It's real fun, but just the same,
|
||
It's hacking, hacking, hacking"
|
||
|
||
The Nutcracker (Hackers UK)
|
||
|
||
HI THERE, OWLETS, FROM OZ AND YUG
|
||
(OLIVER AND GUY)
|
||
|
||
After the hack a number of stories about how it had been carried
|
||
out, and by whom, circulated; it was suggested that the hackers had
|
||
crashed through to the operating system of the Prime computers upon
|
||
which the Dialcom electronic mail software
|
||
|
||
** Page 5
|
||
|
||
resided--it was also suggested that the BBC had arranged the whole
|
||
thing as a stunt, or alternatively, that some BBC employees had fixed
|
||
it up without telling their colleagues. Getting to the truth of a
|
||
legend in such cases is almost always impossible. No one involved has
|
||
a stake in the truth. British Telecom, with a strong commitment to
|
||
get Gold accepted in the business community, was anxious to suggest
|
||
that only the dirtiest of dirty tricks could remove the inherent
|
||
confidentiality of their electronic mail service. Naturally, the
|
||
British Broadcasting Corporation rejected any possibility that it
|
||
would connive in an irresponsible cheap stunt. But the hacker had no
|
||
great stake in the truth either--he had sources and contacts to
|
||
protect, and his image in the hacker community to bolster. Never
|
||
expect any hacking anecdote to be completely truthful.
|
||
|
||
** Page 6
|
||
|
||
|
||
|
||
CHAPTER 2
|
||
|
||
|
||
Computer-to-Computer
|
||
Communications
|
||
|
||
Services intended for access by microcomputers are nowadays
|
||
usually presented in a very user-friendly fashion: pop in your
|
||
software disc or firmware, check the connections, dial the telephone
|
||
number, listen for the tone...and there you are. Hackers, interested
|
||
in venturing where they are not invited, enjoy no such luxury. They
|
||
may want to access older services which preceded the modern 'human
|
||
interface'; they are very likely to travel along paths intended, not
|
||
for ordinary customers, but for engineers or salesmen; they could be
|
||
utilising facilities that were part of a computer's commissioning
|
||
process and have been hardly used since.
|
||
|
||
So the hacker needs a greater knowledge of datacomms technology than
|
||
does a more passive computer user, and some feeling for the history
|
||
of the technology is pretty essential, because of its growth pattern
|
||
and because of the fact that many interesting installations still use
|
||
yesterday's solutions.
|
||
|
||
Getting one computer to talk to another some distance away means
|
||
accepting a number of limiting factors:
|
||
|
||
* Although computers can send out several bits of information at
|
||
once, the ribbon cable necessary to do this is not economical at any
|
||
great length, particularly if the information is to be sent out over
|
||
a network--each wire in the ribbon would need switching separately,
|
||
thus making ex- changes prohibitively expensive. So bits must be
|
||
transmitted one at a time, or serially.
|
||
|
||
** Page 7
|
||
|
||
* Since you will be using, in the first instance, wires and networks
|
||
already installed--in the form of the telephone and telex
|
||
networks--you must accept that the limited bandwidth of these
|
||
facilities will restrict the rate at which data can be sent. The data
|
||
will pass through long lengths of wire, frequently being
|
||
re-amplified, and undergoing de- gradation as it passes through dirty
|
||
switches and relays in a multiplicity of exchanges.
|
||
|
||
* Data must be easily capable of accurate recovery at the far end.
|
||
|
||
* Sending and receiving computers must be synchronised in their
|
||
working.
|
||
|
||
* The mode in which data is transmitted must be one understood by
|
||
all computers; accepting a standard protocol may mean adopting the
|
||
speed and efficiency of the slowest.
|
||
|
||
* The present 'universal' standard for data transmission used by
|
||
microcomputers and many other services uses agreed tones to signify
|
||
binary 0 and binary 1, the ASCII character set (also known as
|
||
International Alphabet No 5), and an asynchronous protocol, whereby
|
||
the transmitting and receiving computers are locked in step every
|
||
time a character is sent, not just at the beginning of a transmission
|
||
stream. Like nearly all standards, it is highly arbitrary in its
|
||
decisions and derives its importance simply from the fact of being
|
||
generally accepted. Like many standards, too, there are a number of
|
||
subtle and important variations.
|
||
|
||
To see how the standard works, how it came about and the reasons
|
||
for the variations, we need to look back a little into history.
|
||
|
||
|
||
The Growth of Telegraphy
|
||
|
||
The essential techniques of sending data along wires has a history
|
||
of 150 years, and some of the common terminology of modern data
|
||
transmission goes right back to the first experiments.
|
||
|
||
The earliest form of telegraphy, itself the earliest form of
|
||
electrical message sending, used the remote actuation of electrical
|
||
relays to leave marks on a strip of paper. The letters of the
|
||
alphabet were defined by the patterns of 'mark' and 'space'.
|
||
|
||
** Page 8
|
||
|
||
The terms have come through to the present, to signify binary
|
||
conditions of '1' and '0' respectively. The first reliable machine
|
||
for sending letters and figures by this method dates from 1840; the
|
||
direct successor of that machine, using remarkably unchanged
|
||
electromechanical technology and a 5-bit alphabetic code, is still
|
||
widely used today, as the telex/teleprinter/teletype. The mark and
|
||
space have been replaced by holes punched in paper-tape: larger holes
|
||
for mark, smaller ones for space. Synchronisation between sending and
|
||
receiving stations is carried out by beginning each letter with a
|
||
'start' bit (a space) and concluding it with a 'stop' bit (mark). The
|
||
'idle' state of a circuit is thus 'mark'. In effect, therefore, each
|
||
letter requires the transmission of 7 bits:
|
||
|
||
. * * . . . * (letter A: . = space; * = mark)
|
||
|
||
of which the first . is the start bit, the last * is the stop bit and
|
||
* * . .. is the code for A.
|
||
|
||
This is the principle means for sending text messages around the
|
||
world, and the way in which news reports are distributed globally.
|
||
And, until third-world countries are rich enough to afford more
|
||
advanced devices, the technology will survive.
|
||
|
||
|
||
Early computer communications
|
||
|
||
When, 110 years after the first such machines came on line, the
|
||
need arose to address computers remotely, telegraphy was the obvious
|
||
way to do so. No one expected computers in the early 1950s to give
|
||
instant results; jobs were assembled in batches, often fed in by
|
||
means of paper-tape (another borrowing from telex, still in use) and
|
||
then run. The instant calculation and collation of data was then
|
||
considered quite miraculous. So the first use of data communications
|
||
was almost exclusively to ensure that the machine was fed with
|
||
up-to-date information, not for the machine to send the results out
|
||
to those who might want it; they could wait for the 'print-out' in
|
||
due course, borne to them with considerable solemnity by the computer
|
||
experts. Typical communications speeds were 50 or 75 baud. (The baud
|
||
is the measure of speed of data transmission: specifically, it refers
|
||
to the number of signal level changes per second and is thus not the
|
||
same as bits-per-second.)
|
||
|
||
These early computers were, of course, in today's jargon,
|
||
single-user/single-task; programs were fed by direct machine coding.
|
||
Gradually, over the next 15 years, computers spawned multi-user
|
||
capabilities by means of time-sharing techniques, and their human
|
||
interface became more 'user-friendly'.
|
||
|
||
** Page 9
|
||
|
||
With these facilities grew the demand for remote access to
|
||
computers, and modern data communications began.
|
||
|
||
Even at the very end of the 1960s when I had my own very first
|
||
encounter with a computer, the links with telegraphy were still
|
||
obvious. As a result of happenstance, I was in a Government-run
|
||
research facility to the south-west of London, and the program I was
|
||
to use was located on a computer just to the north of Central London;
|
||
I was sat down in front of a battered teletype--capitals and figures
|
||
only, and requiring not inconsiderable physical force from my
|
||
smallish fingers to actuate the keys of my choice. As it was a
|
||
teletype outputting on to a paper roll, mistakes could not as readily
|
||
be erased as on a VDU, and since the sole form of error reporting
|
||
consisted of a solitary ?, the episode was more frustrating than
|
||
thrilling. VDUs and good keyboards were then far too expensive for
|
||
'ordinary' use.
|
||
|
||
|
||
The telephone network
|
||
|
||
But by that time all sorts of changes in datacomms were taking
|
||
place. The telex and telegraphy network, originally so important, had
|
||
long been overtaken by voice-grade telephone circuits (Bell's
|
||
invention dates from 1876). For computer communication, mark and
|
||
space could be indicated by different audio tones, rather than by
|
||
different voltage conditions. Data traffic on a telex line can
|
||
operate in only one direction at a time, but, by selecting different
|
||
pairs of tones, both 'transmitter' and 'receiver' could speak
|
||
simultaneously--so that in fact, one has to talk about 'originate'
|
||
and 'answer' instead.
|
||
|
||
Improved electrical circuit design meant that higher speeds than
|
||
50 or 75 baud became possible; there was a move to 110 baud, then 300
|
||
and, so far as ordinary telephone circuits are concerned, 1200 baud
|
||
is now regarded as the top limit.
|
||
|
||
The 'start' and 'stop' method of synchronising the near and far
|
||
end of a communications circuit at the beginning of each individual
|
||
letter has been retained, but the common use of the 5-bit Baudot code
|
||
has been replaced by a 7-bit extended code which allows for many more
|
||
characters, 128 in fact.
|
||
|
||
Lastly, to reduce errors in transmission due to noise in the
|
||
telephone line and circuitry, each letter can be checked by the use
|
||
of a further bit (the parity bit), which adds up all the bits in the
|
||
main character and then, depending on whether the result is odd or
|
||
even, adds a binary 0 or binary 1.
|
||
|
||
The full modern transmission of a letter in this system, in this
|
||
case, K, therefore, looks like this:
|
||
|
||
** Page 10
|
||
|
||
START-STOP TRANSMISSION OF A DATA CHARACTER
|
||
|
||
TIME
|
||
INTERVAL_____________9___0___1___2___3___4___5___6___7___8___9___
|
||
NUMBER
|
||
1 1 1 1 1 1
|
||
Mark +---+ +---+ +---+ +---+---+ +---+
|
||
LINE | | 0 | | 0 0 | | 0 | | 0 | |
|
||
CONDITION Space-+ +---+ +---+---+ +---+ +---+ +-
|
||
|
||
^ ^
|
||
| |
|
||
BINARY STOP-+ START 1 0 0 1 0 1 1 0
|
||
DIGIT
|
||
|
||
The first 0 is the start bit; then follows 7 bits of the actual
|
||
letter code (1001011); then the parity bit; then the final 1 is the
|
||
stop code.
|
||
|
||
This system, asynchronous start-stop ASCII (the common name for
|
||
the alphabetic code), is the basis for nearly all micro-based
|
||
communications. The key variations relate to:
|
||
|
||
bit-length; you can have 7 or 8 databits (*)
|
||
|
||
parity; (it can be even or odd, or entirely absent),
|
||
|
||
Tones - The tones used to signify binary 0 and binary 1, and which
|
||
computer is in 'originate' and which in 'answer', can vary according
|
||
to the speed of the transmission and also to whether the service is
|
||
used in North America or the rest of the world. (Briefly, most of
|
||
the world uses tones and standards laid down by the Geneva-based
|
||
organisation, CCITT, a specialised agency of the International
|
||
Telecommunications Union; whereas in the United States and most parts
|
||
of Canada, tones determined by the telephone utility, colloquially
|
||
known as Ma Bell, are adopted.) The following table gives the
|
||
standards and tones in common use.
|
||
|
||
(*) There are no 'obvious explanations' for the variations commonly
|
||
found: most electronic mail services and viewdata transmit 7 data
|
||
bits, even parity and I stop Bit; Telecom Gold and most hobbyist
|
||
bulletin boards transmit 8 data bits, odd parity and 1 stop bit.
|
||
Terminal emulator software--see chapter 3--allows users to adjust for
|
||
these differing requirements.
|
||
|
||
** Page 11
|
||
|
||
Service Speed Duplex Transmit Receive Answer
|
||
Designator 0 1 0 1
|
||
|
||
V21 orig 300(*) full 1180 980 1850 1650 -
|
||
V21 ans 300(*) full 1850 1650 1180 980 2100
|
||
V23 (1) 600 half 1700 1300 1700 1300 2100
|
||
V23 (2) 1200 f/h(**) 2100 1300 2100 1300 2100
|
||
V23 back 75 f/h(**) 450 390 450 390 -
|
||
Bell 103 orig 300(*) full 1070 1270 2025 2225 -
|
||
Bell 103 ans 300(*) full 2025 2225 1070 1270 2225
|
||
Bell 202 1200 half 2200 1200 2200 1200 2025
|
||
|
||
(*)any speed up to 300 baud, can also include 75 and 110 baud
|
||
services
|
||
|
||
(**)service can either be half-duplex at 1200 baud or asymmetrical
|
||
full duplex, with 75 baud originate and 1200 baud receive (commonly
|
||
used as viewdata user) or 1200 transmit and 75 receive (viewdata
|
||
host)
|
||
|
||
|
||
Higher Speeds
|
||
|
||
1200 baud is usually regarded as the fastest speed possible on an
|
||
ordinary voice-grade telephone line. Beyond this, noise on the line
|
||
due to the switching circuits at the various telephone exchanges,
|
||
poor cabling, etc. make accurate transmission difficult. Indeed, at
|
||
higher speeds it becomes increasingly important to use transmission
|
||
protocols that include error correction.
|
||
|
||
Error correction techniques usually consist of dividing the
|
||
transmission stream into a series of blocks which can be checked, one
|
||
at a time, by the receiving computer. The 'parity' system mentioned
|
||
above is one example, but obviously a crude one. The difficulty is
|
||
that the more secure an error-correction protocol becomes, the
|
||
greater becomes the overhead in terms of numbers of bits transmitted
|
||
to send just one character from one computer to another. Thus, in the
|
||
typical 300 bit situation, the actual letter is defined by 7 bits,
|
||
'start' and 'stop' account for another two, and the check takes a
|
||
further one--ten in all. After a while, what you gain in the speed
|
||
with which each actual bit is transmitted, you lose, because so many
|
||
bits have to be sent to ensure that a single character is accurately
|
||
received!
|
||
|
||
** Page 12
|
||
|
||
Although some people risk using 2400 baud on ordinary telephone
|
||
lines--the jargon is the PTSN (Public Telephone Switched
|
||
Network)--this means using expensive modems. Where higher speeds are
|
||
essential, leased circuits, not available via dial-up. become
|
||
essential. The leased circuit is paid for on a fixed charge, not a
|
||
charge based on time-connected. Such circuits can be conditioned',
|
||
for example by using special amplifiers, to support the higher data
|
||
rate.
|
||
|
||
For really high speed transmissions, however, pairs of copper
|
||
cable are inadequate. Medium speed is obtainable by the use of
|
||
coaxial cable (a little like that used for tv antenna hook-ups) which
|
||
have a very broad bandwidth. Imposing several different channels on
|
||
one cable-length is called multiplexing and, depending on the
|
||
application, the various channels can either carry several different
|
||
computer conversations simultaneously or can send several bits of one
|
||
computer conversation in parallel, just as though there were a ribbon
|
||
cable between the two participating computers. Either way, what
|
||
happens is that each binary 0 or binary 1 is given, not an audio
|
||
tone, but a radio frequency tone.
|
||
|
||
|
||
Synchronous Protocols
|
||
|
||
In the asynchronous protocols so far described, transmitting and
|
||
receiving computers are kept in step with each other every time a
|
||
character is sent, via the 'start' and 'stop' bits. In synchronous
|
||
comms, the locking together is done merely at the start of each block
|
||
of transmission by the sending of a special code (often SYN). The SYN
|
||
code starts a clock (a timed train of pulses) in the receiver and it
|
||
is this that ensures that binary 0s and 1s originating at the
|
||
transmitter are correctly interpreted by the receiver; clearly, the
|
||
displacement of even one binary digit can cause havoc.
|
||
|
||
A variety of synchronous protocols exist, such as the length of
|
||
block sent each time, the form of checking that takes place, the form
|
||
of acknowledgement, and so on. A synchronous protocol is not only a
|
||
function of the modem, which has to have a suitable clock, but also
|
||
of the software and firmware in the computers. Because asynchronous
|
||
protocols transmit so many 'extra' bits in order to avoid error,
|
||
savings in transmission time under synchronous systems often exceed
|
||
20-30%. The disadvantage of synchronous protocols lie in increased
|
||
hardware costs.
|
||
|
||
One other complication exists: most asynchronous protocols use the
|
||
ASCII code to define characters. IBM ('Big Blue'), the biggest
|
||
enthusiast of synchronous comms, has its own binary code to define
|
||
characters. In Appendix IV, you will find an explanation and a
|
||
comparison with ASCII.
|
||
|
||
** Page 13
|
||
|
||
The hacker, wishing to come to terms with synchronous comms, has
|
||
two choices: the more expensive is to purchase a protocol convertor
|
||
board. These are principally available for the IBM PC, which has been
|
||
increasingly marketed for the 'executive workstation' audience, where
|
||
the ability to interface to a company's existing (IBM) mainframe is a
|
||
key feature. The alternative is to see whether the target mainframe
|
||
has a port on to a packet- switched service; in that event, the
|
||
hacker can use ordinary asynchronous equipment and protocols--the
|
||
local PAD (Packet Assembler/Disassembler) will carry out the
|
||
necessary transformations.
|
||
|
||
|
||
Networks
|
||
|
||
Which brings us neatly to the world of high-speed digital networks
|
||
using packet-switching. All the computer communications so far
|
||
described have taken place either on the phone (voice-grade) network
|
||
or on the telex network.
|
||
|
||
In Chapter 7 we will look at packet-switching and the
|
||
opportunities offered by international data networks. We must now
|
||
specify hackers' equipment in more detail.
|
||
|
||
** Page 14
|
||
|
||
|
||
|
||
CHAPTER 3
|
||
|
||
|
||
Hackers' Equipment
|
||
|
||
You can hack with almost any microcomputer capable of talking to
|
||
the outside world via a serial port and a modem. In fact, you don't
|
||
even need a micro; my first hack was with a perfectly ordinary
|
||
viewdata terminal.
|
||
|
||
What follows in this chapter, therefore, is a description of the
|
||
elements of a system I like to think of as optimum for
|
||
straight-forward asynchronous ASCII and Baudot communications. What
|
||
is at issue is convenience as much as anything. With kit like this,
|
||
you will be able to get through most dial-up ports and into
|
||
packet-switching through a PAD -- a packet assembler/ disassembler
|
||
port. (It will not get you into IBM networks, because these use
|
||
different and incompatible protocols; we will return to the matter of
|
||
the IBM world in chapter 10.) In other words, given a bit of money, a
|
||
bit of knowledge, a bit of help from friends and a bit of luck, what
|
||
is described here is the sort of equipment most hackers have at their
|
||
command.
|
||
|
||
You will find few products on the market labelled 'for hackers';
|
||
you must select those items that appear to have 'legitimate' but
|
||
interesting functions and see if they can be bent to the hacker's
|
||
purposes. The various sections within this chapter highlight the sort
|
||
of facilities you need; before lashing out on some new software or
|
||
hardware, try to get hold of as much publicity and documentation
|
||
material as possible to see how adaptable the products are. In a few
|
||
cases, it is worth looking at the second-hand market, particularly
|
||
for modems, cables and test equipment.
|
||
|
||
Although it is by no means essential, an ability to solder a few
|
||
connections and scrabble among the circuit diagrams of 'official'
|
||
products often yield unexpectedly rewarding results.
|
||
|
||
|
||
The computer
|
||
|
||
Almost any popular microcomputer will do; hacking does not call
|
||
upon enormous reserves of computer power. Nearly everything you hack
|
||
will come to you in alphanumeric form, not graphics. The computer
|
||
you already have will almost certainly have the essential qualities.
|
||
However the very cheapest micros, like the ZX81, whilst usable,
|
||
require much more work on the part of the operator/hacker, and give
|
||
him far less in the way of instant facilities.
|
||
|
||
** Page 15
|
||
|
||
(In fact, as the ZX81 doesn't use ASCII internally, but a
|
||
Sinclair-developed variant; you will need a software or firmware fix
|
||
for that, before you even think of hooking it up to a modem.)
|
||
|
||
Most professional data services assume the user is viewing on an
|
||
80-column screen; ideally the hacker's computer should be capable of
|
||
doing that as well, otherwise the display will be full of awkward
|
||
line breaks. Terminal emulator software (see below) can some- times
|
||
provide a 'fix'.
|
||
|
||
One or two disc drives are pretty helpful, because you will want
|
||
to be able to save the results of your network adventures as quickly
|
||
and efficiently as possible. Most terminal emulators use the
|
||
computer's free memory (i.e. all that is not required to support the
|
||
operating system and the emulator software itself) as store for the
|
||
received data, but once the buffer is full, you will begin to lose
|
||
the earliest items. You can, of course, try to save to cassette, but
|
||
normally that is a slow and tedious process.
|
||
|
||
An alternative storage method is to save to a printer, printing
|
||
the received data stream not only to the computer screen, but also on
|
||
a dot matrix printer. However, most of the more popular (and cheaper)
|
||
printers do not work sufficiently fast. You may find you lose
|
||
characters at the beginning of each line. Moreover, if you print
|
||
everything in real-time, you'll include all your mistakes, false
|
||
starts etc., and in the process use masses of paper. So, if you can
|
||
save to disc regularly, you can review each hack afterwards at your
|
||
leisure and, using a screen editor or word processor, save or print
|
||
out only those items of real interest.
|
||
|
||
|
||
Serial ports
|
||
|
||
The computer must have a serial port, either called that or marked
|
||
RS232C (or its slight variant RS423), or V24, which is the official
|
||
designator of RS232C used outside the USA, though not often seen on
|
||
micros.
|
||
|
||
The very cheapest micros, like the ZX81, Spectrum, VIC20, do not
|
||
have RS232C ports, though add-on boards are available. Some of the
|
||
older personal computers, like the Apple or the original Pet, were
|
||
also originally sold without serial ports, though standard boards are
|
||
available for all of these.
|
||
|
||
You are probably aware that the RS232C standard has a large number
|
||
of variants, and that not all computers (or add-on boards) that claim
|
||
to have a RS232C port can actually talk into a modem.
|
||
|
||
Historically, RS232C/V24 is supposed to cover all aspects of
|
||
serial communication, including printers and dumb terminals as well
|
||
as computers. The RS232C standard specifies electrical and physical
|
||
requirements.
|
||
|
||
** Page 16
|
||
|
||
Everything is pumped through a 25-pin D-shaped connector, each pin
|
||
of which has some function in some implementation. But in most cases,
|
||
nearly all the pins are not used. In practice, only three connections
|
||
are essential for computer to modem communication:
|
||
|
||
Pin 7 signal ground
|
||
|
||
Pin 2 characters leaving the computer
|
||
|
||
Pin 3 characters arriving at the computer
|
||
|
||
The remaining connections are for such purposes as feeding power
|
||
to an external device, switching the external advice on or off,
|
||
exchanging status and timing signals, monitoring the state of the
|
||
line, and so forth. Some computers and their associated firmware
|
||
require one or other of these status signals to go 'high' or 'low' in
|
||
particular circumstances, or the program hangs. Check your
|
||
documentation if you have trouble.
|
||
|
||
Some RS232C implementations on microcomputers or add-on boards are
|
||
there simply to support printers with serial interfaces, but they can
|
||
often be modified to talk into modems. The critical two lines are
|
||
those serving Pins 2 and 3.
|
||
|
||
A computer serving a modem needs a cable in which Pin 2 on the
|
||
computer is linked to Pin 2 on the modem.
|
||
|
||
A computer serving a printer, etc, needs a cable in which Pin 3 on
|
||
the: computer is linked to Pin 2 on the printer and Pin 3 on the
|
||
printer is linked to Pin 2 on the computer.
|
||
|
||
If two computers are linked together directly, without a modem,
|
||
then Pin 2 on computer A must be linked to Pin 3 on computer B and
|
||
Pin 3 on computer B linked to Pin 2 on computer A: this arrangement
|
||
is sometimes called a 'null modem' or a 'null modem cable'.
|
||
|
||
There are historic explanations for these arrangements, depending
|
||
on who you think is sending and who is receiving--forget about them,
|
||
they are confusing. The above three cases are all you need to know
|
||
about in practice.
|
||
|
||
One difficulty that frequently arises with newer or portable
|
||
computers is that some manufacturers have abandoned the traditional
|
||
25-way D-connector, largely on the grounds of bulk, cost and
|
||
redundancy. Some European computer and peripheral companies favour
|
||
connectors based on the DIN series (invented in Germany), while
|
||
others use D-connectors with fewer pin-outs.
|
||
|
||
** Page 17
|
||
|
||
There is no standardisation. Even if you see two physically
|
||
similar connectors on two devices, regard them with suspicion. In
|
||
each case, you must determine the equivalents of:
|
||
|
||
Characters leaving computer (Pin 2)
|
||
Characters arriving at computer (Pin 3)
|
||
Signal ground (Pin 7)
|
||
|
||
You can usually set the speed of the port from the computer's
|
||
operating system and/or from Basic. There is no standard way of doing
|
||
this; you must check your handbook and manuals. Most RS232C ports can
|
||
handle the following speeds:
|
||
|
||
75, 110, 300, 600, 1200, 2400, 4800, 9600
|
||
|
||
and sometimes 50 and 19200 baud as well. These speeds are selectable
|
||
in hardware by appropriate wiring of a chip called a baud-rate
|
||
generator. Many modern computers let you select speed in hardware by
|
||
means of a DIL switch. The higher speeds are used either for driving
|
||
printers or for direct computer-to-computer or computer-to-peripheral
|
||
connections. The normal maximum speed for transmitting along phone
|
||
lines is 1200 baud.
|
||
|
||
|
||
Depending on how your computer has been set up, you may be able to
|
||
control the speed from the keyboard--a bit of firmware in the
|
||
computer will accept micro-instructions to flip transistor switches
|
||
controlling the wiring of the baud-rate generator. Alternatively,
|
||
the speeds may be set in pure software, the micro deciding at what
|
||
speed to feed information into the serial port.
|
||
|
||
In most popular micro implementations the RS232C cannot support
|
||
split-speed working (different speeds for receive and transmit). If
|
||
you set the port up for 1200 baud, it has to be 1200 receive and
|
||
transmit. This is a nuisance in Europe, where 75/1200 is in common
|
||
use both for viewdata systems and for some on-line services. The
|
||
usual way round is to have special terminal emulator software, which
|
||
requires the RS232C hardware to operate at 1200 /1200 and then slows
|
||
down (usually the micro's transmit path) to 75 baud in software by
|
||
means of a timing loop. An alternative method relies on a special
|
||
modem, which accepts data from the computer at 1200/1200 and then
|
||
performs the slowing-down to 75 baud in its own internal firmware.
|
||
|
||
|
||
Terminal emulators
|
||
|
||
We all need a quest in life. Sometimes I think mine is to search
|
||
for the perfect software package to make micros talk to the outside
|
||
world.
|
||
|
||
** Page 18
|
||
|
||
As in all such quests, the goal is occasionally approached but
|
||
never reached, if only because the process of the quest causes one to
|
||
redefine what one is looking for.
|
||
|
||
These items of software are sometimes called communications
|
||
packages, or asynchronous comms packages, and sometimes terminal
|
||
emulators, on the grounds that the software can make the micro appear
|
||
to be a variety of different computer terminals. Until recently, most
|
||
on-line computer services assumed that they were being examined
|
||
through 'dumb' terminals--simply a keyboard and a screen, with no
|
||
attendant processing or storage power (except perhaps a printer).
|
||
With the arrival of PCs all this is slowly changing, so that the
|
||
remote computer has to do no more than provide relatively raw data
|
||
and all the formatting and on-screen presentation is done by the
|
||
user's own computer. Terminal emulator software is a sort of
|
||
half-way house between 'dumb' terminals and PCs with considerable
|
||
local processing power.
|
||
|
||
Given the habit of manufacturers of mainframe and mini- computers
|
||
to make their products as incompatible with those of their
|
||
competitors as possible (to maximise their profits), many slight
|
||
variants on the 'dumb' computer terminal exist--hence the
|
||
availability of terminal emulators to provide, in one software
|
||
package, a way of mimicking all the popular types.
|
||
|
||
Basic software to get a computer to talk through its RS232C port,
|
||
and to take in data sent to it, is trivial. What the hacker needs is
|
||
software that will make his computer assume a number of different
|
||
personalities upon command, store data as it is collected, and print
|
||
it out.
|
||
|
||
Two philosophies of presenting such software to the user exist:
|
||
first, one which gives the naive user a simple menu which says, in
|
||
effect, 'press a key to connect to database' and then performs
|
||
everything smoothly, without distracting menus. Such programs need an
|
||
'install' procedure, which requires some knowledge, but most
|
||
'ordinary' users never see this. Normally, this is a philosophy of
|
||
software writing I very much admire: however, as a hacker you will
|
||
want the precise opposite. The second approach to terminal emulator
|
||
software allows you to re configure your computer as you go on--there
|
||
is plenty of on-screen help in the form of menus allowing you to turn
|
||
on and off local echo, set parity bits, show non-visible control
|
||
codes and so on. In a typical hack, you may have only vague
|
||
information about the target computer, and much of the fun is seeing
|
||
how quickly you can work out what the remote computer wants to 'see'
|
||
- and how to make your machine respond.
|
||
|
||
** Page 19
|
||
|
||
Given the numbers of popular computers on the market, and the
|
||
numbers of terminal emulators for each one, it is difficult to make a
|
||
series of specific recommendations. What follows there- fore, is a
|
||
list of the sort of facilities you should look for:
|
||
|
||
On-line help You must be able to change the software
|
||
characteristics while on-line--no separate 'install' routine. You
|
||
should be able to call up 'help' menus instantly, with simple
|
||
commands --while holding on to the line.
|
||
|
||
Text buffer - The received data should be capable of going into the
|
||
computer's free memory automatically so that you can view it later
|
||
off-line. The size of the buffer will depend on the amount of memory
|
||
left after the computer has used up the space required for its
|
||
operating system and the terminal software. If the terminal software
|
||
includes special graphics, as in Apple Visiterm or some of the ROM
|
||
packs used with the BBC, the buffer space may be relatively small.
|
||
The software should tell you how much buffer space you have used and
|
||
how much is left, at any time. A useful adjunct is an auto-save
|
||
facility which, when the buffer becomes full, stops the stream of
|
||
text from the host computer and automatically saves the buffer text
|
||
to disc. A number of associated software commands should let you turn
|
||
on and off the buffer store, clear it or, when off-line, view the
|
||
buffer. You should also be able to print the buffer to a 'line'
|
||
printer (dot-matrix or daisy wheel or thermal image). Some terminal
|
||
emulators even include a simple line editor, so that you can delete
|
||
or adjust the buffer before printing. (I use a terminal emulator
|
||
which saves text files in a form which can be accessed by my
|
||
word-processor and use that before printing out.)
|
||
|
||
Half/full Duplex (Echo On/Off) - Most remote services use an echoing
|
||
protocol: this means that when the user sends a character to the host
|
||
computer, the host immediately sends back the same character to the
|
||
user's computer, by way of confirmation. What the user sees on his
|
||
computer screen, therefore, has been generated, not locally by his
|
||
direct action on the keyboard, but remotely by the host computer.
|
||
(One effect of this is that there may sometimes be a perceptible
|
||
delay between keystroke and display of a letter, particularly if you
|
||
are using a packet-switched connection--if the telephone line is
|
||
noisy, the display may appear corrupt). This echoing protocol is
|
||
known as full duplex, because both the user's computer and the host
|
||
are in communication simultaneously.
|
||
|
||
However, use of full duplex/echo is not universal, and all
|
||
terminal emulators allow you to switch on and off the facility. If,
|
||
for example, you are talking into a half-duplex system (i.e. no
|
||
echo), your screen would appear totally blank. In these
|
||
circumstances, it is best if your software reproduces on the screen
|
||
your keystrokes.
|
||
|
||
** Page 20
|
||
|
||
However, if you have your computer set for half-duplex and the host
|
||
computer is actually operating in full duplex. each letter will
|
||
appear twice--once from the keyboard and once, echoing from the host,
|
||
ggiiwiinngg tthhiiss ssoorrtt ooff eeffffeecctt. Your terminal
|
||
emulator needs to able to toggle between the two states.
|
||
|
||
Data Format/Parity Setting - In a typical asynchronous protocol, each
|
||
character is surrounded by bits to show when it starts, when it ends,
|
||
and to signify whether a checksum performed on its binary equivalent
|
||
comes out even or odd. The character itself is described, typically,
|
||
in 7 bits and the other bits, start, stop and parity, bringing the
|
||
number up to 10. (See chapter 2.) However, this is merely one very
|
||
common form, and many systems use subtle variants -- the ideal
|
||
terminal emulator software will let you try out these variants while
|
||
you are still on line. Typical variants should include:
|
||
|
||
Word length Parity No stop bits
|
||
|
||
7 Even 2
|
||
7 Odd 2
|
||
7 Even 1
|
||
7 Odd 1
|
||
8 None 2
|
||
8 None 1
|
||
8 Even 1
|
||
8 Odd 1
|
||
|
||
|
||
(NB although the ASCII character set is 7 bit, 8 bits are sometimes
|
||
transmitted with a ~padding~ bit; machine code instructions for 8-bit
|
||
and 16-bit machines obviously need 8-bit transmissions.)
|
||
|
||
Show Control Characters - This is a software switch to display
|
||
characters not normally part of the text that is meant to be read but
|
||
which nevertheless are sent by the host computer to carry out display
|
||
functions, operate protocols, etc. With the switch on, you will see
|
||
line feeds displayed as ^J, a back-space as ^H and so on; see
|
||
Appendix IV for the usual equivalents.
|
||
|
||
Using this device properly you will be able, if you are unable to
|
||
get the text stream to display properly on your screen, to work out
|
||
what exactly is being sent from the host, and modify your local
|
||
software accordingly.
|
||
|
||
** Page 21
|
||
|
||
Control-Show is also useful for spotting 'funnies' in passwords and
|
||
log-on procedures--a common trick is to include ^H (backspace) in the
|
||
middle of a log-on so that part of the full password is overwritten.
|
||
(For normal reading of text, you have Control-Show switched off, as
|
||
it makes normal reading difficult.)
|
||
|
||
Macros - This is the US term, now rapidly being adopted in the UK,
|
||
for the preformatting of a log-on procedure, passwords etc. Typical
|
||
connecting procedures to US services like The Source, CompuServe, Dow
|
||
Jones etc are relatively complicated, compared with using a local
|
||
hobbyist bulletin board or calling up Prestel. Typically, the user
|
||
must first connect to a packet- switched service like Telenet or
|
||
Tymnet (the US commercial equivalents of BT's PSS), specify an
|
||
'address' for the host required (a long string of letters and
|
||
numbers) and then, when the desired service or 'host' is on line,
|
||
enter password(s) to be fully admitted. The password itself may be in
|
||
several parts.
|
||
|
||
The value of the 'macro' is that you can type all this junk in
|
||
once and then send off the entire stream any time you wish by means
|
||
of a simple command. Most terminal emulators that have this feature
|
||
allow you to preformat several such macros.
|
||
|
||
From the hacker's point of view, the best type of macro facility
|
||
is one that can be itself addressed and altered in software:
|
||
supposing you have only part of a password: write a little routine
|
||
which successively tries all the unknowns; you can then let the
|
||
computer attempt penetration automatically. (You'll have to read the
|
||
emulator's manual carefully to see if it has software-addressable
|
||
macros: the only people who need them are hackers, and, as we have
|
||
often observed, very few out-and-out hacker products exist!)
|
||
|
||
Auto-dial - Some modems contain programmable auto-diallers so that
|
||
frequently-called services can be dialled from a single keyboard
|
||
command.
|
||
|
||
Again the advantage to the hacker is obvious--a partly- known
|
||
telephone number can be located by writing some simple software
|
||
routine to test the variables.
|
||
|
||
However, not all auto-dial facilities are equally useful. Some
|
||
included in US-originated communications software and terminal
|
||
emulators are for specific 'smart' modems not available
|
||
elsewhere--and there is no way of altering the software to work with
|
||
other equipment. In general, each modem that contains an auto-dialler
|
||
has its own way of requiring instructions to be sent to it. If an
|
||
auto-dialling facility is important to you, check that your software
|
||
is configurable to your choice of auto-dial modem.
|
||
|
||
Another hazard is that certain auto-diallers only operate on the
|
||
multi-frequency tones method ('touch-tone') of dialling used in large
|
||
parts of the United States and only very slowly being introduced in
|
||
other countries. The system widely used in the UK is called 'pulse'
|
||
dialling. Touch-tone dialling is much more rapid than pulse dialling,
|
||
of course.
|
||
|
||
** Page 22
|
||
|
||
Finally, on the subject of US-originated software, some packages
|
||
will only accept phone numbers in the standard North American format
|
||
of: 3-digit area code, 3-digit local code, 4-digit subscriber code.
|
||
In the UK and Europe the phone number formats vary quite
|
||
considerably. Make sure that any auto-dial facility you use actually
|
||
operates on your phone system.
|
||
|
||
Format Screen - Most professional on-line and time-share services
|
||
assume an 80-column screen. The 'format screen' option in terminal
|
||
emulators may allow you to change the regular text display on your
|
||
micro to show 80 characters across by means of a graphics 'fiddle';
|
||
alternatively, it may give you a more readable display of the stream
|
||
from the host by forcing line feeds at convenient intervals, just
|
||
before the stream reaches the right- hand margin of the micro's
|
||
'natural' screen width.
|
||
|
||
Related to this are settings to handle the presentation of the
|
||
cursor and to determine cursor movement about the screen-- normally
|
||
you won't need to use these facilities, but they may help you when
|
||
on-line to some odd-ball, non-standard service. Certain specific
|
||
'dumb' terminals like the VT52 (which has become something of a
|
||
mainframe industry standard) use special sequences to move the cursor
|
||
about the screen--useful when the operator is filling in standard
|
||
forms of information.
|
||
|
||
Other settings within this category may allow you to view
|
||
characters on your screen which are not part of the normal character
|
||
set. The early Apples, for example, lacked lower case, presenting
|
||
everything in capitals (as does the ZX81), so various ingenious
|
||
'fixes' were needed to cope. Even quite advanced home computers may
|
||
lack some of the full ASCII character set, such oddities as the tilde
|
||
~ or backslash \ or curly bracket { }, for example.
|
||
|
||
Re-assign - keyboard A related problem is that home micro keyboards
|
||
may not be able to generate all the required characters the remote
|
||
service wishes to see. The normal way to generate an ASCII character
|
||
not available from the keyboard is from Basic, by using a Print
|
||
CHR$(n) type command. This may not be possible when on-line to a
|
||
remote computer, where everything is needed in immediate mode. Hence
|
||
the requirement for a software facility to re-assign any little-used
|
||
key to send the desired 'missing' feature. Typical requirements are
|
||
BREAK~ ESC, RETURN (when part of a string as opposed to being the end
|
||
of a command) etc. When re-assigning a series of keys, you must make
|
||
sure you don't interfere with the essential functioning of the
|
||
terminal emulator.
|
||
|
||
** Page 23
|
||
|
||
For example, if you designate the sequence ctrl-S to mean 'send a DC1
|
||
character to the host', the chances are you will stop the host from
|
||
sending anything to you, because ctrl-S is a common command (some-
|
||
times called XOF) to call for a pause--incidentally, you can end the
|
||
pause by hitting ctrl-Q. Appendix IV gives a list of the full ASCII
|
||
implementation and the usual 'special' codes as they apply to
|
||
computer-to-computer communications.
|
||
|
||
File Protocols - When computers are sending large files to each
|
||
other, a further layer of protocol, beyond that defining individual
|
||
letters, is necessary. For example, if your computer is automatically
|
||
saving to disk at regular intervals as the buffer fills up, it is
|
||
necessary to be able to tell the host to stop sending for a period,
|
||
until the save is complete. On older time-share services, where the
|
||
typical terminal is a teletypewriter, the terminal is in constant
|
||
danger of being unable mechanically to keep up with the host
|
||
computer's output. For this reason, many host computers use one of
|
||
two well-known protocols which require the regular exchange of
|
||
special control characters for host and user to tell each other all
|
||
is well. The two protocols are:
|
||
|
||
Stop/Start - The receiving computer can at any time send to the host
|
||
a Stop (ctrl-S) signal, followed by, when it is ready a Start,
|
||
(ctrl-Q).
|
||
|
||
EOB/ACK - The sending computer divides its file into a blocks (of any
|
||
convenient length); after each block is sent, an EOB (End of Block)
|
||
character is sent (see ASCII table, Appendix IV). The user's computer
|
||
must then respond with a ACK (Acknowledge) character.
|
||
|
||
These protocols can be used individually, together or not at all.
|
||
You may be able to use the 'Show Control Codes' option to check
|
||
whether either of the protocols are in use. Alternatively, if you
|
||
have hooked on to a service which for no apparent reason, seems to
|
||
stop in its tracks, you could try ending an ACK or Start (ctrl-F or
|
||
ctrl-S) and see if you can get things moving.
|
||
|
||
File transmission - All terminal emulators assume you will want to
|
||
send, as well as receive, text files. Thus, in addition to the
|
||
protocol settings already mentioned, there may be additional ones for
|
||
that purpose, e.g. the XMODEM protocol very popular on bulletin
|
||
boards. Hackers, of course, usually don't want to place files on
|
||
remote computers.....
|
||
|
||
Specific terminal emulation - Some software has pre-formatted sets of
|
||
characteristics to mimic popular commercial 'dumb' terminals. For
|
||
example, with a ROM costing under <20>60 fitted to a BBC micro, you can
|
||
obtain almost all of the features of DEC's VT100 terminal, which
|
||
until recently was regarded as something of an industry-standard and
|
||
costing just under <20>1000.
|
||
|
||
** Page 24
|
||
|
||
Other popular terminals are the VT52 and some Tektronix models, the
|
||
latter for graphics display. ANSI have produced a 'standard'
|
||
specification.
|
||
|
||
Baudot characters - The Baudot code, or International Telegraphic
|
||
Code No 2, is the 5-bit code used in telex and telegraphy -- and in
|
||
many wire-based news services. A few terminal emulators include it as
|
||
an option, and it is useful if you are attempting to hack such
|
||
services. Most software intended for use on radio link-ups (see
|
||
Chapter 10) operates primarily in Baudot, with ASCII as an option.
|
||
|
||
Viewdata emulation - This gives you the full, or almost full,
|
||
graphics and text characters of UK-standard viewdata. Viewdata tv
|
||
sets and adapters use a special character-generator chip and a few,
|
||
mostly British-manufactured, micros use that chip also-- the Acorn
|
||
Atom was one example. The BBC has a teletext mode which adopts the
|
||
same display. But for most micros, viewdata emulation is a matter of
|
||
using hi-res graphics to mimic the qualities of the real thing, or to
|
||
strip out most of the graphics. Viewdata works on a screen 40
|
||
characters by 24 rows, and as some popular home micros have 'native'
|
||
displays smaller than that, some considerable fiddling is necessary
|
||
to get them to handle viewdata at all.
|
||
|
||
In some emulators, the option is referred to as Prestel or
|
||
Micronet--they are all the same thing. Micronet-type software usually
|
||
has additional facilities for fetching down telesoftware programs
|
||
(see Chapter 10).
|
||
|
||
Viewdata emulators must attend not only to the graphics
|
||
presentation, but also to split-speed operation: the usual speeds are
|
||
1200 receive from host, 75 transmit to host. USA users of such
|
||
services may get them via a packet-switched network, in which case
|
||
they will receive it either at 1200/1200 full duplex or at 300/300.
|
||
|
||
Integrated terminal emulators offering both 'ordinary'
|
||
asynchronous emulation and viewdata emulation are rare: I have to use
|
||
completely different and non-compatible bits of software on my own
|
||
home set-up.
|
||
|
||
|
||
Modems
|
||
|
||
Every account of what a modem is and does begins with the classic
|
||
explanation of the derivation of the term: let this be no exception.
|
||
Modem is a contraction of modulator-demodulator.
|
||
|
||
A modem taking instructions from a computer (pin 2 on RS232C)
|
||
converts the binary 0's and 1's into specific single tones, according
|
||
to which 'standard' is being used. In RS232C/V24, binary 0 (ON)
|
||
appears as positive volts and binary 1 (OFF) appears as negative
|
||
volts.
|
||
|
||
** Page 25
|
||
|
||
The tones are then fed, either acoustically via the telephone
|
||
mouth-piece into the telephone line, or electrically, by generating
|
||
the electrical equivalent direct onto the line. This is the
|
||
modulating process.
|
||
|
||
In the demodulating stage, the equipment sits on the phone line
|
||
listening for occurrences of pre-selected tones (again according to
|
||
whichever 'standard' is in operation) and, when it hears one,
|
||
delivers a binary 0 or binary 1 in the form of positive or negative
|
||
voltage pulses into pin 3 of the computer's serial port.
|
||
|
||
This explanation holds true for modems operating at up to 1200
|
||
baud; above this speed, the modem must be able to originate tones,
|
||
and detect them according to phase as well, but since higher-speed
|
||
working is unusual in dial-up ports--the hacker's special interest,
|
||
we can leave this matter to one side.
|
||
|
||
The modem is a relatively simple bit of kit: on the transmit side
|
||
it consists of a series of oscillators acting as tone generators, and
|
||
on receive has a series of narrow band-pass filters. Designers of
|
||
modems must ensure that unwanted tones do not leak into the telephone
|
||
line (exchanges and amplifiers used by telephone companies are
|
||
sometimes remotely controlled by the injection of specific tones) and
|
||
also that, on the receive side, only the distinct tones used for
|
||
communications are 'interpreted' into binary 0s or 1s. The other
|
||
engineering requirements are that unwanted electrical currents do not
|
||
wander down the telephone cable (to the possible risk of phone
|
||
company employees) or back into the user's computer.
|
||
|
||
Until relatively recently, the only UK source of low-speed modems
|
||
was British Telecom. The situation is much easier now, but
|
||
de-regulation of 'telephone line attachments', which include modems,
|
||
is still so recent that the ordinary customer can easily become
|
||
confused. Moreover, modems offering exactly the same service can vary
|
||
in price by over 300%. Strictly speaking, all modems connected to
|
||
the phone line should be officially approved by BT or other
|
||
appropriate regulatory authority.
|
||
|
||
At 300 baud, you have the option of using direct-connect modems
|
||
which are hard-wired into the telephone line, an easy enough
|
||
exercise, or using an acoustic coupler in which you place the
|
||
telephone hand-set. Acoustic couplers are inherently prone to
|
||
interference from room-noise, but are useful for quick lash-ups and
|
||
portable operation. Many acoustic couplers operate only in
|
||
'originate' mode, not in' answer'. Newer commercial direct- connect
|
||
modems are cheaper than acoustic couplers.
|
||
|
||
** Page 26
|
||
|
||
At higher speeds acoustic coupling is not recommended, though a
|
||
75/1200 acoustic coupler produced in association with the Prestel
|
||
Micronet service is not too bad, and is now exchanged on the
|
||
second-hand market very cheaply indeed.
|
||
|
||
I prefer modems that have proper status lights--power on, line
|
||
seized, transmit and receive indicators. Hackers need to know what is
|
||
going on more than most users.
|
||
|
||
The table below shows all but two of the types of service you are
|
||
likely to come across; V-designators are the world-wide 'official'
|
||
names given by the CCITT; Bell-designators are the US names:
|
||
|
||
Service Speed Duplex Transmit Receive Answer
|
||
Designator 0 1 0 1
|
||
|
||
V21 orig 300(*) full 1180 980 1850 1650 -
|
||
V21 ans 300(*) full 1850 1650 1180 980 2100
|
||
V23 (1) 600 half 1700 1300 1700 1300 2100
|
||
V23 (2) 1200 f/h(**) 2100 1300 2100 1300 2100
|
||
V23 back 75 f/h(**) 450 390 450 390 -
|
||
Bell 103 orig 300(*) full 1070 1270 2025 2225 -
|
||
Bell 103 ans 300(*) full 2025 2225 1070 1270 2225
|
||
Bell 202 1200 half 2200 1200 2200 1200 2025
|
||
|
||
(*)any speed up to 300 baud, can also include 75 and 110 baud
|
||
services
|
||
|
||
(**)service can either be half-duplex at 1200 baud or asymmetrical
|
||
full duplex, with 75 baud originate and 1200 baud receive (commonly
|
||
used as viewdata user) or 1200 transmit and 75 receive (viewdata
|
||
host)
|
||
|
||
The two exceptions are:
|
||
V22 1200 baud full duplex, two wire
|
||
Bell 212A The US equivalent
|
||
These services use phase modulation as well as tone.
|
||
|
||
British Telecom markets the UK services under the name of
|
||
Datel--details are given in Appendix V.
|
||
|
||
BT's methods of connecting modems to the line are either to
|
||
hard-wire the junction box (the two outer-wires are the ones you
|
||
usually need)--a 4-ring plug and associated socket (type 95A) for
|
||
most modems, a 5-ring plug and associated socket (type 96A) for
|
||
Prestel applications (note that the fifth ring isn't used)--and, for
|
||
all new equipment, a modular jack called type 600. The US also has a
|
||
modular jack, but of course it is not compatible.
|
||
|
||
** Page 27
|
||
|
||
Modern modem design is greatly aided by a wonder chip called the
|
||
AMD 7910. This contains nearly all the facilities to modulate and
|
||
demodulate the tones associated with the popular speed services, both
|
||
in the CCITT and Bell standards. The only omission--not always made
|
||
clear in the advertisements--are services using 1200/1200
|
||
full-duplex, ie V22 and Bell 212A.
|
||
|
||
Building a modem is now largely a question of adding a few
|
||
peripheral components, some switches and indicator lights, and a box.
|
||
In deciding which 'world standard' modem to purchase, hackers should
|
||
consider the following features:
|
||
|
||
Status lights you need to be able to see what is happening on the
|
||
line.
|
||
|
||
Hardware/software switching - cheaper versions merely give you a
|
||
switch on the front enabling you to change speeds, originate or
|
||
answer mode and CClTT or Bell tones. More expensive ones feature
|
||
firmware which allows your computer to send specially formatted
|
||
instructions to change speed under program control. However, to make
|
||
full use of this facility, you may need to write (or modify) your
|
||
terminal emulator.
|
||
|
||
Auto-dial - a pulse dialler and associated firmware are included in
|
||
some more expensive models. You should ascertain whether the
|
||
auto-dialer operates on the telephone system you intend to hook the
|
||
modem up to--some of the US 'smart' modems present difficulties
|
||
outside the States. You will of course need software in your micro to
|
||
address the firmware in the modem --and the software has to be part
|
||
of your terminal emulator, otherwise you gain nothing in convenience.
|
||
However, with appropriate software, you can get your computer to try
|
||
a whole bank of numbers one after the other.
|
||
|
||
D25 connector - this is the official 'approved' RS232CN24 physical
|
||
connection--useful from the point-of-view of easy hook-up. A number
|
||
of lower-cost models substitute alternative DIN connectors. You must
|
||
be prepared to solder up your own cables to be sure of connecting up
|
||
properly.
|
||
|
||
Documentation I always prefer items to be accompanied by proper
|
||
instructions. Since hackers tend to want to use equipment in
|
||
unorthodox ways, they should look for good documentation too.
|
||
|
||
** Page 28
|
||
|
||
Finally, a word on build-your-own modems. A number of popular
|
||
electronics magazines and mail-order houses have offered modem
|
||
designs. Such modems are not likely to be approved for direct
|
||
connection to the public telephone network. However, most of them
|
||
work. If you are uncertain of your kit-constructing skills, though.
|
||
remember badly-built modems can be dangerous both to your computer
|
||
and to the telephone network.
|
||
|
||
|
||
Test Equipment
|
||
|
||
Various items of useful test equipment occasionally appear on the
|
||
second-hand market--via mail-order, in computer junk shops, in the
|
||
flea-market section of exhibitions and via computer clubs.
|
||
|
||
It's worth searching out a cable 'break-out' box. This lets you
|
||
restrap a RS232C cable without using a soldering iron--the various
|
||
lines are brought out on to an accessible matrix and you use small
|
||
connectors to make (or break) the links you require. It's useful if
|
||
you have an 'unknown' modem, or an unusually configured computer.
|
||
|
||
Related, but much more expensive, is a RS232C/V24 analyser --this
|
||
gives LED status lights for each of the important lines, so you can
|
||
see what is happening.
|
||
|
||
Lastly, if you are a very rich and enthusiastic hacker, you can
|
||
buy a protocol analyser. This is usually a portable device with a
|
||
VDU, full keyboard, and some very clever firmware which examines the
|
||
telephone line or RS232C port and carries out tests to see which of
|
||
several popular datacomms protocols is in use. Hewlett Packard do a
|
||
nice range. Protocol analysers will handle synchronous transmissions
|
||
as well as synchronous. Cost: <20>1500 and up...and up.
|
||
|
||
** Page 29
|
||
|
||
|
||
|
||
CHAPTER 4
|
||
|
||
|
||
Targets
|
||
|
||
Wherever hackers gather, talk soon moves from past achievements
|
||
and adventures to speculation about what new territory might be
|
||
explored. It says much about the compartmentalisation of computer
|
||
specialities in general and the isolation of micro- owners from
|
||
mainstream activities in particular that a great deal of this
|
||
discussion is like that of navigators in the days before Columbus:
|
||
the charts are unreliable, full of blank spaces and confounded with
|
||
myth.
|
||
|
||
In this chapter I am attempting to provide a series of notes on
|
||
the main types of services potentially available on dial-up, and to
|
||
give some idea of the sorts of protocols and conventions employed.
|
||
The idea is to give voyagers an outline atlas of what is interesting
|
||
and possible, and what is not.
|
||
|
||
|
||
On-line hosts
|
||
|
||
On-line services were the first form of electronic publishing: a
|
||
series of big storage computers--and on occasion, associated
|
||
dedicated networks -- act as hosts to a group of individual databases
|
||
by providing not only mass data storage and the appropriate 'search
|
||
language' to access it, but also the means for registering, logging
|
||
and billing users. Typically, users access the on-line hosts via a
|
||
phone number which links into a a public data network using packet
|
||
switching (there's more on these networks in chapter 7).
|
||
|
||
The on-line business began almost by accident; large corporations
|
||
and institutions involved in complicated technological developments
|
||
found that their libraries simply couldn't keep track of the
|
||
publication of relevant new scientific papers, and decided to
|
||
maintain indices of the papers by name, author, subject-matter, and
|
||
so on, on computer. One of the first of these was the armaments and
|
||
aircraft company, Lockheed Corporation.
|
||
|
||
In time the scope of these indices expanded and developed and
|
||
outsiders -- sub-contractors, research agencies, universities,
|
||
government employees, etc were granted access. Other organisations
|
||
with similar information-handling requirements asked if space could
|
||
be found on the computer for their needs.
|
||
|
||
** Page 30
|
||
|
||
Eventually Lockheed and others recognised the beginnings of a quite
|
||
separate business; in Lockheed's case it lead to the foundation of
|
||
Dialogue, which today acts as host and marketing agent for almost 300
|
||
separate databases. Other on-line hosts include BRS (Bibliographic
|
||
Retrieval Services), Comshare (used for sophisticated financial
|
||
modelling), DataStar, Blaise (British Library) I P Sharp, and
|
||
Euronet-Diane.
|
||
|
||
On-line services, particularly the older ones, are not especially
|
||
user-friendly by modern standards. They were set up at a time when
|
||
both core and storage memory was expensive, and the search languages
|
||
tend to be abbreviated and formal. Typically they are used, not by
|
||
the eventual customer for the information, but by professional
|
||
intermediaries--librarians and the like-- who have undertaken special
|
||
courses. Originally on-line hosts were accessed by dumb terminals,
|
||
usually teletypewriters like the Texas Whisperwriter portable with
|
||
built-in acoustic modem, rather than by VDUs. Today the trend is to
|
||
use 'front-end' intelligent software on an IBM PC which allows the
|
||
naive user to pose his/her questions informally while offline; the
|
||
software then redefines the information request into the formal
|
||
language of the on-line host (the user does not witness this process)
|
||
and then goes on-line via an auto-dial modem to extract the
|
||
information as swiftly and efficiently as possible.
|
||
|
||
On-line services require the use of a whole series of passwords:
|
||
the usual NUI and NUA for PSS (see chapter 7), another to reach the
|
||
host, yet another for the specific information service required.
|
||
Charges are either for connect-time or per record retrieved, or
|
||
sometimes a combination.
|
||
|
||
The categories of on-line service include bibliographic, which
|
||
merely indexes the existence of an article or book--you must then
|
||
find a physical copy to read; and source, which contains the article
|
||
or extract thereof. Full-text services not only contain the complete
|
||
article or book but will, if required, search the entire text (as
|
||
opposed to mere keywords) to locate the desired information. An
|
||
example of this is LEXIS, a vast legal database which contains nearly
|
||
all important US and English law judgements, as well as statutes.
|
||
|
||
|
||
News Services
|
||
|
||
The vast majority of news services, even today, are not, in the
|
||
strictest sense, computer-based, although computers play an important
|
||
role in assembling the information and, depending on the nature of
|
||
the newspaper or radio or tv station receiving it, its subsequent
|
||
handling.
|
||
|
||
** Page 31
|
||
|
||
The world's big press agencies--United Press, Associated Press,
|
||
Reuters, Agence France Presse, TASS, Xinhua, PAP, VoA -- use telex
|
||
techniques to broadcast their stories. Permanent leased telegraphy
|
||
lines exist between agencies and customers, and the technology is
|
||
pure telex: the 5-bit Baudot code (rather than ASCII) is adopted,
|
||
giving capital letters only, and 'mark' and space' are sent by
|
||
changing voltage conditions on the line rather than audio tones.
|
||
Speeds are 50 or 75 baud.
|
||
|
||
The user cannot interrogate the agency in any way. The stories
|
||
come in a single stream which is collected on rolls of paper and then
|
||
used as per the contract between agency and subscriber. To hack a
|
||
news agency line you will need to get physically near the appropriate
|
||
leased line, tap in by means of an inductive loop, and convert the
|
||
changing voltage levels (+80 volts on the line) into something your
|
||
RS232C port can handle. You will then need software to translate the
|
||
Baudot code into the ASCII which your computer can handle internally,
|
||
and display on screen or print to a file. The Baudot code is given in
|
||
Appendix IV.
|
||
|
||
None of this is easy and will probably involve breaches of several
|
||
laws, including theft of copyright material! However a number of news
|
||
agencies also transmit services by radio, in which case the signals
|
||
can be hijacked with a short-wave receiver. Chapter 9 explains.
|
||
|
||
Historic news, as opposed to the current stuff from agencies, is
|
||
now becoming available on-line. The New York Times, for example, has
|
||
long held its stories in an electronic 'morgue' or clippings library.
|
||
Initially this was for internal use, but for the last several years
|
||
it has been sold to outsiders, chiefly broadcasting stations and
|
||
large corporations. You can search for information by a combination
|
||
of keyword and date-range. The New York Times Information Bank is
|
||
available through several on-line hosts.
|
||
|
||
As the world's great newspapers increasingly move to electronic
|
||
means of production--journalists working at VDUs, sub-editors
|
||
assembling pages and direct-input into photo-typesetters--the
|
||
additional cost to each newspaper of creating its own morgue is
|
||
relatively slight and we can expect to see many more commercial
|
||
services.
|
||
|
||
In the meantime, other publishing organisations have sought to
|
||
make available articles, extract or complete, from leading magazines
|
||
also. Two UK examples are Finsbury Data Services' Textline and
|
||
Datasolve's d Reporter, the latter including material from the BBC's
|
||
monitoring service, Associated Press, the Economist and the Guardian.
|
||
Textline is an abstract service, but World Reporter gives the full
|
||
text. In October 1984 it already held 500 million English words.
|
||
|
||
** Page 32
|
||
|
||
In the US there is NEXIS, which shares resources with LEXIS; NEXIS
|
||
held 16 million full text articles at that same date. All these
|
||
services are expensive for casual use and are accessed by dial-up
|
||
using ordinary asynchronous protocols.
|
||
|
||
Many electronic newsrooms also have dial-in ports for reporters
|
||
out on the job; depending on the system these ports not only allow
|
||
the reporter to transmit his or her story from a portable computer,
|
||
but may also (like Basys Newsfury used by Channel Four News) let them
|
||
see news agency tapes, read headlines and send electronic mail. Such
|
||
systems have been the subject of considerable hacker speculation.
|
||
|
||
|
||
Financial Services
|
||
|
||
The financial world can afford more computer aids than any other
|
||
non-governmental sector. The vast potential profits that can be made
|
||
by trading huge blocks of currency, securities or commodities--and
|
||
the extraordinary advantages that a slight 'edge' in information can
|
||
bring--have meant that the City, Wall Street and the equivalents in
|
||
Hong Kong, Japan and major European capitals have been in the
|
||
forefront of getting the most from high-speed comms.
|
||
|
||
Ten years ago the sole form of instant financial information was
|
||
the ticker tape--telegraphy technology delivering the latest share
|
||
price movements in a highly abbreviated form. As with its news
|
||
equivalents, these were broadcast services (and still are, for the
|
||
services still exist) sent along leased telegraph lines. The user
|
||
could only watch, and 'interrogation' consisted of back-tracking
|
||
along a tape of paper. Extel (Exchange Telegraph) continues to use
|
||
this technique, though it is gradually upgrading by using viewdata
|
||
and intelligent terminals.
|
||
|
||
However, just over ten years ago Reuters put together the first
|
||
packages which gave some intelligence and 'questioning power' to the
|
||
end user. Each Reuters' Monitor is intelligent, containing (usually)
|
||
a DEC PDP-8 series mini and some firmware which accepts and selects
|
||
the stream of data from the host at the far end of the leased line,
|
||
marshalls interrogation requests and takes care of the local display.
|
||
Information is formatted in 'pages' rather like viewdata frames, but
|
||
without the colour. There is little point in eavesdropping into a
|
||
Reuters line unless you know what the terminal firmware does. Reuters
|
||
now face an aggressive rival in Telerate, and the fight is on to
|
||
deliver not only fast comprehensive prices services but international
|
||
screen-based dealing as well. The growth of Reuters and its rivals is
|
||
an illustration of technology creating markets--especially in
|
||
international currency--where none existed before.
|
||
|
||
** Page 33
|
||
|
||
The first sophisticated Stock Exchange prices 'screens' used
|
||
modified closed circuit television technology. London had a system
|
||
called Market Price Display Service--MPDS--which consisted of a
|
||
number of tv displays of current prices services on different
|
||
'channels' which could be selected by the user. But London now uses
|
||
TOPIC, a leased line variant on viewdata technology, though with its
|
||
magazine-like arrangement and auto-screen refresh, it has as much in
|
||
common with teletext as Prestel. TOPIC carries about 2,500 of the
|
||
total 7,500 shares traded in London, plus selected analytical
|
||
material from brokers. Datastream represents a much higher level of
|
||
sophistication: using its <20>40,000 plus pa terminals you can compare
|
||
historic data-- price movements, movements against sector indices
|
||
etc--and chart the results.
|
||
|
||
The hacker's reward for getting into such systems is that you can
|
||
see share and other prices on the move. None of these prices is
|
||
confidential; all could be obtained by ringing a stockbroker.
|
||
However, this situation is likely to change; as the City makes the
|
||
change from the traditional broker/jobber method of dealing towards
|
||
specialist market making, there will then be electronic prices
|
||
services giving privileged information to specialist share dealers.
|
||
All these services are only available via leased lines; City
|
||
professionals would not tolerate the delays and uncertainties of
|
||
dial-up facilities. However dial-up ports exist for demonstrations,
|
||
exhibitions, engineering and as back-up--and a lot of hacking effort
|
||
has gone into tracking them down.
|
||
|
||
In the United States, in addition to Reuters, Telerate and local
|
||
equivalents of official streams of stock exchange and over-the-
|
||
counter data, there is Dow Jones, best known internationally for its
|
||
market indices similar to those produced by the Financial Times in
|
||
London. Dow Jones is in fact the owner of the Wall Street Journal and
|
||
some influential business magazines. Its Dow Jones News/Retrieval
|
||
Service is aimed at businesses and private investors. It features
|
||
current share prices, deliberately delayed by 15 minutes, historic
|
||
price data, which can be charted by the user's own computer
|
||
(typically an Apple or IBM PC) and historic 'morgue' type company
|
||
news and analysis. Extensions of the service enable customers to
|
||
examine accounts of companies in which they are interested. The bulk
|
||
of the information is US-based, but can be obtained world-wide via
|
||
packet-switching networks. All you need are the passwords and special
|
||
software.
|
||
|
||
** Page 34
|
||
|
||
|
||
Business Information
|
||
|
||
Business information is usually about the credit-worthiness of
|
||
companies, company annual reports, trading opportunities and market
|
||
research. The biggest electronic credit data resource is owned by the
|
||
international company Dun & Bradstreet: during 1985-86 it is due to
|
||
spend <20>25m on making its data available all over Europe, including
|
||
the UK. The service, which covers more than 250,000 UK businesses, is
|
||
called DunsPrint and access is both on-line and via a viewdata
|
||
front-end processor. Another credit agency, CNN Services, extensively
|
||
used already by the big clearing banks, and with 3000 customers
|
||
accessing information via viewdata sets, has recently also announced
|
||
an extended electronic retrieval service for its own called Guardian
|
||
Business Information A third UK credit service available
|
||
electronically is called InfoLink.
|
||
|
||
In addition, all UK companies quoted on the London Stock Exchange
|
||
and many others of any size who are not, have a report and analysis
|
||
available from ICC (InterCompany Comparisons) who can be accessed via
|
||
on--line dial--up, through a viewdata interface and also by
|
||
Datastream customers. Dun & Bradstreet also have an on--line service
|
||
called KBE covering 20,000 key British enterprises.
|
||
|
||
Prodigious quantities of credit and background data on US
|
||
companies can be found on several of the major on--line hosts. A
|
||
valid phone number, passwords and extracts from the operations manual
|
||
of one of the largest US services, TRW--it has credit histories on 90
|
||
million people--sat on some hackers' bulletin boards (of which much
|
||
more later) for over twelve months during 1983 and 1984 before the
|
||
company found out. No one knows how many times hackers accessed the
|
||
service. According to the Washington Post, the password and manual
|
||
had been obtained from a Sears Roebuck national chain store in
|
||
Sacramento; some hackers claimed they were able to alter credit
|
||
records, but TRW maintain that telephone access to their systems is
|
||
designed for read-only operations alone, updating of files taking
|
||
place solely on magnetic tape.
|
||
|
||
US market research and risk analysis comes from Frost Sullivan.
|
||
Risk analysis tells international businessmen which countries are
|
||
politically or economically unstable, or likely t become so, and so
|
||
unsafe to do business with. I once found myself accessing a
|
||
viewdata-based international assessment service run b a company
|
||
called Control Risks, which reputedly has strong link to the Special
|
||
Air Service. As so often happens when hacker think they are about to
|
||
uncover secret knowledge, the actual data files seemed relatively
|
||
trivial, the sort of judgements that could be made by a bright sixth
|
||
former who read posh newspapers and thoughtful weekly magazines.
|
||
|
||
** Page 35
|
||
|
||
|
||
University facilities
|
||
|
||
In complete contrast to computers that are used to store and
|
||
present data are those where the value is to deliver processing power
|
||
to the outside world. Paramount among these are those installed in
|
||
universities and research institutes.
|
||
|
||
Although hackers frequently acquire phone numbers to enter such
|
||
machines, what you can do once you are there varies enormously. There
|
||
are usually tiers and banks of passwords, each allowing only limited
|
||
access to the range of services. It takes considerable knowledge of
|
||
the machine's operating system to break through from one to another
|
||
and indeed, in some cases, the operating system is so thoroughly
|
||
embedded in the mainframe's hardware architecture that the
|
||
substantial modifications necessary to permit a hacker to roam free
|
||
can only be done from a few designated terminals, or by having
|
||
physical access to the machine. However, the hobbyist bulletin board
|
||
system quite often provides passwords giving access to games and the
|
||
ability to write and run programs in exotic languages--my own first
|
||
hands--on experience of Unix came in exactly this way. There are
|
||
bulletin boards on mainframes and even, in some cases, boards for
|
||
hackers!
|
||
|
||
Given the nature of hacking, it is not surprising that some of the
|
||
earliest japes occurred on computers owned by universities. Way back
|
||
in the 1970s, MIT was the location of the famous 'Cookie Monster',
|
||
inspired by a character in the then-popular Rowan & Martin Laugh-in
|
||
television show. As someone worked away at their terminal, the word
|
||
'cookie' would appear across their screen, at first slowly wiping out
|
||
the user's work. Unless the user moved quickly, things started to
|
||
speed up and the machine would flash urgently: "Cookie, cookie, give
|
||
me a cookie". The whole screen would pulse with this message until,
|
||
after a while, the hacking program relented and the 'Monster' would
|
||
clear the screen, leaving the message: "I didn't want a cookie
|
||
anyway." It would then disappear into the computer until it snared
|
||
another unsuspecting user. You could save yourself from the Monster
|
||
by typing the word "Cookie", to which it replied "Thank you" and then
|
||
vanished.
|
||
|
||
In another US case, this time in 1980, two kids in Chicago,
|
||
calling themselves System Cruncher and Vladimir, entered the computer
|
||
at DePaul University and caused a system crash which cost $22,000 to
|
||
fix. They were prosecuted, given probation and were then made a movie
|
||
offer.
|
||
|
||
** Page 36
|
||
|
||
In the UK, many important university and research institution
|
||
computers have been linked together on a special data network called
|
||
SERCNET. SERC is the Science and Engineering Research Council.
|
||
Although most of the computers are individually accessible via PSS,
|
||
SERCNET makes it possible to enter one computer and pass through to
|
||
others. During early 1984, SERCNET was the target of much hacker
|
||
attention; a fuller account appears in chapter 7, but to anticipate a
|
||
little, a local entry node was discovered via one of the London
|
||
University college computers with a demonstration facility which, if
|
||
asked nicely, disgorged an operating manual and list of 'addresses'.
|
||
One of the minor joys of this list was an entry labelled "Gateway to
|
||
the Universe", pure Hitch-hiker material, concealing an extensive
|
||
long-term multi-function communications project. Eventually some
|
||
hackers based at a home counties university managed to discover ways
|
||
of roaming free around the network....
|
||
|
||
|
||
Banking
|
||
|
||
Prominent among public fantasies about hackers is the one where
|
||
banks are entered electronically, accounts examined and some money
|
||
moved from one to another. The fantasies, bolstered by
|
||
under-researched low-budget movies and tv features, arise from
|
||
confusing the details of several actual happenings.
|
||
|
||
Most 'remote stealing' from banks or illicit obtaining of account
|
||
details touch computers only incidentally and involve straight-
|
||
forward fraud, conning or bribery of bank employees. In fact, when
|
||
you think about the effort involved, human methods would be much more
|
||
cost-effective for the criminal. For hackers, however, the very
|
||
considerable effort that has been made to provide security makes the
|
||
systems a great challenge in them- selves.
|
||
|
||
In the United Kingdom, the banking scene is dominated by a handful
|
||
of large companies with many branches. Cheque clearing and account
|
||
maintenance are conducted under conditions of high security with
|
||
considerable isolation of key elements; inter-bank transactions in
|
||
the UK go through a scheme called CHAPS, Clearing House Automatic
|
||
Payments System, which uses the X.25 packet switching protocols (see
|
||
chapter 7). The network is based on Tandem machines; half of each
|
||
machine is common to the network and half unique to the bank. The
|
||
encryption standard used is the US Data Encryption Standard. Certain
|
||
parts of the network, relating to the en- and de-cryption of
|
||
messages, apparently auto-destruct if tampered with.
|
||
|
||
** Page 37
|
||
|
||
The service started early in 1984. The international equivalent
|
||
is SWIFT (Society for Worldwide Interbank Financial Transactions);
|
||
this is also X.25- based and it handles about half-a-million messages
|
||
a day. If you want to learn someone's balance, the easiest and most
|
||
reliable way to obtain it is with a plausible call to the local
|
||
branch. If you want some easy money, steal a cheque book and cheque
|
||
card and practise signature imitation. Or, on a grander scale, follow
|
||
the example of the <20>780,000 kruggerand fraud in the City. Thieves
|
||
intercepted a telephone call from a solicitor or bank manager to
|
||
'authenticate' forged drafts; the gold coins were then delivered to a
|
||
bogus company.
|
||
|
||
In the United States, where federal law limits the size of an
|
||
individual bank's operations and in international banking, direct
|
||
attacks on banks has been much easier because the technology adopted
|
||
is much cruder and more use is made of public phone and telex lines.
|
||
One of the favourite techniques has been to send fake authorisations
|
||
for money transfers. This was the approach used against the Security
|
||
National Pacific Bank by Stanley Rifkin and a Russian diamond dealer
|
||
in Geneva. $10.2m moved from bank to bank across the United States
|
||
and beyond. Rifkin obtained code numbers used in the bilateral Test
|
||
Keys. The trick is to spot weaknesses in the cryptographic systems
|
||
used in such authorisations. The specifications for the systems
|
||
themselves are openly published; one computer security expert, Leslie
|
||
Goldberg, was recently able to take apart one scheme--proposed but
|
||
not actually implemented--and show that much of the 'key' that was
|
||
supposed to give high level cryptographic security was technically
|
||
redundant, and could be virtually ignored. A surprisingly full
|
||
account of his 'perfect' fraud appears in a 1980 issue of the journal
|
||
Computer Fraud and Security Bulletin.
|
||
|
||
There are, however, a few areas where banking is becoming
|
||
vulnerable to the less mathematically literate hacker. A number of
|
||
international banks are offering their big corporation customers
|
||
special facilities so that their Treasury Departments (which ensure,
|
||
among other things, that any spare million dollars are not left doing
|
||
nothing over night but are earning short-term interest) can have
|
||
direct access to their account details via a PC on dial-up. Again,
|
||
telebanking is now available via Prestel and some of its overseas
|
||
imitators. Although such services use several layers of passwords to
|
||
validate transactions, if those passwords are mis-acquired, since no
|
||
signatures are involved, the bank account becomes vulnerable.
|
||
|
||
** Page 38
|
||
|
||
Finally, the network of ATMs (hole-in-the-wall cash machines) is
|
||
expanding greatly. As mentioned early in this book, hackers have
|
||
identified a number of bugs in the machines. None of them,
|
||
incidentally, lead directly to fraud. These machines allow card-
|
||
holders to extract cash up to a finite limit each week (usually
|
||
<EFBFBD>100). The magnetic stripe contains the account number, validation
|
||
details of the owner's PIN (Personal Identity Number), usually 4
|
||
digits, and a record of how much cash has been drawn that week. The
|
||
ATM is usually off-line to the bank's main computer and only goes
|
||
on-line in two circumstances--first, during business hours, to
|
||
respond to a customer's 'balance request'; and second, outside
|
||
regular hours, to take into local memory lists of invalid cards which
|
||
should not be returned to the customer, and to dump out cheque book
|
||
and printed statement requests.
|
||
|
||
Hackers have found ways of getting more than their cash limit each
|
||
week. The ATMs belonging to one clearing bank could be 'cheated' in
|
||
this way: you asked for your maximum amount and then, when the
|
||
transaction was almost completed, the ATM asked you 'Do you want
|
||
another transaction, Yes/No?' If you responded 'yes' you could then
|
||
ask for--and get--your credit limit again, and again, and again. The
|
||
weakness in the system was that the magnetic stripe was not
|
||
overwritten to show you had had a transaction till it was physically
|
||
ejected from the machine. This bug has now been fixed.
|
||
|
||
A related but more bizarre bug resided for a while on the ATMs
|
||
used by that first bank's most obvious High Street rivals. In that
|
||
case, you had to first exhaust your week's limit. You then asked for
|
||
a further sum, say <20>75. The machine refused but asked if you wanted a
|
||
further transaction. Then, you slowly decremented the amounts you
|
||
were asking for by <20>5...70, 65, 60...and so on, down to <20>10. You then
|
||
told the ATM to cancel the last <20>5 transaction...and the machine gave
|
||
you the full <20>75. Some hackers firmly believe the bug was placed
|
||
there by the original software writer. This bug too has now been
|
||
fixed.
|
||
|
||
Neither of these quirks resulted in hackers 'winning' money from
|
||
the banks involved; the accounts were in every case, properly
|
||
debited. The only victory was to beat the system. For the future, I
|
||
note that the cost of magnetic stripe reader/writers which interface
|
||
to PCs is dropping to very low levels. I await the first inevitable
|
||
news reports.
|
||
|
||
|
||
Electronic Mail
|
||
|
||
Electronic mail services work by storing messages created by some
|
||
users until they are retrieved by their intended recipients.
|
||
|
||
** Page 39
|
||
|
||
The ingredients of a typical system are: registration/logging on
|
||
facilities, storage, search and retrieval, networking, timing and
|
||
billing. Electronic mail is an easy add-on to most mainframe
|
||
installations, but in recent years various organisations have sought
|
||
to market services to individuals, companies and industries where
|
||
electronic mail was the main purpose of the system, not an add-on.
|
||
|
||
The system software in widest use is that of ITI-Dialcom; it's the
|
||
one that runs Telecom Gold. Another successful package is that used
|
||
in the UK and USA by Easylink, which is supported by Cable & Wireless
|
||
and Western Union.
|
||
|
||
In the Dialcom/Telecom Gold service, the assumption is made that
|
||
most users will want to concentrate on a relatively narrow range of
|
||
correspondents. Accordingly, the way it is sold is as a series of
|
||
systems, each run by a 'manager': someone within a company. The
|
||
'manager' is the only person who has direct contact with the
|
||
electronic mail owner and he in turn is responsible for bringing
|
||
individual users on to his 'system' -- he can issue 'mailboxes'
|
||
direct, determine tariff levels, put up general messages. In most
|
||
other services, every user has a direct relationship with the
|
||
electronic mail company.
|
||
|
||
The services vary according to their tariff structures and levels;
|
||
and also in the additional facilities: some offer bi-directional
|
||
interfaces to telex; and some contain electronic magazines, a little
|
||
like videotex.
|
||
|
||
The basic systems tend to be quite robust and hacking is mainly
|
||
concentrated on second-guessing users IDs. Many of the systems have
|
||
now sought to increase security by insisting on passwords of a
|
||
certain length--and by giving users only three or four attempts at
|
||
logging on before closing down the line. But increasingly their
|
||
customers are using PCs and special software to automate logging-in.
|
||
The software packages of course have the IDs nicely pre-stored....
|
||
|
||
|
||
Government computers
|
||
|
||
Among hackers themselves the richest source of fantasising
|
||
revolves around official computers like those used by the tax and
|
||
national insurance authorities, the police, armed forces and
|
||
intelligence agencies.
|
||
|
||
The Pentagon was hacked in 1983 by a 19-year-old Los Angeles
|
||
student, Ronald Austin. Because of the techniques he used, a full
|
||
account is given in the operating systems section of chapter 6. NASA,
|
||
the Space Agency, has also acknowledged that its e-mail system has
|
||
been breached and that messages and pictures of Kilroy were left as
|
||
graffiti.
|
||
|
||
** Page 40
|
||
|
||
This leaves only one outstanding mega-target, Platform, the global
|
||
data network of 52 separate systems focused on the headquarters of
|
||
the US's electronic spooks, the National Security Agency at Fort
|
||
Meade, Maryland. The network includes at least one Cray-1, the worlds
|
||
most powerful number-cruncher, and facilities provided by GCHQ at
|
||
Cheltenham.
|
||
|
||
Although I know UK phone freaks who claim to have managed to
|
||
appear on the internal exchanges used by Century House (M16) and
|
||
Curzon Street House (M15) and have wandered along AUTOVON, the US
|
||
secure military phone network, I am not aware of anyone bold or
|
||
clever enough to have penetrated the UK's most secure computers.
|
||
|
||
It must be acknowledged that in general it is far easier to obtain
|
||
the information held on these machines--and lesser ones like the DVLC
|
||
(vehicle licensing) and PNC (Police National Computer)-- by criminal
|
||
means than by hacking -- bribery, trickery or blackmail, for example.
|
||
Nevertheless, there is an interesting hacker's exercise in
|
||
demonstrating how far it is possible to produce details from open
|
||
sources of these systems, even when the details are supposed to be
|
||
secret. But this relates to one of the hacker's own secret
|
||
weapons--thorough research, the subject of the next chapter.
|
||
|
||
** Page 41
|
||
|
||
|
||
|
||
CHAPTER 5
|
||
|
||
|
||
Hackers' Intelligence
|
||
|
||
Of all the features of hacking that mystify outsiders, the first
|
||
is how the hackers get the phone numbers that give access to the
|
||
computer systems, and the passwords that open the data. Of all the
|
||
ways in which hacking is portrayed in films, books and tv, the most
|
||
misleading is the concentration on the image of the solitary genius
|
||
bashing away at a keyboard trying to 'break in'.
|
||
|
||
It is now time to reveal one of the dirty secrets of hacking:
|
||
there are really two sorts of hacker. For this purpose I will call
|
||
them the trivial and the dedicated. Anyone can become a trivial
|
||
hacker: you acquire, from someone else, a phone number and a password
|
||
to a system; you dial up, wait for the whistle, tap out the password,
|
||
browse around for a few minutes and log off. You've had some fun,
|
||
perhaps, but you haven't really done anything except follow a
|
||
well-marked path. Most unauthorised computer invasions are actually
|
||
of this sort.
|
||
|
||
The dedicated hacker, by contrast, makes his or her own
|
||
discoveries, or builds on those of other pioneers. The motto of
|
||
dedicated hackers is modified directly from a celebrated split
|
||
infinitive: to boldly pass where no man has hacked before.
|
||
|
||
Successful hacking depends on good research. The materials of
|
||
research are all around: as well as direct hacker-oriented material
|
||
of the sort found on bulletin board systems and heard in quiet
|
||
corners during refreshment breaks at computer clubs, huge quantities
|
||
of useful literature are published daily by the marketing departments
|
||
of computer companies and given away to all comers: sheaves of
|
||
stationery and lorry loads of internal documentation containing
|
||
important clues are left around to be picked up. It is up to the
|
||
hacker to recognise this treasure for what it is, and to assemble it
|
||
in a form in which it can be used.
|
||
|
||
Anyone who has ever done any intelligence work, not necessarily
|
||
for a government, but for a company, or who has worked as an
|
||
investigative journalist, will tell you that easily 90% of the
|
||
information you want is freely available and that the difficult part
|
||
is recognising and analysing it. Of the remaining 10%, well over
|
||
half can usually be inferred from the material you already have,
|
||
because, given a desired objective, there are usually only a limited
|
||
number of sensible solutions.
|
||
|
||
** Page 42
|
||
|
||
You can go further: it is often possible to test your inferences and,
|
||
having done that, develop further hypotheses. So the dedicated
|
||
hacker, far from spending all the time staring at a VDU and 'trying
|
||
things' on the keyboard, is often to be found wandering around
|
||
exhibitions, attending demonstrations, picking up literature, talking
|
||
on the phone (voice-mode!) and scavenging in refuse bins.
|
||
|
||
But for both trivial operator, and the dedicated hacker who wishes
|
||
to consult with his colleagues, the bulletin board movement has been
|
||
the single greatest source of intelligence.
|
||
|
||
|
||
Bulletin Boards
|
||
|
||
Since 1980, when good software enabling solitary micro-computers
|
||
to offer a welcome to all callers first became widely available, the
|
||
bulletin board movement has grown by leaps and bounds. If you haven t
|
||
logged on to at least one already, now is the time to try. At the
|
||
very least it will test out your computer, modem and software --and
|
||
your skills in handling them. Current phone numbers, together with
|
||
system hours and comms protocol requirements, are regularly published
|
||
in computer mags; once you have got into one, you will usually find
|
||
current details of most of the others.
|
||
|
||
Somewhere on most boards you will find a series of Special
|
||
Interest Group (SIG) sections and among these, often, will be a
|
||
Hacker's Club. Entrance to each SIG will be at the discretion of the
|
||
Sysop, the Bulletin Board owner. Since the BBS software allows the
|
||
Sysop to conceal from users the list of possible SIGs, it may not be
|
||
immediately obvious whether a Hacker's section exists on a particular
|
||
board. Often the Sysop will be anxious to form a view of a new
|
||
entrant before admitting him or her to a 'sensitive' area. It has
|
||
even been known for bulletin boards to carry two hacker sections:
|
||
one, admission to which can be fairly easily obtained; and a second,
|
||
the very existence of which is a tightly-controlled secret, where
|
||
mutually trusting initiates swap information.
|
||
|
||
The first timer, reading through a hacker's bulletin board, will
|
||
find that it seems to consist of a series of discursive conversations
|
||
between friends. Occasionally, someone may write up a summary for
|
||
more universal consumption. You will see questions being posed. if
|
||
you feel you can contribute, do so, because the whole idea is that a
|
||
BBS is an information exchange. It is considered crass to appear on a
|
||
board and simply ask 'Got any good numbers?; if you do, you will not
|
||
get any answers. Any questions you ask should be highly specific,
|
||
show that you have already done some ground-work, and make clear that
|
||
any results derived from the help you receive will be reported back
|
||
to the board.
|
||
|
||
** Page 43
|
||
|
||
Confidential notes to individuals, not for general consumption,
|
||
can be sent using the E-Mail option on the bulletin board, but
|
||
remember, nothing is hidden from the Sysop.
|
||
|
||
A flavour of the type of material that can be seen on bulletin
|
||
boards appears from this slightly doctored excerpt (I have removed
|
||
some of the menu sequences in which the system asks what you want to
|
||
do next and have deleted the identities of individuals):
|
||
|
||
Msg#: 3538 *Modem Spot*
|
||
01/30/84 12:34:54 (Read 39 Times)
|
||
From: xxxxxxxxxx
|
||
To: ALL
|
||
Subj: BBC/MAPLIN MODEMS
|
||
RE THE CONNECTIONS ON THE BBC/MAPLIN MODEM SETUP. THE crs PIN IS USED TO
|
||
HANDSHAKE WITH THE RTS PIN E.G. ONE UNIT SENDS RTS (READY TO SEND) AND
|
||
SECOND UNIT REPLIES CTS (CLEAR TO SEND). USUALLY DONE BY TAKING PIN HIGH. IF
|
||
YOU STRAP IT HIGH I WOULD SUGGEST VIA A 4K7 RESISTOR TO THE VCC/+VE RAIL (5V).
|
||
IN THE EVENT OF A BUFFER OVERFLOW THESE RTS/CTS PINS ARE TAKEN LOW AND THIS
|
||
STOPS THE DATA TRANSFER. ON A 25WAY D TYPE CONNECTOR TX DATA IS PIN 2
|
||
RX DATA IS PIN 3
|
||
RTS IS PIN 4
|
||
CTS IS PIN 5
|
||
GROUND IS PIN 7
|
||
|
||
ALL THE BEST -- ANY COMMTO XXXXXXXXX
|
||
(DATA COMMS ENGINEER)
|
||
|
||
Msg#: 3570 *Modem Spot*
|
||
01/31/84 23:43:08 (Read 31 Times)
|
||
From: XXXXXXXXXX
|
||
To: XXXXXXXXXXX
|
||
Subj: REPLY TO MSG# 3538 (BBC/MAPLIN MODEMS)
|
||
ON THE BBC COMPUTER IT IS EASIER TO CONNECT THE RTS (READY TO SEND) PIN HE
|
||
CTS (CLEAR TO SEND) PIN. THIS OVERCOMES THE PROBLEM OF HANDSHAKING.
|
||
SINCE THE MAPLIN MODEM DOES NOT HAVE HANDSHAKING.I HAVE PUT MY RTS CTS JUMPER
|
||
INSIDE THE MODEM. MY CABLES ARE THEN STANDARD AND CAN BE USED WITH HANDSHAKERS.
|
||
REGARDS
|
||
|
||
Hsg#: 3662 *HACKER'S CLUB*
|
||
02/04/84 23:37:11 (Read 41 Times)
|
||
From: XXXXXXXXXX
|
||
To: ALL
|
||
Subj: PUBLIC DATA NET
|
||
Does anyone know what the Public Data Net is? I appear to have access to it, &
|
||
I daren't ask what it is!
|
||
Also, can anyone tell me more about the Primenet systems... Again I seem to
|
||
have the means,but no info. For instance, I have a relative who logs on to
|
||
another Prime Both of our systems are on Primenet, is there any way we can
|
||
communicate?
|
||
More info to those who want it...
|
||
|
||
<N>ext msg, <R>eply, or <S>top?
|
||
Msg has replies, read now(Y/N)? y
|
||
|
||
Reply has been deleted
|
||
|
||
<N>ext msg, <R>eply, or <S>top?
|
||
|
||
Msg#: 3739 *HACKER'S CLUB*
|
||
02/06/84 22:39:06 (Read 15 Times)
|
||
From: xxxxxxxxxx
|
||
To: xxxxxxxxxx
|
||
Subj: REPLY TO MSG# 3716 (PRIMENET COMMS)
|
||
Ahh, but what is the significance of the Address-does it mean a PSS number. or
|
||
some thing like that? Meanwhile, I'II get on-line (via voice-link on the phone!)
|
||
to my cousin, and see what he has on it....
|
||
|
||
** Page 44
|
||
|
||
Msg#: 3766 *HACKER'S CLUB*
|
||
02/07/84 13:37:54 (Read 13 Times)
|
||
From: xxxxxxxxxxx
|
||
To: xxxxxxxxxxx
|
||
Subj: REPLY TO MSG# 3751 (PUBLIC DATA NET)
|
||
Primenet is a local network. I know of one in Poole, An BTGold use
|
||
one between their systems too. It Is only an internal network, I
|
||
suggest using PSS to communicate between different primes. Cheers.
|
||
|
||
<N>ext msg, <R>eply, or <S>top?
|
||
|
||
Msg#: 3799 *BBC*
|
||
02/07/84 22:09:05 (Read 4 Times)
|
||
From: xxxxxxxxxxx
|
||
To: xxxxxxxxxxx
|
||
Subj: REPLY TO MSG# 3751 (RGB VIDEO)
|
||
The normal video output BNC can be made to produce colour video by
|
||
making a link near to the bnc socket on the pcb. details are in the
|
||
advanced user guide under the chapter on what the various links do.
|
||
If you require more I will try to help, as I have done this mod and
|
||
it works fine
|
||
|
||
Msg#: 935 *EREWHON*
|
||
09/25/83 01:23:00 (Read 90 Times)
|
||
From: xxxxxxxxxx
|
||
To: ALL
|
||
Subj: US PHONE FREAKING
|
||
USA Phone Freaking is done with a 2 out of 5 Code. The tones must be
|
||
with 30Hz, and have less than 1% Distortion.
|
||
|
||
Master Tone Frequency = 2600 Hz.
|
||
>1 = 700 & 900 Hz
|
||
>2 = 700 & 1100 Hz
|
||
>3 = 900 & 1100 HZ
|
||
>4 = 700 & 1300 Hz
|
||
>5 = 900 & 1300 Hz
|
||
>6 = 1100 & 1300 Hz
|
||
>7 = 700 & 1500 HZ
|
||
>8 = 900 & 1500 Hz
|
||
>9 = 1100 & 1500 Hz
|
||
>0 = 1300 & 1500 Hz
|
||
>Start Key Signal = 1100 & 1700 Hz
|
||
>End Key Signal = 1300 & 1700 Hz
|
||
> Military Priority Keys 11=700 & 1700 ; 12=900 & 1700 - I don't
|
||
recommend using these. ( The method of use will be explained in a
|
||
separate note. DO NOT DISCLOSE WHERE YOU GOT THESE FREQUENCIES TO
|
||
ANYONE!
|
||
|
||
Msg#: 936 *EREWHON*
|
||
09/20/83 01:34:43 (Read 89 Times)
|
||
From: xxxxxxxxxxxx
|
||
To: ALL
|
||
Subj: UK PHONE FREAKING
|
||
|
||
The UK System also uses a 2 out of 5 tone pattern.
|
||
|
||
The Master Frequency is 2280 Hz
|
||
>I = 1380 & 1500 Hz
|
||
>2 = 1380 & 1620 Hz
|
||
>3 = 1500 & 1620 Hz
|
||
>4 = 1380 & 1740 Hz
|
||
>5 = 1500 & 1740 Hz
|
||
>6 = 1620 & 1740 Hz
|
||
>7 = 1380 & I860 Hz
|
||
>8 = 1500 & 1860 Hz
|
||
>9 = 1620 & 1860 Hz
|
||
>0 = 1740 & 1860 Hz
|
||
>Start Key = 1740 & 1980 ; End Keying = 1860 & 1980 Hz
|
||
>Unused I think 11 = 1380 & 1980 ; 12 = 1500 & 1980 Hz
|
||
|
||
This is from the CCITT White Book Vol. 6 and is known as SSMF No. 3
|
||
to some B.T. Personnel.
|
||
|
||
The 2280 Hz tone is being filtered out at many exchanges so you may
|
||
need quite high level for it to work.
|
||
|
||
** Page 45
|
||
|
||
Msg#: 951 *EREWHON*
|
||
09/21/83 17:44:28 (Read 79 Times)
|
||
From: xxxxxxxxxx
|
||
To: PHONE FREAK's
|
||
Subj: NEED YOU ASK ?
|
||
In two other messages you will find the frequencies listed for the
|
||
Internal phone system controls. This note is intended to explain how
|
||
the system could be operated. The central feature to realise is that
|
||
( especially in the (USA) the routing information in a call is not in
|
||
the Dialled Code. The normal sequence of a call is that the Area Code
|
||
is received while the Subscriber No. Is stored for a short period.
|
||
The Local Exchange reads the area code and selects the best route at
|
||
that time for the call. The call together with a new "INTERNAL"
|
||
dialling code Is then sent on to the next exchange together with the
|
||
subscriber number. This is repeated from area to area and group to
|
||
group. The system this way provides many routes and corrects itself
|
||
for failures.
|
||
|
||
The Technique. make a Long Distance call to a number which does not
|
||
answer. Send down the Master Tone. (2600 or 22080 Hz) This will
|
||
clear the line back, but leave you in the system. You may now send
|
||
the "Start key Pulse" followed by the Routing Code and the Subscriber
|
||
No. Finish with the "End keying Pulse". The system sees you as being
|
||
a distant exchange requesting a route for a call.
|
||
|
||
Meanwhile back at the home base. Your local exchange will be logging
|
||
you in as still ringing on the first call. There are further problems
|
||
in this in both the USA and the UK as the techniques are understood
|
||
and disapproved of by those in authority. You may need to have a
|
||
fairly strong signal into the system to get past filters present on
|
||
the line. Warning newer exchanges may link these filters to alarms.
|
||
Try from a phone box or a Public Place and see what happens or who
|
||
comes.
|
||
|
||
Example:- To call from within USA to Uk:
|
||
> Ring Toll Free 800 Number
|
||
> Send 2600 Hz Key Pulse
|
||
> When line goes dead you are in trunk level
|
||
> Start Pulse 182 End Pulse = White Plains N.Y. Gateway continued in
|
||
next message
|
||
|
||
Hsg#: 952 *EREWHON*
|
||
09/21/83 18:03:12 (Read 73 Times)
|
||
From: xxxxxxxxxx
|
||
To: PHONE FREAKS
|
||
Subj: HOW TO DO IT PT 2
|
||
|
||
> Start Pulse 044 = United Kingdom
|
||
> 1 = London ( Note no leading O please )
|
||
> 730 1234 = Harrods Department Store.
|
||
|
||
Any info on internal address codes would be appreciated from any
|
||
callers.
|
||
|
||
Msg#: 1028 *EREWHON*
|
||
09/25/83 23:02:35 (Read 94 Times)
|
||
From: xxxxxxxxxxxx
|
||
To: ALL
|
||
Subj: FREEFONE PART I
|
||
|
||
The following info comes from a leaflet entitled 'FREEFONE':
|
||
|
||
"British Telecom's recent record profits and continuing appalling
|
||
service have prompted the circulation of this information. It
|
||
comprises a method of making telephone calls free of charge."
|
||
|
||
Circuit Diagram:
|
||
|
||
O---o------- -------o----O
|
||
: ! ! :
|
||
: ! ! :
|
||
L o-------- --------o P
|
||
I ! ! H
|
||
N ! ! O
|
||
E o-- ------ ----o N
|
||
: ! ! E
|
||
I ! ! :
|
||
N o------- -------o :
|
||
: :
|
||
: :
|
||
: :
|
||
O---------------------------O
|
||
|
||
** Page 46
|
||
|
||
S1 = XXX
|
||
C1 = XXX
|
||
D1 = XXX
|
||
D2 = XXX
|
||
R1 = XXX
|
||
|
||
Continued...
|
||
|
||
MSG#: 1029 *EREWHON*
|
||
09/25/83 23:19:17 (Read 87 Times)
|
||
From xxxxxxxxxxx
|
||
To: ALL
|
||
Subj: FREEFONE PART 2
|
||
|
||
Circuit Operation:
|
||
|
||
The circuit inhibits the charging for incoming calls only. When a
|
||
phone is answered, there is normally approx. IOOmA DC loop current
|
||
but only 8mA or so is necessary to polarise the mic In the handset.
|
||
Drawing only this small amount is sufficient to fool BT's ancient
|
||
"Electric Meccano".
|
||
|
||
It's extremely simple. When ringing, the polarity of the line
|
||
reverses so D1 effectively answers the call when the handset is
|
||
lifted. When the call is established, the line polarity reverts and
|
||
R1 limits the loop current while D2 is a LED to indicate the circuit
|
||
is in operation. C1 ensures speech is unaffected. S1 returns the
|
||
telephone to normal.
|
||
|
||
Local calls of unlimited length can be made free of charge. Long
|
||
distance calls using this circuit are prone to automatic
|
||
disconnection this varies from area to area but you will get at least
|
||
3 minutes before the line is closed down. Further experimentation
|
||
should bear fruit in this respect.
|
||
|
||
Sith the phone on the hook this circuit is completely undetectable.
|
||
The switch should be cLosed if a call is received from an operator,
|
||
for example, or to make an outgoing call. It has proved extremely
|
||
useful, particularly for friends phoning from pay phones with jammed
|
||
coin slots.
|
||
|
||
*Please DO NOT tell ANYONE where yoU found this information*
|
||
|
||
Msg#: 1194 *EREWHON*
|
||
10/07/83 04:50:34 (Read 81 Times)
|
||
From: xxxxxxxxxxxx
|
||
To: ALL
|
||
Subj: FREE TEST NUMBERS
|
||
|
||
Free Test Numbers
|
||
|
||
Here are some no's that have been found to work:
|
||
Dial 174 <last 4 figs of your no>: this gives unobtainable then when
|
||
you replace handset the phone rings.
|
||
|
||
Dial 175 <last 4 figs of your no: this gives 'start test...start
|
||
test...', then when you hang-up the phone rings. Pick it up and you
|
||
either get dial tone which indicates OK or you will get a recording
|
||
i.e 'poor insulation B line' telling you what's wrong. If you get
|
||
dial tone you can immediately dial 1305 to do a further test which
|
||
might say 'faulty dial pulses'. Other numbers to try are 182, 184 or
|
||
185. I have discovered my exchange (Pontybodkin) gives a test ring
|
||
for 1267. These numbers all depend on you local exchange so It pays
|
||
to experiment, try numbers starting with 1 as these are all local
|
||
functions. Then when you discover something of interest let me know
|
||
on this SIG.
|
||
|
||
|
||
Msg: 2241 *EREWHON*
|
||
12/04/83 20:48:49 (Read 65 Times)
|
||
From: SYSOP
|
||
To: SERIOUS FREAKS
|
||
Subj: USA INFO
|
||
|
||
There is a company (?) in the USA called Loopmaniacs Unlimited,
|
||
PO Box 1197, Port Townsend. WA, 98368, who publish a line of books on
|
||
telephone hacking. Some have circuits even. Write to M. Hoy there.
|
||
|
||
One of their publications is "Steal This Book" at S5.95 plus about $4
|
||
post. Its Worth stealing, but don't show it to the customs!
|
||
|
||
** Page 47
|
||
|
||
Msg#: 3266 *EREWHON*
|
||
01/22/84 06:25:01 (Read 53 Times)
|
||
From: xxxxxxxxxx
|
||
To: ALL
|
||
Subj: UNIVERSITY COMPUTERS
|
||
As already described getting onto the UCL PAD allows various calls.
|
||
Via this network you can access many many university/research
|
||
computers To get a full list use CALL 40 then HELP, select GUIDE.
|
||
Typing '32' at the VIEW prompt will start listing the addresses. Host
|
||
of these can be used at the pad by 'CALL addr' where addr is the
|
||
address. For passwords you try DEMO HELP etc. If you find anything
|
||
interesting report it here.
|
||
HINT: To aviod the PAD hanging up at the end of each call use the
|
||
LOGON command - use anything for name and pwd. This seems to do the
|
||
trick.
|
||
Another number: Tel: (0235) 834531. This is another data
|
||
exchange. This one's a bit harder to wake up. You must send a 'break
|
||
level' to start. This can be done using software but with a maplin
|
||
just momentarily pull out the RS232 com. Then send RETURNs. To get a
|
||
list of 'classes' you could use say Manchesters HELP:- CALL 1020300,
|
||
user:DEMO pwd:DEMO en when you're on HELP PACX.
|
||
|
||
Msg#: 3687 *HACKER'S CLUB*
|
||
02/05/84 14:41:43 (Read 416 Times)
|
||
From: xxxxxxxxxxxx
|
||
To: ALL
|
||
Subj: HACKERS NUMBERS
|
||
|
||
The following are some of the numbers collected in the Hackers SIG:
|
||
|
||
Commodore BBS (Finland) 358 61 116223
|
||
|
||
Gateway test 01 600 1261
|
||
PRESTEST (1200/75) 01 583 9412
|
||
Some useful PRESTEL nodes - 640..Res.D (Martlesham's experiments in
|
||
Dynamic Prestel DRCS, CEPT standards, Picture Prestel, 601
|
||
(Mailbox,Telemessaging, Telex Link - and maybe Telecom Gold), 651
|
||
(Scratchpad -always changing). Occasionally parts of 650 (IP News)
|
||
are not properly CUGed off. 190 sometimes is interesting well.
|
||
|
||
These boards all specialised in lonely hearts services !
|
||
The boards with an asterisk all use BELL Tones
|
||
*Fairbanks, AK, 907-479-0315
|
||
*Burbank, CA, 213-840-8252
|
||
*Burbank, CA, 213-842-9452
|
||
*Clovis, CA, 209-298-1328
|
||
*Glendale, CA, 213-242-l882
|
||
*La Palma, CA, 714-220-0239
|
||
*Hollywood, CA, 213-764-8000
|
||
*San Francisco CA, 415-467-2588
|
||
*Santa Monica CA, 213-390-3239
|
||
*Sherman Oaks CA, 213-990-6830
|
||
*Tar~ana , CA, 213-345-1047
|
||
*Crystal Rivers FL,904-795-8850
|
||
*Atlanta, GA, 912-233-0863
|
||
*Hammond, IN, 219-845-4200
|
||
*Cleveland, OH, 216-932-9845
|
||
*Lynnefield, MA, 6l7-334-6369
|
||
*Omaha, NE, 402-571-8942
|
||
*Freehold, NJ, 201-462-0435
|
||
*New York, NY, 212-541-5975
|
||
*Cary, NC, 919-362-0676
|
||
*Newport News,VA 804-838-3973
|
||
*Vancouver, WA, 200-250-6624
|
||
Marseilles, France 33-91-91-0060
|
||
|
||
Both USA nos. prefix (0101)
|
||
a) Daily X-rated Doke Service 516-922-9463
|
||
b) Auto-Biographies of young ladies who normally work in
|
||
unpublishable magazines on 212-976-2727.
|
||
c)Dial a wank 0101,212,976,2626; 0101,212,976,2727
|
||
|
||
** Page 48
|
||
|
||
Msg#: 3688 *HACKER'S CLUB*
|
||
02/05/84 14:44:51 (Read 393 Times)
|
||
From: xxxxxxxxxxx
|
||
To: ALL
|
||
Subj: HACKERS NUMBERS CONT...
|
||
Hertford PDP 11/70 Hackers BBS:
|
||
Call 0707-263577 with 110 baud selected.
|
||
type: SET SPEED 300'CR'
|
||
After hitting CR switch to 300 baud.
|
||
Then type: HELLO 124,4'CR
|
||
!Password: HAE4 <CR>
|
||
When logged on type: COMMAND HACKER <CR>
|
||
Use: BYE to log out
|
||
*********
|
||
EUCLID 388-2333
|
||
TYPE A COUPLE OF <CR> THEN PAD <CR>
|
||
ONCE LOGGED ON TO PAD TYPE CALL 40 <CR> TRY DEMO AS A USERID WHY NOT
|
||
TRY A FEW DIFFER DIFFERENT CALLS THIS WILL LET U LOG ON TO A WHOLE
|
||
NETWORK SYSTEM ALL OVER EUROPE!
|
||
YOU CAN ALSO USE 01-278-4355.
|
||
********
|
||
unknown 300 Baud 01-854 2411
|
||
01-854 2499
|
||
******
|
||
Honeywell:From London dial the 75, else 0753(SLOUGH)
|
||
75 74199 75 76930
|
||
Type- TSS
|
||
User id: D01003
|
||
password: Unknown (up to 10 chars long)
|
||
Type: EXPL GAMES LIST to list games
|
||
To run a game type: FRN GAMES(NAME) E for a fotran game.
|
||
Replace FRN with BRN for BASIC games.
|
||
******
|
||
Central London Poly 01 637 7732/3/4/5
|
||
******
|
||
PSS (300) 0753 6141
|
||
******
|
||
Comshare (300) 01 351 2311
|
||
******
|
||
'Money Box' 01 828 9090
|
||
******
|
||
Imperial College 01 581 1366
|
||
01 581 1444
|
||
*******
|
||
These are most of the interesting numbers that have come up over the
|
||
last bit. If I have omitted any, please leave them in a message.
|
||
|
||
Cheers, xxxxx.
|
||
|
||
Msg#: 5156 *HACKER'S CLUB*
|
||
04/15/84 08:01:11 (Read 221 Times)
|
||
From: xxxxxxxxxx
|
||
To: ALL
|
||
Subj: FINANCIAL DATABASES
|
||
You can get into Datastream on dial-up at 300/300 on 251 6180 - no I
|
||
don't have any passwords....you can get into Inter Company
|
||
Comparisons (ICC) company database of 60,000 companies via their
|
||
1200/75 viewdata front-end processor on 253 8788. Type ***# when
|
||
asked for your company code to see a demo...
|
||
|
||
|
||
Msg#: 5195 *HACKER'S CLUB*
|
||
04/17/84 02:28:10 (Read 229 Times)
|
||
From: xxxxxxxxxx
|
||
To: ALL
|
||
Subj: PSS TELEX
|
||
THIS IS PROBOBLY OLD HAT BY NOW BUT IF YOU USE PSS THEN A92348******
|
||
WHERE **=UK TELEX NO. USE CTRL/P CLR TO BET OUT AFTER MESSAGE. YOU
|
||
WILL BE CHARGED FOR USE I GUESS
|
||
|
||
** Page 49
|
||
|
||
Msg#: 7468 *EREWHON*
|
||
06/29/84 23:30:24 (Read 27 Times)
|
||
From: xxxxxxxxxx
|
||
To: PHREAKS
|
||
Subj: NEW(OLD..) INFO
|
||
TODAY I WAS LUCKY ENOUGH TO DISCOVER A PREVIOUSLY UNKNOWN CACHE OF
|
||
AMERICAN MAGAZINE KNOWN AS TAP. ALTHOUGH THEYRE RATHER OUT OF DATE
|
||
(1974-1981) OR SO THEY ARE PRETTY FUNNY AND HAVE A FEW INTERESTING
|
||
BITS OF INFORMATION, ESPECIALLY IF U WANT TO SEE THE CIRCUIT DIAGRAMS
|
||
OF UNTOLD AMOUNTS OF BLUE/RED/BLACK/??? BOXES THERE ARE EVEN A FEW
|
||
SECTIONS ON THE UK (BUT AS I SAID ITS COMPLETELY OUT OF DATE). IN THE
|
||
FUTURE I WILL POST SOME OF THE GOOD STUFF FROM TAP ON THIS BOARD
|
||
(WHEN AND IF I CAN GET ON THIS BLOODY SYSTEM''). ALSO I MANAGED TO
|
||
FIND A HUGE BOOK PUBLISHED BY AT&T ON DISTANCE DIALING (DATED 1975).
|
||
DUNNO, IF ANYBODY'S INTERESTED THEN LEAVE A NOTE REQUESTING ANY INFO
|
||
YOU'RE ARE CHEERS PS ANYBODY KNOW DEPRAVO THE RAT?? DOES HE STILL
|
||
LIVE?
|
||
|
||
Msg#: 7852 t*ACKER'S CLUB*
|
||
08/17/84 00:39:05 (Read 93 Times)
|
||
From: xxxxxxxxxx
|
||
To: ALL USERS
|
||
Subj: NKABBS
|
||
NKABBS IS NOW ONLINE. FOR ATARI & OTHER MICRO USERS. OPERATING ON 300
|
||
BAUD VIA RINGBACK SYSTEM. TIMES 2130HRS-2400HRS DAILY. TEL :0795
|
||
842324. SYSTEM UP THESE TIMES ONLY UNTIL RESPONSE GROWS. ALL USERS
|
||
ARE WELCOME TO ON. EVENTUALLY WE WILL BE SERVING BBC,COMMODORE VIC
|
||
20/64 OWNERS.+NEWS ETC.
|
||
|
||
Msg#:8154 *EREWHON*
|
||
08/02/84 21:46:11 (Read 13 Times)
|
||
From: ANON
|
||
To: ALL
|
||
Subj: REPLY TO MSG# :1150 (PHREAK BOARDS)
|
||
|
||
PHREAK BOARD NUMBERS
|
||
ACROSS THE U.S.
|
||
|
||
|
||
IF YOU KNOW OF A BOARD THAT IS NOT LISTED HERE, PLEASE LET ME KNOW
|
||
ABOUT IT.
|
||
|
||
JOLLY ROGER 713-468-0174
|
||
PIRATE'S CHEST 617-981-1349
|
||
PIRATE'S DATA CENTER 213-341-3962
|
||
PIRATE'S SPACE STATION 617-244-8244
|
||
PIRATE'S OUTHOUSE 301-299-3953
|
||
PIRATE'S HANDLE 314-434-6187
|
||
PIRATE'S DREAM 713-997-5067
|
||
PIRATE'S TRADE 213-932-8294
|
||
PIRATE'S TREK 914-634-1268
|
||
PIRATE'S TREK III 914-835-3627
|
||
PIRATE-80 305-225-8059
|
||
SANCTUARY 201-891-9567
|
||
SECRET SERVICE ][ 215-855-7913
|
||
SKELETON ISLAND 804-285-0041
|
||
BOCA HARBOR 305-392-5924
|
||
PIRATES OF PUGET SOUND 206-783-9798
|
||
THE INSANITARIUM 609-234-6106
|
||
HAUNTED MANSION 516-367-8172
|
||
WASTELANDS 513-761-8250
|
||
PIRATE'S HARBOR 617-720-3600
|
||
SKULL ISLAND 203-972-1685
|
||
THE TEMPLE 305-798-1615
|
||
SIR LANCELOT'S CASTLE 914-381-2124
|
||
PIRATE'8 CITY 703-780-0610
|
||
PIRATE-S GALLEY 213-796-6602
|
||
THE PAWN SHOPPE 213-859-2735
|
||
HISSION CONTROL 301-983-8293
|
||
BIG BLUE MONSTER 305-781-1683
|
||
THE I.C.'S SOCKET 213-541-5607
|
||
THE MAGIC REALM 212-767-9046
|
||
PIRATE'S BAY 415-775-2384
|
||
BEYOND BELIEF 213-377-6568
|
||
PIRATE's TROVE 703-644-1665
|
||
CHEYANNE MOUNTAIN 303-753 1554
|
||
ALAHO CITY 512-623-6123
|
||
CROWS NEST 617-862-7037
|
||
PIRATE'S PUB ][ 617-891-5793
|
||
PIRATE'S I/0 201-543-6139
|
||
SOUNDCHASER 804-788-0774
|
||
SPLIT INFINITY 408-867-4455
|
||
CAPTAIN'S LOG 612-377-7747
|
||
THE SILHARILLION 714-535-7527
|
||
TWILIGHT PHONE 313-775-1649
|
||
THE UNDERGROUND 707-996-2427
|
||
THE INTERFACE 213-477-4605
|
||
THE DOC BOARD 713-471-4131
|
||
SYSTEM SEVEN 415-232-7200
|
||
SHADOW WORLD 713-777-8608
|
||
OUTER LIMITS 213-784-0204
|
||
METRO 313-855-6321
|
||
MAGUS 703-471-0611
|
||
GHOST SHIP 111 - PENTAGON 312-627-5138
|
||
GHOST SHIP - TARDIS 312-528-1611
|
||
DATA THIEVES 312-392-2403
|
||
DANGER ISLAND 409-846-2900
|
||
CORRUPT COMPUTING 313-453-9183
|
||
THE ORACLE 305-475-9062
|
||
PIRATE'S PLANET 901-756-0026
|
||
CAESER S PALACE 305-253-9869
|
||
CRASHER BBS 415-461-8215
|
||
PIRATE'S BEACH 305-865-5432
|
||
PIRATE'S COVE 516-698-4008
|
||
PIRATE'S WAREHOUSE 415-924-8338
|
||
PIRATE'S PORT 512-345-3752
|
||
PIRATE'S NEWSTAND ][ 213-373-3318
|
||
PIRATE'S GOLDMINE 617-443-7428
|
||
PIRATE'S SHIP 312-445-3883
|
||
PIRATE'S MOUNTAIN 213-472-4287
|
||
PIRATE'S TREK ][ 914-967-2917
|
||
PIRATE'S TREK IV 714-932-1124
|
||
PORT OR THIEVES 305-798-1051
|
||
SECRET SERVICE 213-932-8294
|
||
SHERWOOD FOREST 212-896-6063
|
||
GALAXY ONE 215-224-0864
|
||
R.A.G.T.I.H.E. 217-429-6310
|
||
KINGDOM OF SEVEN 206-767-7777
|
||
THE STAR SYSTEM 516-698-7345
|
||
ALPHANET 203-227-2987
|
||
HACKER HEAVEN 516-796-6454
|
||
PHANTOM ACCESS 814-868-1884
|
||
THE CONNECTION 516-487-1774
|
||
THE TAVERN 516-623-9004
|
||
PIRATE'S HIDEAWAY 617-449-2808
|
||
PIRATE'S PILLAGE 317-743-5789
|
||
THE PARADISE ON-LINE 512-477-2672
|
||
MAD BOARD FROM MARS 213-470-5912
|
||
NERVOUS SYSTEM 305-554-9332
|
||
DEVO 305-652-9422
|
||
TORTURE CHAMBER 213-375-6137
|
||
HELL 914-835-4919
|
||
CRASHER BBS 415-461-8215
|
||
ALCATRAZ 301-881-0846
|
||
THE TRADING POST 504-291-4970
|
||
DEATH STAR 312-627-5138
|
||
THE CPU 313-547-7903
|
||
TRADER'S INN 618-856-3321
|
||
PIRATE'S PUB 617-894-7266
|
||
BLUEBEARDS GALLEY 213-842-0227
|
||
MIDDLE EARTH 213-334-4323
|
||
EXIDY 2000 713-442-7644
|
||
SHERWOOD FOREST ][ 914-352-6543
|
||
WARLOCK~S CASTLE 618-345-6638
|
||
TRON 312-675-1819
|
||
THE SAFEHOUSE 612-724-7066
|
||
THE GRAPE VINE 612-454-6209
|
||
THE ARK 701-343-6426
|
||
SPACE VOYAGE 713-530-5249
|
||
OXGATE 804-898-7493
|
||
MINES OF MORIA ][ 408-688-9629
|
||
MERLIN'S TOWER 914-381-2374
|
||
GREENTREE 919-282-4205
|
||
GHOST SHIP ][ - ARAGORNS 312-644-5165
|
||
GENERAL HOSPITAL 201-992-9893
|
||
DARK REALM 713-333-2309
|
||
COSMIC VOYAGE 713-530-5249
|
||
CAMELOT 312-357-8075
|
||
PIRATE'S GUILD 312-279-4399
|
||
HKGES 305-676-5312
|
||
MINES OF MORIA 713-871-8577
|
||
A.S.C.I.I. 301-984-3772
|
||
|
||
** Page 50
|
||
|
||
If Anybody is mad enough to actually dial up one (or more') of these
|
||
BBs please log everything so thAt others may benefit from your
|
||
efforts. IE- WE only have to register once, and we find out if this
|
||
board suits our interest. Good luck and have fun! Cheers,
|
||
|
||
Msg#: 8163 *HACKER'S CLUB*
|
||
08/30/84 18:55:27 (Read 78 Times)
|
||
From: XXXXXXXXXX
|
||
To- ALL
|
||
Subj: XXXXXX
|
||
NBBS East is a relatively new bulletin board running from lOpm to
|
||
1230am on 0692 630610. There are now special facilities for BBC users
|
||
with colour, graphics etc. If you call it then please try to leave
|
||
some messages as more messages mean more callers, which in turn means
|
||
more messages Thanks a lot, Jon
|
||
|
||
Msg#: 8601 *HACKER'S CLUB*
|
||
09/17/84 10:52:43 (Read 57 Times!
|
||
From: xxxxxxxxxx
|
||
To: xxxxxxxxx
|
||
Subj: REPLY TO Msg# 8563 (HONEYWELL)
|
||
The thing is I still ( sort of I work for XXX so I don't think they
|
||
would be too pleased if I gave out numbers or anything else. and I
|
||
would rather keep my job Surely you don't mean MFI furniture ??
|
||
|
||
Msg#: 8683 *HACKER'S CLUB*
|
||
09/19/84 19:54:05 (Read 63 Times)
|
||
From: xxxxxxxxx
|
||
To: ALL
|
||
Subj: DATA NODE
|
||
To those who have difficulty finding interesting numbers. try the UCL
|
||
Data Node on 01-388 2333 (300 baud).When you get the Which Service?
|
||
prompt. type PAD and a couple of CRs. Then, when the PAD> prompt
|
||
appears type CALL XOOXOOX, where is any(number orrange of numbers.
|
||
Indeed you can try several formats and numbers until you find
|
||
something interesting. The Merlin Cern computer is 9002003 And it's
|
||
difficult to trace You through aq data exchange! If anyone finds any
|
||
interesting numbers, let me know on this board, or Pretsel mailbox
|
||
012495225.
|
||
|
||
Msg has replies, read now(Y/N)' Y
|
||
|
||
Msg#: 9457 *HACKER'S CLUB*
|
||
10/11/84 01:52:56 (Read 15 Times)
|
||
From: xxxxxxxxxxx
|
||
To: xxxxxxxxxxx
|
||
Subj: REPLY TO MSG# 8683 (DATA NODE)
|
||
IF YOU WANT TO KNOW MORE ABOUT THIS xxxxx PHONE PHONE xxxx xxxxxx
|
||
ON 000 0000
|
||
|
||
Msg#: 8785 *HACKER'S CLUB*
|
||
09/21/B4 20-28-59 (Read 40 Times)
|
||
From xxxxxxxxxxxxxx
|
||
Subj: NEW Number
|
||
|
||
NEW Computer ON LINE TRY RINGING 960 7868 SORRY THAT'S 01 (IN LONDON) IN FRONT.
|
||
good LUCK!
|
||
|
||
** Page 51
|
||
|
||
Please note that none of these hints, rumours, phone numbers and
|
||
passwords are likely to work by the time you are reading this...
|
||
However, in the case of the US credit agency TRW, described in the
|
||
previous chapter, valid phone numbers and passwords appear to have
|
||
sat openly on a number of bulletin boards for up to a year before the
|
||
agency realised it. Some university mainframes have hacker's boards
|
||
hidden on them as well.
|
||
|
||
It is probably bad taste to mention it, but of course people try
|
||
to hack bulletin boards as well. An early version of one of the most
|
||
popular packages could be hacked simply by sending two semi-colons
|
||
(;;) when asked for your name. The system allowed you to become the
|
||
Sysop, even though you were sitting at a different computer; you
|
||
could access the user file, complete with all passwords, validate or
|
||
devalidate whomever you liked, destroy mail, write general notices,
|
||
and create whole new areas...
|
||
|
||
|
||
Research Sources
|
||
|
||
The computer industry has found it necessary to spend vast sums on
|
||
marketing its products and whilst some of that effort is devoted to
|
||
'image' and 'concept' type advertising--to making senior management
|
||
comfortable with the idea of the XXX Corporation's hardware because
|
||
it has 'hear |